Analysis
-
max time kernel
149s -
max time network
162s -
platform
android-13_x64 -
resource
android-33-x64-arm64-20240910-en -
resource tags
-
submitted
22-11-2024 22:04
General
-
Target
3727f8abca297c50cbfb3df2448790b6b2e4c92e0cbea0c0cd8f599be33465d9.apk
-
Size
541KB
-
MD5
49d25ab605045500db97f6f94ef2f15c
-
SHA1
fdd10963e334a78d1b3c10f09524fd71ee766cfd
-
SHA256
3727f8abca297c50cbfb3df2448790b6b2e4c92e0cbea0c0cd8f599be33465d9
-
SHA512
7f65bd9286abd7d65df8a418855005bd6c750a01eb696a70ada4f352ae4ce2f4ecd9f6b9f820b0f03d19f1411628393e5a2fe74c03b607f4e8d4d2d351895393
-
SSDEEP
12288:yVAlN5Eg4nG0XqKRkdCSvxLmD2qP3JTuuTWoM4gnR:ycT2nG0UCSvQai44WoM4gnR
Malware Config
Extracted
octo
https://restore-center.org/OTRkNGFmNjQxZmI3/
https://avagroup2.net/OTRkNGFmNjQxZmI3/
https://gold-host22.org/OTRkNGFmNjQxZmI3/
https://industrial-soft32.com/OTRkNGFmNjQxZmI3/
Extracted
octo
https://restore-center.org/OTRkNGFmNjQxZmI3/
https://avagroup2.net/OTRkNGFmNjQxZmI3/
https://gold-host22.org/OTRkNGFmNjQxZmI3/
https://industrial-soft32.com/OTRkNGFmNjQxZmI3/
Signatures
-
Octo
Octo is a banking malware with remote access capabilities first seen in April 2022.
-
Octo family
-
Octo payload 1 IoCs
-
Loads dropped Dex/Jar 1 TTPs 1 IoCs
Runs executable file dropped to the device during analysis.
-
Makes use of the framework's Accessibility service 4 TTPs 1 IoCs
Retrieves information displayed on the phone screen using AccessibilityService.
-
Obtains sensitive information copied to the device clipboard 2 TTPs 1 IoCs
Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.
-
Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
-
Queries the phone number (MSISDN for GSM devices) 1 TTPs
-
Acquires the wake lock 1 IoCs
-
Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs
Application may abuse the framework's foreground service to continue running in the foreground.
-
Performs UI accessibility actions on behalf of the user 1 TTPs 3 IoCs
Application may abuse the accessibility service to prevent their removal.
-
Queries the mobile country code (MCC) 1 TTPs 1 IoCs
-
Reads information about phone network operator. 1 TTPs
-
Requests accessing notifications (often used to intercept notifications before users become aware). 1 TTPs 1 IoCs
-
Requests disabling of battery optimizations (often used to enable hiding in the background). 1 TTPs 1 IoCs
-
Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs
-
Checks CPU information 2 TTPs 1 IoCs
-
Checks memory information 2 TTPs 1 IoCs
Processes
-
com.enoughdog11⤵
- Loads dropped Dex/Jar
- Makes use of the framework's Accessibility service
- Obtains sensitive information copied to the device clipboard
- Acquires the wake lock
- Makes use of the framework's foreground persistence service
- Performs UI accessibility actions on behalf of the user
- Queries the mobile country code (MCC)
- Requests accessing notifications (often used to intercept notifications before users become aware).
- Requests disabling of battery optimizations (often used to enable hiding in the background).
- Uses Crypto APIs (Might try to encrypt user data)
- Checks CPU information
- Checks memory information
Network
MITRE ATT&CK Mobile v15
Defense Evasion
Download New Code at Runtime
1Foreground Persistence
1Hide Artifacts
1User Evasion
1Impair Defenses
1Prevent Application Removal
1Input Injection
1Virtualization/Sandbox Evasion
2System Checks
2Credential Access
Access Notifications
1Clipboard Data
1Input Capture
2GUI Input Capture
1Keylogging
1Discovery
Software Discovery
1Security Software Discovery
1System Information Discovery
2System Network Configuration Discovery
3Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
403B
MD5f0a2b6ecda094152241a155584518b7e
SHA1d2f9c435bc0fd4e2231c6d8da0c0d82eb76b6462
SHA2569e657b3c3aa9f12b79d8dda05dee3c0ef8d4d498b4a1be9ad5281c3d8a053661
SHA512f1071e0d4cb8e9ae4529d9e1026e6fb34e80e6bdf5065f036b1adc72dabf434c278eb842d245ca1a1caaa1a8887c34810793ba5a44553dde81020d238f6db485
-
Filesize
448KB
MD5f713f4541a2300d77483aff55f091452
SHA1e424907d3f77d5e31b5dd78e5601e5decd492a3f
SHA2562c4f3008b4fa474de7f406e4ed8953936b1554f274ba7d7a91ef11180e5dbfab
SHA512e1aba25e31ac27cfa2cf87ac8213dd2a0b1eb1668eaa8138710a082b1aff60413f578da3c88ce30bdb87fbd677f707241a8085229a084672b1dacd656a83cea8
-
Filesize
28B
MD56311c3fd15588bb5c126e6c28ff5fffe
SHA1ce81d136fce31779f4dd62e20bdaf99c91e2fc57
SHA2568b82f6032e29a2b5c96031a3630fb6173d12ff0295bc20bb21b877d08f0812d8
SHA5122975fe2e94b6a8adc9cfc1a865ad113772b54572883a537b02a16dd2d029c0f7d9cca3b154fd849bdfe978e18b396bcf9fa6e67e7c61f92bdc089a29a9c355c6
-
Filesize
221B
MD5181039d53dde0e3220a230cf89599905
SHA174b383cc21e1668dce320fbea185fdded4951149
SHA256c980a902012628d936bf9939e616530752216581070e2f2703dd1f999163481e
SHA51246f663a452338c9295b93a686ace9e9b45dbc9c832221b2e98768b389df56ec9df645fc0079113a5d6638a12bc93574ecaa793f7b2644bf276bc890878aca925
-
Filesize
59B
MD579560fe4b0e03c466afdd13273142262
SHA13e84f4b84f35beada512539aca00021b21d05287
SHA25604c0d16d52cb6b672911e759055566ed14a23d4d2abfc91a89207ee309671e62
SHA512e00d7ff20f245c456305140c5e92e5f6a5822bc69a0a310be3eb94a59cb2101866dde716d0d04c128b8fb473d83a298ac556dda3c79edd5f07aed25c67a772af
-
Filesize
69B
MD5222fbccb8f47ae0956437ffefd857b70
SHA1749fdff81c0515dcbd305cde64ff1c778129b838
SHA256b7a17e8276a8521e78069d487d0f34285dd6e53cef081db427471b7c66e87baf
SHA512c6628a0e1014ad7ecdf7335354d6a38490d4257e56a6d400b4902752cbc6289c3525751b8f670630082c4858c21d15c542784ae7fea58ebb83e752a68f3f24cc
-
Filesize
504B
MD54ebf8dc287c93522aa9188ac503c57ad
SHA1d09993d3c5fea5dbf7b955f56bc9b88d80760f56
SHA256669555e37193e5c7fe792277ebf5b33571f2c32963671f0cf970a41d073fc296
SHA512e67623604fc886eb22f00abf38a43115675713880043b747de92cf1c78b75c93e9a36e2af4e77f9ab0b75f9a256945e118039828997afd4f519be00f37f01a55