Analysis
-
max time kernel
29s -
max time network
44s -
platform
android_x64 -
resource
android-33-x64-arm64-20240624-en -
resource tags
-
submitted
23-11-2024 10:56
General
-
Target
d27fe181daa9683613fa89b973ac1a904b0efca5.apk
-
Size
541KB
-
MD5
17ae964fc20b463648c46cc61570f60e
-
SHA1
d27fe181daa9683613fa89b973ac1a904b0efca5
-
SHA256
2f0aa32c38e9f003006134daec95065e57051ccb0dd94cc9aa49d9f800a702b0
-
SHA512
3bc57adbb0b444c59d67ee6649b139a06236114d648040696e8ed6934eefb6a81dc7cca070a060e2bcc152c069cefc00ecd526973d99dc97528d43467c4b3b30
-
SSDEEP
12288:MKDsIxOjGGix9nPk3GudqVTOIDwwBAAMOGchL+ImI:1nOBjdnIbBBFjJJ
Malware Config
Extracted
octo
https://176.111.174.92/ZTIyNTVmMmE1NzNl/
https://12logites432532s.xyz/ZTIyNTVmMmE1NzNl/
https://13logites432532s.xyz/ZTIyNTVmMmE1NzNl/
https://14logites432532s.xyz/ZTIyNTVmMmE1NzNl/
https://15logites432532s.xyz/ZTIyNTVmMmE1NzNl/
https://16logites432532s.xyz/ZTIyNTVmMmE1NzNl/
https://17logites432532s.xyz/ZTIyNTVmMmE1NzNl/
https://18logites432532s.xyz/ZTIyNTVmMmE1NzNl/
https://19logites432532s.xyz/ZTIyNTVmMmE1NzNl/
https://20logites432532s.xyz/ZTIyNTVmMmE1NzNl/
https://21logites432532s.xyz/ZTIyNTVmMmE1NzNl/
https://22logites432532s.xyz/ZTIyNTVmMmE1NzNl/
Extracted
octo
https://176.111.174.92/ZTIyNTVmMmE1NzNl/
https://12logites432532s.xyz/ZTIyNTVmMmE1NzNl/
https://13logites432532s.xyz/ZTIyNTVmMmE1NzNl/
https://14logites432532s.xyz/ZTIyNTVmMmE1NzNl/
https://15logites432532s.xyz/ZTIyNTVmMmE1NzNl/
https://16logites432532s.xyz/ZTIyNTVmMmE1NzNl/
https://17logites432532s.xyz/ZTIyNTVmMmE1NzNl/
https://18logites432532s.xyz/ZTIyNTVmMmE1NzNl/
https://19logites432532s.xyz/ZTIyNTVmMmE1NzNl/
https://20logites432532s.xyz/ZTIyNTVmMmE1NzNl/
https://21logites432532s.xyz/ZTIyNTVmMmE1NzNl/
https://22logites432532s.xyz/ZTIyNTVmMmE1NzNl/
Signatures
-
Octo
Octo is a banking malware with remote access capabilities first seen in April 2022.
-
Octo family
-
Octo payload 1 IoCs
-
Loads dropped Dex/Jar 1 TTPs 1 IoCs
Runs executable file dropped to the device during analysis.
-
Makes use of the framework's Accessibility service 4 TTPs 2 IoCs
Retrieves information displayed on the phone screen using AccessibilityService.
-
Obtains sensitive information copied to the device clipboard 2 TTPs 1 IoCs
Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.
-
Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
-
Queries the phone number (MSISDN for GSM devices) 1 TTPs
-
Acquires the wake lock 1 IoCs
-
Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs
Application may abuse the framework's foreground service to continue running in the foreground.
-
Queries the mobile country code (MCC) 1 TTPs 1 IoCs
-
Reads information about phone network operator. 1 TTPs
-
Requests accessing notifications (often used to intercept notifications before users become aware). 1 TTPs 1 IoCs
-
Requests disabling of battery optimizations (often used to enable hiding in the background). 1 TTPs 1 IoCs
-
Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs
-
Checks CPU information 2 TTPs 1 IoCs
-
Checks memory information 2 TTPs 1 IoCs
Processes
-
com.facemore721⤵
- Loads dropped Dex/Jar
- Makes use of the framework's Accessibility service
- Obtains sensitive information copied to the device clipboard
- Acquires the wake lock
- Makes use of the framework's foreground persistence service
- Queries the mobile country code (MCC)
- Requests accessing notifications (often used to intercept notifications before users become aware).
