Analysis
-
max time kernel
149s -
max time network
141s -
platform
android_x64 -
resource
android-x64-arm64-20240624-en -
resource tags
-
submitted
29-11-2024 22:13
General
-
Target
51f9972e563dad2e07b5119bf8c3a02a0f8e903f933c1a1403b66fff4346e39d.apk
-
Size
541KB
-
MD5
986469fcf203e0ffe2253d718854f24a
-
SHA1
9213bf0e4b68febc053c7dc9012ce13399ba8367
-
SHA256
51f9972e563dad2e07b5119bf8c3a02a0f8e903f933c1a1403b66fff4346e39d
-
SHA512
399d10c62cf82671c2a65a4ef42737a5a55fd83e0fa8ece26d5429a6cb7a279e28ec6d6364c824462752183f17af46c7d82727d5b1d41ac5de116e6774f5163a
-
SSDEEP
12288:hY/F190tXFuOt74VMPMOCmNW0Is3coM7VDn7j0nzi7SMQ:WLG1uOt74VeUdsMoMhn7on4u
Malware Config
Extracted
octo
https://2uxafnknc4.net/YzgwMjM0NDkzZTQ3/
https://6xd7twv543.org/YzgwMjM0NDkzZTQ3/
https://xblxyxn84y.pro/YzgwMjM0NDkzZTQ3/
https://gt2xhtlmxg.xyz/YzgwMjM0NDkzZTQ3/
https://uchgrh8nb5.com/YzgwMjM0NDkzZTQ3/
Extracted
octo
https://2uxafnknc4.net/YzgwMjM0NDkzZTQ3/
https://6xd7twv543.org/YzgwMjM0NDkzZTQ3/
https://xblxyxn84y.pro/YzgwMjM0NDkzZTQ3/
https://gt2xhtlmxg.xyz/YzgwMjM0NDkzZTQ3/
https://uchgrh8nb5.com/YzgwMjM0NDkzZTQ3/
Signatures
-
Octo
Octo is a banking malware with remote access capabilities first seen in April 2022.
-
Octo family
-
Octo payload 1 IoCs
-
Loads dropped Dex/Jar 1 TTPs 2 IoCs
Runs executable file dropped to the device during analysis.
-
Makes use of the framework's Accessibility service 4 TTPs 2 IoCs
Retrieves information displayed on the phone screen using AccessibilityService.
-
Obtains sensitive information copied to the device clipboard 2 TTPs 1 IoCs
Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.
-
Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
-
Queries the phone number (MSISDN for GSM devices) 1 TTPs
-
Acquires the wake lock 1 IoCs
-
Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs
Application may abuse the framework's foreground service to continue running in the foreground.
-
Performs UI accessibility actions on behalf of the user 1 TTPs 4 IoCs
Application may abuse the accessibility service to prevent their removal.
-
Queries the mobile country code (MCC) 1 TTPs 1 IoCs
-
Reads information about phone network operator. 1 TTPs
-
Requests accessing notifications (often used to intercept notifications before users become aware). 1 TTPs 1 IoCs
-
Requests disabling of battery optimizations (often used to enable hiding in the background). 1 TTPs 1 IoCs
-
Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs
-
Checks CPU information 2 TTPs 1 IoCs
-
Checks memory information 2 TTPs 1 IoCs
Processes
-
com.factsixdc1⤵
- Loads dropped Dex/Jar
- Makes use of the framework's Accessibility service
- Obtains sensitive information copied to the device clipboard
- Acquires the wake lock
- Makes use of the framework's foreground persistence service
- Performs UI accessibility actions on behalf of the user
- Queries the mobile country code (MCC)
- Requests accessing notifications (often used to intercept notifications before users become aware).
- Requests disabling of battery optimizations (often used to enable hiding in the background).
