Analysis
-
max time kernel
148s -
max time network
154s -
platform
android-11_x64 -
resource
android-x64-arm64-20240910-en -
resource tags
-
submitted
16-11-2024 22:00
General
-
Target
63827fb56cc23a2eeefde2406410954fbd38b86c059088db5ed00c864ce2345e.apk
-
Size
605KB
-
MD5
d83218c0049033226231a192b536e1f3
-
SHA1
cfbe17b09fa323bac132338a59a1a034cb15de3f
-
SHA256
63827fb56cc23a2eeefde2406410954fbd38b86c059088db5ed00c864ce2345e
-
SHA512
b5c50567e72ef4760a3961b28c279481153ec46d65257aae91193b00bd01d05be5d6f3a2473d56185680e6b9681c6df01cd46bd7416c87d846ce89a6bc83a078
-
SSDEEP
12288:mgjPPegWzQaRv43wwuMrplcrZZacG/lm8fd1ls4hDLrMhdfP:rPExBZM+RG/l11lsIzgdfP
Malware Config
Extracted
octo
https://7bb13903074567453981d0595033c23.com/YmZiMzU0OTU5NGIz/
https://4b6413903074567453981d0595033c23.com/YmZiMzU0OTU5NGIz/
https://34b6413903074567453981d0595033c23.com/YmZiMzU0OTU5NGIz/
https://64b6413903074567453981d0595033c23.com/YmZiMzU0OTU5NGIz/
https://74b6413903074567453981d0595033c23.com/YmZiMzU0OTU5NGIz/
https://894b6413903074567453981d0595033c23.com/YmZiMzU0OTU5NGIz/
https://94b64139030754567453981d0595033c23.com/YmZiMzU0OTU5NGIz/
https://94b64139033074567453981d0595033c23.com/YmZiMzU0OTU5NGIz/
https://94b641553903074567453981d0595033c23.com/YmZiMzU0OTU5NGIz/
Signatures
-
Octo
Octo is a banking malware with remote access capabilities first seen in April 2022.
-
Octo family
-
Octo payload 1 IoCs
-
Loads dropped Dex/Jar 1 TTPs 2 IoCs
Runs executable file dropped to the device during analysis.
-
Makes use of the framework's Accessibility service 4 TTPs 2 IoCs
Retrieves information displayed on the phone screen using AccessibilityService.
-
Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
-
Queries the phone number (MSISDN for GSM devices) 1 TTPs
-
Acquires the wake lock 1 IoCs
-
Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs
Application may abuse the framework's foreground service to continue running in the foreground.
-
Performs UI accessibility actions on behalf of the user 1 TTPs 5 IoCs
Application may abuse the accessibility service to prevent their removal.
-
Queries the mobile country code (MCC) 1 TTPs 1 IoCs
-
Reads information about phone network operator. 1 TTPs
-
Requests accessing notifications (often used to intercept notifications before users become aware). 1 TTPs 1 IoCs
-
Requests disabling of battery optimizations (often used to enable hiding in the background). 1 TTPs 1 IoCs
-
Requests modifying system settings. 1 IoCs
-
Schedules tasks to execute at a specified time 1 TTPs 1 IoCs
Application may abuse the framework's APIs to perform task scheduling for initial or recurring execution of malicious code.
-
Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs
Processes
-
com.sideboy81⤵
- Loads dropped Dex/Jar
- Makes use of the framework's Accessibility service
- Acquires the wake lock
- Makes use of the framework's foreground persistence service
- Performs UI accessibility actions on behalf of the user
- Queries the mobile country code (MCC)
- Requests accessing notifications (often used to intercept notifications before users become aware).
- Requests disabling of battery optimizations (often used to enable hiding in the background).
- Requests modifying system settings.
