Overview

overview

10

Static

static

6

5610bfeab7...36.apk

android-9-x86

10

5610bfeab7...36.apk

android-13-x64

10

Analysis

  • max time kernel
    149s
  • max time network
    154s
  • platform
    android_x86
  • resource
    android-x86-arm-20240624-en
  • resource tags

    androidarch:armarch:x86image:android-x86-arm-20240624-enlocale:en-usos:android-9-x86system
  • submitted
    01-12-2024 19:28

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    5610bfeab76710ba02decfb28e7685fd7ab02b48b78ae63548c387f63288d036.apk

  • Size

    8.5MB

  • MD5

    368d70d254f488bafb87fa4293fc048a

  • SHA1

    4764d5e82a267047f11a1d1d8cdd8084546fc035

  • SHA256

    5610bfeab76710ba02decfb28e7685fd7ab02b48b78ae63548c387f63288d036

  • SHA512

    6b1b4123c6850690ba129c18192decd6e19879f29079390701a395cd78d25b051243fb1347da1c0150451214df8e0ca3c678c9094c77e9066ecdf51f41e5fd5b

  • SSDEEP

    98304:imISrQZbMhbULwKbTciYMoI57VKpN5iSRGLFEGfkk23y2j7uCY8XKP2R7oRsq+gy:hSiIxU3rBGfk1Lj7f4k7oRSv

Score
10/10
octobankercollectioncredential_accessdiscoveryevasionimpactinfostealerpersistencerattrojan

Malware Config

Extracted

Family

octo

C2

https://156350786312d7feba2b1c9b7577097b.com

AES_key
AES_key

Signatures

  • Octo

    Octo is a banking malware with remote access capabilities first seen in April 2022.

    bankertrojaninfostealerratocto
  • Octo family
    octo
  • Octo payload 1 IoCs
  • Loads dropped Dex/Jar 1 TTPs 3 IoCs

    Runs executable file dropped to the device during analysis.

    evasion
  • Makes use of the framework's Accessibility service 4 TTPs 2 IoCs

    Retrieves information displayed on the phone screen using AccessibilityService.

    collectionevasioncredential_access
  • Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
    bankerdiscovery
  • Queries the phone number (MSISDN for GSM devices) 1 TTPs
    discovery
  • Acquires the wake lock 1 IoCs
  • Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs

    Application may abuse the framework's foreground service to continue running in the foreground.

    evasionpersistence
  • Queries the mobile country code (MCC) 1 TTPs 1 IoCs
    discovery
  • Queries the unique device ID (IMEI, MEID, IMSI) 1 TTPs
    discovery
  • Reads information about phone network operator. 1 TTPs
    discovery
  • Requests disabling of battery optimizations (often used to enable hiding in the background). 1 TTPs 1 IoCs
    evasion
  • Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs
    persistence
  • Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs
    impact
  • Checks CPU information 2 TTPs 1 IoCs
  • Checks memory information 2 TTPs 1 IoCs

Processes

  • com.talkbackdevice_notoserif63
    1⤵
    • Loads dropped Dex/Jar
    • Makes use of the framework's Accessibility service
    • Acquires the wake lock
    • Makes use of the framework's foreground persistence service
    • Queries the mobile country code (MCC)
    • Requests disabling of battery optimizations (often used to enable hiding in the background).
    • Registers a broadcast receiver at runtime (usually for listening for system events)
    • Uses Crypto APIs (Might try to encrypt user data)
    • Checks CPU information
    • Checks memory information
    PID:4253
    • /system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.talkbackdevice_notoserif63/app_noodle/KHY.json --output-vdex-fd=41 --oat-fd=42 --oat-location=/data/user/0/com.talkbackdevice_notoserif63/app_noodle/oat/x86/KHY.odex --compiler-filter=quicken --class-loader-context=&
      2⤵
      • Loads dropped Dex/Jar
      PID:4277

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Event Triggered Execution

1
T1624

Broadcast Receivers

1
T1624.001

Foreground Persistence

1
T1541

Privilege Escalation

Defense Evasion

Download New Code at Runtime

1
T1407

Foreground Persistence

1
T1541

Hide Artifacts

1
T1628

User Evasion

1
T1628.002

Input Injection

1
T1516

Virtualization/Sandbox Evasion

2
T1633

System Checks

2
T1633.001

Credential Access

Input Capture

2
T1417

GUI Input Capture

1
T1417.002

Keylogging

1
T1417.001

Discovery

Software Discovery

1
T1418

Security Software Discovery

1
T1418.001

System Information Discovery

2
T1426

System Network Configuration Discovery

4
T1422

Lateral Movement

Collection

Input Capture

2
T1417

GUI Input Capture

1
T1417.002

Keylogging

1
T1417.001

Screen Capture

1
T1513

Command and Control

Exfiltration

Impact

Data Encrypted for Impact

1
T1471

Input Injection

1
T1516

Replay Monitor

Loading Replay Monitor...

