Analysis
-
max time kernel
140s -
max time network
155s -
platform
android_x64 -
resource
android-x64-20240624-en -
resource tags
androidarch:x64arch:x86image:android-x64-20240624-enlocale:en-usos:android-10-x64system -
submitted
13-01-2025 22:05
Static task
static1
Behavioral task
behavioral1
Sample
d2cba5495b3d84306e72e457d98c70d8bc1b53371fdffc0dd68ac4c592cb414c.apk
Resource
android-x86-arm-20240910-en
Behavioral task
behavioral2
Sample
d2cba5495b3d84306e72e457d98c70d8bc1b53371fdffc0dd68ac4c592cb414c.apk
Resource
android-x64-20240624-en
General
-
Target
d2cba5495b3d84306e72e457d98c70d8bc1b53371fdffc0dd68ac4c592cb414c.apk
-
Size
509KB
-
MD5
a1265d1613b31e140d5f47ccfbd2eefa
-
SHA1
eb04376796561898d0d7f045cc0bacd49a32cde3
-
SHA256
d2cba5495b3d84306e72e457d98c70d8bc1b53371fdffc0dd68ac4c592cb414c
-
SHA512
e08e462b1be68f1bc20fc07480eb980158493096984e0e9befde6c5ac858fb31f07067f1efbf14098bd78a98155da274107ec87d9ef2dcf8221831e7db210184
-
SSDEEP
12288:mxNHZa0oPML4ePz2D6kIc3PQKzYOfPdO1jXLATnWQ:mr5loPM4Mz2D6kIc3PvYT8nWQ
Malware Config
Extracted
octo
https://selamcanoonaber.site/ZDljMGYyZTQ3YWRi/
https://hava540derece.com/ZDljMGYyZTQ3YWRi/
https://cehennemdirloo34.com/ZDljMGYyZTQ3YWRi/
https://sicaktanbayilcam52.com/ZDljMGYyZTQ3YWRi/
https://otururkenterliyorum42.com/ZDljMGYyZTQ3YWRi/
https://sicakdanbeynimyandii2.com/ZDljMGYyZTQ3YWRi/
https://slmla6242nbr.com/ZDljMGYyZTQ3YWRi/
https://havacerinlii34.com/ZDljMGYyZTQ3YWRi/
https://havasarinliyorla234.com/ZDljMGYyZTQ3YWRi/
https://sicaklarbittikurtldk6215.com/ZDljMGYyZTQ3YWRi/
https://pikniktupu2534.com/ZDljMGYyZTQ3YWRi/
https://robetcotraslros5234.com/ZDljMGYyZTQ3YWRi/
Extracted
octo
https://selamcanoonaber.site/ZDljMGYyZTQ3YWRi/
https://hava540derece.com/ZDljMGYyZTQ3YWRi/
https://cehennemdirloo34.com/ZDljMGYyZTQ3YWRi/
https://sicaktanbayilcam52.com/ZDljMGYyZTQ3YWRi/
https://otururkenterliyorum42.com/ZDljMGYyZTQ3YWRi/
https://sicakdanbeynimyandii2.com/ZDljMGYyZTQ3YWRi/
https://slmla6242nbr.com/ZDljMGYyZTQ3YWRi/
https://havacerinlii34.com/ZDljMGYyZTQ3YWRi/
https://havasarinliyorla234.com/ZDljMGYyZTQ3YWRi/
https://sicaklarbittikurtldk6215.com/ZDljMGYyZTQ3YWRi/
https://pikniktupu2534.com/ZDljMGYyZTQ3YWRi/
https://robetcotraslros5234.com/ZDljMGYyZTQ3YWRi/
Signatures
-
Octo
Octo is a banking malware with remote access capabilities first seen in April 2022.
-
Octo family
-
Octo payload 1 IoCs
resource yara_rule behavioral2/files/fstream-1.dat family_octo -
Loads dropped Dex/Jar 1 TTPs 2 IoCs
Runs executable file dropped to the device during analysis.
ioc pid Process /data/user/0/com.redfire0/cache/hbmpriobwwtcq 4937 com.redfire0 /data/user/0/com.redfire0/cache/hbmpriobwwtcq 4937 com.redfire0 -
Makes use of the framework's Accessibility service 4 TTPs 2 IoCs
Retrieves information displayed on the phone screen using AccessibilityService.
description ioc Process Framework service call android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId com.redfire0 Framework service call android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByViewId com.redfire0 -
Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
-
Queries the phone number (MSISDN for GSM devices) 1 TTPs
-
Acquires the wake lock 1 IoCs
description ioc Process Framework service call android.os.IPowerManager.acquireWakeLock com.redfire0 -
Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs
Application may abuse the framework's foreground service to continue running in the foreground.
description ioc Process Framework service call android.app.IActivityManager.setServiceForeground com.redfire0 -
Performs UI accessibility actions on behalf of the user 1 TTPs 4 IoCs
Application may abuse the accessibility service to prevent their removal.
ioc Process android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction com.redfire0 android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction com.redfire0 android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction com.redfire0 android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction com.redfire0 -
Queries the mobile country code (MCC) 1 TTPs 1 IoCs
description ioc Process Framework service call com.android.internal.telephony.ITelephony.getNetworkCountryIsoForPhone com.redfire0 -
Reads information about phone network operator. 1 TTPs
-
Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs
description ioc Process Framework service call android.app.IActivityManager.registerReceiver com.redfire0 -
Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs
description ioc Process Framework API call javax.crypto.Cipher.doFinal com.redfire0
Processes
-
com.redfire01⤵
- Loads dropped Dex/Jar
- Makes use of the framework's Accessibility service
- Acquires the wake lock
- Makes use of the framework's foreground persistence service
- Performs UI accessibility actions on behalf of the user
- Queries the mobile country code (MCC)
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Uses Crypto APIs (Might try to encrypt user data)
PID:4937
Network
MITRE ATT&CK Mobile v15
Persistence
Event Triggered Execution
1Broadcast Receivers
1Foreground Persistence
1Defense Evasion
Download New Code at Runtime
1Foreground Persistence
1Impair Defenses
1Prevent Application Removal
1Input Injection
1Discovery
Software Discovery
1Security Software Discovery
1System Network Configuration Discovery
3Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
448KB
MD5aeae3cd54a4eb76dbe4e4bd6adaf75eb
SHA18fa9f074e651006b783c69207de03805ab34a57c
SHA256107ed0641cb8e0cd898449002e7b23ab3658ee7459c3c5847f39eb60a451ba3d
SHA51290d78971ef860b55d6789428efd2f8ffa492c6453250afacf1acbae34b7b6c894d8ad793a88256fdcc50400a1be60619fcbd433f3bcfabfa0c2780a0ccf2cb7b
-
Filesize
469B
MD5bee2bacb07856cef280c90801b78afe9
SHA1ea1ed0fc238a8d5ed5e13ee1c80f06c8a45a42b7
SHA25649643a27da45a7712dc030a0a5035be937c0d6c292c4e932b98b6adc0c07cb76
SHA5129baec7338bddc27dd2260c71397b7f53ba1c7c8876ed02f452de999a2c80a914b9640dcc632dd993fa3ee143248336319be4711a6d41bd2154d235e0333d594b