Analysis
-
max time kernel
148s -
max time network
163s -
platform
android-9_x86 -
resource
android-x86-arm-20240910-en -
resource tags
-
submitted
23-11-2024 11:00
General
-
Target
84b4b256e482bad6dfa694a96e9b4ea5fcc9fc0f.apk
-
Size
2.2MB
-
MD5
081bd06adceac9e3b5b19d9369156634
-
SHA1
84b4b256e482bad6dfa694a96e9b4ea5fcc9fc0f
-
SHA256
0a878d9178c95ad2a518471d2d97d6dfb50b5e9bc1bd0e053a3fa85c787b891b
-
SHA512
77f30b67b577f1fc5c4450b92211c85163eb94e4c6b0a2ed8e2fe4e1436ef1d0ccd115255d71272ca60c6890ce8c0d75aa65ee2eb7c7454b1f3625eebb172eae
-
SSDEEP
49152:DwufK3pY9s83fPmN+yOp97eYCyczag2XiZGZbmqQa6qAE4KoSx:DwuUY9sUfPmNfOeYQz/2XiZQ/Q5g
Malware Config
Extracted
octo
https://chrownna.top/ZmU2YzQ2NjZlNjc2/
https://lauytropo.net/ZmU2YzQ2NjZlNjc2/
https://bobnoopo.org/ZmU2YzQ2NjZlNjc2/
https://junggvrebvqq.org/ZmU2YzQ2NjZlNjc2/
https://junggpervbvqqqqqq.com/ZmU2YzQ2NjZlNjc2/
https://junggvbvqqgroup.com/ZmU2YzQ2NjZlNjc2/
https://junggvbvqqnetok.com/ZmU2YzQ2NjZlNjc2/
Extracted
octo
https://chrownna.top/ZmU2YzQ2NjZlNjc2/
https://lauytropo.net/ZmU2YzQ2NjZlNjc2/
https://bobnoopo.org/ZmU2YzQ2NjZlNjc2/
https://junggvrebvqq.org/ZmU2YzQ2NjZlNjc2/
https://junggpervbvqqqqqq.com/ZmU2YzQ2NjZlNjc2/
https://junggvbvqqgroup.com/ZmU2YzQ2NjZlNjc2/
https://junggvbvqqnetok.com/ZmU2YzQ2NjZlNjc2/
Signatures
-
Octo
Octo is a banking malware with remote access capabilities first seen in April 2022.
-
Octo family
-
Octo payload 1 IoCs
-
Removes its main activity from the application launcher 1 TTPs 1 IoCs
-
Loads dropped Dex/Jar 1 TTPs 4 IoCs
Runs executable file dropped to the device during analysis.
-
Makes use of the framework's Accessibility service 4 TTPs 2 IoCs
Retrieves information displayed on the phone screen using AccessibilityService.
-
Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
-
Queries the phone number (MSISDN for GSM devices) 1 TTPs
-
Acquires the wake lock 1 IoCs
-
Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs
Application may abuse the framework's foreground service to continue running in the foreground.
-
Performs UI accessibility actions on behalf of the user 1 TTPs 2 IoCs
Application may abuse the accessibility service to prevent their removal.
-
Queries the mobile country code (MCC) 1 TTPs 1 IoCs
-
Queries the unique device ID (IMEI, MEID, IMSI) 1 TTPs
-
Reads information about phone network operator. 1 TTPs
-
Requests accessing notifications (often used to intercept notifications before users become aware). 1 TTPs 1 IoCs
-
Requests disabling of battery optimizations (often used to enable hiding in the background). 1 TTPs 1 IoCs
-
Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs
-
Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs
-
Checks CPU information 2 TTPs 1 IoCs
-
Checks memory information 2 TTPs 1 IoCs
Processes
-
com.halfseeqp1⤵
- Removes its main activity from the application launcher
- Loads dropped Dex/Jar
- Makes use of the framework's Accessibility service
- Acquires the wake lock
- Makes use of the framework's foreground persistence service
- Performs UI accessibility actions on behalf of the user
- Queries the mobile country code (MCC)
- Requests accessing notifications (often used to intercept notifications before users become aware).
- Requests disabling of battery optimizations (often used to enable hiding in the background).
