Analysis
-
max time kernel
149s -
max time network
166s -
platform
android-13_x64 -
resource
android-33-x64-arm64-20240910-en -
resource tags
-
submitted
23-11-2024 11:00
General
-
Target
753c262257602605e79946ed42fa855da101761d.apk
-
Size
2.0MB
-
MD5
40265050e0136239ffc1ac9d782e31ae
-
SHA1
753c262257602605e79946ed42fa855da101761d
-
SHA256
dc69c74be98939f4940807d2268b5b32ed2f2729b2ba068591caf0254160a6d6
-
SHA512
03512268e0a9440c5f35a5c3b08f97a0c60b4bc5c11fa3cfd843089ad83d049cfb5ee525f00adf0b8334b5b413e23fae0287899f737cc1f9f4473155c85a654b
-
SSDEEP
49152:BTT+7AgEUy1I8ehFC1l8+E5RMoznNlJnFm:dT+dEUy1I3FCzE5R/z5c
Malware Config
Extracted
octo
https://jtfersion.com/YWFiM2VkMmFmNWFh/
https://kineomager.net/YWFiM2VkMmFmNWFh/
https://aberinogerd.com/YWFiM2VkMmFmNWFh/
https://nolevibanget.net/YWFiM2VkMmFmNWFh/
Extracted
octo
https://jtfersion.com/YWFiM2VkMmFmNWFh/
https://kineomager.net/YWFiM2VkMmFmNWFh/
https://aberinogerd.com/YWFiM2VkMmFmNWFh/
https://nolevibanget.net/YWFiM2VkMmFmNWFh/
Signatures
-
Octo
Octo is a banking malware with remote access capabilities first seen in April 2022.
-
Octo family
-
Octo payload 1 IoCs
-
Loads dropped Dex/Jar 1 TTPs 2 IoCs
Runs executable file dropped to the device during analysis.
-
Makes use of the framework's Accessibility service 4 TTPs 2 IoCs
Retrieves information displayed on the phone screen using AccessibilityService.
-
Obtains sensitive information copied to the device clipboard 2 TTPs 1 IoCs
Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.
-
Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
-
Queries the phone number (MSISDN for GSM devices) 1 TTPs
-
Acquires the wake lock 1 IoCs
-
Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs
Application may abuse the framework's foreground service to continue running in the foreground.
-
Performs UI accessibility actions on behalf of the user 1 TTPs 6 IoCs
Application may abuse the accessibility service to prevent their removal.
-
Queries the mobile country code (MCC) 1 TTPs 1 IoCs
-
Reads information about phone network operator. 1 TTPs
-
Requests accessing notifications (often used to intercept notifications before users become aware). 1 TTPs 1 IoCs
-
Requests disabling of battery optimizations (often used to enable hiding in the background). 1 TTPs 1 IoCs
-
Requests modifying system settings. 1 IoCs
-
Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs
-
Checks CPU information 2 TTPs 1 IoCs
-
Checks memory information 2 TTPs 1 IoCs
Processes
-
com.carrybuild41⤵
- Loads dropped Dex/Jar
- Makes use of the framework's Accessibility service
- Obtains sensitive information copied to the device clipboard
- Acquires the wake lock
- Makes use of the framework's foreground persistence service
- Performs UI accessibility actions on behalf of the user
- Queries the mobile country code (MCC)
- Requests accessing notifications (often used to intercept notifications before users become aware).
- Requests disabling of battery optimizations (often used to enable hiding in the background).
- Requests modifying system settings.
