Analysis
-
max time kernel
148s -
max time network
165s -
platform
android-11_x64 -
resource
android-x64-arm64-20240910-en -
resource tags
-
submitted
23-11-2024 11:00
General
-
Target
865e193b3c83f15cfb0a180dd33affaed8bfab3d.apk
-
Size
1.7MB
-
MD5
bed61342b7339b40f96172a8f3bf6e9e
-
SHA1
865e193b3c83f15cfb0a180dd33affaed8bfab3d
-
SHA256
55b92655fd372189cb7ae07dedefa23f7660c0500892150e8c5ffe788c3dc72f
-
SHA512
108b86ed363d03c222b7abb8c37cad4a5cff6c57241daa38ada14cec04173d311736b1cadb040beaf065235671e8fcdc40819eebc1168829580e87980da5f2dd
-
SSDEEP
49152:D8ow18yYd2Ws57EeC9vbOyLTE4+BPgwOrY:D8oFNdBce9vzLY41rY
Malware Config
Extracted
octo
https://ssfdnsjds.top/OGYyZmMyZmVlMGI0/
Extracted
octo
https://ssfdnsjds.top/OGYyZmMyZmVlMGI0/
Signatures
-
Octo
Octo is a banking malware with remote access capabilities first seen in April 2022.
-
Octo family
-
Octo payload 1 IoCs
-
Loads dropped Dex/Jar 1 TTPs 2 IoCs
Runs executable file dropped to the device during analysis.
-
Makes use of the framework's Accessibility service 4 TTPs 1 IoCs
Retrieves information displayed on the phone screen using AccessibilityService.
-
Obtains sensitive information copied to the device clipboard 2 TTPs 1 IoCs
Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.
-
Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
-
Queries the phone number (MSISDN for GSM devices) 1 TTPs
-
Acquires the wake lock 1 IoCs
-
Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs
Application may abuse the framework's foreground service to continue running in the foreground.
-
Performs UI accessibility actions on behalf of the user 1 TTPs 3 IoCs
Application may abuse the accessibility service to prevent their removal.
-
Queries the mobile country code (MCC) 1 TTPs 1 IoCs
-
Reads information about phone network operator. 1 TTPs
-
Requests accessing notifications (often used to intercept notifications before users become aware). 1 TTPs 1 IoCs
-
Requests disabling of battery optimizations (often used to enable hiding in the background). 1 TTPs 1 IoCs
-
Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs
-
Checks CPU information 2 TTPs 1 IoCs
-
Checks memory information 2 TTPs 1 IoCs
Processes
-
com.yetdirectokmn1⤵
- Loads dropped Dex/Jar
- Makes use of the framework's Accessibility service
- Obtains sensitive information copied to the device clipboard
- Acquires the wake lock
- Makes use of the framework's foreground persistence service
- Performs UI accessibility actions on behalf of the user
- Queries the mobile country code (MCC)
- Requests accessing notifications (often used to intercept notifications before users become aware).
- Requests disabling of battery optimizations (often used to enable hiding in the background).
- Uses Crypto APIs (Might try to encrypt user data)
- Checks CPU information
- Checks memory information
Network
MITRE ATT&CK Mobile v15
Defense Evasion
Download New Code at Runtime
1Foreground Persistence
1Hide Artifacts
1User Evasion
1Impair Defenses
1Prevent Application Removal
1Input Injection
1Virtualization/Sandbox Evasion
2System Checks
2Credential Access
Access Notifications
1Clipboard Data
1Input Capture
2GUI Input Capture
1Keylogging
1Discovery
Software Discovery
1Security Software Discovery
1System Information Discovery
2System Network Configuration Discovery
3Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
339B
MD53c3d476801338acc6b962fc53a6d36e1
SHA1a1655a5c3c0f3eb9156668d6ca8d49e56c263ea2
SHA2563e9c2d26a8eb019a14c0e87fc142748f49ac3f411ed0cbf4a5390f85461c95f5
SHA512410f92d530bd0e17ffe454d80dee806fa3706643e9cce44e92b1a4c8f68ec8b4e29f343f3d88db82315f0a7fe2c4b891e585d332c6eb8a3098a251a39e987753
-
Filesize
462KB
MD56c7b59c8c7a98418c43bade2fd1b0d3c
SHA118e177dbb846c5d9de887650f353d23755b93707
SHA2568df99892eaab6e194105f33843e3de45dfad127f90b102c6a530fd593b686716
SHA512b1e410115271ee370edd6330d1273622162d1de125eb99ecbe8211ff34c310f6f2a03bb25963f4c2668cf85cffb5c0996ef04bd6ea3fc4efdbac18efe3544845
-
Filesize
28B
MD56311c3fd15588bb5c126e6c28ff5fffe
SHA1ce81d136fce31779f4dd62e20bdaf99c91e2fc57
SHA2568b82f6032e29a2b5c96031a3630fb6173d12ff0295bc20bb21b877d08f0812d8
SHA5122975fe2e94b6a8adc9cfc1a865ad113772b54572883a537b02a16dd2d029c0f7d9cca3b154fd849bdfe978e18b396bcf9fa6e67e7c61f92bdc089a29a9c355c6
-
Filesize
240B
MD5af2a9bb09fe054c50d7238d691a825ca
SHA1391ef99a8e49875577ec97727506732f710da304
SHA25694371df41d586694df99a8d9e427648041b0cdbf118eb5cb9e6911e13ce1b214
SHA5125c3e74acea2edb9c4cc4313c816ffc84fbb4eaf8e67472df622ee4e862359160e0a6254cfbc51d45f19b07d64fc38b219b55b2094c5e607d845ae2c5a9b22189
-
Filesize
69B
MD546489f9d888892219ec9812035be2357
SHA1b3d0684cfb8b1d41aab1365504e05cce4b482ee7
SHA25680c0c18beb9fd7ffeedfbb0dd5a22581d9ab1b4ae1e739f35a6f81c2ebecb1a4
SHA51200227f9ff8021a5d9ce8a80022b9ede176690a3a592477f1e8c20c0db0383aa3c98bb2f1d994056c20d6deefa53eb49edbc225a947413526473dd4a3409ee7dd
-
Filesize
59B
MD590dc3077565553729aa959095fb71294
SHA12d75213366a5433eb175f3bf9e5647c1bea9f926
SHA2567514026b729cd5a1120d268017f57fe853ae31077a13a0f876a5f414ac90f78b
SHA5129a58e7b0b5db751862024da1883e33c99a378ec1fe96fae263d3b8af64cfd999a1dea78ed2ac6959d4c509be91025ca2983e651ebfc491174400df3c782e9c44
-
Filesize
476B
MD53e57b0af75d9221844726eb855a53602
SHA1857772e755612968db02a06b12abaf6335e799ba
SHA2566b921ffff03595e48612ba8b57ab262becd72056bb8e1671b61903675a39e7a6
SHA5126d216d8a6cbd27903a427319fb9bdc9b8c476811bcde208c08f6e481790774a1c131b679de0ebd85f7e0606c07afb9c56ae7b13a9e335b8506275644fb396348