Overview

overview

10

Static

static

6

6739506697...b4.apk

android-9-x86

10

6739506697...b4.apk

android-13-x64

10

Analysis

  • max time kernel
    149s
  • max time network
    157s
  • platform
    android-13_x64
  • resource
    android-33-x64-arm64-20240910-en
  • resource tags

    arch:arm64arch:x64arch:x86image:android-33-x64-arm64-20240910-enlocale:en-usos:android-13-x64system
  • submitted
    25/11/2024, 22:07

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    67395066972d0da17cedb8e587edd1acf45086ecad97c493ff3a6083e825cab4.apk
  • Size 2.0MB
  • Sample241125-115f8aynet
  • SHA256 67395066972d0da17cedb8e587edd1acf45086ecad97c493ff3a6083e825cab4
  • MD5 SHA1 SHA512 SSDEEP
Score
10/10
octobankercollectioncredential_accessdiscoveryevasionimpactinfostealerpersistencerattrojan

Malware Config

Extracted

Family

  • octo

C2

  • https://bunaseiranahui.top/ZmU2YzQ2NjZlNjc2/

  • https://lauytropopo.net/ZmU2YzQ2NjZlNjc2/

  • https://bobnoopopo.org/ZmU2YzQ2NjZlNjc2/

  • https://junggvrebvqqpo.org/ZmU2YzQ2NjZlNjc2/

  • https://junggpervbvqqqqqqpo.com/ZmU2YzQ2NjZlNjc2/

  • https://junggvbvqqgrouppo.com/ZmU2YzQ2NjZlNjc2/

  • https://junggvbvqqnetokpo.com/ZmU2YzQ2NjZlNjc2/

rc4.plain

Extracted

Family

  • octo

C2

  • https://bunaseiranahui.top/ZmU2YzQ2NjZlNjc2/

  • https://lauytropopo.net/ZmU2YzQ2NjZlNjc2/

  • https://bobnoopopo.org/ZmU2YzQ2NjZlNjc2/

  • https://junggvrebvqqpo.org/ZmU2YzQ2NjZlNjc2/

  • https://junggpervbvqqqqqqpo.com/ZmU2YzQ2NjZlNjc2/

  • https://junggvbvqqgrouppo.com/ZmU2YzQ2NjZlNjc2/

  • https://junggvbvqqnetokpo.com/ZmU2YzQ2NjZlNjc2/

AES_key

Signatures

  • Octo

    Octo is a banking malware with remote access capabilities first seen in April 2022.

    bankertrojaninfostealerratocto
  • Octo family
    octo
  • Octo payload 1 IoCs
  • Loads dropped Dex/Jar 1 TTPs 2 IoCs

    Runs executable file dropped to the device during analysis.

    evasion
  • Makes use of the framework's Accessibility service 4 TTPs 2 IoCs

    Retrieves information displayed on the phone screen using AccessibilityService.

    collectionevasioncredential_access
  • Obtains sensitive information copied to the device clipboard 2 TTPs 1 IoCs

    Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.

    collectioncredential_accessimpact
  • Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
    bankerdiscovery
  • Queries the phone number (MSISDN for GSM devices) 1 TTPs
    discovery
  • Acquires the wake lock 1 IoCs
  • Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs

    Application may abuse the framework's foreground service to continue running in the foreground.

    evasionpersistence
  • Performs UI accessibility actions on behalf of the user 1 TTPs 5 IoCs

    Application may abuse the accessibility service to prevent their removal.

    evasion
  • Queries the mobile country code (MCC) 1 TTPs 1 IoCs
    discovery
  • Reads information about phone network operator. 1 TTPs
    discovery
  • Requests accessing notifications (often used to intercept notifications before users become aware). 1 TTPs 1 IoCs
    collectioncredential_access
  • Requests disabling of battery optimizations (often used to enable hiding in the background). 1 TTPs 1 IoCs
    evasion
  • Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs
    impact
  • Checks CPU information 2 TTPs 1 IoCs
  • Checks memory information 2 TTPs 1 IoCs

Processes

  • com.decidehundred2
    1⤵
    • Loads dropped Dex/Jar
    • Makes use of the framework's Accessibility service
    • Obtains sensitive information copied to the device clipboard
    • Acquires the wake lock
    • Makes use of the framework's foreground persistence service
    • Performs UI accessibility actions on behalf of the user
    • Queries the mobile country code (MCC)
    • Requests accessing notifications (often used to intercept notifications before users become aware).
    • Requests disabling of battery optimizations (often used to enable hiding in the background).
    • Uses Crypto APIs (Might try to encrypt user data)
    • Checks CPU information
    • Checks memory information
    PID:4517

