Analysis
-
max time kernel
149s -
max time network
155s -
platform
android-13_x64 -
resource
android-33-x64-arm64-20240910-en -
resource tags
-
submitted
23-11-2024 11:00
General
-
Target
84b4b256e482bad6dfa694a96e9b4ea5fcc9fc0f.apk
-
Size
2.2MB
-
MD5
081bd06adceac9e3b5b19d9369156634
-
SHA1
84b4b256e482bad6dfa694a96e9b4ea5fcc9fc0f
-
SHA256
0a878d9178c95ad2a518471d2d97d6dfb50b5e9bc1bd0e053a3fa85c787b891b
-
SHA512
77f30b67b577f1fc5c4450b92211c85163eb94e4c6b0a2ed8e2fe4e1436ef1d0ccd115255d71272ca60c6890ce8c0d75aa65ee2eb7c7454b1f3625eebb172eae
-
SSDEEP
49152:DwufK3pY9s83fPmN+yOp97eYCyczag2XiZGZbmqQa6qAE4KoSx:DwuUY9sUfPmNfOeYQz/2XiZQ/Q5g
Malware Config
Extracted
octo
https://chrownna.top/ZmU2YzQ2NjZlNjc2/
https://lauytropo.net/ZmU2YzQ2NjZlNjc2/
https://bobnoopo.org/ZmU2YzQ2NjZlNjc2/
https://junggvrebvqq.org/ZmU2YzQ2NjZlNjc2/
https://junggpervbvqqqqqq.com/ZmU2YzQ2NjZlNjc2/
https://junggvbvqqgroup.com/ZmU2YzQ2NjZlNjc2/
https://junggvbvqqnetok.com/ZmU2YzQ2NjZlNjc2/
Extracted
octo
https://chrownna.top/ZmU2YzQ2NjZlNjc2/
https://lauytropo.net/ZmU2YzQ2NjZlNjc2/
https://bobnoopo.org/ZmU2YzQ2NjZlNjc2/
https://junggvrebvqq.org/ZmU2YzQ2NjZlNjc2/
https://junggpervbvqqqqqq.com/ZmU2YzQ2NjZlNjc2/
https://junggvbvqqgroup.com/ZmU2YzQ2NjZlNjc2/
https://junggvbvqqnetok.com/ZmU2YzQ2NjZlNjc2/
Signatures
-
Octo
Octo is a banking malware with remote access capabilities first seen in April 2022.
-
Octo family
-
Octo payload 1 IoCs
-
Loads dropped Dex/Jar 1 TTPs 2 IoCs
Runs executable file dropped to the device during analysis.
-
Makes use of the framework's Accessibility service 4 TTPs 2 IoCs
Retrieves information displayed on the phone screen using AccessibilityService.
-
Obtains sensitive information copied to the device clipboard 2 TTPs 1 IoCs
Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.
-
Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
-
Queries the phone number (MSISDN for GSM devices) 1 TTPs
-
Acquires the wake lock 1 IoCs
-
Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs
Application may abuse the framework's foreground service to continue running in the foreground.
-
Performs UI accessibility actions on behalf of the user 1 TTPs 3 IoCs
Application may abuse the accessibility service to prevent their removal.
-
Queries the mobile country code (MCC) 1 TTPs 1 IoCs
-
Reads information about phone network operator. 1 TTPs
-
Requests accessing notifications (often used to intercept notifications before users become aware). 1 TTPs 1 IoCs
-
Requests disabling of battery optimizations (often used to enable hiding in the background). 1 TTPs 1 IoCs
-
Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs
-
Checks CPU information 2 TTPs 1 IoCs
-
Checks memory information 2 TTPs 1 IoCs
Processes
-
com.halfseeqp1⤵
- Loads dropped Dex/Jar
- Makes use of the framework's Accessibility service
- Obtains sensitive information copied to the device clipboard
- Acquires the wake lock
- Makes use of the framework's foreground persistence service
- Performs UI accessibility actions on behalf of the user
- Queries the mobile country code (MCC)
- Requests accessing notifications (often used to intercept notifications before users become aware).
- Requests disabling of battery optimizations (often used to enable hiding in the background).