- Uses Crypto APIs (Might try to encrypt user data)
- Checks CPU information
- Checks memory information
Network
MITRE ATT&CK Mobile v15
Defense Evasion
Download New Code at Runtime
1Foreground Persistence
1Hide Artifacts
1User Evasion
1Impair Defenses
1Prevent Application Removal
1Input Injection
1Virtualization/Sandbox Evasion
2System Checks
2Credential Access
Access Notifications
1Clipboard Data
1Input Capture
2GUI Input Capture
1Keylogging
1Discovery
Software Discovery
1Security Software Discovery
1System Information Discovery
2System Network Configuration Discovery
3Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2KB
MD5099566ba3010bf29dd0b74d16dfd2c81
SHA1c81c115b5d9fdcb9ad2d3bfa2dbf894797d89d1b
SHA256190e41c7cfd4487f40877e4f69c24415c787fb3224ad13500ab97f74a2f4a526
SHA512265a474e2ef6261a27be1e1dca73ce8806f66fe103365208a40f64de238d7d510dd9cb7b3522ce0483e56cbbac25a363ff4458589b6fdd54583ea9572d7e4863
-
Filesize
2KB
MD550aaaee161ff33560781ae6474091699
SHA17312861b1c038912c23d0cdbff2876a4456cddfe
SHA256c3705004cfb2a4a8a39511c8940fd2a8d0fd4220fbd3c10a32f75c03ed0f55ab
SHA51201a0b15b71572836b4d1940ed7efe8bb0d03e11bc11b772710b1cf794e9d4293d24813bfe910fc3d834162b916079eac4c6a5d818f7e9b469f56c2ee740c482b
-
Filesize
5KB
MD511a3b3fc2b85c30bdeb8ce89f5b2d568
SHA11fc9f3d1ae372011bcc2303d2de88630965b1535
SHA2560811480d39d338a846fee5db302b07d598edec4ea9ef4c2a361d181299172649
SHA51253490fd84c941e88c140cf0baf146322b943e8aff003e389840938c4146cabb06061daa3c9aa5687418bc52dea0ed2453d746069363f90f1947ac04dd836b3c4
-
Filesize
410B
MD58304a040a67fa826453f144bbefc9d88
SHA1e031314286fcf6ec9eeb8ad1e97c033cdb8358bd
SHA256f37a39b30805ab3d03a62bb22438577534f9e382a80cbcf14e98ba6f61e47749
SHA5121e8a2be018a46f74c784e63b078db17eed2cc333042cd33b02dd79443a7f4ce66d7fc1e2ed4b71104e1f59ac5919f33d35d19a277a0a20ebefa6ecb5f02ebd3b
-
Filesize
448KB
MD5251f5be95aad11c7a231d88b37b0154d
SHA16e694c35ff718a617e9999aae12a63711c8e7c1c
SHA25609272d112558b22a70359becd2a292cb110b9e2f33202cb5cb491bd08c8bd6c2
SHA5122f63110429eff2ac05d18f40d80ce26909f1071fc1bff75a1d1b2603b0b61a37794b7f2ba1da6d37000c1b20dd7c22881ac1c7adf201ce7523c6e6d37822558f
-
Filesize
54B
MD5bdd3dd5e2dec80219e1ce6d3258b3e36
SHA16552aeefd39d1aa4e22f35b49949e2000055925e
SHA25674c06122128290fcc431e38d03394d8ea8c08e80808ba6427daf4fb0f06bb080
SHA512b5372625bb74686d2e1beb679dc67ec253928aaf57a2c2667394f61893e504ebbae274e2f98bfbcf36c14c70aa26c0be4f7bdf61cb4ca28aa69b1536abcf41f9
-
Filesize
504B
MD55babb5100cc9d652e372f7eb35d711bf
SHA13050c7aa1214e2fdb40362cf00f3900d7e7d347a
SHA256205f8586ba4072999d6a0452cd9f4a3a9d228e06fd1c3e8dbb146a651d30638b
SHA512b40c43137b8f73b8aafabb1316830473242956d0fec4a5cfa6f20ff6c6371addb6262be7374ff69655f41ef83d281081fa8cf4b632c96787e9717ab8c10b2df5
-
Filesize
28B
MD56311c3fd15588bb5c126e6c28ff5fffe
SHA1ce81d136fce31779f4dd62e20bdaf99c91e2fc57
SHA2568b82f6032e29a2b5c96031a3630fb6173d12ff0295bc20bb21b877d08f0812d8
SHA5122975fe2e94b6a8adc9cfc1a865ad113772b54572883a537b02a16dd2d029c0f7d9cca3b154fd849bdfe978e18b396bcf9fa6e67e7c61f92bdc089a29a9c355c6
-
Filesize
221B
MD579fc4f8b06ed9dbac35a1c5476ee2d4d
SHA182f258b9e2131c12d8734156e298f7f25bfbe572
SHA256ab65e12f03317abd189fe83585be6c71ad77d099bc82eee88b6a3fbd0e66abf9
SHA51246051352e836e6f1dac795725fe7eb4b5b15ba468d4274a957eb58d0046b1b09f93951a66458082e0a6876d1f500c29e9a6b0da3cb437332fa1790c896dfa492
-
Filesize
64B
MD5cd9c31638ff7396d2e4c94fd05a8531f
SHA1a75646f23a567451d28f15ffaffb764be873d775
SHA256bb595c8cf5f96c94c0eeae4e5a024831e50cd9602d70e70c4efe1bb4386ac477
SHA51221fb857c30825c649e7930b736a2b04a8b95ad57c7ef17b134bc7d52bc49dd25abc0a8e5772a604553fa54ef3af3a90308128e598579042c08f8475170de1717