Overview

overview

10

Static

static

6

01e6cb93ee...9e.apk

android-9-x86

10

01e6cb93ee...9e.apk

android-10-x64

10

01e6cb93ee...9e.apk

android-11-x64

10

197359a4d8...d7.apk

android-9-x86

10

197359a4d8...d7.apk

android-11-x64

10

2427241add...70.apk

android-9-x86

10

2427241add...70.apk

android-10-x64

10

282a7cfccb...bd.apk

android-9-x86

10

282a7cfccb...bd.apk

android-10-x64

10

284d74a6fb...fa.apk

android-9-x86

10

284d74a6fb...fa.apk

android-13-x64

10

3221126c35...63.apk

android-9-x86

10

3221126c35...63.apk

android-10-x64

10

3f3ab2cd7e...bf.apk

android-9-x86

10

3f3ab2cd7e...bf.apk

android-10-x64

10

43e48ed5f6...fc.apk

android-9-x86

10

43e48ed5f6...fc.apk

android-11-x64

10

616c4ad548...8a.apk

android-9-x86

10

616c4ad548...8a.apk

android-13-x64

10

74aca9fcfb...e6.apk

android-9-x86

10

74aca9fcfb...e6.apk

android-13-x64

10

753c262257...1d.apk

android-9-x86

10

753c262257...1d.apk

android-13-x64

10

83684d8fa6...97.apk

android-9-x86

10

83684d8fa6...97.apk

android-13-x64

10

84b4b256e4...0f.apk

android-9-x86

10

84b4b256e4...0f.apk

android-13-x64

10

865e193b3c...3d.apk

android-9-x86

10

865e193b3c...3d.apk

android-11-x64

10

8734504205...3f.apk

android-9-x86

10

8734504205...3f.apk

android-11-x64

10

950867a96c...32.apk

android-9-x86

10

Analysis

  • max time kernel
    148s
  • max time network
    159s
  • platform
    android-9_x86
  • resource
    android-x86-arm-20240910-en
  • resource tags

    arch:armarch:x86image:android-x86-arm-20240910-enlocale:en-usos:android-9-x86system
  • submitted
    23-11-2024 11:00

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    8734504205b5cdf1ea4c0e2d62a0dcf8500dc73f.apk

  • Size

    1.8MB

  • MD5

    f8f55308787894637f25d60b36f9cd85

  • SHA1

    8734504205b5cdf1ea4c0e2d62a0dcf8500dc73f

  • SHA256

    a740e47017159d8907da0d9752479ee28e7246104e6332a6f654ccaf846366d9

  • SHA512

    051d35251a63e0d11b84f45da8fb41e2a7f6c28564ff8b1401d4615bc6976d8694db6ebdcae7c665eb2dd4ad6acc2b6cdb7fe6073d5cde62e883cb3401a0e7a8

  • SSDEEP

    49152:7Nq2/4HF0X8HT5P4wOamxUGpeatOlvGkJ6g6ZX7Xq:BqHF0X81PPOnOGptkM0

Score
10/10
octobankercollectioncredential_accessdiscoveryevasionimpactinfostealerpersistenceratstealthtrojan

