Analysis

  • max time kernel
    49s
  • max time network
    131s
  • platform
    android_x86
  • resource
    android-x86-arm-20240624-en
  • resource tags

    androidarch:armarch:x86image:android-x86-arm-20240624-enlocale:en-usos:android-9-x86system
  • submitted
    04-01-2025 22:01

General

  • Target

    c4200e1b8010e0dc985428fd36d5f705ee69722c22d6dc6c5cd204a5cf8c75f8.apk

  • Size

    2.1MB

  • MD5

    48b7b7999bfe1f6cb23b35d8c00fb7a1

  • SHA1

    8cf0cf63d7cfab4f8bf83e89b8787c89bba320b3

  • SHA256

    c4200e1b8010e0dc985428fd36d5f705ee69722c22d6dc6c5cd204a5cf8c75f8

  • SHA512

    dd6a13b69be61dddb450e431386f03625e21a5e16e1cc6564deddf3fecb6dda537842e6d46f05aa15aad52864303c8bc826ba4ccbea7f4f9e95969359d216cb2

  • SSDEEP

    49152:HaGDXeQ1589aKAaTRynp3rYoIPgDwmgk34Rbxrr:H9DuQL89aEgpUfIPH3+9r

Malware Config

Extracted

Family

octo

C2

https://karakalpakdostlugutasarimi.xyz/NWNlNzMzN2Y4NmI2/

https://karakalpakmodavesanat.xyz/NWNlNzMzN2Y4NmI2/

https://karakalpakkulturunsirlari.xyz/NWNlNzMzN2Y4NmI2/

https://karakalpakgeleneklerikosesi.xyz/NWNlNzMzN2Y4NmI2/

https://karakalpakdesentasarimlari.xyz/NWNlNzMzN2Y4NmI2/

https://karakalpakdokumasanati.xyz/NWNlNzMzN2Y4NmI2/

https://karakalpakmodasıvehayat.xyz/NWNlNzMzN2Y4NmI2/

https://karakalpakyanihikayeler.xyz/NWNlNzMzN2Y4NmI2/

https://karakalpakginensanatdiyari.xyz/NWNlNzMzN2Y4NmI2/

https://karakalpakdesenvesanatkosesi.xyz/NWNlNzMzN2Y4NmI2/

https://karakalpaklagelenektasima.xyz/NWNlNzMzN2Y4NmI2/

https://karakalpakustalarinakil.xyz/NWNlNzMzN2Y4NmI2/

https://karakalpakmodagercegi.xyz/NWNlNzMzN2Y4NmI2/

https://karakalpakvesanateserleri.xyz/NWNlNzMzN2Y4NmI2/

https://karakalpakdaguzelrenkler.xyz/NWNlNzMzN2Y4NmI2/

https://karakalpakseverlerinkosesi.xyz/NWNlNzMzN2Y4NmI2/

https://karakalpakileribakiyor.xyz/NWNlNzMzN2Y4NmI2/

https://karakalpakdernegitutkusu.xyz/NWNlNzMzN2Y4NmI2/

https://karakalpakvesanattasarimi.xyz/NWNlNzMzN2Y4NmI2/

https://karakalpakyarenlerisever.xyz/NWNlNzMzN2Y4NmI2/

rc4.plain

Extracted

Family

octo

C2

https://karakalpakdostlugutasarimi.xyz/NWNlNzMzN2Y4NmI2/

https://karakalpakmodavesanat.xyz/NWNlNzMzN2Y4NmI2/

https://karakalpakkulturunsirlari.xyz/NWNlNzMzN2Y4NmI2/

https://karakalpakgeleneklerikosesi.xyz/NWNlNzMzN2Y4NmI2/

https://karakalpakdesentasarimlari.xyz/NWNlNzMzN2Y4NmI2/

https://karakalpakdokumasanati.xyz/NWNlNzMzN2Y4NmI2/

https://karakalpakmodasıvehayat.xyz/NWNlNzMzN2Y4NmI2/

https://karakalpakyanihikayeler.xyz/NWNlNzMzN2Y4NmI2/

https://karakalpakginensanatdiyari.xyz/NWNlNzMzN2Y4NmI2/

https://karakalpakdesenvesanatkosesi.xyz/NWNlNzMzN2Y4NmI2/

https://karakalpaklagelenektasima.xyz/NWNlNzMzN2Y4NmI2/

https://karakalpakustalarinakil.xyz/NWNlNzMzN2Y4NmI2/

https://karakalpakmodagercegi.xyz/NWNlNzMzN2Y4NmI2/

https://karakalpakvesanateserleri.xyz/NWNlNzMzN2Y4NmI2/

https://karakalpakdaguzelrenkler.xyz/NWNlNzMzN2Y4NmI2/

https://karakalpakseverlerinkosesi.xyz/NWNlNzMzN2Y4NmI2/

https://karakalpakileribakiyor.xyz/NWNlNzMzN2Y4NmI2/

https://karakalpakdernegitutkusu.xyz/NWNlNzMzN2Y4NmI2/

https://karakalpakvesanattasarimi.xyz/NWNlNzMzN2Y4NmI2/

https://karakalpakyarenlerisever.xyz/NWNlNzMzN2Y4NmI2/

AES_key

Signatures

  • Octo

    Octo is a banking malware with remote access capabilities first seen in April 2022.