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Uses Crypto APIs (Might try to encrypt user data)
- Checks CPU information
- Checks memory information
-
/system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.halfseeqp/app_DynamicOptDex/YrTGbO.json --output-vdex-fd=41 --oat-fd=42 --oat-location=/data/user/0/com.halfseeqp/app_DynamicOptDex/oat/x86/YrTGbO.odex --compiler-filter=quicken --class-loader-context=&2⤵
- Loads dropped Dex/Jar
-
Network
MITRE ATT&CK Mobile v15
Persistence
Event Triggered Execution
1Broadcast Receivers
1Foreground Persistence
1Defense Evasion
Download New Code at Runtime
1Foreground Persistence
1Hide Artifacts
2Suppress Application Icon
1User Evasion
1Impair Defenses
1Prevent Application Removal
1Input Injection
1Virtualization/Sandbox Evasion
2System Checks
2Credential Access
Access Notifications
1Input Capture
2GUI Input Capture
1Keylogging
1Discovery
Software Discovery
1Security Software Discovery
1System Information Discovery
2System Network Configuration Discovery
4Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2KB
MD570ef485aa51f14f59a5e2997127a586e
SHA1bce9e0f81308508ed401d7152ec4f029f29e1edd
SHA256a415981f4450ccb964ef1623d5ab40e1d47f6e95c3fa6d5204bcd606fead2f57
SHA512abbb84c24545a1f5db40a47503fced30a600403f84c475fec0995619bdad01f6c397145ed4123634959449a4b9a0f714cf575fbeb25ee4562b40dc919e7f5fc3
-
Filesize
2KB
MD58ff7172d8017703945f25fa5d2fd516a
SHA182b1670ac887ade6081a2f40149b908485cdad7d
SHA25606ff9288cd367273ce886a37583827557b01d4fca1970476a907b7c43d386340
SHA51244c0b7e9312ce1009c385712084dc0c8fc997a5617c7145d062799a38106548fd49211c945a41200eae3cdb403a45b00d5b0a4f2a4f7bc668ad877645519f85b
-
Filesize
511B
MD5168aa49f5b70e8a029ebdab3c4c0be1b
SHA14172e6e24ff0e2ae468ea7c60c0b749f6eb0bb7e
SHA25698d743e7215bcc88b57ca23c26c09dfc774806684d1e4a269d8be5c15e8aeba8
SHA512503d2316f6de403a172d9015105776ce21811b58244de9f963932927c9ec940bb3d5a8dfa365a8449687486c3580d8ed9643b701a7741622c21c7e0c702822fe
-
Filesize
448KB
MD5c786ed856d4ed11d259d73cae47bcc7f
SHA114617e3bfdca890da694b7f7f1dc0d3ae85f39a5
SHA2561492a7cdffbd232b4f738c529f85fdd2a198cc62331f7746357043458e8ebca6
SHA512c07d31a9b404c8815f3a276a0d1a28df9830805a9c030a1f638577164246919067d78aa887df02a1ce0af140c77e8d89ee62d55685663150dcd9238b522f77b1
-
Filesize
28B
MD56311c3fd15588bb5c126e6c28ff5fffe
SHA1ce81d136fce31779f4dd62e20bdaf99c91e2fc57
SHA2568b82f6032e29a2b5c96031a3630fb6173d12ff0295bc20bb21b877d08f0812d8
SHA5122975fe2e94b6a8adc9cfc1a865ad113772b54572883a537b02a16dd2d029c0f7d9cca3b154fd849bdfe978e18b396bcf9fa6e67e7c61f92bdc089a29a9c355c6
-
Filesize
237B
MD5f61259089fb86284d777c8f8a63cf9db
SHA114b8e4eafa702f5df48d5e33eb9076b6e2876b44
SHA2567929b9f0648caeba3e22eff6f8b0dca82fe9d75e5e037d94ac7e10ca434e546f
SHA512247fc0ba601291f2549946a511a6fbe7e8889d13837030dde832a71d7e844d16a1e118a0d34d4d26236917b385551df0f5f2db3c6c291b68377935fcf352cb7e
-
Filesize
63B
MD57cbce5980e54d11490f0d196f3e9713e
SHA1f51c61e5a6c4aa072296bdc3162d23191f94d616
SHA256e827f12c419287b0a836da365d0f3a9a88ebdb3b39f46a59b96db55b08e86e67
SHA51286b81a7e122d207b2f353317b4c8066774b2eda300b9bb34e19fbc5442df154521b83ac7996c709ac46cf3bcfd22bcb5f85a00e06a958ef41ab2cf7cd7613ccb
-
Filesize
54B
MD5db301deefb7e484737524a525670d788
SHA12c98c769a7de46bde6f50eb7d6c0971bca3d9012
SHA2566bc0f7941e19225ce3d1948335cf324cf50a64daeb1d561b92f3e0cc7ba8ced5
SHA512d0d945c1508ce0b9a5d038cf48d24ac65ea06020f3d2ab2e7d68aaf2a469906aaa5ae74d9b9263a30db6a310cb8660a9ac7ef8a337d30a646b7d5d6a1a25b714
-
Filesize
437B
MD528c0b9b9f23cbff3bc87bebd8b8f131b
SHA1f40f6d0fbd7e6242150cfe3bbdd9708d4bfbcb3a
SHA256ca8347e2fb135c20de4facf594a2def553b419f7f5ed9b0caf764c4e348cf721
SHA5122f9414f0be2dd276e469529142567dc460743f99ccaa4c1a781223b86e38b21032828f818108f1da69c29df276dac3e49c3b0164ff352964ea0187d754b0350e
-
Filesize
6KB
MD5c0391f77f35f2ed994fb11e76d632219
SHA14c68bdb8ab4f9b16f7b805d33ea4cd73edf9f36b
SHA2565186e9a7e260f53e8c0b3407dd9c72d3a4c057ee4946634ed20bd8ed3e0ad96d
SHA512d935741500bceb28d0fb9e02cd241a3cbcfe0cf7bdd2f4ad8d7cf55a493cfd7b844507893759a916c90b7b1b4d5b6d987888a2b8a7877501fb8eca3bc68acc2a
-
Filesize
6KB
MD5941f6ba9962e1c4565512205cb319bb1
SHA147ebdb3e2f19bbbe44f7ebbf550cbb2dd62b1359
SHA256321fa09377cd3915f8a621172fd851487d4a3a6c9cb3b0315318d2b8d5e40a8b
SHA5128075b671926d24dcece0c10a5d32ee547b90013e77afb541f7a13dea210b8ec3dee57827386659a72c4c79e233f4dcc6ca2a93efc57e669ca07d162d25f95404