Analysis
-
max time kernel
149s -
max time network
158s -
platform
android_x64 -
resource
android-33-x64-arm64-20240624-en -
resource tags
-
submitted
25-11-2024 12:27
General
-
Target
929bcd212adb9ab6c1ebb24b1fdb4ec9c88c2ab5d2ea63fef506ad5ddcead574.apk
-
Size
9.1MB
-
MD5
8285d8fcf2271a11cae76cfbeb0c7a3d
-
SHA1
d3ad6999fdc8d4773740dd91b915294bb3ef1eaa
-
SHA256
929bcd212adb9ab6c1ebb24b1fdb4ec9c88c2ab5d2ea63fef506ad5ddcead574
-
SHA512
729cb3aa724196566eca56948d8c06cb122c9cce10f1185c1f692168ba0de46a23c5f938a6fc8fe8fa5fe28a81642d5a1350f117892f0b48b8d987ceda9da0a9
-
SSDEEP
98304:Vgq/PQncsZk1BUVKrFr1j7O5iSRGadvlcv9voRs4WKfp4iK:mcsZkIURpj7OrttcvoR17fpRK
Malware Config
Extracted
octo
https://5529a3274e6461f28361540314db703d.info
https://345a33e95eafc30d6183f0be8f4a61ce.biz
https://2a59fab237a1ef5f723ef61195d779c7.net
https://6c051e0670436d7ae157160e457dd683.xyz
Signatures
-
Octo
Octo is a banking malware with remote access capabilities first seen in April 2022.
-
Octo family
-
Octo payload 1 IoCs
-
Loads dropped Dex/Jar 1 TTPs 2 IoCs
Runs executable file dropped to the device during analysis.
-
Makes use of the framework's Accessibility service 4 TTPs 2 IoCs
Retrieves information displayed on the phone screen using AccessibilityService.
-
Obtains sensitive information copied to the device clipboard 2 TTPs 1 IoCs
Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.
-
Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
-
Queries the phone number (MSISDN for GSM devices) 1 TTPs
-
Acquires the wake lock 1 IoCs
-
Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs
Application may abuse the framework's foreground service to continue running in the foreground.
-
Queries the mobile country code (MCC) 1 TTPs 1 IoCs
-
Reads information about phone network operator. 1 TTPs
-
Requests disabling of battery optimizations (often used to enable hiding in the background). 1 TTPs 1 IoCs
-
Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs
-
Checks CPU information 2 TTPs 1 IoCs
-
Checks memory information 2 TTPs 1 IoCs
Processes
-
com.vxconnect74_wlantest1⤵
- Loads dropped Dex/Jar
- Makes use of the framework's Accessibility service
- Obtains sensitive information copied to the device clipboard
- Acquires the wake lock
- Makes use of the framework's foreground persistence service
- Queries the mobile country code (MCC)
- Requests disabling of battery optimizations (often used to enable hiding in the background).
- Uses Crypto APIs (Might try to encrypt user data)
- Checks CPU information
- Checks memory information
Network
MITRE ATT&CK Mobile v15
Defense Evasion
Download New Code at Runtime
1Foreground Persistence
1Hide Artifacts
1User Evasion
1Input Injection
1Virtualization/Sandbox Evasion
2System Checks
2Credential Access
Clipboard Data
1Input Capture
2GUI Input Capture
1Keylogging
1Discovery
Software Discovery
1Security Software Discovery
1System Information Discovery
2System Network Configuration Discovery
3Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
48B
MD5046a414913add6f5bb60072c7db819b6
SHA1451ee4f6809260aec622d772fd329c7d0297a842
SHA256b66c1320cb063a1d391c94273572ea6edae76c8c8b0a07f8d75c88686f0df72a
SHA5124e6355f3051ed5e811ab030abde1f5be7f5e1cf33be99cd08477e9b6c015deb1d8bd75a09fb9c7176b8511c5ad0a67abc0902a3531e97564ccb6afc57496a47c
-
Filesize
1021B
MD5a8cbc75affb3ab7f3b41c43fa382ff1f
SHA177fdde7eeacb460590e3add61cf20a53d6af0e01
SHA256b0ee96a1575de3075069d696388ac0a4f8ddee3850f6079a1193b44583c8ccff
SHA512229c7f325ffff0263ac009cb11d92c09455648ba0a473f4ee12c35cd44249abe98789daee60beb6bfe116654d04bd4f0894e2c46ab68b019755d401be0ede5d8
-
Filesize
1021B
MD51a024e30903ea8a3c33fd5adcd9515fc
SHA1965b9f7dc82a475c20f0a7a84d734592c31280a1
SHA256158a940a9cfbfc739a1b02108550cc5e9d1b01f75adb55e0377199a239301f98
SHA512f0d5f74a08e3d86ebed04a7bcffd62df3cae0a585afdbf36a99dabe9272f3c173a21c5cba190fb7478790ed600159409bb5fd7b7a3677507d13ad2cb4d60710d
-
Filesize
322KB
MD577dc50489b9323274732d27dc8a4e803
SHA10e02a3595b62489d0739d771881da8604d117c65
SHA256c5684e792d1ebefea6aac09fed45911703fd58c899f8a08133d49dd91429a820
SHA5120684a92f3e9c525384cfa53f531afba61e5930e1c27032a7e27e3315f72761b62e122dc34768d8162ba08f9bed53d148aa8dc034b46456bdd211f230637eba58
-
Filesize
13KB
MD52a06ddef56f966895d1f7470f65b0b42
SHA119340241e0adb6094aecb56c67b8fdc3069839d8
SHA2560a41475362402b9c7ef105a7daa95dd5f7e31f04df0316551d5d3816b07e3a70
SHA512122aa43297c3bff71edb5db9de20ae58fc043b173c06d91f3902da511cd8d25b98e9f77049b58bc8be998bae0652ce619d80fdb8fae0cb5438066e8ebbe78bc6
-
Filesize
526KB
MD5d1404307ec37de18dcfb8f1d19bb066a
SHA1a0dbc5883a885f97ec5bcd9824f031f1cec2dcb8
SHA256ce6b3dc8cdf0196c2ffe08f525d6572d3a609d3ab611e46ec54d2876410a1b67
SHA512e177b3e6245e3cb3cbb3bcbd9d6f2cbafb9df5db26ed07870ce109484996235ae4c953699f2c2f3d511274534b45aad6cd7841e10ac8bff9dbca5012f5a9d592
-
Filesize
1KB
MD52ee7ba8dd6935a09556a61d8312a5896
SHA152556e18dd12c79dc7a9c2f9a51ca267321685f7
SHA2568ce0d3035f9f5eb4585fae0472b623f1819ffb2f92e5882076d0486a227d0a3e
SHA512ec4b3f37f08d4363c1b7100320a276296da77ad7a14e23380f6601b8cb3ecd368cf5f30f669a9a9e815a51b753c7c6afb34eea7180840ce2473103a31586279d