Analysis
-
max time kernel
149s -
max time network
152s -
platform
android-9_x86 -
resource
android-x86-arm-20240910-en -
resource tags
-
submitted
06-12-2024 22:06
General
-
Target
0f6ffbedf73d761785aa32a48a359b41236c6f64087f4b5adca0fd56d2807a04.apk
-
Size
509KB
-
MD5
8aef817dc478ca703b025ab57a3a366c
-
SHA1
40f801eb0e0ff0b3df031204a9e18adb0b82c673
-
SHA256
0f6ffbedf73d761785aa32a48a359b41236c6f64087f4b5adca0fd56d2807a04
-
SHA512
0d1edf7048ce902d570e97be788f0416bba9f217631985d6ed54baaa561c9c3d68f43eb9516e3b2e3c68f26687b5ad2ae1c65da7e98f10322c25cba5df89fefd
-
SSDEEP
12288:m7ZPXozZDK4RJjDGEdtKdgkD0tBYlv59NQs1zzBLdRCrg1n19:uyzxdYdgs0q/VLmmnP
Malware Config
Extracted
octo
https://mutocosturoyur.com/YmJhM2M5ZjYyODY5/
https://lolo2naberlo.com/YmJhM2M5ZjYyODY5/
https://havalarsicaktir.com/YmJhM2M5ZjYyODY5/
https://calısmıske34r.com/YmJhM2M5ZjYyODY5/
https://r4s5t2t2fa.com/YmJhM2M5ZjYyODY5/
https://gurcustill254.com/YmJhM2M5ZjYyODY5/
Extracted
octo
https://mutocosturoyur.com/YmJhM2M5ZjYyODY5/
https://lolo2naberlo.com/YmJhM2M5ZjYyODY5/
https://havalarsicaktir.com/YmJhM2M5ZjYyODY5/
https://calısmıske34r.com/YmJhM2M5ZjYyODY5/
https://r4s5t2t2fa.com/YmJhM2M5ZjYyODY5/
https://gurcustill254.com/YmJhM2M5ZjYyODY5/
Signatures
-
Octo
Octo is a banking malware with remote access capabilities first seen in April 2022.
-
Octo family
-
Octo payload 1 IoCs
-
Removes its main activity from the application launcher 1 TTPs 1 IoCs
-
Loads dropped Dex/Jar 1 TTPs 2 IoCs
Runs executable file dropped to the device during analysis.
-
Makes use of the framework's Accessibility service 4 TTPs 2 IoCs
Retrieves information displayed on the phone screen using AccessibilityService.
-
Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
-
Queries the phone number (MSISDN for GSM devices) 1 TTPs
-
Acquires the wake lock 1 IoCs
-
Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs
Application may abuse the framework's foreground service to continue running in the foreground.
-
Performs UI accessibility actions on behalf of the user 1 TTPs 4 IoCs
Application may abuse the accessibility service to prevent their removal.
-
Queries the mobile country code (MCC) 1 TTPs 1 IoCs
-
Queries the unique device ID (IMEI, MEID, IMSI) 1 TTPs
-
Reads information about phone network operator. 1 TTPs
-
Requests accessing notifications (often used to intercept notifications before users become aware). 1 TTPs 1 IoCs
-
Requests disabling of battery optimizations (often used to enable hiding in the background). 1 TTPs 1 IoCs
-
Requests modifying system settings. 1 IoCs
-
Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs
-
Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs
Processes
-
com.usehappen21⤵
- Removes its main activity from the application launcher
- Loads dropped Dex/Jar
- Makes use of the framework's Accessibility service
- Acquires the wake lock
- Makes use of the framework's foreground persistence service
- Performs UI accessibility actions on behalf of the user
- Queries the mobile country code (MCC)
- Requests accessing notifications (often used to intercept notifications before users become aware).
- Requests disabling of battery optimizations (often used to enable hiding in the background).
- Requests modifying system settings.
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Uses Crypto APIs (Might try to encrypt user data)
Network
MITRE ATT&CK Mobile v15
Persistence
Event Triggered Execution
1Broadcast Receivers
1Foreground Persistence
1Defense Evasion
Download New Code at Runtime
1Foreground Persistence
1Hide Artifacts
2Suppress Application Icon
1User Evasion
1Impair Defenses
1Prevent Application Removal
1Input Injection
1Credential Access
Access Notifications
1Input Capture
2GUI Input Capture
1Keylogging
1Discovery
Software Discovery
1Security Software Discovery
1System Network Configuration Discovery
4Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
458B
MD5dafae40fe2ade475efdfd10a8d35b069
SHA1f05548cfc6c1eb609f2144fc043906a179305140
SHA256a96e7c52443e0317a831c534467f8e5b8345a23d1d91459cc9d81fcff36073ff
SHA5126bda5b4931eb160172e6752158b23bc9013d639236dba83d86a4b31f218e123acdc81ba8d3d8df13ebd15050bcc4a8e0df1d53a5070236c834c00ff758355499
-
Filesize
448KB
MD58107dc77429deb1749ffbde72448737c
SHA1a79a50a9938ffe90ff01539dfd894a612c708fc7
SHA256fcc625dc927e5961537fa36285cdc91001beaa188e16c10822ef5c23e1b24a5f
SHA5125d6b7c40a822cd5690e7a25c3cb69a9e00f0d961219cbfb2f7bb03234681a5ed1474870a1df3951bc663220ac28bd9f0af33a7e5db8e36a4f111c4e6fe655dfb