Analysis
-
max time kernel
149s -
max time network
155s -
platform
android_x64 -
resource
android-x64-20240624-en -
resource tags
-
submitted
11-01-2025 22:00
General
-
Target
b4930bf5732f2d2cfb4d5924a45fd5a67f22d214f391ebd848ea7ba9c417b003.apk
-
Size
541KB
-
MD5
d7716a7755ecbfe048e5096d775617d0
-
SHA1
732bd8acef8f8d558418f06613697a479a92936c
-
SHA256
b4930bf5732f2d2cfb4d5924a45fd5a67f22d214f391ebd848ea7ba9c417b003
-
SHA512
d17c7ad85c57edfb2cc2d946e958c6ab6f394c1e27c714cbb63525742f3bea34bc212fa13f3bf4ef7da311c8d43b01597689f7b048cb2e5d09694d77450e33ad
-
SSDEEP
12288:jj4nKGJbaxw0Oi0KrekCz/Y5lc55sgZ566FA2xHneSeGan0:jj6K4b/0FpqkUQE5hFAGHnebn0
Malware Config
Extracted
octo
https://179.43.142.190/MDQ4Yzc4NTJkYTg4/
https://azisswravaas.xyz/MDQ4Yzc4NTJkYTg4/
https://azisswravaas1.xyz/MDQ4Yzc4NTJkYTg4/
https://azisswravaas2.xyz/MDQ4Yzc4NTJkYTg4/
https://azisswravaas5.xyz/MDQ4Yzc4NTJkYTg4/
https://azisswravaas34.xyz/MDQ4Yzc4NTJkYTg4/
https://azisswrav44as2.xyz/MDQ4Yzc4NTJkYTg4/
https://azisswrava333as2.xyz/MDQ4Yzc4NTJkYTg4/
Extracted
octo
https://179.43.142.190/MDQ4Yzc4NTJkYTg4/
https://azisswravaas.xyz/MDQ4Yzc4NTJkYTg4/
https://azisswravaas1.xyz/MDQ4Yzc4NTJkYTg4/
https://azisswravaas2.xyz/MDQ4Yzc4NTJkYTg4/
https://azisswravaas5.xyz/MDQ4Yzc4NTJkYTg4/
https://azisswravaas34.xyz/MDQ4Yzc4NTJkYTg4/
https://azisswrav44as2.xyz/MDQ4Yzc4NTJkYTg4/
https://azisswrava333as2.xyz/MDQ4Yzc4NTJkYTg4/
Signatures
-
Octo
Octo is a banking malware with remote access capabilities first seen in April 2022.
-
Octo family
-
Octo payload 1 IoCs
-
Loads dropped Dex/Jar 1 TTPs 2 IoCs
Runs executable file dropped to the device during analysis.
-
Makes use of the framework's Accessibility service 4 TTPs 2 IoCs
Retrieves information displayed on the phone screen using AccessibilityService.
-
Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
-
Queries the phone number (MSISDN for GSM devices) 1 TTPs
-
Acquires the wake lock 1 IoCs
-
Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs
Application may abuse the framework's foreground service to continue running in the foreground.
-
Performs UI accessibility actions on behalf of the user 1 TTPs 2 IoCs
Application may abuse the accessibility service to prevent their removal.
-
Queries the mobile country code (MCC) 1 TTPs 1 IoCs
-
Reads information about phone network operator. 1 TTPs
-
Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs
-
Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs
Processes
-
com.runpatternny1⤵
- Loads dropped Dex/Jar
- Makes use of the framework's Accessibility service
- Acquires the wake lock
- Makes use of the framework's foreground persistence service
- Performs UI accessibility actions on behalf of the user
- Queries the mobile country code (MCC)
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Uses Crypto APIs (Might try to encrypt user data)
Network
MITRE ATT&CK Mobile v15
Persistence
Event Triggered Execution
1Broadcast Receivers
1Foreground Persistence
1Defense Evasion
Download New Code at Runtime
1Foreground Persistence
1Impair Defenses
1Prevent Application Removal
1Input Injection
1Discovery
Software Discovery
1Security Software Discovery
1System Network Configuration Discovery
3Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
450KB
MD53f30030e42d075ba4af374e40c5e162f
SHA13986f41c13e948386bea8c28f095333c889235b9
SHA2568f4a4974cc6a0b77214255fc975a1df8d757f59beee346ede443a49f3d5d7fe2
SHA512bccdf25c2e3a94c60b347e2be54f792660823c447a9de7cb59a3f35f3bca6155d548b0487bf03af2efec2f578585818d4bc4aaf52d2376ae276befae5972bb15
-
Filesize
559B
MD5707ea0c29baf63c4d7c598296296009f
SHA1e2c2f56bc1434bd554bf509d11ef95a6872ece49
SHA25600f0d45635b22d9d97130d5d073be54f6acc8e62bed8371857595fdca1eb86d2
SHA512be1e8b33217418b9deb94d7c182ca45fcf7983938d0b0a9f03d71f3cb3836a9fe1dd4f1bb284571b56c97893683039cd5576a9fb14411f3bee5eb7225d68c6fd