Malware Config

Extracted

Family

octo

C2

https://jungjungju.com/M2EyOTM2M2FlY2My/

https://junggvbvqqqqqq.com/M2EyOTM2M2FlY2My/

https://lajunggvbvqq.com/M2EyOTM2M2FlY2My/

https://junggvbvqqgroup.com/M2EyOTM2M2FlY2My/

https://junggvbvqqnet.com/M2EyOTM2M2FlY2My/

https://bestjunggvbvqq.com/M2EyOTM2M2FlY2My/

https://sabgggsabggg.com/M2EyOTM2M2FlY2My/

https://sabgggsabggg.top/M2EyOTM2M2FlY2My/

https://sabgggsabgggsabggg.top/M2EyOTM2M2FlY2My/

https://nisiqnisiq.top/M2EyOTM2M2FlY2My/

https://abgggpoh.top/M2EyOTM2M2FlY2My/
rc4.plain

Extracted

Family

octo

C2

https://jungjungju.com/M2EyOTM2M2FlY2My/

https://junggvbvqqqqqq.com/M2EyOTM2M2FlY2My/

https://lajunggvbvqq.com/M2EyOTM2M2FlY2My/

https://junggvbvqqgroup.com/M2EyOTM2M2FlY2My/

https://junggvbvqqnet.com/M2EyOTM2M2FlY2My/

https://bestjunggvbvqq.com/M2EyOTM2M2FlY2My/

https://sabgggsabggg.com/M2EyOTM2M2FlY2My/

https://sabgggsabggg.top/M2EyOTM2M2FlY2My/

https://sabgggsabgggsabggg.top/M2EyOTM2M2FlY2My/

https://nisiqnisiq.top/M2EyOTM2M2FlY2My/

https://abgggpoh.top/M2EyOTM2M2FlY2My/
AES_key

Signatures

  • Octo

    Octo is a banking malware with remote access capabilities first seen in April 2022.

    bankertrojaninfostealerratocto
  • Octo family
    octo
  • Octo payload 1 IoCs
  • Removes its main activity from the application launcher 1 TTPs 1 IoCs
    stealthtrojanevasion
  • Loads dropped Dex/Jar 1 TTPs 4 IoCs

    Runs executable file dropped to the device during analysis.

    evasion
  • Makes use of the framework's Accessibility service 4 TTPs 2 IoCs

    Retrieves information displayed on the phone screen using AccessibilityService.

    collectionevasioncredential_access
  • Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
    bankerdiscovery
  • Queries the phone number (MSISDN for GSM devices) 1 TTPs
    discovery
  • Acquires the wake lock 1 IoCs
  • Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs

    Application may abuse the framework's foreground service to continue running in the foreground.

    evasionpersistence
  • Performs UI accessibility actions on behalf of the user 1 TTPs 2 IoCs

    Application may abuse the accessibility service to prevent their removal.

    evasion
  • Queries the mobile country code (MCC) 1 TTPs 1 IoCs
    discovery
  • Queries the unique device ID (IMEI, MEID, IMSI) 1 TTPs
    discovery
  • Reads information about phone network operator. 1 TTPs
    discovery
  • Requests accessing notifications (often used to intercept notifications before users become aware). 1 TTPs 1 IoCs
    collectioncredential_access
  • Requests disabling of battery optimizations (often used to enable hiding in the background). 1 TTPs 1 IoCs
    evasion
  • Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs
    persistence
  • Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs
    impact

Processes

  • com.underonlyipt
    1⤵
    • Removes its main activity from the application launcher
    • Loads dropped Dex/Jar
    • Makes use of the framework's Accessibility service
    • Acquires the wake lock
    • Makes use of the framework's foreground persistence service
    • Performs UI accessibility actions on behalf of the user
    • Queries the mobile country code (MCC)
    • Requests accessing notifications (often used to intercept notifications before users become aware).
    • Requests disabling of battery optimizations (often used to enable hiding in the background).
    • Registers a broadcast receiver at runtime (usually for listening for system events)
    • Uses Crypto APIs (Might try to encrypt user data)
    PID:4262
    • /system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.underonlyipt/app_DynamicOptDex/DQg.json --output-vdex-fd=41 --oat-fd=42 --oat-location=/data/user/0/com.underonlyipt/app_DynamicOptDex/oat/x86/DQg.odex --compiler-filter=quicken --class-loader-context=&
      2⤵
      • Loads dropped Dex/Jar
      PID:4286

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Event Triggered Execution

1
T1624

Broadcast Receivers

1
T1624.001

Foreground Persistence

1
T1541

Privilege Escalation

Defense Evasion

Download New Code at Runtime

1
T1407

Foreground Persistence

1
T1541

Hide Artifacts

2
T1628

Suppress Application Icon

1
T1628.001

User Evasion

1
T1628.002

Impair Defenses

1
T1629

Prevent Application Removal

1
T1629.001

Input Injection

1
T1516

Credential Access

Access Notifications

1
T1517

Input Capture

2
T1417

GUI Input Capture

1
T1417.002

Keylogging

1
T1417.001

Discovery

Software Discovery

1
T1418

Security Software Discovery

1
T1418.001

System Network Configuration Discovery

4
T1422

Lateral Movement

Collection

Access Notifications

1
T1517

Input Capture

2
T1417

GUI Input Capture

1
T1417.002

Keylogging

1
T1417.001

Screen Capture

1
T1513

Command and Control

Exfiltration

Impact

Data Encrypted for Impact

1
T1471

Input Injection

1
T1516

Replay Monitor

Loading Replay Monitor...

