Analysis
-
max time kernel
148s -
max time network
167s -
platform
android-9_x86 -
resource
android-x86-arm-20240910-en -
resource tags
-
submitted
23-11-2024 11:00
General
-
Target
865e193b3c83f15cfb0a180dd33affaed8bfab3d.apk
-
Size
1.7MB
-
MD5
bed61342b7339b40f96172a8f3bf6e9e
-
SHA1
865e193b3c83f15cfb0a180dd33affaed8bfab3d
-
SHA256
55b92655fd372189cb7ae07dedefa23f7660c0500892150e8c5ffe788c3dc72f
-
SHA512
108b86ed363d03c222b7abb8c37cad4a5cff6c57241daa38ada14cec04173d311736b1cadb040beaf065235671e8fcdc40819eebc1168829580e87980da5f2dd
-
SSDEEP
49152:D8ow18yYd2Ws57EeC9vbOyLTE4+BPgwOrY:D8oFNdBce9vzLY41rY
Malware Config
Extracted
octo
https://ssfdnsjds.top/OGYyZmMyZmVlMGI0/
Extracted
octo
https://ssfdnsjds.top/OGYyZmMyZmVlMGI0/
Signatures
-
Octo
Octo is a banking malware with remote access capabilities first seen in April 2022.
-
Octo family
-
Octo payload 1 IoCs
-
Removes its main activity from the application launcher 1 TTPs 1 IoCs
-
Loads dropped Dex/Jar 1 TTPs 2 IoCs
Runs executable file dropped to the device during analysis.
-
Makes use of the framework's Accessibility service 4 TTPs 1 IoCs
Retrieves information displayed on the phone screen using AccessibilityService.
-
Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
-
Queries the phone number (MSISDN for GSM devices) 1 TTPs
-
Acquires the wake lock 1 IoCs
-
Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs
Application may abuse the framework's foreground service to continue running in the foreground.
-
Performs UI accessibility actions on behalf of the user 1 TTPs 1 IoCs
Application may abuse the accessibility service to prevent their removal.
-
Queries the mobile country code (MCC) 1 TTPs 1 IoCs
-
Queries the unique device ID (IMEI, MEID, IMSI) 1 TTPs
-
Reads information about phone network operator. 1 TTPs
-
Requests accessing notifications (often used to intercept notifications before users become aware). 1 TTPs 1 IoCs
-
Requests disabling of battery optimizations (often used to enable hiding in the background). 1 TTPs 1 IoCs
-
Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs
-
Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs
-
Checks CPU information 2 TTPs 1 IoCs
-
Checks memory information 2 TTPs 1 IoCs
Processes
-
com.yetdirectokmn1⤵
- Removes its main activity from the application launcher
- Loads dropped Dex/Jar
- Makes use of the framework's Accessibility service
- Acquires the wake lock
- Makes use of the framework's foreground persistence service
- Performs UI accessibility actions on behalf of the user
- Queries the mobile country code (MCC)
- Requests accessing notifications (often used to intercept notifications before users become aware).
- Requests disabling of battery optimizations (often used to enable hiding in the background).
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Uses Crypto APIs (Might try to encrypt user data)
- Checks CPU information
- Checks memory information
Network
MITRE ATT&CK Mobile v15
Persistence
Event Triggered Execution
1Broadcast Receivers
1Foreground Persistence
1Defense Evasion
Download New Code at Runtime
1Foreground Persistence
1Hide Artifacts
2Suppress Application Icon
1User Evasion
1Impair Defenses
1Prevent Application Removal
1Input Injection
1Virtualization/Sandbox Evasion
2System Checks
2Credential Access
Access Notifications
1Input Capture
2GUI Input Capture
1Keylogging
1Discovery
Software Discovery
1Security Software Discovery
1System Information Discovery
2System Network Configuration Discovery
4Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
441B
MD58fb507dd89ab310afd42268a833a1dd3
SHA1998b853b8f4efab2b764080c68bf6f0e5901ed4f
SHA2562dffe0bf4d9fe8d5e69ef32640c558d1626641afe9f6b8d9090a497c275dc0a6
SHA512c14d5650e951bacc29fbf3ce2d4691344fe998524e990d9b802e14571b36a0fb6457587a0e71cfe7ca75466320adaa3dad10c79bd4b9400c16a2ff1da6d0d371
-
Filesize
462KB
MD56c7b59c8c7a98418c43bade2fd1b0d3c
SHA118e177dbb846c5d9de887650f353d23755b93707
SHA2568df99892eaab6e194105f33843e3de45dfad127f90b102c6a530fd593b686716
SHA512b1e410115271ee370edd6330d1273622162d1de125eb99ecbe8211ff34c310f6f2a03bb25963f4c2668cf85cffb5c0996ef04bd6ea3fc4efdbac18efe3544845
-
Filesize
28B
MD56311c3fd15588bb5c126e6c28ff5fffe
SHA1ce81d136fce31779f4dd62e20bdaf99c91e2fc57
SHA2568b82f6032e29a2b5c96031a3630fb6173d12ff0295bc20bb21b877d08f0812d8
SHA5122975fe2e94b6a8adc9cfc1a865ad113772b54572883a537b02a16dd2d029c0f7d9cca3b154fd849bdfe978e18b396bcf9fa6e67e7c61f92bdc089a29a9c355c6
-
Filesize
235B
MD56bd74491358a811484090e55089169ba
SHA1f5c337091716bc1e1a6b8ac30a46b8a37c530232
SHA25620b8dcce85ed745ecc133c99a7c5f1641d56575f9fc9f5afc7df44123497378a
SHA5120b42a13b8bb12d6d13e05458535ca72915a6e8f3cc5e129b08900e9baa0a9b7f32c42284bb5db7218d7ffebf6601e3d3ddc0385e0c914e98b74b11d729853b06
-
Filesize
63B
MD5eee65b68a5109d75cadde3654227ff1e
SHA1d86fe7d1a3cbea9becc28374f0c939ad74a7f0d2
SHA2569e7e5a9a5667f9a2d4698e926069cfb8e67ec3ff2ab6a908000e2011e1727c2f
SHA512795c85543a6e5248a86c30c79a18ba6f8c98449736551cc9b9330c2cb3e06e0eab668369046941f0c29da9724b184547f1d3efb76bc03629fe683bf515e93466
-
Filesize
54B
MD5507660e0cb53a998d4074082bc06c8af
SHA1c34ff89727aa5d91620a32803c2ce37ca137c080
SHA2564705513c6d29e5638a175814d1224a7be2fd3c3bca3a71dde26c0028a548daaa
SHA512a43551410a8ab39f01264ae16a4d3ecf365c363c9cf6e0be9af84c0d8935044b1bae9cf09da173445e8285b9a0e3521093b2a6952a9c5071e0239412c6afdd33
-
Filesize
433B
MD5e6bd1079866e2b36787b0f17d5faaf66
SHA115fe63429b51713512fc064c744f1896345b9401
SHA256f640961c347114b3e635c4a41911e20ab15573fe8070901dd85768aa8fc08892
SHA51233d21cb9cfa893f30d718d8cadc487f51d53128d2670866a38abcc245f4f2980a5d5254402b615c4011d36e8d82be81c2b76582e8b267a984d0d7e1472a6f93f