Analysis
-
max time kernel
149s -
max time network
152s -
platform
android-9_x86 -
resource
android-x86-arm-20240910-en -
resource tags
-
submitted
24-11-2024 22:11
General
-
Target
5f39ea35201e49b7f14bdae9d2f077580f6c2527d17c767620be6890435ef979.apk
-
Size
1.6MB
-
MD5
59080c638509bac8c8d3b18001c1af6b
-
SHA1
5f3fef0ee883c14a821c1ce33cab832c21f1b898
-
SHA256
5f39ea35201e49b7f14bdae9d2f077580f6c2527d17c767620be6890435ef979
-
SHA512
cedd5a4e0fd773a90cca4c7ad45378e87dccc7ba27c6ce3c1fb96c047908d13577408465d897ceee855f20519ec7ba4118179c9c1e3f6707fd0dfe20a1507b0e
-
SSDEEP
49152:iWwZQufxBMwgREhrSHiu5XNZGZbmqiC+AAE4KoST:iDZrxBMQ1g35XNZQ/ina
Malware Config
Extracted
octo
https://povtoruhh.top/MmEzNTkzZDFkOWQz/
https://lauytropo.net/MmEzNTkzZDFkOWQz/
https://bobnoopo.org/MmEzNTkzZDFkOWQz/
https://junggvrebvqq.org/MmEzNTkzZDFkOWQz/
https://junggpervbvqqqqqq.com/MmEzNTkzZDFkOWQz/
https://junggvbvqqgroup.com/MmEzNTkzZDFkOWQz/
https://junggvbvqqnetok.com/MmEzNTkzZDFkOWQz/
Extracted
octo
https://povtoruhh.top/MmEzNTkzZDFkOWQz/
https://lauytropo.net/MmEzNTkzZDFkOWQz/
https://bobnoopo.org/MmEzNTkzZDFkOWQz/
https://junggvrebvqq.org/MmEzNTkzZDFkOWQz/
https://junggpervbvqqqqqq.com/MmEzNTkzZDFkOWQz/
https://junggvbvqqgroup.com/MmEzNTkzZDFkOWQz/
https://junggvbvqqnetok.com/MmEzNTkzZDFkOWQz/
Signatures
-
Octo
Octo is a banking malware with remote access capabilities first seen in April 2022.
-
Octo family
-
Octo payload 1 IoCs
-
Removes its main activity from the application launcher 1 TTPs 1 IoCs
-
Loads dropped Dex/Jar 1 TTPs 3 IoCs
Runs executable file dropped to the device during analysis.
-
Makes use of the framework's Accessibility service 4 TTPs 2 IoCs
Retrieves information displayed on the phone screen using AccessibilityService.
-
Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
-
Queries the phone number (MSISDN for GSM devices) 1 TTPs
-
Acquires the wake lock 1 IoCs
-
Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs
Application may abuse the framework's foreground service to continue running in the foreground.
-
Performs UI accessibility actions on behalf of the user 1 TTPs 2 IoCs
Application may abuse the accessibility service to prevent their removal.
-
Queries the mobile country code (MCC) 1 TTPs 1 IoCs
-
Queries the unique device ID (IMEI, MEID, IMSI) 1 TTPs
-
Reads information about phone network operator. 1 TTPs
-
Requests accessing notifications (often used to intercept notifications before users become aware). 1 TTPs 1 IoCs
-
Requests disabling of battery optimizations (often used to enable hiding in the background). 1 TTPs 1 IoCs
-
Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs
-
Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs
-
Checks CPU information 2 TTPs 1 IoCs
-
Checks memory information 2 TTPs 1 IoCs
Processes
-
com.hundredcan81⤵
- Removes its main activity from the application launcher
- Loads dropped Dex/Jar
- Makes use of the framework's Accessibility service
- Acquires the wake lock
- Makes use of the framework's foreground persistence service
- Performs UI accessibility actions on behalf of the user
- Queries the mobile country code (MCC)
- Requests accessing notifications (often used to intercept notifications before users become aware).
- Requests disabling of battery optimizations (often used to enable hiding in the background).