Downloads

  • /data/data/com.underonlyipt/app_DynamicOptDex/DQg.json
    Filesize

    2KB

    MD5

    7e81aa11ee3a4bd55e349c456dbcf945

    SHA1

    e5c839c470dcbf216a6f0a724e0790b37cd7c9eb

    SHA256

    f29d4025ec6b0fcc27108a4ea2f2ce2042dad83ff86951fc95cfc27990517e8e

    SHA512

    2c6b668d54b387f3bcf6116eed93c64821366fd505975061fb096e4c97cf66d9f965fced7175a16835b60e6dca318f5e8ffb37c6b9e069c8052d686dadb5a38c

    Download Submit

  • /data/data/com.underonlyipt/app_DynamicOptDex/DQg.json
    Filesize

    2KB

    MD5

    9b5465d55f1f563fb8da0a3788bd372e

    SHA1

    b8e4735c9a13194f0f79b161cb69a2433f0a7b06

    SHA256

    cd9ec8232db8bae9d7730dde4615997b6d062846e0461cb19f6a35c17e1b0d40

    SHA512

    30337a04d7489b5c849bf6e826f037a997d4596a8a892df2795bc5d8bd186beb441d7c770f08263ca07fde3bcc9157f8264ac2cccfb3d9c51ae8e8be8c752c47

    Download Submit

  • /data/data/com.underonlyipt/cache/adebqcl
    Filesize

    449KB

    MD5

    5b9369862cb950593943886e0cafb9d9

    SHA1

    cc5f9e9d48656aab49b7798ad69777893ed4ba1c

    SHA256

    6dfe0b14edd51eed690a582599e93393962d1b9a365510c823e875d9ba117eb9

    SHA512

    e641849f91e125187584205e7e30fbfc4153762693ad2ae810d6bbc563ff2e0e960b4b04f35a51e4f058a480b66d82a0e39ae8af97c200a829582784a3263479

    Download Submit

  • /data/data/com.underonlyipt/cache/oat/adebqcl.cur.prof
    Filesize

    529B

    MD5

    0ef370efe0bc9de2983b7916326e302d

    SHA1

    84b3c189b02e3116dbba7316064c411177047628

    SHA256

    bdef9b2813c179601a8fde4b5acb93e61f86bc179dec51a0d659fcf8248e71b8

    SHA512

    7c55aaf052ec1af603f7ee2cb890e2909586a6effcf6588644ac649d1e21c374932ce17e5267401f20a94ec991c714df7348e2c1369a116efe36bb4d3c7bf891

    Download Submit

  • /data/user/0/com.underonlyipt/app_DynamicOptDex/DQg.json
    Filesize

    6KB

    MD5

    510e8cb4936cc15c5acb9ec6d48825d2

    SHA1

    e57f1667ac1b02bbea13ac1135237cfb4e8e724a

    SHA256

    ace31d8f8202dd6dc3e87482eee8c1adae527769f1125ac96d634bb1a8405c1e

    SHA512

    f957e2805ac3352f60b90eac19cb029a3219cec3b97379056c4b98fd1c236692ce4893e5a6b4cc7fa82d3074bb41dba0ee842c622cec399d2bd7280054e467bc

    Download Submit

  • /data/user/0/com.underonlyipt/app_DynamicOptDex/DQg.json
    Filesize

    6KB

    MD5

    392d3a7dd4bdabc1d11a5d1706682c0c

    SHA1

    d4f1145c05f25f820fe577418eb1c6e77f70b50a

    SHA256

    f24e8e583bc29586541200403227961fe218bf7b3a992049ee254e9553d74b89

    SHA512

    616c0efc733c0d47ef63429f2e95db605da70ec49d96204df4196a52931a1ed707ec77fd22e77cde8a55b2cb877b7bb671bd59804adfa258a421f477ab10aaeb

    Download Submit