Analysis
-
max time kernel
298s -
max time network
304s -
platform
android_x64 -
resource
android-x64-20240624-en -
resource tags
-
submitted
17-12-2024 07:46
General
-
Target
e-Devlet.apk
-
Size
650KB
-
MD5
17d8046f293f1829e81fb2a078bbc5c7
-
SHA1
63bb752bdcaea6c5af9b45bd30a1bfccb84b1627
-
SHA256
5c4846324a80e389e88d56a9a2af76a940be68a9af6a6ebf7991fa151ee57e1a
-
SHA512
a59e2c6eb318e06d6c4cd8f210392a6eaad1e8f3efd42b3a9ec6b7794e1108abf6fb0855411bb7e6dafeed47306e1247264ae6bb340ec74a3e5f0cc093bef89c
-
SSDEEP
12288:JvsC+yHIb+P247egtghfFnteJYAPCMPJJVdywLK/dQLNmQ1Y9wkKSbEYXfQce:JkCFH1VEfFte/1pkh/d6KwobEg4H
Malware Config
Extracted
octo
https://85.209.176.160/sbffpth/
https://85.209.176.190/sbffpth/
https://alinmamisd0main1.net/sbffpth/
https://alinmamisd0main2.net/sbffpth/
Extracted
octo
https://85.209.176.160/sbffpth/
https://85.209.176.190/sbffpth/
https://alinmamisd0main1.net/sbffpth/
https://alinmamisd0main2.net/sbffpth/
Signatures
-
Octo
Octo is a banking malware with remote access capabilities first seen in April 2022.
-
Octo family
-
Octo payload 1 IoCs
-
Loads dropped Dex/Jar 1 TTPs 2 IoCs
Runs executable file dropped to the device during analysis.
-
Makes use of the framework's Accessibility service 4 TTPs 2 IoCs
Retrieves information displayed on the phone screen using AccessibilityService.
-
Obtains sensitive information copied to the device clipboard 2 TTPs 1 IoCs
Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.
-
Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
-
Queries the phone number (MSISDN for GSM devices) 1 TTPs
-
Acquires the wake lock 1 IoCs
-
Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs
Application may abuse the framework's foreground service to continue running in the foreground.
-
Performs UI accessibility actions on behalf of the user 1 TTPs 3 IoCs
Application may abuse the accessibility service to prevent their removal.
-
Queries the mobile country code (MCC) 1 TTPs 1 IoCs
-
Reads information about phone network operator. 1 TTPs
-
Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs
-
Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs
-
Checks CPU information 2 TTPs 1 IoCs
-
Checks memory information 2 TTPs 1 IoCs
Processes
-
com.cs16jailbreak1⤵
- Loads dropped Dex/Jar
- Makes use of the framework's Accessibility service
- Obtains sensitive information copied to the device clipboard
- Acquires the wake lock
- Makes use of the framework's foreground persistence service
- Performs UI accessibility actions on behalf of the user
- Queries the mobile country code (MCC)
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Uses Crypto APIs (Might try to encrypt user data)
- Checks CPU information
- Checks memory information
Network
MITRE ATT&CK Mobile v15
Persistence
Event Triggered Execution
1Broadcast Receivers
1Foreground Persistence
1Defense Evasion
Download New Code at Runtime
1Foreground Persistence
1Impair Defenses
1Prevent Application Removal
1Input Injection
1Virtualization/Sandbox Evasion
2System Checks
2Credential Access
Clipboard Data
1Input Capture
2GUI Input Capture
1Keylogging
1Discovery
Software Discovery
1Security Software Discovery
1System Information Discovery
2System Network Configuration Discovery
3Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
449KB
MD5c51a3de27e1dccd5977d0bc025d56370
SHA102132d9e876316634fad262473f531d8d7507c19
SHA2562afa5e915b8dc0b0c9f397ef655ca5a59b90ea31bbf19954d01c36ec9a6e7823
SHA51212806a63f0c437bfef78a5c01e6a196b4ba42024b1f941c4a19caddbea7524ece58233cab8ffef2be5656d7deb89af5537e661008a17874992b55c647b80c9b4
-
Filesize
458B
MD5a8223694041c79f6d17958ed910e1e06
SHA1ae38ae3917a41895e08c7d8e39b5f04d77ff734e
SHA25605b4e2c824e1ffabf6cec68f67d50047b0044c7cb15dfcf38ba9430b8a5c0e1f
SHA512367f199c7f82e0bc6c728f17d5e8903818a78119cd405da6ee7fc70bdc26defdd3a4be02183728e484bc66726fc52866245b10347ab02a08c401eb9ee69950b9
-
Filesize
28B
MD56311c3fd15588bb5c126e6c28ff5fffe
SHA1ce81d136fce31779f4dd62e20bdaf99c91e2fc57
SHA2568b82f6032e29a2b5c96031a3630fb6173d12ff0295bc20bb21b877d08f0812d8
SHA5122975fe2e94b6a8adc9cfc1a865ad113772b54572883a537b02a16dd2d029c0f7d9cca3b154fd849bdfe978e18b396bcf9fa6e67e7c61f92bdc089a29a9c355c6
-
Filesize
63B
MD52bb5bc912dd59db1a12dab67816f1aa7
SHA1f4bcff3ce0d1ea5f67077522c749e43406c989cd
SHA25629747e236a3ba9b39195284df8222ae7bac2ad47ac80e3cb50944a617a689ee1
SHA51296378ee1a402d864e351282f957e670f0ff8731137a6bfa45d85ae9e73bc125b5cecbe9fd09fceec5b3edbbb64c5d48aea20378c03a29a37d4522f488f635ade
-
Filesize
58B
MD5a4089bb8a8152bef90ed3a177ad0df3c
SHA1567db0320c8e1614b9b358fdbd2059e6ec59df6c
SHA256298329506b902c47eee5a78636ee96b8892c5bc7b63c2fbcab7d48124c9bba0f
SHA512c51202356051a581fd6261dc44ef308d7a7df2abb655df0ee4c1a0adfea5d340eb30486d4b3b418073ac9f313bbe5a7c7d556a4e03da9e1593bece46a786911b
-
Filesize
62B
MD59cc060544dbca64761f8bd009ff50c5c
SHA1091634d853018042ac4ab74f8df2e6361ad271c8
SHA2565e1a8715562d828bf7741369293ebc191c7507315764ca8e97f7dc8bc12b3bce
SHA512f3b059bc9b9fcb9689008f07ef6fedecab6dbb14574081903d274d76e7327fc572bd58d9a57df194374adffc6152ac26a3394484858a582fd9c200670b660b53
-
Filesize
427B
MD55fa2c9ee432c15a3d74a3ab56354be83
SHA1a4b86644694fb737c4347ce69e2a2b90b6525d19
SHA2561380fe9841c6704678c11664fd3402594337d0abdf9eddfce5db8a2db0c2b97a
SHA51247ec681a897d2ba53ed0b2e0d391e1116d6e99540b0db07fe066231ff3d5c6d32e5a9a2d6f1922695a72beba045aae7af391589dbbacf74611193d8c01a8f562