Analysis
-
max time kernel
149s -
max time network
152s -
platform
android-9_x86 -
resource
android-x86-arm-20240910-en -
resource tags
-
submitted
18-12-2024 22:09
General
-
Target
20f7f3802a6d2d2ad98fc7acf6d468413e9ec7d6849ccae41b8d0a793fbc7e86.apk
-
Size
1.4MB
-
MD5
3f6421621f70010dd0da8f66ae82cc8c
-
SHA1
397cc283467d8bc849318723f68be9e1be0cad58
-
SHA256
20f7f3802a6d2d2ad98fc7acf6d468413e9ec7d6849ccae41b8d0a793fbc7e86
-
SHA512
7edddb711b6074c420620d19204cfdf3f5f3ffece0401f3b601d81d0a8215435d47597b98581d735b4b7432548f9343ee7f01e2371a5552db6eb6b75402e8d19
-
SSDEEP
24576:71WbRS1T9vWD0YYY2hSUlfd+Hny9Jc9OJ8qY0LwgZ3t3b3Oa65G7wWa/6hqZxFCK:7ORS1T9XhRfd+CO9TWjZ9r+a65GPWOqP
Malware Config
Extracted
octo
https://uhgtr9jjdiuriegvjudf.top/N2Y5ZmU3OTI5ZDky/
https://ukhfrerl84hnfjdlns.online/N2Y5ZmU3OTI5ZDky/
https://menetory4gert.xyz/N2Y5ZmU3OTI5ZDky/
https://hdewuhunfrv74f.site/N2Y5ZmU3OTI5ZDky/
https://kuurjfds8rjrdiwse.online/N2Y5ZmU3OTI5ZDky/
Extracted
octo
https://uhgtr9jjdiuriegvjudf.top/N2Y5ZmU3OTI5ZDky/
https://ukhfrerl84hnfjdlns.online/N2Y5ZmU3OTI5ZDky/
https://menetory4gert.xyz/N2Y5ZmU3OTI5ZDky/
https://hdewuhunfrv74f.site/N2Y5ZmU3OTI5ZDky/
https://kuurjfds8rjrdiwse.online/N2Y5ZmU3OTI5ZDky/
Signatures
-
Octo
Octo is a banking malware with remote access capabilities first seen in April 2022.
-
Octo family
-
Octo payload 1 IoCs
-
Removes its main activity from the application launcher 1 TTPs 1 IoCs
-
Loads dropped Dex/Jar 1 TTPs 3 IoCs
Runs executable file dropped to the device during analysis.
-
Makes use of the framework's Accessibility service 4 TTPs 2 IoCs
Retrieves information displayed on the phone screen using AccessibilityService.
-
Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
-
Queries the phone number (MSISDN for GSM devices) 1 TTPs
-
Acquires the wake lock 1 IoCs
-
Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs
Application may abuse the framework's foreground service to continue running in the foreground.
-
Performs UI accessibility actions on behalf of the user 1 TTPs 2 IoCs
Application may abuse the accessibility service to prevent their removal.
-
Queries the mobile country code (MCC) 1 TTPs 1 IoCs
-
Queries the unique device ID (IMEI, MEID, IMSI) 1 TTPs
-
Reads information about phone network operator. 1 TTPs
-
Requests accessing notifications (often used to intercept notifications before users become aware). 1 TTPs 1 IoCs
-
Requests disabling of battery optimizations (often used to enable hiding in the background). 1 TTPs 1 IoCs
-
Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs
-
Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs
Processes
-
com.askpoint61⤵
- Removes its main activity from the application launcher
- Loads dropped Dex/Jar
- Makes use of the framework's Accessibility service
- Acquires the wake lock
- Makes use of the framework's foreground persistence service
- Performs UI accessibility actions on behalf of the user
- Queries the mobile country code (MCC)
- Requests accessing notifications (often used to intercept notifications before users become aware).
- Requests disabling of battery optimizations (often used to enable hiding in the background).
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Uses Crypto APIs (Might try to encrypt user data)
Network
MITRE ATT&CK Mobile v15
Persistence
Event Triggered Execution
1Broadcast Receivers
1Foreground Persistence
1Defense Evasion
Download New Code at Runtime
1Foreground Persistence
1Hide Artifacts
2Suppress Application Icon
1User Evasion
1Impair Defenses
1Prevent Application Removal
1Input Injection
1Credential Access
Access Notifications
1Input Capture
2GUI Input Capture
1Keylogging
1Discovery
Software Discovery
1Security Software Discovery
1System Network Configuration Discovery
4Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2KB
MD58315a2cca12417f2d13cf8e3f7487ba3
SHA18e1f9b7464d0289236a858da39b601ca041fbda5
SHA2562d6f73d504af27971c4cf1133fa4ae6cc6e999c9f94237d0771ff88a2b27e2c5
SHA512b4db30a2eb0df6f03bc04e113376ab7e6167f88d9ba247c681a918dfcab074f71234c08e606ea845c8091748b2ad6130c8c66fa93932e657c3ff43f667cf51ae
-
Filesize
2KB
MD59efb8c110406a2929219b2fcd6ca243a
SHA1165f306ae0996fc7a503efc0813de01c402e9488
SHA2561e44eaa5c9b6e36da701d5406bf32f28f2cc08052602e595bb70d845c3023f29
SHA512102e46e41c4dd513bf1f35dfaf318ce3e5e825ec070b02d1c82439a7f56175247ea8d73a3a074e2d91b455edf7cd5ee77f53f8f6d9a2cc6d045ae34eb6f79f8f
-
Filesize
449KB
MD583e55de2f80f830e15b7894c6fca0ad7
SHA1713abd053c185467f2433009a640684eeebed694
SHA256e2e7506760a2892f82200b3d47a573daeb0234dd5f893b1b3cfb03fc47824fad
SHA51296766f07ce213115a73f778f4f518b2a1cc0b143b7d2523e28ce49b2a90def6f589d9bb67be6bbf309eacd655d0f094433c1aa0cbb6e13ca9a66970597ed7427
-
Filesize
486B
MD5164917082fb6cf5eba731c2f280fba21
SHA15c36199e678694678c3b62a4e70b54b358124a40
SHA256775bb053e01ef4a513e27724d16012260860a51e033ac6938ab522fda6c0bbfa
SHA5129339060b597769c69dd997488c44c238f444666e992f7557e7aae31f436667d358f427ebb27093beca7d3b122a0dd71a89214c63a0b2d938e9aa21789421917d
-
Filesize
6KB
MD5feb736a7533f218b714da8599144b7b6
SHA1bb93b945048b9f9e5e24ec335e0f4690020f75c3
SHA25658cfd48de0938427ea10f3c6a7c3868dc69538736b17e3f1ca59ff44bdbe365d
SHA512063c0f9f4529b6a807bc54ea1e443f146e2e71b92a4e3c23b11237ce6d94b18a1a69cb592fee76ba114221bbc44e2334eacb9718f6f597b9c0c76b5998a0b60d