Analysis
-
max time kernel
29s -
max time network
41s -
platform
android-13_x64 -
resource
android-33-x64-arm64-20240910-en -
resource tags
-
submitted
23-11-2024 10:56
General
-
Target
753c262257602605e79946ed42fa855da101761d.apk
-
Size
2.0MB
-
MD5
40265050e0136239ffc1ac9d782e31ae
-
SHA1
753c262257602605e79946ed42fa855da101761d
-
SHA256
dc69c74be98939f4940807d2268b5b32ed2f2729b2ba068591caf0254160a6d6
-
SHA512
03512268e0a9440c5f35a5c3b08f97a0c60b4bc5c11fa3cfd843089ad83d049cfb5ee525f00adf0b8334b5b413e23fae0287899f737cc1f9f4473155c85a654b
-
SSDEEP
49152:BTT+7AgEUy1I8ehFC1l8+E5RMoznNlJnFm:dT+dEUy1I3FCzE5R/z5c
Malware Config
Extracted
octo
https://jtfersion.com/YWFiM2VkMmFmNWFh/
https://kineomager.net/YWFiM2VkMmFmNWFh/
https://aberinogerd.com/YWFiM2VkMmFmNWFh/
https://nolevibanget.net/YWFiM2VkMmFmNWFh/
Extracted
octo
https://jtfersion.com/YWFiM2VkMmFmNWFh/
https://kineomager.net/YWFiM2VkMmFmNWFh/
https://aberinogerd.com/YWFiM2VkMmFmNWFh/
https://nolevibanget.net/YWFiM2VkMmFmNWFh/
Signatures
-
Octo
Octo is a banking malware with remote access capabilities first seen in April 2022.
-
Octo family
-
Octo payload 1 IoCs
-
Loads dropped Dex/Jar 1 TTPs 2 IoCs
Runs executable file dropped to the device during analysis.
-
Makes use of the framework's Accessibility service 4 TTPs 2 IoCs
Retrieves information displayed on the phone screen using AccessibilityService.
-
Obtains sensitive information copied to the device clipboard 2 TTPs 1 IoCs
Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.
-
Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
-
Queries the phone number (MSISDN for GSM devices) 1 TTPs
-
Acquires the wake lock 1 IoCs
-
Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs
Application may abuse the framework's foreground service to continue running in the foreground.
-
Performs UI accessibility actions on behalf of the user 1 TTPs 2 IoCs
Application may abuse the accessibility service to prevent their removal.
-
Queries the mobile country code (MCC) 1 TTPs 1 IoCs
-
Reads information about phone network operator. 1 TTPs
-
Requests accessing notifications (often used to intercept notifications before users become aware). 1 TTPs 1 IoCs
-
Requests disabling of battery optimizations (often used to enable hiding in the background). 1 TTPs 1 IoCs
-
Requests modifying system settings. 1 IoCs
-
Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs
-
Checks CPU information 2 TTPs 1 IoCs
-
Checks memory information 2 TTPs 1 IoCs
Processes
-
com.carrybuild41⤵
- Loads dropped Dex/Jar
- Makes use of the framework's Accessibility service
- Obtains sensitive information copied to the device clipboard
- Acquires the wake lock
- Makes use of the framework's foreground persistence service
- Performs UI accessibility actions on behalf of the user
- Queries the mobile country code (MCC)
- Requests accessing notifications (often used to intercept notifications before users become aware).
- Requests disabling of battery optimizations (often used to enable hiding in the background).
- Requests modifying system settings.
