Analysis
-
max time kernel
149s -
max time network
130s -
platform
android_x86 -
resource
android-x86-arm-20240624-en -
resource tags
-
submitted
22-11-2024 22:04
General
-
Target
3727f8abca297c50cbfb3df2448790b6b2e4c92e0cbea0c0cd8f599be33465d9.apk
-
Size
541KB
-
MD5
49d25ab605045500db97f6f94ef2f15c
-
SHA1
fdd10963e334a78d1b3c10f09524fd71ee766cfd
-
SHA256
3727f8abca297c50cbfb3df2448790b6b2e4c92e0cbea0c0cd8f599be33465d9
-
SHA512
7f65bd9286abd7d65df8a418855005bd6c750a01eb696a70ada4f352ae4ce2f4ecd9f6b9f820b0f03d19f1411628393e5a2fe74c03b607f4e8d4d2d351895393
-
SSDEEP
12288:yVAlN5Eg4nG0XqKRkdCSvxLmD2qP3JTuuTWoM4gnR:ycT2nG0UCSvQai44WoM4gnR
Malware Config
Extracted
octo
https://restore-center.org/OTRkNGFmNjQxZmI3/
https://avagroup2.net/OTRkNGFmNjQxZmI3/
https://gold-host22.org/OTRkNGFmNjQxZmI3/
https://industrial-soft32.com/OTRkNGFmNjQxZmI3/
Extracted
octo
https://restore-center.org/OTRkNGFmNjQxZmI3/
https://avagroup2.net/OTRkNGFmNjQxZmI3/
https://gold-host22.org/OTRkNGFmNjQxZmI3/
https://industrial-soft32.com/OTRkNGFmNjQxZmI3/
Signatures
-
Octo
Octo is a banking malware with remote access capabilities first seen in April 2022.
-
Octo family
-
Octo payload 1 IoCs
-
Removes its main activity from the application launcher 1 TTPs 1 IoCs
-
Loads dropped Dex/Jar 1 TTPs 2 IoCs
Runs executable file dropped to the device during analysis.
-
Makes use of the framework's Accessibility service 4 TTPs 1 IoCs
Retrieves information displayed on the phone screen using AccessibilityService.
-
Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
-
Queries the phone number (MSISDN for GSM devices) 1 TTPs
-
Acquires the wake lock 1 IoCs
-
Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs
Application may abuse the framework's foreground service to continue running in the foreground.
-
Performs UI accessibility actions on behalf of the user 1 TTPs 3 IoCs
Application may abuse the accessibility service to prevent their removal.
-
Queries the mobile country code (MCC) 1 TTPs 1 IoCs
-
Queries the unique device ID (IMEI, MEID, IMSI) 1 TTPs
-
Reads information about phone network operator. 1 TTPs
-
Requests accessing notifications (often used to intercept notifications before users become aware). 1 TTPs 1 IoCs
-
Requests disabling of battery optimizations (often used to enable hiding in the background). 1 TTPs 1 IoCs
-
Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs
-
Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs
-
Checks CPU information 2 TTPs 1 IoCs
-
Checks memory information 2 TTPs 1 IoCs
Processes
-
com.enoughdog11⤵
- Removes its main activity from the application launcher
- Loads dropped Dex/Jar
- Makes use of the framework's Accessibility service
- Acquires the wake lock
- Makes use of the framework's foreground persistence service
- Performs UI accessibility actions on behalf of the user
- Queries the mobile country code (MCC)
- Requests accessing notifications (often used to intercept notifications before users become aware).
- Requests disabling of battery optimizations (often used to enable hiding in the background).