- Schedules tasks to execute at a specified time
- Uses Crypto APIs (Might try to encrypt user data)
Network
MITRE ATT&CK Mobile v15
Defense Evasion
Download New Code at Runtime
1Foreground Persistence
1Hide Artifacts
1User Evasion
1Impair Defenses
1Prevent Application Removal
1Input Injection
1Credential Access
Access Notifications
1Input Capture
2GUI Input Capture
1Keylogging
1Discovery
Software Discovery
1Security Software Discovery
1System Network Configuration Discovery
3Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
447KB
MD5a77250d8b3eac77fd2dc34ad969df4e5
SHA104250daf8b41a4761aae25670f88f4fd499ce4c2
SHA2567aceb898c2732581fbbdecdc2fa701b28c7d90114611c1ca0d767fbe8281ff2b
SHA5127cdda80001952cfb15876de021cda2ed7db39fff2a4a07192158491d5a111559df06e4828ffd2fd42d9c44e21550ece3ae4570925098c409cc8034d94835dcc6
-
Filesize
1.1MB
MD5679f2fa79a5761fbf4ae231357150be9
SHA19b99eac87d521bc4d10282ededd94b2a54dcac08
SHA2569b3d13f8fc5e70640c53dd7be00ef55b7c4e8404bd47b3c135cf333e2026caae
SHA5122c09dc666bf8ad018a3d8819483f054940d20cbb13d2c5da0ce6744f1e403369b89bb3f55610da9e077448065d8a6c0fd5c16834bbed546a6f94e2f238fb5c6c
-
Filesize
8B
MD5bac75f9fd891e26ea384e4a6c16c728d
SHA1a655237caa7b430ec9ce6a2b0f82f49dd4d70c8e
SHA256944d8214f1ca93d9b53fc42981b671c06311b4717b0d2675c1da5cfc02f9f528
SHA5123d5de00abd16b82afc6fec38a6a60aeb5a05a64062ddf0ac5bcb6e62b0261b60752fcf06451068315c71fbc9fd093e6a8e2ccfae7c89be96173d48a4319ec69f
-
Filesize
4KB
MD57e858c4054eb00fcddc653a04e5cd1c6
SHA12e056bf31a8d78df136f02a62afeeca77f4faccf
SHA2569010186c5c083155a45673017d1e31c2a178e63cc15a57bbffde4d1956a23dad
SHA512d0c7a120940c8e637d5566ef179d01eff88a2c2650afda69ad2a46aad76533eaace192028bba3d60407b4e34a950e7560f95d9f9b8eebe361ef62897d88b30cb
-
Filesize
512B
MD5be61d6c42ce143a5f51457664bf683b6
SHA1b0fbe913cde50f3cb28f54c9d659a7c0d45410a2
SHA2568dc1551e3e52c147ce3284a013ba5d7b9855977740d832e97d57af69676bb2f8
SHA5127792a588fc2489f469bea48560585dcf839107060fecb8c7b088891e8bf6f86776f6cab88e7f2e7fd21e2f9ff71cc2f447515e6c1c88c0bba1225f6fcf3d247a
-
Filesize
32KB
MD5bb7df04e1b0a2570657527a7e108ae23
SHA15188431849b4613152fd7bdba6a3ff0a4fd6424b
SHA256c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479
SHA512768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012
-
Filesize
169KB
MD5c3a22b05d9f03f3f59d7c35afd07531d
SHA13947d5ec5cb6b38e14385b0361232db20175209e
SHA256c1b74b4b668ce3b5faf49a8a95c2bce27abba1a4b6a60956c4723799b7753566
SHA512e97f8e7bcad5c13768162e49708abb90a1c067c866454bb6e8b45ac6a3f98f916156768b7120e44b3a903c292b024a837a8d22e7e30ad6855104ca7fc0076ba6
-
Filesize
16KB
MD5f8b221bd70d682ac40523ef674bb4f92
SHA1fe41edd7e1edd0a1d0f4e318acaf007160a1e5a3
SHA25628e8e5f1a9ffb093f7f6bcfeb90ed714e358bb5dd67da7579af96f2264b3b35a
SHA5120cc2776592a4e9531affdc782393c9958421226b033c6da119526cbb05b0116452c71ac4693c6b280b1403da6f4e77852a9f138249bffa84a81dea25284dd2de
-
Filesize
116KB
MD59e1fc0f18720011ccbf95912c2093a0b
SHA11d5cc34ee1ab917c21e7aaeae712d58203b74350
SHA25685dc5ff2067a55ade6807ea1dfcc23eacae891b4430640af91f5cd4aa5b7835b
SHA5123e7b8f1f2f9f94b012be1bc18d1d288e75d2e71935bd07899abdab2dab7a74462a86d608a028b415dff1ab2d69b74593ab1448cc320b5323a87aa9c3f19d828b
-
Filesize
112B
MD51dcb9cc8247c525b14476fe296c471c1
SHA1ad775c91c2ece7619bc8c22c29b87b051d332cdf
SHA256353a4a5c06e1dab6fae6b469e51ff0091422ad1f71ed5bc2c443c597398f0963
SHA51243da245faf70631f487dc412cdf57755809301c14b7c6d68a9845d433b2f1a606a1f687051fdf34389bbffca32ce86a4fb784f4f050a3fadd668508e79585a9f
-
Filesize
25B
MD5b9d9e0f8902d129e1aeebff0ae7b725b
SHA1cb0d2b4c9dd60a5c1fc6261fb581bcd3416fe781
SHA25625a822139d06016af8be1296c0242b60e35074f94c713e03323636be1162ce91
SHA512f158a9dc753e0cb41f71a98714ff02198c576bacdd792a6153fdaf6f9a7b52d8cfb6d09099a269d0c1b0d31e2ea5a307ea1db85115bdc6797887a6de36d597f6