Network

        MITRE ATT&CK Mobile v15

        Initial Access

        Execution

        Persistence

        Foreground Persistence

        1
        T1541

        Privilege Escalation

        Defense Evasion

        Download New Code at Runtime

        1
        T1407

        Foreground Persistence

        1
        T1541

        Hide Artifacts

        1
        T1628

        User Evasion

        1
        T1628.002

        Impair Defenses

        1
        T1629

        Prevent Application Removal

        1
        T1629.001

        Input Injection

        1
        T1516

        Virtualization/Sandbox Evasion

        2
        T1633

        System Checks

        2
        T1633.001

        Credential Access

        Access Notifications

        1
        T1517

        Clipboard Data

        1
        T1414

        Input Capture

        2
        T1417

        GUI Input Capture

        1
        T1417.002

        Keylogging

        1
        T1417.001

        Discovery

        Software Discovery

        1
        T1418

        Security Software Discovery

        1
        T1418.001

        System Information Discovery

        2
        T1426

        System Network Configuration Discovery

        3
        T1422

        Lateral Movement

        Collection

        Access Notifications

        1
        T1517

        Clipboard Data

        1
        T1414

        Input Capture

        2
        T1417

        GUI Input Capture

        1
        T1417.002

        Keylogging

        1
        T1417.001

        Screen Capture

        1
        T1513

        Command and Control

        Exfiltration

        Impact

        Data Encrypted for Impact

        1
        T1471

        Data Manipulation

        1
        T1641

        Transmitted Data Manipulation

        1
        T1641.001

        Input Injection

        1
        T1516

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        FPJ.json
        • Path /data/user/0/com.decidehundred2/app_DynamicOptDex/FPJ.json
        • Size 1KB
        • SHA256 f86b9b496e719df5c5bbeb9141aad8d628c6f9cb8bb1f721c635bfaedd13ba2b
        • MD5 SHA1 SHA512
        Submit Download

        FPJ.json
        • Path /data/user/0/com.decidehundred2/app_DynamicOptDex/FPJ.json
        • Size 1KB
        • SHA256 75d9165625912005d0efc0c624c32a8c10e9ceef27fba4e275c2be136baa8fc4
        • MD5 SHA1 SHA512
        Submit Download

        FPJ.json
        • Path /data/user/0/com.decidehundred2/app_DynamicOptDex/FPJ.json
        • Size 2KB
        • SHA256 ed17830e8fc9b4f65379a534733f947862ce110a7609c813c82d56f6f696d01d
        • MD5 SHA1 SHA512
        Download

        zhxkcsiqkhfvf.cur.prof
        • Path /data/user/0/com.decidehundred2/cache/oat/zhxkcsiqkhfvf.cur.prof
        • Size 404B
        • SHA256 4c6d22efc6f3b814bd3a92589d5d464f8a6f8bbc86f0e501ea67a94b1dac33b6
        • MD5 SHA1 SHA512
        Submit Download

        zhxkcsiqkhfvf
        • Path /data/user/0/com.decidehundred2/cache/zhxkcsiqkhfvf
        • Size 449KB
        • SHA256 b4276c301751e1a398c5f64fe1f48401c0e7f483e0cc99a6752fcd1c6d26f681
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        kl.txt
        • Path /data/user/0/com.decidehundred2/kl.txt
        • Size 54B
        • SHA256 5a7771fed93fc682b5e9f551fa1f3f717bef202331c6112e57ace4567bfff969
        • MD5 SHA1 SHA512
        Submit Download

        kl.txt
        • Path /data/user/0/com.decidehundred2/kl.txt
        • Size 76B
        • SHA256 fa86c909622bb4328ee933e843b812941e07632d13fde1bac93a4d90f8f1fc50
        • MD5 SHA1 SHA512
        Submit Download

        kl.txt
        • Path /data/user/0/com.decidehundred2/kl.txt
        • Size 28B
        • SHA256 8b82f6032e29a2b5c96031a3630fb6173d12ff0295bc20bb21b877d08f0812d8
        • MD5 SHA1 SHA512
        Submit Download

        kl.txt
        • Path /data/user/0/com.decidehundred2/kl.txt
        • Size 221B
        • SHA256 eec9928982887581dd8f87de626310c8d5d7b43e817bba4d122b4f6a120d8628
        • MD5 SHA1 SHA512
        Submit Download

        kl.txt
        • Path /data/user/0/com.decidehundred2/kl.txt
        • Size 64B
        • SHA256 67fde0ece7db3bb39bdebada14d5256a4f3863a7417d841d30ae6d60467dfad2
        • MD5 SHA1 SHA512
        Submit Download