- Uses Crypto APIs (Might try to encrypt user data)
- Checks CPU information
- Checks memory information
Network
MITRE ATT&CK Mobile v15
Defense Evasion
Download New Code at Runtime
1Foreground Persistence
1Hide Artifacts
1User Evasion
1Impair Defenses
1Prevent Application Removal
1Input Injection
1Virtualization/Sandbox Evasion
2System Checks
2Credential Access
Access Notifications
1Clipboard Data
1Input Capture
2GUI Input Capture
1Keylogging
1Discovery
Software Discovery
1Security Software Discovery
1System Information Discovery
2System Network Configuration Discovery
3Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2KB
MD570ef485aa51f14f59a5e2997127a586e
SHA1bce9e0f81308508ed401d7152ec4f029f29e1edd
SHA256a415981f4450ccb964ef1623d5ab40e1d47f6e95c3fa6d5204bcd606fead2f57
SHA512abbb84c24545a1f5db40a47503fced30a600403f84c475fec0995619bdad01f6c397145ed4123634959449a4b9a0f714cf575fbeb25ee4562b40dc919e7f5fc3
-
Filesize
2KB
MD58ff7172d8017703945f25fa5d2fd516a
SHA182b1670ac887ade6081a2f40149b908485cdad7d
SHA25606ff9288cd367273ce886a37583827557b01d4fca1970476a907b7c43d386340
SHA51244c0b7e9312ce1009c385712084dc0c8fc997a5617c7145d062799a38106548fd49211c945a41200eae3cdb403a45b00d5b0a4f2a4f7bc668ad877645519f85b
-
Filesize
6KB
MD5941f6ba9962e1c4565512205cb319bb1
SHA147ebdb3e2f19bbbe44f7ebbf550cbb2dd62b1359
SHA256321fa09377cd3915f8a621172fd851487d4a3a6c9cb3b0315318d2b8d5e40a8b
SHA5128075b671926d24dcece0c10a5d32ee547b90013e77afb541f7a13dea210b8ec3dee57827386659a72c4c79e233f4dcc6ca2a93efc57e669ca07d162d25f95404
-
Filesize
399B
MD539cb0f3459f71a590ad2caa616b8ec19
SHA133e12804bd7c2fc28c3e6212d9213c0706a87fd6
SHA256da87a39991eed38a36d366603276bab1909b9c9ba62e0224c0409e2b4cfde202
SHA512fced2b97ebc3efbc9e12aa9d92cbbb91c80d1b940d70e385235878cec90cb7a8e4463b06806d131a3fb37be240724605671e85ed75a96405ff23749f7c82725e
-
Filesize
448KB
MD5c786ed856d4ed11d259d73cae47bcc7f
SHA114617e3bfdca890da694b7f7f1dc0d3ae85f39a5
SHA2561492a7cdffbd232b4f738c529f85fdd2a198cc62331f7746357043458e8ebca6
SHA512c07d31a9b404c8815f3a276a0d1a28df9830805a9c030a1f638577164246919067d78aa887df02a1ce0af140c77e8d89ee62d55685663150dcd9238b522f77b1
-
Filesize
72B
MD54444cd38a17d71b500c1b0497c65df0d
SHA144a45c031c3f8e65efff900105e7d5d7b44bb215
SHA2565ef456f99fe89efe72811cb21eb912ac44083b384386541d356d24fde500eaff
SHA51232a8eb2e831aee0e361cec6c9bedd5f905b817c3cef239d7b9dfacfbda2891c96ed6e492ac79fd1327ebe955b51ab89e644a4f196e12ab2edb8127cf113617d0
-
Filesize
76B
MD5f3526eec7c0a96174eca936ef099178c
SHA124c866aa0ba85c000e2ffe297b699597e1898d42
SHA2567698b5d9621a1daee63946663c288610a6d732d5f053a0620266005210a8ebb7
SHA512e9d2dea9072ab1b863cd16aeb3f3fb81839fc96c4399fdade502c8615d8dd88d0f3ab312e8ce8e4551811448e30f5dd486c98ac62db3a27d2fbb4e8885d3e380
-
Filesize
28B
MD56311c3fd15588bb5c126e6c28ff5fffe
SHA1ce81d136fce31779f4dd62e20bdaf99c91e2fc57
SHA2568b82f6032e29a2b5c96031a3630fb6173d12ff0295bc20bb21b877d08f0812d8
SHA5122975fe2e94b6a8adc9cfc1a865ad113772b54572883a537b02a16dd2d029c0f7d9cca3b154fd849bdfe978e18b396bcf9fa6e67e7c61f92bdc089a29a9c355c6
-
Filesize
221B
MD5fdf6599fb42f0f79d2d015f84be787ab
SHA1e12ae62fceeaa0922efef5df83b72c4d384179f1
SHA25635b0896f14ddabab1f6e661020d9d7a6e5185d4c38cf7e5199b0e2ee4c875814
SHA51231addf132308c016d018af5504db98c8e7bc70c33ab6a90a38fbb8885f65f0dc5ba6384ccd771f7a4ee79ff9d816665488d0a231ec99a5d3e72d61cdf4afd0ed
-
Filesize
68B
MD5d033411c79dfd7322ea56e101816c72f
SHA1f26ab3ef4e564d9cc58aa4b0fd54a61db4e842b8
SHA25602fd82a1d5285d0d2c95974d965eb03e6432088099857dc945159d4b8b6d5033
SHA51287f92425a19f2cf1753969c56097315d82c606dd965a7101f953df862f9964975f10d5f377ee8b4bf1099fe4cdf7b21e2a402b59b13b2e19a8336e1c5f0ba313