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Uses Crypto APIs (Might try to encrypt user data)
- Checks CPU information
- Checks memory information
Network
MITRE ATT&CK Mobile v15
Persistence
Event Triggered Execution
1Broadcast Receivers
1Foreground Persistence
1Defense Evasion
Download New Code at Runtime
1Foreground Persistence
1Hide Artifacts
2Suppress Application Icon
1User Evasion
1Impair Defenses
1Prevent Application Removal
1Input Injection
1Virtualization/Sandbox Evasion
2System Checks
2Credential Access
Access Notifications
1Input Capture
2GUI Input Capture
1Keylogging
1Discovery
Software Discovery
1Security Software Discovery
1System Information Discovery
2System Network Configuration Discovery
4Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2KB
MD501d4c65d111d9aed9fe661542740928d
SHA1d29d2d25e5d289f8c05d8eb172e31f8da19acafc
SHA25631fffa2ee6a230cd48d85655b7c6dc05ec9d2f65455ea41207b0342b50d1d3c1
SHA5122f1795bbcbe9e7b71b8d8931743516df3ed77946e1fcc6ddbd75c5006ae75062fb549f99e1e81cf318248486e84fd2fbc78d8f058b6458128533f4f14facada1
-
Filesize
2KB
MD55f4480016d6494b6a5a37c5ec814b56c
SHA179ff937d929198ae3b0011ce76c13e146950a54f
SHA2566489e346001cc367108b7fa7546392e6a5c1fd644062de3a9ef9ce9ca6420529
SHA512872584f7264ae3ae3cfcfab1c7c77674fe822044c9b84afa0fdb037e0c108f4f839033f433805338b22bca73e822756b296644bff70f43367c5eb1e43f50ba56
-
Filesize
465B
MD5ecee8ca7b144b05f265eb07553ab322b
SHA1d5d55d386c449841c18fccf62bb52929bcf741e2
SHA2561b4fe697de7e85cbafd8c68ec3fd18b659fdc104d6a568ea4484cc0263463532
SHA512361b977d632251a403b78838e2228ac4cd583aeeff7cd3f7d1b9f98d04903487ab7f108e8f3fc992237dcc3eb8f2177a0f25dac0c074ffd9d53ece5f7572ce02
-
Filesize
449KB
MD51dd73b91757c1dc964f169daa7feb8be
SHA1a0c15b35e043422a5c1321515a37a21281885185
SHA256bf76cf4305e7055bca22b8b3298182733143523b254b5a0621563ec75ae4c2cc
SHA5125cfe86b3e9d647620928f7af36e636cf4ff7910af1faf7dcd16d2c25eff4fc520adf535d5b032fb6e9239782f1cdf04117f7db8c5ee40f449a2e153339bf79ec
-
Filesize
28B
MD56311c3fd15588bb5c126e6c28ff5fffe
SHA1ce81d136fce31779f4dd62e20bdaf99c91e2fc57
SHA2568b82f6032e29a2b5c96031a3630fb6173d12ff0295bc20bb21b877d08f0812d8
SHA5122975fe2e94b6a8adc9cfc1a865ad113772b54572883a537b02a16dd2d029c0f7d9cca3b154fd849bdfe978e18b396bcf9fa6e67e7c61f92bdc089a29a9c355c6
-
Filesize
237B
MD509c5061f01d0e18c23e56e0db1373e8e
SHA1cd5bf897e2d60aa60ccfbbb5ec3202fa5b41c423
SHA25663047cdf76c0f8ad6b4ed51338464ba964d5fbfe1e3c587cb102e724d5427c3a
SHA51241bd0b805ad81ea5ff424665e144110ab496b25effc1fd97ae4fc10d0796acabbe652c3c27577ecabef9e994b9c1f2d147600f20ec723b60002d61f23ebd1d7f
-
Filesize
63B
MD5a0ce3fb64cd341f8086d1a5581d93456
SHA15e2e6b81e3ad4aab430e942c15d217e2f73b5987
SHA256fe114bcd5f528502a4af900696458b7c303c867b34bc7bd4712b394cdc591f73
SHA512aebe75d3b47eca5bec764545f37dc3830cd7ebb077e06ac63d87ab5197c54555e86bc67b18fbe2a081b8060c2dbbe0da7cc46c5ac3af0321a8abdb0b82ce1cf8
-
Filesize
54B
MD5ab8920159a5c171df05d53eb3a10c021
SHA1408962d253563676483534c025205e8201c9cf6f
SHA2569fc9cd1ce69a2d9e80569385602cd142d688f1a45669b4496923094eef4c0abc
SHA51252e590b409e5a4adc19cc1274710414fd64e8d486cb0881cda3fde97bef405e97d99fe7218e7ce2cfb4202973db5ad3aaf92ac085e68b4ed1431b9dc32180404
-
Filesize
437B
MD536bfddaa8bb14c85ffba8e461b24aec6
SHA19aede3774b9c6c01291b0a6332719152886be4e4
SHA256dccfeff11657b9ce3e267b079c57553647d505409e17a97cab7b81f6afeed1ba
SHA512863ba788f960e0cb44657f1a8674dba387e1ed7a352725ad0beb41373f4941cc0f0306ef72a2b29c55f08ae2efa531e38468ff9ef95046a4d77b7cf2e3b212c0
-
Filesize
7KB
MD541616ebc87eb08680fa9405040cb105f
SHA12df0b5e1256c1b1ee15c0f232a90851bfeac1d57
SHA2565cb9e993f37de76f4cd6828eba64d902fd3c78dd30db670a9e365f122a5536d1
SHA51281d730c2fde5eb4056740fcd08fe3af9be13c7e3f3831839ef76e32f16ff8df241c93be8e7fa6987d0c7183404c777636dba8e0c7cf3d3d6e7e6f65003a27e7c