Analysis
-
max time kernel
29s -
max time network
40s -
platform
android_x64 -
resource
android-33-x64-arm64-20240624-en -
resource tags
-
submitted
23-11-2024 10:56
General
-
Target
af3368fbdffaed6f089dbdd77d170b09dc9fc8c7.apk
-
Size
1.9MB
-
MD5
cf72562e2263776d54be0bbd9e9d3909
-
SHA1
af3368fbdffaed6f089dbdd77d170b09dc9fc8c7
-
SHA256
73d3e8023ba36e1f89377a9f85ca9bfc5e7e8f9f566056341eafc85696f7e6da
-
SHA512
03e349f663de23c2f088f58a4d2c73cee8eafaaa569b683b506de1666faf08ff735410ed534bbc9e13d701e24369742be1d0d540027b5737751b144173e60241
-
SSDEEP
49152:VoF/+qiX0EnMFMab8dABmPJUG3LpFsn3PB/JlXX2ZGZbmqId8tAE4KoSJ:VoF/+qVEMFA6IUYdFO/B/nX2ZQ/IRc
Malware Config
Extracted
octo
https://chroww.top/MmEzNTkzZDFkOWQz/
https://lauytropo.net/MmEzNTkzZDFkOWQz/
https://bobnoopo.org/MmEzNTkzZDFkOWQz/
https://junggvrebvqq.org/MmEzNTkzZDFkOWQz/
https://junggpervbvqqqqqq.com/MmEzNTkzZDFkOWQz/
https://junggvbvqqgroup.com/MmEzNTkzZDFkOWQz/
https://junggvbvqqnetok.com/MmEzNTkzZDFkOWQz/
Extracted
octo
https://chroww.top/MmEzNTkzZDFkOWQz/
https://lauytropo.net/MmEzNTkzZDFkOWQz/
https://bobnoopo.org/MmEzNTkzZDFkOWQz/
https://junggvrebvqq.org/MmEzNTkzZDFkOWQz/
https://junggpervbvqqqqqq.com/MmEzNTkzZDFkOWQz/
https://junggvbvqqgroup.com/MmEzNTkzZDFkOWQz/
https://junggvbvqqnetok.com/MmEzNTkzZDFkOWQz/
Signatures
-
Octo
Octo is a banking malware with remote access capabilities first seen in April 2022.
-
Octo family
-
Octo payload 1 IoCs
-
Loads dropped Dex/Jar 1 TTPs 2 IoCs
Runs executable file dropped to the device during analysis.
-
Makes use of the framework's Accessibility service 4 TTPs 2 IoCs
Retrieves information displayed on the phone screen using AccessibilityService.
-
Obtains sensitive information copied to the device clipboard 2 TTPs 1 IoCs
Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.
-
Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
-
Queries the phone number (MSISDN for GSM devices) 1 TTPs
-
Acquires the wake lock 1 IoCs
-
Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs
Application may abuse the framework's foreground service to continue running in the foreground.
-
Queries the mobile country code (MCC) 1 TTPs 1 IoCs
-
Reads information about phone network operator. 1 TTPs
-
Requests accessing notifications (often used to intercept notifications before users become aware). 1 TTPs 1 IoCs
-
Requests disabling of battery optimizations (often used to enable hiding in the background). 1 TTPs 1 IoCs
-
Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs
-
Checks CPU information 2 TTPs 1 IoCs
-
Checks memory information 2 TTPs 1 IoCs
Processes
-
com.governtake01⤵
- Loads dropped Dex/Jar
- Makes use of the framework's Accessibility service
- Obtains sensitive information copied to the device clipboard
- Acquires the wake lock
- Makes use of the framework's foreground persistence service
- Queries the mobile country code (MCC)
- Requests accessing notifications (often used to intercept notifications before users become aware).
- Requests disabling of battery optimizations (often used to enable hiding in the background).
