Analysis
-
max time kernel
149s -
max time network
134s -
platform
android_x64 -
resource
android-x64-arm64-20240624-en -
resource tags
-
submitted
23-11-2024 11:00
General
-
Target
8734504205b5cdf1ea4c0e2d62a0dcf8500dc73f.apk
-
Size
1.8MB
-
MD5
f8f55308787894637f25d60b36f9cd85
-
SHA1
8734504205b5cdf1ea4c0e2d62a0dcf8500dc73f
-
SHA256
a740e47017159d8907da0d9752479ee28e7246104e6332a6f654ccaf846366d9
-
SHA512
051d35251a63e0d11b84f45da8fb41e2a7f6c28564ff8b1401d4615bc6976d8694db6ebdcae7c665eb2dd4ad6acc2b6cdb7fe6073d5cde62e883cb3401a0e7a8
-
SSDEEP
49152:7Nq2/4HF0X8HT5P4wOamxUGpeatOlvGkJ6g6ZX7Xq:BqHF0X81PPOnOGptkM0
Malware Config
Extracted
octo
https://jungjungju.com/M2EyOTM2M2FlY2My/
https://junggvbvqqqqqq.com/M2EyOTM2M2FlY2My/
https://lajunggvbvqq.com/M2EyOTM2M2FlY2My/
https://junggvbvqqgroup.com/M2EyOTM2M2FlY2My/
https://junggvbvqqnet.com/M2EyOTM2M2FlY2My/
https://bestjunggvbvqq.com/M2EyOTM2M2FlY2My/
https://sabgggsabggg.com/M2EyOTM2M2FlY2My/
https://sabgggsabggg.top/M2EyOTM2M2FlY2My/
https://sabgggsabgggsabggg.top/M2EyOTM2M2FlY2My/
https://nisiqnisiq.top/M2EyOTM2M2FlY2My/
https://abgggpoh.top/M2EyOTM2M2FlY2My/
Extracted
octo
https://jungjungju.com/M2EyOTM2M2FlY2My/
https://junggvbvqqqqqq.com/M2EyOTM2M2FlY2My/
https://lajunggvbvqq.com/M2EyOTM2M2FlY2My/
https://junggvbvqqgroup.com/M2EyOTM2M2FlY2My/
https://junggvbvqqnet.com/M2EyOTM2M2FlY2My/
https://bestjunggvbvqq.com/M2EyOTM2M2FlY2My/
https://sabgggsabggg.com/M2EyOTM2M2FlY2My/
https://sabgggsabggg.top/M2EyOTM2M2FlY2My/
https://sabgggsabgggsabggg.top/M2EyOTM2M2FlY2My/
https://nisiqnisiq.top/M2EyOTM2M2FlY2My/
https://abgggpoh.top/M2EyOTM2M2FlY2My/
Signatures
-
Octo
Octo is a banking malware with remote access capabilities first seen in April 2022.
-
Octo family
-
Octo payload 1 IoCs
-
Loads dropped Dex/Jar 1 TTPs 3 IoCs
Runs executable file dropped to the device during analysis.
-
Makes use of the framework's Accessibility service 4 TTPs 2 IoCs
Retrieves information displayed on the phone screen using AccessibilityService.
-
Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
-
Queries the phone number (MSISDN for GSM devices) 1 TTPs
-
Acquires the wake lock 1 IoCs
-
Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs
Application may abuse the framework's foreground service to continue running in the foreground.
-
Performs UI accessibility actions on behalf of the user 1 TTPs 2 IoCs
Application may abuse the accessibility service to prevent their removal.
-
Queries the mobile country code (MCC) 1 TTPs 1 IoCs
-
Reads information about phone network operator. 1 TTPs
-
Requests accessing notifications (often used to intercept notifications before users become aware). 1 TTPs 1 IoCs
-
Requests disabling of battery optimizations (often used to enable hiding in the background). 1 TTPs 1 IoCs
-
Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs
Processes
-
com.underonlyipt1⤵
- Loads dropped Dex/Jar
- Makes use of the framework's Accessibility service
- Acquires the wake lock
- Makes use of the framework's foreground persistence service
- Performs UI accessibility actions on behalf of the user
- Queries the mobile country code (MCC)
- Requests accessing notifications (often used to intercept notifications before users become aware).
- Requests disabling of battery optimizations (often used to enable hiding in the background).
- Uses Crypto APIs (Might try to encrypt user data)
Network
MITRE ATT&CK Mobile v15
Defense Evasion
Download New Code at Runtime
1Foreground Persistence
1Hide Artifacts
1User Evasion
1Impair Defenses
1Prevent Application Removal
1Input Injection
1Credential Access
Access Notifications
1Input Capture
2GUI Input Capture
1Keylogging
1Discovery
Software Discovery
1Security Software Discovery
1System Network Configuration Discovery
3Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2KB
MD57e81aa11ee3a4bd55e349c456dbcf945
SHA1e5c839c470dcbf216a6f0a724e0790b37cd7c9eb
SHA256f29d4025ec6b0fcc27108a4ea2f2ce2042dad83ff86951fc95cfc27990517e8e
SHA5122c6b668d54b387f3bcf6116eed93c64821366fd505975061fb096e4c97cf66d9f965fced7175a16835b60e6dca318f5e8ffb37c6b9e069c8052d686dadb5a38c
-
Filesize
2KB
MD59b5465d55f1f563fb8da0a3788bd372e
SHA1b8e4735c9a13194f0f79b161cb69a2433f0a7b06
SHA256cd9ec8232db8bae9d7730dde4615997b6d062846e0461cb19f6a35c17e1b0d40
SHA51230337a04d7489b5c849bf6e826f037a997d4596a8a892df2795bc5d8bd186beb441d7c770f08263ca07fde3bcc9157f8264ac2cccfb3d9c51ae8e8be8c752c47
-
Filesize
6KB
MD5392d3a7dd4bdabc1d11a5d1706682c0c
SHA1d4f1145c05f25f820fe577418eb1c6e77f70b50a
SHA256f24e8e583bc29586541200403227961fe218bf7b3a992049ee254e9553d74b89
SHA512616c0efc733c0d47ef63429f2e95db605da70ec49d96204df4196a52931a1ed707ec77fd22e77cde8a55b2cb877b7bb671bd59804adfa258a421f477ab10aaeb
-
Filesize
449KB
MD55b9369862cb950593943886e0cafb9d9
SHA1cc5f9e9d48656aab49b7798ad69777893ed4ba1c
SHA2566dfe0b14edd51eed690a582599e93393962d1b9a365510c823e875d9ba117eb9
SHA512e641849f91e125187584205e7e30fbfc4153762693ad2ae810d6bbc563ff2e0e960b4b04f35a51e4f058a480b66d82a0e39ae8af97c200a829582784a3263479
-
Filesize
309B
MD546ee3383a45b8dce39054fc020da6397
SHA1684bc47a62bad1004dc2bc7678927426b4fe3749
SHA256bf8846bf85a00130e7760807c944dbc9b5b676fe7d569521484361afd009ab9c
SHA5126c376477de5521ccc8a68e8ecb61f4ecec9ee6f2b61c9268cf15cab0eae9eea9f6d378d3aaf88c6f66cc9a93ff8f58c9a98603ae3dcdcf252edebc8d8e9d6c3a