Overview

overview

10

Static

static

6

e6569b723a...d3.apk

android-9-x86

10

Resubmissions

18-11-2024 10:55

241118-m1bx1svlds 10

17-11-2024 22:00

241117-1wttxsyncy 10

Analysis

  • max time kernel
    109s
  • max time network
    90s
  • platform
    android_x86
  • resource
    android-x86-arm-20240624-es
  • resource tags

    androidarch:armarch:x86image:android-x86-arm-20240624-eslocale:es-esos:android-9-x86system
  • submitted
    18-11-2024 10:55

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    e6569b723ab84a98c9f8d43b03f0aad49efcf2c314efbc7ae6f99d2f462febd3.apk

  • Size

    605KB

  • MD5

    e109abe047081e2850c113f051fa2399

  • SHA1

    013a453d3cf1a897a8055c4dcd0ee974b7fbe15d

  • SHA256

    e6569b723ab84a98c9f8d43b03f0aad49efcf2c314efbc7ae6f99d2f462febd3

  • SHA512

    a084442a82f83ab83db09bbbfaa0d4218e0c7d246544ac978fdd261d7ef7c32e802b202ebee558eb2916af35a1ad499bb9f9e431aa42a40cd1b30e06d7933cf4

  • SSDEEP

    12288:4TK+XfiFh6KipZ8hlrOKMWLfkf8+U01PxKeyis4hDLrMhdy4:4ThOfiZI8tt1P7yisIzgdy4

Score
10/10
octobankercollectioncredential_accessdiscoveryevasionexecutionimpactinfostealerpersistenceratstealthtrojan

Malware Config

Extracted

Family

octo

C2

https://34b6413903074567453981d0595033c23.com/YmZiMzU0OTU5NGIz/

https://64b6413903074567453981d0595033c23.com/YmZiMzU0OTU5NGIz/

https://74b6413903074567453981d0595033c23.com/YmZiMzU0OTU5NGIz/

https://894b6413903074567453981d0595033c23.com/YmZiMzU0OTU5NGIz/

https://94b64139030754567453981d0595033c23.com/YmZiMzU0OTU5NGIz/

https://94b64139033074567453981d0595033c23.com/YmZiMzU0OTU5NGIz/

https://94b641553903074567453981d0595033c23.com/YmZiMzU0OTU5NGIz/
DES_key
AES_key

Signatures

  • Octo

    Octo is a banking malware with remote access capabilities first seen in April 2022.

    bankertrojaninfostealerratocto
  • Octo family
    octo
  • Octo payload 2 IoCs
  • Removes its main activity from the application launcher 1 TTPs 1 IoCs
    stealthtrojanevasion
  • Loads dropped Dex/Jar 1 TTPs 3 IoCs

    Runs executable file dropped to the device during analysis.

    evasion
  • Makes use of the framework's Accessibility service 4 TTPs 2 IoCs

    Retrieves information displayed on the phone screen using AccessibilityService.

    collectionevasioncredential_access
  • Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
    bankerdiscovery
  • Queries the phone number (MSISDN for GSM devices) 1 TTPs
    discovery
  • Acquires the wake lock 1 IoCs
  • Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs

    Application may abuse the framework's foreground service to continue running in the foreground.

    evasionpersistence
  • Performs UI accessibility actions on behalf of the user 1 TTPs 4 IoCs

    Application may abuse the accessibility service to prevent their removal.

    evasion
  • Queries the mobile country code (MCC) 1 TTPs 1 IoCs
    discovery
  • Reads information about phone network operator. 1 TTPs
    discovery
  • Requests accessing notifications (often used to intercept notifications before users become aware). 1 TTPs 1 IoCs
    collectioncredential_access
  • Requests disabling of battery optimizations (often used to enable hiding in the background). 1 TTPs 1 IoCs
    evasion
  • Requests modifying system settings. 1 IoCs
    evasion
  • Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs
    persistence
  • Schedules tasks to execute at a specified time 1 TTPs 1 IoCs

    Application may abuse the framework's APIs to perform task scheduling for initial or recurring execution of malicious code.

    executionpersistence
  • Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs
    impact

Processes

  • com.eachdidrtz
    1⤵
    • Removes its main activity from the application launcher
    • Loads dropped Dex/Jar
    • Makes use of the framework's Accessibility service
    • Acquires the wake lock
    • Makes use of the framework's foreground persistence service
    • Performs UI accessibility actions on behalf of the user
    • Queries the mobile country code (MCC)
    • Requests accessing notifications (often used to intercept notifications before users become aware).
    • Requests disabling of battery optimizations (often used to enable hiding in the background).
    • Requests modifying system settings.
    • Registers a broadcast receiver at runtime (usually for listening for system events)
    • Schedules tasks to execute at a specified time
    • Uses Crypto APIs (Might try to encrypt user data)
    PID:4219
    • /system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.eachdidrtz/code_cache/secondary-dexes/1731927342175_classes.dex --output-vdex-fd=42 --oat-fd=43 --oat-location=/data/user/0/com.eachdidrtz/code_cache/secondary-dexes/oat/x86/1731927342175_classes.odex --compiler-filter=quicken --class-loader-context=&
      2⤵
      • Loads dropped Dex/Jar
      PID:4244