- Uses Crypto APIs (Might try to encrypt user data)
- Checks CPU information
- Checks memory information
Network
MITRE ATT&CK Mobile v15
Defense Evasion
Download New Code at Runtime
1Foreground Persistence
1Hide Artifacts
1User Evasion
1Input Injection
1Virtualization/Sandbox Evasion
2System Checks
2Credential Access
Access Notifications
1Clipboard Data
1Input Capture
2GUI Input Capture
1Keylogging
1Discovery
Software Discovery
1Security Software Discovery
1System Information Discovery
2System Network Configuration Discovery
3Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2KB
MD548ba3b7c9f270d6a0ab58d901c648101
SHA1d10c2d5efd9c7e13e2367e43e48b431397d0cc36
SHA256c9d634e9429156c03b0ac7acf05e28beb26864d36c9946642fe25c0fe64c1de6
SHA512a07b563b3a9f3f2693aa0d4ce23c9b4a1149eb3aaee308a5546c045e3c89aed7c4d6fa38a4838f2aaaef31af320ff54e814e06fb64ab66ea0cae43269759fa3c
-
Filesize
2KB
MD5de1d853e7952e7d36a7d5793e3045fc7
SHA1b9407a2c1a5f0901ae288a392831c5ee8beb8754
SHA2563cb4b87577bd41fe7195715ec61f9db3902e121514de28dadbc0a8db5c73efd8
SHA512b643671c2a70e67249cdba9f47fa66c0f6ee8d1fc758c49086fa7a60c64d3ce3ed058c39b8717c2c3503932ed9ef0ee4559e95ada66d45df29011e564753bd7e
-
Filesize
6KB
MD55447d973c54b0c60a81de4f22120e99c
SHA11de73d16ba315b62f8f505bc86e4e8c2f8e89da5
SHA2561876367ec4c0667c719868f3ec15ca6252193e12196bb042934687cccdd88eb7
SHA51273f4fd75e735b8a713ddf923c20cf4c97b135e4974fa3847196ea1277e0ed6b2fedfab91f2c8cc49db4076542351ab65cfa4c9917201b1b54c415f05f642746d
-
Filesize
449KB
MD59dbdf61845830233da0fdd72c2fa8d21
SHA107fe74f39dd629393b89f818952af4873fd040a3
SHA256c16f113110553da7b2995936017262c8cd21042228941954c51aac079efe6ef1
SHA512315b8831fcd05bf455f24b2b2cbe347c35913c65b0849285fb497da0e7393c84dce4e57132067cf043c663802b9ed27b9c815954333968ca61c19e188a4e0a17
-
Filesize
28B
MD56311c3fd15588bb5c126e6c28ff5fffe
SHA1ce81d136fce31779f4dd62e20bdaf99c91e2fc57
SHA2568b82f6032e29a2b5c96031a3630fb6173d12ff0295bc20bb21b877d08f0812d8
SHA5122975fe2e94b6a8adc9cfc1a865ad113772b54572883a537b02a16dd2d029c0f7d9cca3b154fd849bdfe978e18b396bcf9fa6e67e7c61f92bdc089a29a9c355c6
-
Filesize
221B
MD51b1a1d0231ef163c3dc17d18cb2bae19
SHA1b9dcc3709fe915c8cb227afafeca3615e3554a19
SHA2568238b4b5dbd781a02e5d80e6323ee882688c2535c84e82dadd4fcd2860d73ef9
SHA512485ae70f13e7b636f08b94f14ff36b43d70cbfcfc440892402d99eb769695892fbe4068e32ba974446495eef1e78e7450aeb5a7940c773c3c3256d2f1fa07911
-
Filesize
54B
MD522f199801d05049528943264da266045
SHA110e1ab2c1fcd7379e9f113c46ca4cd66d0621e1c
SHA2563a62cb5ac4152be3e674d79ea1d0b1999425fbcbf2d6ba8b803c46fe7d367a24
SHA5120451633b360d55fe53807230afd0bf1853098546defec63b43944e3572cfd73f61f6fdc9e52e1062b27c44a4fa3442371731ee4c1d25bc6c293020fe98c291cc