Analysis
-
max time kernel
149s -
max time network
157s -
platform
android-10_x64 -
resource
android-x64-20240910-en -
resource tags
-
submitted
05-12-2024 22:05
General
-
Target
8d47670f9ff63c59c9b419e3ee8b7aaa03acb8b78084bcce4d574deb9bdaa9e0.apk
-
Size
224KB
-
MD5
d5bfb98d212223d1a2a59441ccca542d
-
SHA1
afcb10b32e8c821b962af2ff225dcbd20f4fb34b
-
SHA256
8d47670f9ff63c59c9b419e3ee8b7aaa03acb8b78084bcce4d574deb9bdaa9e0
-
SHA512
52b0babe6549c728484fe41e470e9306ca633df3ea9ec3ad813e5dda04a8a1a8a72500ce40f9c0f4408f1c07ddf5aef215b57feef59e787fb201f1239ece0564
-
SSDEEP
3072:zNUZ0F0980sGvq9HW6lvgWDoW6kiMgDOFVcn/NBgfyaedZyll3cchpvpR:zU0F0FjOplvglf2V4/NiySl19lH
Malware Config
Extracted
octo
https://154.216.17.178:7117/gate/
Extracted
octo
https://154.216.17.178:7117/gate/
Signatures
-
Octo
Octo is a banking malware with remote access capabilities first seen in April 2022.
-
Octo family
-
Octo payload 1 IoCs
-
Loads dropped Dex/Jar 1 TTPs 2 IoCs
Runs executable file dropped to the device during analysis.
-
Makes use of the framework's Accessibility service 4 TTPs 2 IoCs
Retrieves information displayed on the phone screen using AccessibilityService.
-
Obtains sensitive information copied to the device clipboard 2 TTPs 1 IoCs
Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.
-
Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
-
Queries the phone number (MSISDN for GSM devices) 1 TTPs
-
Acquires the wake lock 1 IoCs
-
Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs
Application may abuse the framework's foreground service to continue running in the foreground.
-
Performs UI accessibility actions on behalf of the user 1 TTPs 2 IoCs
Application may abuse the accessibility service to prevent their removal.
-
Queries the mobile country code (MCC) 1 TTPs 1 IoCs
-
Reads information about phone network operator. 1 TTPs
-
Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs
-
Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs
-
Checks CPU information 2 TTPs 1 IoCs
-
Checks memory information 2 TTPs 1 IoCs
Processes
-
com.adaxffsfzfada.zbsvxgsvbxhdgs1⤵
- Loads dropped Dex/Jar
- Makes use of the framework's Accessibility service
- Obtains sensitive information copied to the device clipboard
- Acquires the wake lock
- Makes use of the framework's foreground persistence service
- Performs UI accessibility actions on behalf of the user
- Queries the mobile country code (MCC)
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Uses Crypto APIs (Might try to encrypt user data)
- Checks CPU information
- Checks memory information
Network
MITRE ATT&CK Mobile v15
Persistence
Event Triggered Execution
1Broadcast Receivers
1Foreground Persistence
1Defense Evasion
Download New Code at Runtime
1Foreground Persistence
1Impair Defenses
1Prevent Application Removal
1Input Injection
1Virtualization/Sandbox Evasion
2System Checks
2Credential Access
Clipboard Data
1Input Capture
2GUI Input Capture
1Keylogging
1Discovery
Software Discovery
1Security Software Discovery
1System Information Discovery
2System Network Configuration Discovery
3Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
451KB
MD5cb004b201c567db64910e65b984c9447
SHA1c64724627f791c91ef1fc11e0504106f843da186
SHA2568aba800e4caf3ea5442f0fee7a584361129518d04c465fc52b9e96954dd9c757
SHA512ab53cc64802d9dde3f3221621467d8f7200aea6e76a3e8fdbeac531c207dca1098bc5e47a1e7d8f02fd9e12a9f3252acbe6c6d253a337dfb365ff917b5425ffa
-
Filesize
28B
MD56311c3fd15588bb5c126e6c28ff5fffe
SHA1ce81d136fce31779f4dd62e20bdaf99c91e2fc57
SHA2568b82f6032e29a2b5c96031a3630fb6173d12ff0295bc20bb21b877d08f0812d8
SHA5122975fe2e94b6a8adc9cfc1a865ad113772b54572883a537b02a16dd2d029c0f7d9cca3b154fd849bdfe978e18b396bcf9fa6e67e7c61f92bdc089a29a9c355c6
-
Filesize
232B
MD5314f759e1db404d6d2d6b8bc34ed4c84
SHA11947d5460dc1b9772d3fad3318b723b789692f44
SHA2569e33a973ef139ab69eba0cfecb3c73a169e29e982fd76561964bedbaa91b6b43
SHA5125b437b62b1a894000d12e0c3fcec28f18117fe6b93e7b30ef6fbeff5556e9637eafa3c67a36722662ea0ed3572095693dbf9ef44729a11d501c910254eec8946
-
Filesize
63B
MD513f22ba85c3eee79d6bd338ef3399b5f
SHA1247b85c58ad30a7e6d504e110dd555740af60117
SHA256ef8851a4270183ca77634b8effc7f767896dd9dde72b6d6e7c1e9a3d65f40242
SHA512e632329376a8b7b4200ae9601bb9a3cf4ceff1b04324fc6dc4085845f65bfc2ea8ed9609c0fc001d3f6af4a94d6c4524bd626d9d299113440af2fe180d33de23
-
Filesize
45B
MD522e2ee880ef5d1067cf9501804873d74
SHA1fe9774bf58f179efbd9e33c06f0b0747240a5938
SHA2560d8ab2995e97e22d4f65cd686ea4714237f58dcfdee1a50dfb300f4440b4d4b1
SHA51285fe046a96671990df7512ce3247d483a1e6c008d2cf2060b1c75423e1db6016d40aad2843ec5d58c057154c649f138a2c1fe3699e0c437f3991cb13e4bc73e6
-
Filesize
427B
MD557e45b54d93d87c7f5c88a65a71618eb
SHA1267a8aa00bfcfc685a1e840a9ad525d5b3bee1e4
SHA256c030558a6459222efa5efb8127efc3fbacea339ec632dd020a3963c9a467018c
SHA5127777d125ad110bce89eafe55d7c0b8a7e1fc048c3e6f3bdcb11aeebd0ffb4a3b5101527f4994e5f3f756694411c1c7d2c95ffdd577935069bc2f5f3e0874353e