Analysis
-
max time kernel
149s -
max time network
149s -
platform
android-10_x64 -
resource
android-x64-20240910-en -
resource tags
-
submitted
30-11-2024 22:08
General
-
Target
bae8e8547bd334de011f07c338aaed16d134f7e9f70f4cfd562bfc62a944e5bf.apk
-
Size
256KB
-
MD5
4ee277a510ecd1635eb5a08551f29951
-
SHA1
36a2d622862f5794904cafb16b17051966241a24
-
SHA256
bae8e8547bd334de011f07c338aaed16d134f7e9f70f4cfd562bfc62a944e5bf
-
SHA512
e536f17849498be13869367642e0674079f4ab4dbf321577fed6bc5b2a68bb807973b220079b4d219404f31bfaf3f2718804feb97428cc76685727b9aeabcccf
-
SSDEEP
6144:st0A4g8fsuojKDVoJfEPY10ShOEJrWSw85eWBc1l1zg8:ng6EyV6MP9e1Z58l1zg8
Malware Config
Extracted
octo
https://154.216.16.134:7117/gate/
Extracted
octo
https://154.216.16.134:7117/gate/
Signatures
-
Octo
Octo is a banking malware with remote access capabilities first seen in April 2022.
-
Octo family
-
Octo payload 1 IoCs
-
Loads dropped Dex/Jar 1 TTPs 2 IoCs
Runs executable file dropped to the device during analysis.
-
Makes use of the framework's Accessibility service 4 TTPs 2 IoCs
Retrieves information displayed on the phone screen using AccessibilityService.
-
Obtains sensitive information copied to the device clipboard 2 TTPs 1 IoCs
Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.
-
Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
-
Queries the phone number (MSISDN for GSM devices) 1 TTPs
-
Acquires the wake lock 1 IoCs
-
Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs
Application may abuse the framework's foreground service to continue running in the foreground.
-
Performs UI accessibility actions on behalf of the user 1 TTPs 2 IoCs
Application may abuse the accessibility service to prevent their removal.
-
Queries the mobile country code (MCC) 1 TTPs 1 IoCs
-
Reads information about phone network operator. 1 TTPs
-
Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs
-
Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs
-
Checks CPU information 2 TTPs 1 IoCs
-
Checks memory information 2 TTPs 1 IoCs
Processes
-
com.adaxffsfzfada.zbsvxgsvbxhdgs1⤵
- Loads dropped Dex/Jar
- Makes use of the framework's Accessibility service
- Obtains sensitive information copied to the device clipboard
- Acquires the wake lock
- Makes use of the framework's foreground persistence service
- Performs UI accessibility actions on behalf of the user
- Queries the mobile country code (MCC)
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Uses Crypto APIs (Might try to encrypt user data)
- Checks CPU information
- Checks memory information
Network
MITRE ATT&CK Mobile v15
Persistence
Event Triggered Execution
1Broadcast Receivers
1Foreground Persistence
1Defense Evasion
Download New Code at Runtime
1Foreground Persistence
1Impair Defenses
1Prevent Application Removal
1Input Injection
1Virtualization/Sandbox Evasion
2System Checks
2Credential Access
Clipboard Data
1Input Capture
2GUI Input Capture
1Keylogging
1Discovery
Software Discovery
1Security Software Discovery
1System Information Discovery
2System Network Configuration Discovery
3Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
451KB
MD59cc81089c0e3f7b73bed57a85c6889a6
SHA103c90f987b3bb7627ec2340e772e6935a8ac931a
SHA2566d0a63cfc0ca9e1925a32d8e063b580dda15455a2388e7f7f08288b1d1336129
SHA512fe6231debb93982060a594567ae175cf72ccaec512f0a6c965d1cbd40db7edbf31fd90cb353a33369762bd2ab8ec8f22372551a256a56916f0bc4bc6d92392c7
-
Filesize
28B
MD56311c3fd15588bb5c126e6c28ff5fffe
SHA1ce81d136fce31779f4dd62e20bdaf99c91e2fc57
SHA2568b82f6032e29a2b5c96031a3630fb6173d12ff0295bc20bb21b877d08f0812d8
SHA5122975fe2e94b6a8adc9cfc1a865ad113772b54572883a537b02a16dd2d029c0f7d9cca3b154fd849bdfe978e18b396bcf9fa6e67e7c61f92bdc089a29a9c355c6
-
Filesize
230B
MD5d6c2213e43d3e1d36c0651921b6f1adf
SHA1830adf0197c4fdc3b220cc3f354e0d5cd8e946a6
SHA256c2c8ce7317574621eb84f593da11d777f0069bbf25f4fe407616d3754ae901d6
SHA51235e4a36acf5b6fec9ecd2071192bea7d0774bddf5a6ecec349164a9d9c888d1b3ea4b5eb9047e54c0374d1c1e0eeb9262d6dafd492c41fd6505afe6b42064bb5
-
Filesize
63B
MD5884cd72d1577418a9c8b6b2db3025a34
SHA1e502e4f3f20aac7d895fd400700e5c25beb38bad
SHA256724de6f56c44f8a186ba156d3dbf24e926e3d125d8d45ab67dbf847e006456e0
SHA5126d86ddf56881c7e57f4fa1ecef7087b9ae225a0c1519c89301b42e9df9031586115cd750321dc35fe3f7ebbb7224101f8220c63474c0a21a36af0b6c90b4f129
-
Filesize
45B
MD5383d71501476773fccada39f4ebb27e4
SHA1bb676f1592631b8d3b478fd216158d1222712282
SHA256a5dc3392ca0f5d373ab43be7baae793ff21a4d012a891a0ae8aa4d1bfd0d7e83
SHA5129a694b2a05b10e215fedb513b489d7a50bc2875eb0ecec88c504e630416091d1b747e56eba4a3f10a4a5269d9b1d3d1df48042021b0664cbf015088e004ec861
-
Filesize
423B
MD55dc72b6c3e0ea6d131111f27fb1d8c67
SHA1bd564dc565b8187238f62f2e5846ab8cf54029db
SHA25685786f06ee448d08b779fd411d59a147ca0f34f05a96a5acd9d00a9698311c80
SHA5125b6d3b0e4d58f34915cfc173fa65c4ba1bb7c5e47cf981dbefed9acbd51c8e5abd267780d999ccda3b2485fb51b3a78c05fb9c46a39be5d5705770e4b5853411