Analysis
-
max time kernel
149s -
max time network
158s -
platform
android-10_x64 -
resource
android-x64-20240910-en -
resource tags
-
submitted
27/12/2024, 22:08
General
-
Target
cc68b53145b77e5d5bb81991dca44c0f39024d336d7cd7572c58827308594ded.apk
-
Size
180KB
-
MD5
0435c65ad98099fee44d65da9d7d196d
-
SHA1
906fbcbca5d4c1ebf5c8f0e49f68cd844c0757d0
-
SHA256
cc68b53145b77e5d5bb81991dca44c0f39024d336d7cd7572c58827308594ded
-
SHA512
e0d2380dfab8a193462fb2a961261dfa1f1f8f57bfe2fc8c3c89c6fb756efb8eeef6173f00ab319ea193bd991b76e9a1368b5354883bbb3fcb8f344994a1efe6
-
SSDEEP
3072:KYn1nhT62SBg2bF1vEGFMnF3PPY3ASLdp7QD/QkPXPMqzdZlMvklZT8XJBMCZ:/nl5SBLbnvFMPPY3ASLdtQD/QkPEwjlq
Malware Config
Extracted
octo
https://94.103.125.49:7117/gate/
Signatures
-
Octo
Octo is a banking malware with remote access capabilities first seen in April 2022.
-
Octo family
-
Makes use of the framework's Accessibility service 4 TTPs 2 IoCs
Retrieves information displayed on the phone screen using AccessibilityService.
-
Obtains sensitive information copied to the device clipboard 2 TTPs 1 IoCs
Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.
-
Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
-
Queries the phone number (MSISDN for GSM devices) 1 TTPs
-
Acquires the wake lock 1 IoCs
-
Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs
Application may abuse the framework's foreground service to continue running in the foreground.
-
Performs UI accessibility actions on behalf of the user 1 TTPs 4 IoCs
Application may abuse the accessibility service to prevent their removal.
-
Queries the mobile country code (MCC) 1 TTPs 1 IoCs
-
Reads information about phone network operator. 1 TTPs
-
Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs
-
Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs
-
Checks CPU information 2 TTPs 1 IoCs
-
Checks memory information 2 TTPs 1 IoCs
Processes
-
com.governsaidp1⤵
- Makes use of the framework's Accessibility service
- Obtains sensitive information copied to the device clipboard
- Acquires the wake lock
- Makes use of the framework's foreground persistence service
- Performs UI accessibility actions on behalf of the user
- Queries the mobile country code (MCC)
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Uses Crypto APIs (Might try to encrypt user data)
- Checks CPU information
- Checks memory information
Network
MITRE ATT&CK Mobile v15
Persistence
Event Triggered Execution
1Broadcast Receivers
1Foreground Persistence
1Defense Evasion
Foreground Persistence
1Impair Defenses
1Prevent Application Removal
1Input Injection
1Virtualization/Sandbox Evasion
2System Checks
2Credential Access
Clipboard Data
1Input Capture
2GUI Input Capture
1Keylogging
1Discovery
Software Discovery
1Security Software Discovery
1System Information Discovery
2System Network Configuration Discovery
3Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
28B
MD56311c3fd15588bb5c126e6c28ff5fffe
SHA1ce81d136fce31779f4dd62e20bdaf99c91e2fc57
SHA2568b82f6032e29a2b5c96031a3630fb6173d12ff0295bc20bb21b877d08f0812d8
SHA5122975fe2e94b6a8adc9cfc1a865ad113772b54572883a537b02a16dd2d029c0f7d9cca3b154fd849bdfe978e18b396bcf9fa6e67e7c61f92bdc089a29a9c355c6
-
Filesize
63B
MD54bf4036e06746e42888464acc5207259
SHA1a8e87190497603cf69a2f878b774a713f334974e
SHA2560bfd7c7f1668923259c8c8ca938ca8b6cd6d19684238dc048120546808ada8ba
SHA512374cf3910a6c0560cf60162f659195dd51350bbf3124cb5379a1f3950cb74b0058595891f21c95cf0a1aeb801d458aa498569748a8397328abd2c5774eca1e30
-
Filesize
45B
MD50987bef98ac1b806f2ad5f76ec6be3b9
SHA1e47fc3b3c4fccf4105d60ad592a8198a5de24045
SHA256fd7b21464d56d7463718034410832521117e5ce397d55299330d510047d09a73
SHA512728286c2b3044e482f9e23c721cf99c85629db3d06fae4e93e6785c8d1fc75eafc443cbfbed25f2e7eafdf205eb34f8ed2d6ce96aba6c0d265cee109be940fab
-
Filesize
67B
MD572c5a81097bf6d8212d1f5bae15c8301
SHA152f734183c4b9f36fa53eb8bc8a21f2d464a38ff
SHA25601234da71425b64aafa542b18be1f01d4df9b93551fe7c3c607343fac718d88b
SHA5120199d408be234b871f301997b7f71a5b01721458ed563c10bcc67954f11977a617a82c46ec0f20640abb2ef7a44db88a7e5d69e8d6ecd7616dbc11f321b9e23f
-
Filesize
437B
MD5099f62c4f5f9f3769c1126a8e85258cc
SHA13f4a1c09c606087a0661cd0eec2c4849a33ab602
SHA256e8dd248c9501e19fae726834d398c433b328a82e4d835343a413f2344800ca91
SHA512fe9551459716f8ba26e98ee6b7d7dd5a0273cb2dff7813331b344c39475c612648aa3b94c697b5ceac7932ba44c26db51e77947c3f014847e175efb58499136f