Analysis
-
max time kernel
29s -
max time network
31s -
platform
android_x86 -
resource
android-x86-arm-20240624-en -
resource tags
-
submitted
25-11-2024 15:24
General
-
Target
b020cedfec9f721dddfcdeededfc4d7f18f495c7862a84151df4b5eab01eb1b7.apk
-
Size
539KB
-
MD5
f3aba8ea01df3ec443dbcbcc6e2944d0
-
SHA1
4c9fff9967553a92a60e8455563a92dd59229551
-
SHA256
b020cedfec9f721dddfcdeededfc4d7f18f495c7862a84151df4b5eab01eb1b7
-
SHA512
6b6c466d95e7afd77509bc72f3feb58cc33befe109b5fddd61454c60e6c8ccf16288ef74355527745ca66f266fc5dc3b63b264df486b83977ac24ebfdcb62540
-
SSDEEP
12288:gd7xj+S2GgSWh2JxHjyToWGPUila0WKi+dg46RlHDia:+1Dgvh2JUTIPUilaVKigg7Wa
Malware Config
Extracted
octo
https://mine-495834.com/NmE4NzY2MmIzMTM2/
https://mine-495834.net/NmE4NzY2MmIzMTM2/
https://mine-495834.info/NmE4NzY2MmIzMTM2/
https://mine-495834.org/NmE4NzY2MmIzMTM2/
https://mine-495834.xyz/NmE4NzY2MmIzMTM2/
Extracted
octo
https://mine-495834.com/NmE4NzY2MmIzMTM2/
https://mine-495834.net/NmE4NzY2MmIzMTM2/
https://mine-495834.info/NmE4NzY2MmIzMTM2/
https://mine-495834.org/NmE4NzY2MmIzMTM2/
https://mine-495834.xyz/NmE4NzY2MmIzMTM2/
Signatures
-
Octo
Octo is a banking malware with remote access capabilities first seen in April 2022.
-
Octo family
-
Octo payload 1 IoCs
-
Removes its main activity from the application launcher 1 TTPs 1 IoCs
-
Loads dropped Dex/Jar 1 TTPs 2 IoCs
Runs executable file dropped to the device during analysis.
-
Makes use of the framework's Accessibility service 4 TTPs 2 IoCs
Retrieves information displayed on the phone screen using AccessibilityService.
-
Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
-
Queries the phone number (MSISDN for GSM devices) 1 TTPs
-
Acquires the wake lock 1 IoCs
-
Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs
Application may abuse the framework's foreground service to continue running in the foreground.
-
Performs UI accessibility actions on behalf of the user 1 TTPs 3 IoCs
Application may abuse the accessibility service to prevent their removal.
-
Queries the mobile country code (MCC) 1 TTPs 1 IoCs
-
Queries the unique device ID (IMEI, MEID, IMSI) 1 TTPs
-
Requests accessing notifications (often used to intercept notifications before users become aware). 1 TTPs 1 IoCs
-
Requests disabling of battery optimizations (often used to enable hiding in the background). 1 TTPs 1 IoCs
-
Requests modifying system settings. 1 IoCs
-
Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs
-
Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs
-
Checks CPU information 2 TTPs 1 IoCs
-
Checks memory information 2 TTPs 1 IoCs
Processes
-
com.mountainperhaps41⤵
- Removes its main activity from the application launcher
- Loads dropped Dex/Jar
- Makes use of the framework's Accessibility service
- Acquires the wake lock
- Makes use of the framework's foreground persistence service
- Performs UI accessibility actions on behalf of the user
- Queries the mobile country code (MCC)
- Requests accessing notifications (often used to intercept notifications before users become aware).
- Requests disabling of battery optimizations (often used to enable hiding in the background).
- Requests modifying system settings.
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Uses Crypto APIs (Might try to encrypt user data)
- Checks CPU information
- Checks memory information
Network
MITRE ATT&CK Mobile v15
Persistence
Event Triggered Execution
1Broadcast Receivers
1Foreground Persistence
1Defense Evasion
Download New Code at Runtime
1Foreground Persistence
1Hide Artifacts
2Suppress Application Icon
1User Evasion
1Impair Defenses
1Prevent Application Removal
1Input Injection
1Virtualization/Sandbox Evasion
2System Checks
2Credential Access
Access Notifications
1Input Capture
2GUI Input Capture
1Keylogging
1Discovery
Software Discovery
1Security Software Discovery
1System Information Discovery
2System Network Configuration Discovery
3Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
448KB
MD5e642dec39002bfe3da103141818d6f03
SHA190dd375490092ee7f1b51c8b18ee42321ac9bdae
SHA256a46c8e5157275971938cfe52caa62ead06d819dbae42f4bc2d49045baa8aac4c
SHA512dfc570cfe19503b96ea95a901ade6a5b33d10ec2f921456c11d1e5a7716197d999122ec250eaacfa1977e949fcc58d98a2ecac7930c33c7a392610c238d1c881
-
Filesize
28B
MD56311c3fd15588bb5c126e6c28ff5fffe
SHA1ce81d136fce31779f4dd62e20bdaf99c91e2fc57
SHA2568b82f6032e29a2b5c96031a3630fb6173d12ff0295bc20bb21b877d08f0812d8
SHA5122975fe2e94b6a8adc9cfc1a865ad113772b54572883a537b02a16dd2d029c0f7d9cca3b154fd849bdfe978e18b396bcf9fa6e67e7c61f92bdc089a29a9c355c6
-
Filesize
240B
MD5a2bf0f0c971ff99add465060865a69f3
SHA1d08a2ec488e7b04b3662a18b14e9e5747d666e19
SHA256a8998b768500ad36e5fb94e99ffe1ca3fdd222ae8e2bd7fb2da2b4130369698e
SHA512f3a5def539ccef6de391ba4f067895548f7689b6c3a45a74e69dc73af47b5fe2359181fb08f8dc901428b092825702325ddfa2472fb2ba59294aa5c167ae703a
-
Filesize
63B
MD5dcca20be91f34a6516a8d0599461d75c
SHA16082587ce125504c9b9c914597001cc876a687f9
SHA2560aa2417ca272b9a342273f3e1b57d83913ab711bf19bc65012368713f168658b
SHA512a83843ea293bd085beff817a0a514d409bba63e64eff352d3b479142e39b801ae8f0a0b493404c6b1131f638ba7d8747fb0ea70ee5974b0efa5836e45eb155cc
-
Filesize
54B
MD58a2855e84499204a208dc671e57eebae
SHA1d54aec76e3325a529bde4425631361f29254a3df
SHA256e1a5d11a41395bb934e403ba273fb7227b704dae9431e2fbe71a6e68c026ef0e
SHA5123d988ebbc93b3a9263d3e4d88fc8595a399130421ead187cb3372fdab9bf870248afc13aeb525403e4add17979bd78f5d2f561136fe18debb9b486177d031251
-
Filesize
443B
MD5d3568634d362723b0296e6149ee90cc2
SHA1b79ec0f2929e7929873503351f29bd0b2b5e6f41
SHA25611a0559067a9c69d92a4531b938bf13d72251852ba2c954981fb2b955a9c7183
SHA512d2777de450f8c84824475f8d02cff2f2350ca581292b103fe5125a8fe13263d28f3dc9bea6aefb78760595f15e6003bcff10b15d5d876a457ab3a3c4ea234e7b