Analysis
-
max time kernel
149s -
max time network
151s -
platform
android-9_x86 -
resource
android-x86-arm-20240910-en -
resource tags
-
submitted
18-11-2024 22:07
General
-
Target
7987b546e10977cdd204a02dd86cd9a0cb64014223f660d0d97ef76daa25e96e.apk
-
Size
513KB
-
MD5
23a3d4bdc7775a2ad0c117de609b60cb
-
SHA1
398eba2212260848c0a144b590e000f793218074
-
SHA256
7987b546e10977cdd204a02dd86cd9a0cb64014223f660d0d97ef76daa25e96e
-
SHA512
cc6f69017e98c9f5fd4a2a5e47b4db1c06c3da479bf51c3dbb49a7939335fde0b0df61eaea11a478ae9ece0eadca13a441cc207e14462a13a9298e0ac3aff2da
-
SSDEEP
12288:jch5rD6GaRGEEnXhGD81MMfrOT8nbDeSQyclovFEV4enkt:jcfD6GNhx2ZyOT8/3QycedEBnW
Malware Config
Extracted
octo
https://mutesksek3421.com/MzQ1Yzk1ZGQ4ODY3/
https://adyesksockcem3421.com/MzQ1Yzk1ZGQ4ODY3/
https://adnndlga23cm.com/MzQ1Yzk1ZGQ4ODY3/
https://ad23cmxd.com/MzQ1Yzk1ZGQ4ODY3/
https://adbniskseekske2.com/MzQ1Yzk1ZGQ4ODY3/
Extracted
octo
https://mutesksek3421.com/MzQ1Yzk1ZGQ4ODY3/
https://adyesksockcem3421.com/MzQ1Yzk1ZGQ4ODY3/
https://adnndlga23cm.com/MzQ1Yzk1ZGQ4ODY3/
https://ad23cmxd.com/MzQ1Yzk1ZGQ4ODY3/
https://adbniskseekske2.com/MzQ1Yzk1ZGQ4ODY3/
Signatures
-
Octo
Octo is a banking malware with remote access capabilities first seen in April 2022.
-
Octo family
-
Octo payload 1 IoCs
-
Removes its main activity from the application launcher 1 TTPs 1 IoCs
-
Loads dropped Dex/Jar 1 TTPs 2 IoCs
Runs executable file dropped to the device during analysis.
-
Makes use of the framework's Accessibility service 4 TTPs 2 IoCs
Retrieves information displayed on the phone screen using AccessibilityService.
-
Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
-
Queries the phone number (MSISDN for GSM devices) 1 TTPs
-
Acquires the wake lock 1 IoCs
-
Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs
Application may abuse the framework's foreground service to continue running in the foreground.
-
Performs UI accessibility actions on behalf of the user 1 TTPs 4 IoCs
Application may abuse the accessibility service to prevent their removal.
-
Queries the mobile country code (MCC) 1 TTPs 1 IoCs
-
Queries the unique device ID (IMEI, MEID, IMSI) 1 TTPs
-
Reads information about phone network operator. 1 TTPs
-
Requests accessing notifications (often used to intercept notifications before users become aware). 1 TTPs 1 IoCs
-
Requests disabling of battery optimizations (often used to enable hiding in the background). 1 TTPs 1 IoCs
-
Requests modifying system settings. 1 IoCs
-
Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs
-
Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs
Processes
-
com.doneyearr1⤵
- Removes its main activity from the application launcher
- Loads dropped Dex/Jar
- Makes use of the framework's Accessibility service
- Acquires the wake lock
- Makes use of the framework's foreground persistence service
- Performs UI accessibility actions on behalf of the user
- Queries the mobile country code (MCC)
- Requests accessing notifications (often used to intercept notifications before users become aware).
- Requests disabling of battery optimizations (often used to enable hiding in the background).
- Requests modifying system settings.
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Uses Crypto APIs (Might try to encrypt user data)
Network
MITRE ATT&CK Mobile v15
Persistence
Event Triggered Execution
1Broadcast Receivers
1Foreground Persistence
1Defense Evasion
Download New Code at Runtime
1Foreground Persistence
1Hide Artifacts
2Suppress Application Icon
1User Evasion
1Impair Defenses
1Prevent Application Removal
1Input Injection
1Credential Access
Access Notifications
1Input Capture
2GUI Input Capture
1Keylogging
1Discovery
Software Discovery
1Security Software Discovery
1System Network Configuration Discovery
4Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
475B
MD5ac03990f9d9557cad154f9003b3c5c0d
SHA1b8767097c22218b66d9d70a007b280f975173993
SHA25681d149ab4e722684341c4cac732abe0a8386d676739d76ea579eca25ede768f8
SHA512f4986b3ab97bb9c86448c9b3560c0f80a7977a45d2c1eff4c4e823eff756ef76b7c1017ac0d707c24a8c2f2773f6bbb049c5e72c57262bae0f8c8b277f251eae
-
Filesize
448KB
MD5930eeac38e5f2825a7290dd775fcf2ad
SHA1c008ae7a9ba3e6c9b4c21e45cc5242e1d61dbcf6
SHA2568dfb9e6abb7c3cc6f3db9fef1337f824774aba32955f49dd435e507387465ea6
SHA5127857e925d6ba6a27df41559d2b683ab11ed2637ee8ad149f6b9b4d417152a474f59f2e037c071b6c8ee21e489f0a1385438b40250cae35d367021992ce09453a