- Requests disabling of battery optimizations (often used to enable hiding in the background).
- Uses Crypto APIs (Might try to encrypt user data)
- Checks CPU information
- Checks memory information
Network
MITRE ATT&CK Mobile v15
Defense Evasion
Download New Code at Runtime
1Foreground Persistence
1Hide Artifacts
1User Evasion
1Input Injection
1Virtualization/Sandbox Evasion
2System Checks
2Credential Access
Access Notifications
1Clipboard Data
1Input Capture
2GUI Input Capture
1Keylogging
1Discovery
Software Discovery
1Security Software Discovery
1System Information Discovery
2System Network Configuration Discovery
3Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
450KB
MD5bd29a237b7c72b7b67623cfbf581a64a
SHA1c202e95116e1f7a60a1552880a4f67b21249af33
SHA256865a5e46602897d6988f2d08a8a3d5252120de44677695e3753a195bc37d43f7
SHA512f608edce40ab4303059ed7b4a7b601df6c74e28ad6d368b240a9605daf6fc7d71f0daed3fe656ff264de293f3bbd7458b9a32b6b489a5d317f51e0326be9ac1a
-
Filesize
28B
MD56311c3fd15588bb5c126e6c28ff5fffe
SHA1ce81d136fce31779f4dd62e20bdaf99c91e2fc57
SHA2568b82f6032e29a2b5c96031a3630fb6173d12ff0295bc20bb21b877d08f0812d8
SHA5122975fe2e94b6a8adc9cfc1a865ad113772b54572883a537b02a16dd2d029c0f7d9cca3b154fd849bdfe978e18b396bcf9fa6e67e7c61f92bdc089a29a9c355c6
-
Filesize
219B
MD5d13f7ea890c3783d93b37b38beacbabe
SHA1bcc51ae3942c7eb9f69827b4f12c8eca9a0cbfad
SHA25619409474d2caa53f691e26c853b60420edbec54079e7c3528bb7321e09544040
SHA51262538be1db8ac668f8b81917f5cbf580b565569be480ace2ba5ac6666e77b3abc74dfb35030dc57799b40d9924440da657be545d4ecba3fb064fdd5b0a215725
-
Filesize
61B
MD542ff1c56f2e50e3e09e9af87cf061cf5
SHA14776d88efe06d6c225eed55723038c1bab299c27
SHA2561763f4afc6b6d27ba0eec53136ae9829c583b896a11fe57d55e3a4222300d0e3
SHA51208baa98b483bd75b0ddd77e36fdee02199220fe058810255084baf85b696759f945dc038f4ffa81ac4b8a7cd598524b9d2cda8209895cd3c4c350e5955d90b02
-
Filesize
60B
MD5de73f20dd42f85ba7ced6718bf9beff4
SHA11ab28a07e88e5d0d2e3b77b4afdb116fe5ce60c8
SHA2567341bced18e24a0327b021c5c9f9c9c924fddf4e8eb68c544ba0f4683f6fac9d
SHA512b3acbba380ffb438dfae99bd4567a07c33146a6a0e8e43ece5e358d8cea9bc7f86edd0cd2b6ca7fa323b7a70c841fa04b20ae6982c8319a71084f13e24495639
-
Filesize
76B
MD56692cb7c1d3d44cb6692c92e835b356d
SHA153e9f7cbfbae0ebb8e32e2b487482c493e032b8e
SHA25691f3508c3eecaf0dfd4542526c69724af1ec4b8f4c018b59e8cd52ba6092d7a9
SHA512871fd0d4a404fef3c565adaf563c4274d9551f1e8be8c0608238c5fa837042b8131f50754f726744063c8ffd21910c0408f7ce929be0f75e0f5ea9ea73f77f71