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Uses Crypto APIs (Might try to encrypt user data)
- Checks CPU information
- Checks memory information
Network
MITRE ATT&CK Mobile v15
Persistence
Event Triggered Execution
1Broadcast Receivers
1Foreground Persistence
1Defense Evasion
Download New Code at Runtime
1Foreground Persistence
1Hide Artifacts
2Suppress Application Icon
1User Evasion
1Impair Defenses
1Prevent Application Removal
1Input Injection
1Virtualization/Sandbox Evasion
2System Checks
2Credential Access
Access Notifications
1Input Capture
2GUI Input Capture
1Keylogging
1Discovery
Software Discovery
1Security Software Discovery
1System Information Discovery
2System Network Configuration Discovery
4Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
460B
MD5ce15a733c03c2ed04a7cecb053f45e7e
SHA1586dc9c70dab346fd302bb65c2c93aa7914e58c0
SHA2568fd7ff1e5e405dc4103525dc3c3f5533de995ad5d00d23aa9935cfa0f0fa9322
SHA512ca90f7c6eef55de1281f55209f720fd2c4cd17e87bbfbb6b2676cd760e36128232d6fdc6adf0487ced5fb82017ce3d3bcc1a163aefe371857889624fb5681e8f
-
Filesize
448KB
MD5f713f4541a2300d77483aff55f091452
SHA1e424907d3f77d5e31b5dd78e5601e5decd492a3f
SHA2562c4f3008b4fa474de7f406e4ed8953936b1554f274ba7d7a91ef11180e5dbfab
SHA512e1aba25e31ac27cfa2cf87ac8213dd2a0b1eb1668eaa8138710a082b1aff60413f578da3c88ce30bdb87fbd677f707241a8085229a084672b1dacd656a83cea8
-
Filesize
28B
MD56311c3fd15588bb5c126e6c28ff5fffe
SHA1ce81d136fce31779f4dd62e20bdaf99c91e2fc57
SHA2568b82f6032e29a2b5c96031a3630fb6173d12ff0295bc20bb21b877d08f0812d8
SHA5122975fe2e94b6a8adc9cfc1a865ad113772b54572883a537b02a16dd2d029c0f7d9cca3b154fd849bdfe978e18b396bcf9fa6e67e7c61f92bdc089a29a9c355c6
-
Filesize
73B
MD5cfda2c9412037ecad09b13dae7c28857
SHA1d18014248d60b8422b106a696692155532ee1fc4
SHA25667bb25ad37ea27701fbc9f23bd72676c1bc19b878b8ed819fcdb75db20076a4f
SHA5121c6d5804f936eea8b84436af104a23d6cbeafb5748d6b2e76e8723af7d9fd9cea7478dc047a91f758533778c33c41fee2d3064348e05fc6952239e14874c5555
-
Filesize
237B
MD5690a125839daff60d6af6a8b1b4eef1e
SHA1f15dcdfdbbd9f8b4bf9036a3dafa536416c4eb0f
SHA2568e0bfb1acfc4f7516f0ea305e987cf75cdc719c8357e3ac7b4a2cb7a9d1e80d7
SHA5128242761a5fbd671cfe5b3715bc49b6e92b6be77155ec5caa447fefd1245e19627d9bd1d308414fc5be6c03ebe7b2745356f5b78d3aac65d6a567ca0aff98caa9
-
Filesize
54B
MD5ac86e7ede0e6d66e108b22309f09b55e
SHA1806a3940aa3a82d0c7e0d0cd6cb3c86a63c7a9b9
SHA256e508f07603877175ce2708b72430bd579630eb3e92625f02f0214eed6b2f95d8
SHA5127e043fd1ccbb42c5c908f1f8395baef147f2ccd07f79089739f2b009f1a16e5e5bac10a40d1f0e5b408d9a77944b171f2f0bdbcd9653fa5d5835cec1b4e949e9
-
Filesize
437B
MD5e3e84911d400418dccd53a929884073a
SHA14a9977c91b887f96174f18cf9a5710051b86b111
SHA25612aa0d8cc42ac17812cd8d3d3043ec45a6083466c5ce1e718406e611656ebc25
SHA512bf00ac8c4c08904963fd8ec5eeccfb7791a21665e1934d57f98ff4ff71d38700cd366cdf739e9c34ee3f7eb679b32cb80ea689fe494da3922614ffa35e632a17