Analysis
-
max time kernel
149s -
max time network
131s -
platform
android-10_x64 -
resource
android-x64-20240910-en -
resource tags
-
submitted
29-11-2024 22:18
General
-
Target
478c43aa96a43cf26548384d171898aac7d07f2810b3b5e5fc5957a3cec27bde.apk
-
Size
2.6MB
-
MD5
bbcb3edd3b5102029ca963cf0023cc89
-
SHA1
efd6608a2da1874e3b4a17768727fed71c3b665e
-
SHA256
478c43aa96a43cf26548384d171898aac7d07f2810b3b5e5fc5957a3cec27bde
-
SHA512
079ef87a9b57691b9ed120cfc6b81b06ef3bad931ab657479a40b2eb90a8e0837f2f94dfea0a6c03907fe770d31442200996015f578f4502b952713bdfa45337
-
SSDEEP
49152:jQY3tFeBhovmr5+WW9NR/7yF/wL0Ra7eEr3Seo3BysEIcv62cEWvMjCyYnZRmXZW:zjeBhoOsp9Of7Rd3BANcByYn+JfZSQ/S
Malware Config
Extracted
octo
https://asdhaskhjdksjahdkasjdhaksj.hk/MTBiYTAyMTk0NzJj/
https://shdiuvhisudvhuishvdiud.hk/MTBiYTAyMTk0NzJj/
https://asdasjhdgasjhdgas.hk/MTBiYTAyMTk0NzJj/
https://qssxsqxaqxqazxaq.hk/MTBiYTAyMTk0NzJj/
Extracted
octo
https://asdhaskhjdksjahdkasjdhaksj.hk/MTBiYTAyMTk0NzJj/
https://shdiuvhisudvhuishvdiud.hk/MTBiYTAyMTk0NzJj/
https://asdasjhdgasjhdgas.hk/MTBiYTAyMTk0NzJj/
https://qssxsqxaqxqazxaq.hk/MTBiYTAyMTk0NzJj/
Signatures
-
Octo
Octo is a banking malware with remote access capabilities first seen in April 2022.
-
Octo family
-
Octo payload 1 IoCs
-
Loads dropped Dex/Jar 1 TTPs 3 IoCs
Runs executable file dropped to the device during analysis.
-
Makes use of the framework's Accessibility service 4 TTPs 2 IoCs
Retrieves information displayed on the phone screen using AccessibilityService.
-
Obtains sensitive information copied to the device clipboard 2 TTPs 1 IoCs
Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.
-
Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
-
Queries the phone number (MSISDN for GSM devices) 1 TTPs
-
Acquires the wake lock 1 IoCs
-
Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs
Application may abuse the framework's foreground service to continue running in the foreground.
-
Performs UI accessibility actions on behalf of the user 1 TTPs 2 IoCs
Application may abuse the accessibility service to prevent their removal.
-
Queries the mobile country code (MCC) 1 TTPs 1 IoCs
-
Reads information about phone network operator. 1 TTPs
-
Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs
-
Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs
-
Checks CPU information 2 TTPs 1 IoCs
-
Checks memory information 2 TTPs 1 IoCs
Processes
-
com.maincertainubl1⤵
- Loads dropped Dex/Jar
- Makes use of the framework's Accessibility service
- Obtains sensitive information copied to the device clipboard
- Acquires the wake lock
- Makes use of the framework's foreground persistence service
- Performs UI accessibility actions on behalf of the user
- Queries the mobile country code (MCC)
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Uses Crypto APIs (Might try to encrypt user data)
- Checks CPU information
- Checks memory information
Network
MITRE ATT&CK Mobile v15
Persistence
Event Triggered Execution
1Broadcast Receivers
1Foreground Persistence
1Defense Evasion
Download New Code at Runtime
1Foreground Persistence
1Impair Defenses
1Prevent Application Removal
1Input Injection
1Virtualization/Sandbox Evasion
2System Checks
2Credential Access
Clipboard Data