- Uses Crypto APIs (Might try to encrypt user data)
- Checks CPU information
- Checks memory information
Network
MITRE ATT&CK Mobile v15
Defense Evasion
Download New Code at Runtime
1Foreground Persistence
1Hide Artifacts
1User Evasion
1Impair Defenses
1Prevent Application Removal
1Input Injection
1Virtualization/Sandbox Evasion
2System Checks
2Credential Access
Access Notifications
1Clipboard Data
1Input Capture
2GUI Input Capture
1Keylogging
1Discovery
Software Discovery
1Security Software Discovery
1System Information Discovery
2System Network Configuration Discovery
3Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
449KB
MD510198d3c2db99fb4e00fc0514c80a99b
SHA16aabf131227c6600ff56f4a91988d68ac19b9f39
SHA2569051c10c2ab8171fc462544ed0ff2768a600383213ff61409383202abd39ebfa
SHA512984fb152247dcb2c347b7e83812da26fa64d362b2c3fc21a0e33575ccce8032495c702b866366615ef1c704400592f3da8ab03a5b3284b2ee5918de5acebb2f2
-
Filesize
335B
MD59a931f3f63498595dbd1ca516ed0320c
SHA1482d8e8d6f71700226514077b3d836c79af283de
SHA2563b1adcbd46747ded128ad3b152cd10d27cee2a6b08233d5a63a523ddafcda7a4
SHA5127955134bc33b34e1ea2fa87b41ea32ee21c32b81efe0b284b6d0dbd5451f7bd56d84ffd95419855a36dc345ea4b5dab7f9e78c46d7b6ec5c107dade002b60eeb
-
Filesize
28B
MD56311c3fd15588bb5c126e6c28ff5fffe
SHA1ce81d136fce31779f4dd62e20bdaf99c91e2fc57
SHA2568b82f6032e29a2b5c96031a3630fb6173d12ff0295bc20bb21b877d08f0812d8
SHA5122975fe2e94b6a8adc9cfc1a865ad113772b54572883a537b02a16dd2d029c0f7d9cca3b154fd849bdfe978e18b396bcf9fa6e67e7c61f92bdc089a29a9c355c6
-
Filesize
235B
MD5031928312f1c509b9d2bf27d79d1fcb6
SHA14f8c21188423a126fd0a6780837c687ce3e14708
SHA256333ce1b243c65832dd2b4c41fe95f144f803216015b0aaaf16920b0bdada0bd9
SHA512595402696184f5926ec96b2f865313e34182614459a6f607cd4c03596958a3c55512938dbb36be767c827ac3e0cfa76c87668c5112176741fa034b8d83f88eca
-
Filesize
45B
MD5c4f4c205e5385a940a8af8413284a43f
SHA11e6b6f773de25442b73cb7ebd0c285e83835e572
SHA256ec51cf8cd8e98e214466af977e0fd22d8ef486356945a0bcdb5aed1e35b4f05e
SHA512b8558c7cb762c9d4efeab27be5f5eb1ed7d1b89ae9562032113158fd753d7c2413a67f03bada08f8697c324d528bc806753555f618840ca08629c9bed96b6e54
-
Filesize
63B
MD5f595cedf4f2d1d9080f8d9bcc3bb8c7a
SHA128d2c0c3a7c69d78ab28ebfa30423e6c9aa7cbae
SHA2567d3aba9f38ebf49660e27faca0484e8a24bb9b32e198775eb6e368b58176eb25
SHA512ecf0c314a9db6b7484cb78aaf49849d887e85a9f07ef73c6ba618dedaf3c6dbbe92ba30667975bb39d09f8fd2f344551fbf8bc2853300510c68695b4b60ef077
-
Filesize
476B
MD529e8848f9e6a467b25b96fbf83bd6c5a
SHA142b36a4e84cdf3a58924bd5bbbe0d4f927af44c7
SHA2562ce9934ec54ba3e52e98cd45e15a2e5753334135e9505eb0708f4c13f8024840
SHA512a703b84806e3371580a0773018a240d5e1d383c7077d0351114024d1b89ee019d5ba6a6bfd5d00464773fbda02502b2301d2048cbf8e3b6ac367f4ecfbe0b06c