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Scheduled Task/Job

1
T1603

Persistence

Event Triggered Execution

1
T1624

Broadcast Receivers

1
T1624.001

Foreground Persistence

1
T1541

Scheduled Task/Job

1
T1603

Privilege Escalation

Defense Evasion

Download New Code at Runtime

1
T1407

Foreground Persistence

1
T1541

Hide Artifacts

2
T1628

Suppress Application Icon

1
T1628.001

User Evasion

1
T1628.002

Impair Defenses

1
T1629

Prevent Application Removal

1
T1629.001

Input Injection

1
T1516

Credential Access

Access Notifications

1
T1517

Input Capture

2
T1417

GUI Input Capture

1
T1417.002

Keylogging

1
T1417.001

Discovery

Software Discovery

1
T1418

Security Software Discovery

1
T1418.001

System Network Configuration Discovery

3
T1422

Lateral Movement

Collection

Access Notifications

1
T1517

Input Capture

2
T1417

GUI Input Capture

1
T1417.002

Keylogging

1
T1417.001

Screen Capture

1
T1513

Command and Control

Exfiltration

Impact

Data Encrypted for Impact

1
T1471

Input Injection

1
T1516

Replay Monitor

Loading Replay Monitor...

Downloads

  • /data/data/com.eachdidrtz/cache/classes.dex
    Filesize

    447KB

    MD5

    8262b6e449a9c36b0b04da4f0ba66faf

    SHA1

    9048317b5eb21106a26043dccc50bf88e01c01ff

    SHA256

    219ed6c3f2a607bf79d237ec79da71c60f5dded5628755ac1c6a49f4da0192ab

    SHA512

    d8c8c934f4f4e24820e4cfa22049eb1107bd97a38250574f47e80513a07598d60c900c8fb13ca668e55462112b926ced3e3e8490cbc16baeac7c39cd37b893be

    Download Submit

  • /data/data/com.eachdidrtz/code_cache/secondary-dexes/1731927342175_classes.dex
    Filesize

    1.1MB

    MD5

    466d8d46387ad88b170b1c35085e9e08

    SHA1

    64279445185cc85ecca8e67aa626ba2dd3a4b6e2

    SHA256

    54a4e0e614f4e25153271efc05103aaf57ee70abeac84a921f48e5701159bbdf

    SHA512

    2e8f0ee18b75921bcffc151df7cefad1b4c5ec5b8ab1df79c8808222be5524d107438458f5d64d24ff6a1ca61491895cf3a458a95ea6a456cf82c1189901573d

    Download Submit

  • /data/data/com.eachdidrtz/files/profileInstalled
    Filesize

    24B

    MD5

    0947ec12d8752921b176274127320033

    SHA1

    48cf374cb3318d62f3dd90e294fd7a78615dea97

    SHA256

    6439f8f1ee725de8576ecd7ff0851a9d6fafdd9ea16b57c7bbbd8c521fa2d385

    SHA512

    35cc98d0db147c0a9436d4bb3cae2789155b5214a887dd5487acf1359aac78f682641e48f7d2859e532436410cfa43d8a6f76a8df4f389b39e63c51731b0806b

    Download Submit

  • /data/data/com.eachdidrtz/files/profileinstaller_profileWrittenFor_lastUpdateTime.dat
    Filesize

    8B

    MD5

    16757326fd4b22878c36d6dff308eab9

    SHA1

    19cf0696c40520da1d1562c8c1fb1a4cfaef127e

    SHA256

    b8427785a986846e0baa335ec3bfb577c39ebaf50be486640bd36ab261eca926

    SHA512

    4580006dbb3e3e898b141fd991ad09e25abab3005fc0e0e82249c32c78523fe6fa8566b774c308fa9de01375e7ecde6eac3e4caf5b5c93b7c58ef97e9c28ce6a

    Download Submit

  • /data/data/com.eachdidrtz/no_backup/androidx.work.workdb
    Filesize

    4KB

    MD5

    f2b4b0190b9f384ca885f0c8c9b14700

    SHA1

    934ff2646757b5b6e7f20f6a0aa76c7f995d9361

    SHA256

    0a8ffb6b327963558716e87db8946016d143e39f895fa1b43e95ba7032ce2514

    SHA512

    ec12685fc0d60526eed4d38820aad95611f3e93ae372be5a57142d8e8a1ba17e6e5dfe381a4e1365dddc0b363c9c40daaffdc1245bd515fddac69bf1abacd7f1