Downloads

  • /data/data/com.talkbackdevice_notoserif63/.global.com.talkbackdevice_notoserif63
    Filesize

    48B

    MD5

    046a414913add6f5bb60072c7db819b6

    SHA1

    451ee4f6809260aec622d772fd329c7d0297a842

    SHA256

    b66c1320cb063a1d391c94273572ea6edae76c8c8b0a07f8d75c88686f0df72a

    SHA512

    4e6355f3051ed5e811ab030abde1f5be7f5e1cf33be99cd08477e9b6c015deb1d8bd75a09fb9c7176b8511c5ad0a67abc0902a3531e97564ccb6afc57496a47c

    Download Submit

  • /data/data/com.talkbackdevice_notoserif63/app_noodle/KHY.json
    Filesize

    1016B

    MD5

    cf6cd4baded500807f5a4bce850541f6

    SHA1

    db8cec882db42eb40f32c2216c2a402072e3a732

    SHA256

    abe152bda9a3af754d1ac8e8cfae039eaa570f2e1df3eb6111e1bbe3871db96f

    SHA512

    d571081b0da41feb11d7a67a12a70f66d834217ca724d79693282a4df8173cd1f41f713b1a9c2dfac5f9b095492475df09f1b4c845e91bf467a86871d40562c6

    Download Submit

  • /data/data/com.talkbackdevice_notoserif63/app_noodle/KHY.json
    Filesize

    1016B

    MD5

    cac895956d729fedb0a999b39a56a256

    SHA1

    5ffa9e242abb55d2bc10cfd6ee5acba53fd22349

    SHA256

    5a55166c945791ed9d91df100df006a2585af1e0a07ce4d036159d3e299ccd42

    SHA512

    9770c47221523866c935bec3dce85047ce7e1b71bae9eb44b26bd5285425ff1924881a5e22706f6e1df7211904b826747cb5a2b461b7b45b26ac8b2f95ec9802

    Download Submit

  • /data/data/com.talkbackdevice_notoserif63/files/.s
    Filesize

    307KB

    MD5

    4e73947cabb5db3f92ca85004981b754

    SHA1

    6d9667fdb0280ed2dcb782b4683e422a51bdc601

    SHA256

    6db94232e756b90ed437f1bc87dc38cf20fb2e7c7a19a5e40c6c17254b7e234c

    SHA512

    be8b500a7070af1dfb53b0cf1a7b327dadc4e163a6dad905496ac228c58cd1ed87b054533917924455d35e9b300683ae33e1bcdd91935a5dbae1d693c3e13d69

    Download Submit

  • /data/user/0/com.talkbackdevice_notoserif63/app_noodle/KHY.json
    Filesize

    1KB

    MD5

    02d55b56e6ab5f35cdc364a4f2f47016

    SHA1

    8a46f72c1451efed4aedb2220b677f44a9df94d6

    SHA256

    41aa68605baa22809481ca6636cac0a46e066c3862499826e94ce22a9e0e52ee

    SHA512

    910e41655c9680e9ee7b02ab9aef6d19adc1a0df1b8b3a0f324fa69c3f60991f1f3533c3105ed74bf1762bc06a5ae7352848aa4fcc1c2e77b57b231d904d651d

    Download Submit

  • /data/user/0/com.talkbackdevice_notoserif63/app_noodle/KHY.json
    Filesize

    1KB

    MD5

    32a44094c17929eca19ee695cc69cd39

    SHA1

    b184edaedb1f495e45ab71e5bb31e18210a25bfc

    SHA256

    5e8a62447c62ad5acc757e3a5850c6005b3ed59a384241d2052356c8721b20a7

    SHA512

    c425cbcdb52eb3ce8a33f78af14e59692e9f4f0e09f0f7359821c1470020eee8715477d68b6b307eda83c345df2cb5f4df77212ae06a458056c19077decae538

    Download Submit

  • Anonymous-DexFile@0xd270f000-0xd2792b38
    Filesize

    526KB

    MD5

    6d5cd37303f2c882308086e123a50d3e

    SHA1

    dd68843844ee0d4f8e36529fdb3b0d067855f35d

    SHA256

    ddd51bad8d4fb58fac172f65faefd66cb8689be7f1e089ed97dbbf6a34b61897

    SHA512

    85058b5d52f89ee428431937a1e3c6a7c29b08f913f7d8ec13f91ee4c836f65598489ce7b5c5b9ef96582728e0a45182df48f3a83ca14b68c379c56e244db5ff

    Download Submit