  • Octo family
  • Octo payload 2 IoCs
  • Removes its main activity from the application launcher 1 TTPs 1 IoCs
  • Loads dropped Dex/Jar 1 TTPs 2 IoCs

    Runs executable file dropped to the device during analysis.

  • Makes use of the framework's Accessibility service 4 TTPs 2 IoCs

    Retrieves information displayed on the phone screen using AccessibilityService.

  • Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
  • Queries the phone number (MSISDN for GSM devices) 1 TTPs
  • Acquires the wake lock 1 IoCs
  • Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs

    Application may abuse the framework's foreground service to continue running in the foreground.

  • Performs UI accessibility actions on behalf of the user 1 TTPs 4 IoCs

    Application may abuse the accessibility service to prevent their removal.

  • Queries the mobile country code (MCC) 1 TTPs 1 IoCs
  • Queries the unique device ID (IMEI, MEID, IMSI) 1 TTPs
  • Requests accessing notifications (often used to intercept notifications before users become aware). 1 TTPs 1 IoCs
  • Requests disabling of battery optimizations (often used to enable hiding in the background). 1 TTPs 1 IoCs
  • Requests modifying system settings. 1 IoCs
  • Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs
  • Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs

Processes

  • com.vapor.shock
    1⤵
    • Removes its main activity from the application launcher
    • Loads dropped Dex/Jar
    • Makes use of the framework's Accessibility service
    • Acquires the wake lock
    • Makes use of the framework's foreground persistence service
    • Performs UI accessibility actions on behalf of the user
    • Queries the mobile country code (MCC)
    • Requests accessing notifications (often used to intercept notifications before users become aware).
    • Requests disabling of battery optimizations (often used to enable hiding in the background).
    • Requests modifying system settings.
    • Registers a broadcast receiver at runtime (usually for listening for system events)
    • Uses Crypto APIs (Might try to encrypt user data)
    PID:4266
    • /system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.vapor.shock/app_tray/PxgeEh.json --output-vdex-fd=41 --oat-fd=42 --oat-location=/data/user/0/com.vapor.shock/app_tray/oat/x86/PxgeEh.odex --compiler-filter=quicken --class-loader-context=&
      2⤵
      • Loads dropped Dex/Jar
      PID:4292

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • /data/data/com.vapor.shock/app_tray/PxgeEh.json

    Filesize

    153KB

    MD5

    0d2887dbbe5ff446d5b5d5035fe85598

    SHA1

    935f0865bbb533969c049e8b2358e248c29734d3

    SHA256

    2881d0aac7eafb97288bde6e8a98978f6239550aefe18f71bd9303522e6f5e15

    SHA512

    5fa2edfe80f2e67c80c5de63a1844dad7abd0f3e086e107406628b9dab9492c4111262a7fedabb744c562c2b761bca49dba32c70f86fe997d9bd071cde134b8c

  • /data/data/com.vapor.shock/app_tray/PxgeEh.json

    Filesize

    153KB

    MD5

    71eb1302b28ca554617c3064202c48d1

    SHA1

    6e368bf61912cdbb45e036536027f0399f8563e7

    SHA256

    a694eabc6e2f45a53d5776d8f1e41010a4ab81bbbf063b0e402a1bced79f7d72

    SHA512

    cb8b8832581294ecf8596b4b18cc9018795c8aa24e20b43d15681e5fe13145b866fabbbed5451363db83235c5678c00a4b9c6baa64217f4e27bdcf4ed085f117

  • /data/user/0/com.vapor.shock/app_tray/PxgeEh.json

    Filesize

    451KB

    MD5

    d856ce709b8e129430970b8c58df9112

    SHA1

    24e4ba8c7ba9875c1d579722a086016e32e6d477

    SHA256

    4504b59f73bfd24eb320ca0b6c2463f6822da96e9c11397abf2c72a7b8cbf576

    SHA512

    9f6dacba88628b37f8f4ea5a7dcf2b66984f857343d9cf715bcc98ea4aab7942b1a6177eb7c3d534132e9555950b4b09818247afe5e17fd6191077908a58c160

  • /data/user/0/com.vapor.shock/app_tray/PxgeEh.json

    Filesize

    451KB

    MD5

    d360a9f10a756cbb2372ad3311550cfa

    SHA1

    837a2709dfa5c5627b76230a7051dd7703a2c251

    SHA256

    adec54ae2935b9127ecc1fab46e1dcc9e3777871d9ea53711177bdd528698f32

    SHA512

    5ccb92ca569e6c953a34f069faa11449ee64ee94aff123cc25a4ad3ff07e156e8c88002b5b9d1e9ce348219ddf4da17af905fcdba24347f3092078b3fb1264d1