- Uses Crypto APIs (Might try to encrypt user data)
- Checks CPU information
- Checks memory information
Network
MITRE ATT&CK Mobile v15
Defense Evasion
Download New Code at Runtime
1Foreground Persistence
1Hide Artifacts
1User Evasion
1Impair Defenses
1Prevent Application Removal
1Input Injection
1Virtualization/Sandbox Evasion
2System Checks
2Credential Access
Access Notifications
1Clipboard Data
1Input Capture
2GUI Input Capture
1Keylogging
1Discovery
Software Discovery
1Security Software Discovery
1System Information Discovery
2System Network Configuration Discovery
3Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2KB
MD5099566ba3010bf29dd0b74d16dfd2c81
SHA1c81c115b5d9fdcb9ad2d3bfa2dbf894797d89d1b
SHA256190e41c7cfd4487f40877e4f69c24415c787fb3224ad13500ab97f74a2f4a526
SHA512265a474e2ef6261a27be1e1dca73ce8806f66fe103365208a40f64de238d7d510dd9cb7b3522ce0483e56cbbac25a363ff4458589b6fdd54583ea9572d7e4863
-
Filesize
2KB
MD550aaaee161ff33560781ae6474091699
SHA17312861b1c038912c23d0cdbff2876a4456cddfe
SHA256c3705004cfb2a4a8a39511c8940fd2a8d0fd4220fbd3c10a32f75c03ed0f55ab
SHA51201a0b15b71572836b4d1940ed7efe8bb0d03e11bc11b772710b1cf794e9d4293d24813bfe910fc3d834162b916079eac4c6a5d818f7e9b469f56c2ee740c482b
-
Filesize
5KB
MD511a3b3fc2b85c30bdeb8ce89f5b2d568
SHA11fc9f3d1ae372011bcc2303d2de88630965b1535
SHA2560811480d39d338a846fee5db302b07d598edec4ea9ef4c2a361d181299172649
SHA51253490fd84c941e88c140cf0baf146322b943e8aff003e389840938c4146cabb06061daa3c9aa5687418bc52dea0ed2453d746069363f90f1947ac04dd836b3c4
-
Filesize
448KB
MD5251f5be95aad11c7a231d88b37b0154d
SHA16e694c35ff718a617e9999aae12a63711c8e7c1c
SHA25609272d112558b22a70359becd2a292cb110b9e2f33202cb5cb491bd08c8bd6c2
SHA5122f63110429eff2ac05d18f40d80ce26909f1071fc1bff75a1d1b2603b0b61a37794b7f2ba1da6d37000c1b20dd7c22881ac1c7adf201ce7523c6e6d37822558f
-
Filesize
64B
MD543abb984370ccbebf739eea9937ba4df
SHA1dc6c8a4206eff9692074814a31181c861ac98cfb
SHA2563939753fac7ddebb0ea502c9770576e4d2022c12a44c9a6fefa0ba40751795d4
SHA5127a647f14db4933416e3bbf9c59f5eaba9e23327be5710f49c8f577ad4bf929b96da10d9a8bfcc79f4ed236f6c54710a99eead464aa78769b2ba6bd6f26ef2f76
-
Filesize
84B
MD598081134408db4446261f3f85edb65e2
SHA197143ac9ae372e7af4880d0b9c163f0d4a157bde
SHA2562f785450976534a6c772cf3c76a120fa65f56b5490d4b414217761427b2c7424
SHA51275e0ed84994cb606add99123615ff245058240d081f597c3b87fd73bfbe906ba4a05bfa8caa51322c59b227e44d2a84b5bd28c89dfeacc9d449e7fff8f523092
-
Filesize
28B
MD56311c3fd15588bb5c126e6c28ff5fffe
SHA1ce81d136fce31779f4dd62e20bdaf99c91e2fc57
SHA2568b82f6032e29a2b5c96031a3630fb6173d12ff0295bc20bb21b877d08f0812d8
SHA5122975fe2e94b6a8adc9cfc1a865ad113772b54572883a537b02a16dd2d029c0f7d9cca3b154fd849bdfe978e18b396bcf9fa6e67e7c61f92bdc089a29a9c355c6
-
Filesize
221B
MD540d020583c4c7b1aa7cdc9c7e303cfb9
SHA1b4d019a8bcf9763d5930f761a1e1c28eaa8bda8b
SHA256e518108b6b28391ad5b6ca278000c0cf8351e7652603fb1cda96ce8772b4ed11
SHA512e7898271567640ec8ecd46fb014b3700bc4f193ba924052ce7cf2a574c6fa155c9de83ac0168f497753718d8e800cecbb2797e15e7b9dd4eed26bdf5bde6fbf2
-
Filesize
54B
MD5dd73d9aaa923e54478fd9b521b51da94
SHA1606d4aee09b17b9c8b7bf6b42095e8ef2ce83868
SHA2563b37edab4a683e813bfe1e679d3ca456cf2070300e4d632221caddbf588a7a7f
SHA5124b175472182b8dc5e8138fbba171df052b763d877ee1c58317c7d0105f86495824a5c90f9919f6e568b42e5c141bcfb8e1f670347fdf3253cfa19edec3103b77