1Input Capture
2GUI Input Capture
1Keylogging
1Discovery
Software Discovery
1Security Software Discovery
1System Information Discovery
2System Network Configuration Discovery
3Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
3KB
MD5ecd45c664f6dfb240195ba6b0abbda98
SHA1301a3213b24051a82b328496126b10289c51dafc
SHA2567aa878297f91d13158dfebe6f8bb1fd79485ea1876b49b490c28fb47f526ec34
SHA512bcd12eb54fa185135af63ef050e31db97bcb402aae01aa7bc88c187e965e0353786add1ea858d2262418350fd9389c53f4519c5de6f577fd51d8604583623ed5
-
Filesize
3KB
MD548a0fe11acd52a2f97ffb7ba4c70cf14
SHA1c360d9a5d7d4d4c9200e2b1d0b72f1a9239a8394
SHA2562712ee19b39713f5cef2ea62c3ea2e2d06081e83d841ba64e06fc84f3df1f972
SHA51242a93b91f531133db0a0c42781e2681b60994e61e02493a8bc2bb11229754eeedff7a4dbecac047a4e4f8cd7168e9ef9e7a55c5b322b2e1dea7b94c6718aa34e
-
Filesize
450KB
MD501b512a325d71763c80f88afa1462418
SHA198e4c4743bedbaca5371c0cc15838e05141e48f2
SHA2568028d8ad7d66be1ac427c82a276b16c784d83e4c6db67589af88e33d22f6f228
SHA512e92d62affbe45086bdc05bd6ad424622a90ba9a71c6f65fede83634410e3644a75ffe080a747426d8ee4fb16fd0309c1cbd1d8755379f2d8e82c76ca1296bc11
-
Filesize
463B
MD54f7dccbba3d3697fd4fe21902f460781
SHA11f80752ad50f4775349b994560f1c2855a5c9f97
SHA25622a110d15ea8b1952e9db9e9a0f71f38c921d50bb22a967d90c311e76ee962be
SHA512e29d83335a0f4ab4b69145e9d26a2612f885336560ebeeb5f782e645aaba36d16b00d5de4ed5dfb3adac0519710d24a00bbd07a9dcd257307bfbb7a380ef0f11
-
Filesize
437B
MD56941cfcaa64b7e8788769653539d6066
SHA1f3ff151a5e47675da78405f2a178d09fc5b79c6c
SHA2565586ae1fb2aef929207e772e2ced7e6a7a7f409514fbd082ed1eb713e045764b
SHA51289c2785c44c463551ae2179bc0ed18096481841e2f192e18c8884618ac9e85971eb1f77cd2d587dcc5dffb4f86ce88a1cf7329094afaa35b09ea0ca9598e23dc
-
Filesize
28B
MD56311c3fd15588bb5c126e6c28ff5fffe
SHA1ce81d136fce31779f4dd62e20bdaf99c91e2fc57
SHA2568b82f6032e29a2b5c96031a3630fb6173d12ff0295bc20bb21b877d08f0812d8
SHA5122975fe2e94b6a8adc9cfc1a865ad113772b54572883a537b02a16dd2d029c0f7d9cca3b154fd849bdfe978e18b396bcf9fa6e67e7c61f92bdc089a29a9c355c6
-
Filesize
63B
MD5778a301fb55c9434d3ec93828f8ac7ce
SHA17f874fcea1516c1b2877cfb441e2aa7934021ad9
SHA256548569f6e07fb19f872834f2b43b67fea5c56dd7845f27ec8019e14f736b3e23
SHA5121c72e06add701cfa354e8adab1b1b093082cfeab39122b1e1b798e7715917f694c80ebd9338a5e2216815ec8c67546b8fcf22dc3a1e73be282392a71889e7b55
-
Filesize
45B
MD5fd83e07f855ba8f1f7413bc5e0c2f38e
SHA15637514c3fec9647e49e0abed556f6e706edb1b5
SHA256c189f1de47956ab96f1538c89822a29bbc1a035833809a558e5d15ec246d2240
SHA5124166c7f104487c3df208a024bf9ffaaaf0f4a402aaacdd81ba5ea56ad6fb203a6c263352ab8c752591ce5bef67f033b28458fbae295fdddbcce7b9fa18fc0018
-
Filesize
67B
MD5d9ce4f642e7356dae0aa584bf4bb4435
SHA1ea1c7861e02a0313c35e0cb161aebad69638002a
SHA25631b23749abe95830447d3e15263b548b16d10905e47f0a68607d01e5a293d589
SHA512d86500c1d1d8dac920a54ad9badbc18dda72c14f8129dda00521e31529e78e2ca4053d3bb9240431b78f18c72ebd862f2e80f9a2992a1610a2c199112f8d56db
-
Filesize
7KB
MD51a7dc908f57f23353712a5e9a6313027
SHA1b0d687e2d350c32b45002247274e37ca5b0925a1
SHA256fae3e9547001b38a03dd4bf0a32d3c45456b72634db314de4ef4a7191041edd4
SHA512c5ddc90f855fcf65890f9c98aedf9c3310f998abd8d3aaa3a4d519096de7028516e80f18cc09810dda9cc85fecb297144edbde559821e8626bbe6dbfec15b451