    Download Submit

  • /data/data/com.eachdidrtz/no_backup/androidx.work.workdb-journal
    Filesize

    512B

    MD5

    5bf57af69dea8d65a38df57056c1b5cc

    SHA1

    e90adc14b8bf88c9dcd89bcff88b31d5be1bc056

    SHA256

    673707fd59cb891e020229d524a4183aedf94f37f84e44c4f4c6bde45269e647

    SHA512

    04fd27ff9ba3cde2ff5ec453888983e0959f577c9d64fb8015bd083e47072e7325cac819b0673072bdb8032218c2c4cd2c6d11712625a580031b8f6cdf605659

    Download Submit

  • /data/data/com.eachdidrtz/no_backup/androidx.work.workdb-shm
    Filesize

    32KB

    MD5

    bb7df04e1b0a2570657527a7e108ae23

    SHA1

    5188431849b4613152fd7bdba6a3ff0a4fd6424b

    SHA256

    c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479

    SHA512

    768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012

    Download Submit

  • /data/data/com.eachdidrtz/no_backup/androidx.work.workdb-wal
    Filesize

    16KB

    MD5

    6f99c20d91264b9789d2eecd193f3d12

    SHA1

    c933af855541eabeaea90fbe5c5d161231dea7b9

    SHA256

    2448bd3b05735b0e07bfbdf69178be7403d745e0566b120fbd56190670b69f81

    SHA512

    c3bc4cb5a490e872cbc358a18106f779373a33ecd5138478f50fa1151b20d2e90d32560511adc125409b220d2add867b9dd17165aaf9963628d7c4811e6a5da2

    Download Submit

  • /data/data/com.eachdidrtz/no_backup/androidx.work.workdb-wal
    Filesize

    116KB

    MD5

    c1b0edc6f9a0b08798834e88b92995d9

    SHA1

    63780ccf478b87f9f9239fa2fe8ca0571dc7ff26

    SHA256

    e75a75689f4a0667e604da6452f91405f967d2f1a663bdd5bfee1565437746fc

    SHA512

    4056149b6fee46e42d60dc47607abc9bcf1d07b8142d21a6a016ef76d86a4e351bba48972c442f4c63293e5e1d75658fd198cad80b039a642247824b0912aa8c

    Download Submit

  • /data/data/com.eachdidrtz/no_backup/androidx.work.workdb-wal
    Filesize

    177KB

    MD5

    c6c0b059be916d0707575d7f4c2f322f

    SHA1

    bb77d87e1cbec3fb9ed0c7f917803ec0536a768c

    SHA256

    28e82e058c158c22a32700a01b476d2df77dd2ee3d1a828352501cda61a0be6d

    SHA512

    5db3bec1f9ad86f55a5b55453230c2b76c80d74128e492f22e1cce66f2bfefd6e1ab908c389530d780af412f46a4652a9e31b28e8ee622782ec33aa3185ef160

    Download Submit

  • /data/misc/profiles/cur/0/com.eachdidrtz/primary.prof
    Filesize

    111B

    MD5

    24e462e1c546783ab5e1d547d9543d01

    SHA1

    d392b1840dc25a33f3bfd33e04d0d632a75e388c

    SHA256

    afa1f9ac2fcf9afdef3e071bead9665edeb290cbcb1b453beb0c4dad73312d91

    SHA512

    797cd3a91c3a9c2174639d3885c0b33a9fab425e6215b0c2d303a4e2bdcc10931d7fac740cd1427e3e60b22c593f6e01cea57d48368c0947fdd0c080f3fb354d

    Download Submit

  • /data/misc/profiles/cur/0/com.eachdidrtz/primary.prof
    Filesize

    25B

    MD5

    b9d9e0f8902d129e1aeebff0ae7b725b

    SHA1

    cb0d2b4c9dd60a5c1fc6261fb581bcd3416fe781

    SHA256

    25a822139d06016af8be1296c0242b60e35074f94c713e03323636be1162ce91

    SHA512

    f158a9dc753e0cb41f71a98714ff02198c576bacdd792a6153fdaf6f9a7b52d8cfb6d09099a269d0c1b0d31e2ea5a307ea1db85115bdc6797887a6de36d597f6

    Download Submit

  • /data/user/0/com.eachdidrtz/code_cache/secondary-dexes/1731927342175_classes.dex
    Filesize

    1.1MB

    MD5

    15db515fb3a5c702d961dfa12aa4d5c4

    SHA1

    fdf54d3510097e12284efb0719630511c66f5920

    SHA256

    d79d84c0232515075da62fcc775975bee916ae2716fcd27a97a64bd4a59d986e

    SHA512

    5bbfd1a5950507226b8e5130f1eaa365560d4cfa6dea10f575e8833377bf6dfe2e53daa83e5957b906542256ce306115c34a5d97c71e401718e7527f71c6840b

    Download Submit