Overview

overview

10

Static

static

6

44c2f87588...ed.apk

android-9-x86

10

44c2f87588...ed.apk

android-13-x64

10

Resubmissions

13-01-2025 06:02

250113-grq3pa1rem 10

12-01-2025 22:07

250112-11vl1stqfm 10

Analysis

  • max time kernel
    898s
  • max time network
    908s
  • platform
    android_x64
  • resource
    android-33-x64-arm64-20240624-en
  • resource tags

    androidarch:arm64arch:x64image:android-33-x64-arm64-20240624-enlocale:en-usos:android-13-x64system
  • submitted
    13-01-2025 06:02

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    44c2f875880f216fd5fdb6cf9fb6b94eb7e35682caa7f5a7b7d5eb7738ed2bed.apk

  • Size

    3.1MB

  • MD5

    6c0e41bc5138a2931303297604c8630d

  • SHA1

    6688673a9f7cbce497406de4563a16a665895865

  • SHA256

    44c2f875880f216fd5fdb6cf9fb6b94eb7e35682caa7f5a7b7d5eb7738ed2bed

  • SHA512

    7ad539982d46f8d40ed796bba356b983cbd65df4c887e42a5b194483ed059e14868998ff1834c4c3d7c1ba579bcdb213259d06595a0e0858812918213bea0941

  • SSDEEP

    98304:wPXtbA5KTK7E7ne1On2BVBUUfgZUdBjCvbE:ESKmye1a2PBU9ZUzjsbE

Score
10/10
octobankercollectioncredential_accessdiscoveryevasionimpactinfostealerpersistencerattrojan

Malware Config

Extracted

Family

octo

C2

https://94.156.68.231/NmM2YjMyYjE4MmMx/

https://mmma8291play.xyz/NmM2YjMyYjE4MmMx/

https://94.156.68.232/NmM2YjMyYjE4MmMx/

https://94.156.68.233/NmM2YjMyYjE4MmMx/

https://94.156.68.234/NmM2YjMyYjE4MmMx/

https://mmma8291play.net/NmM2YjMyYjE4MmMx/

https://mmma8291play.com/NmM2YjMyYjE4MmMx/

https://mmma7811play.net/NmM2YjMyYjE4MmMx/

https://mmma7811play.xyz/NmM2YjMyYjE4MmMx/

https://mmma7811play.com/NmM2YjMyYjE4MmMx/
rc4.plain

Extracted

Family

octo

C2

https://94.156.68.231/NmM2YjMyYjE4MmMx/

https://mmma8291play.xyz/NmM2YjMyYjE4MmMx/

https://94.156.68.232/NmM2YjMyYjE4MmMx/

https://94.156.68.233/NmM2YjMyYjE4MmMx/

https://94.156.68.234/NmM2YjMyYjE4MmMx/

https://mmma8291play.net/NmM2YjMyYjE4MmMx/

https://mmma8291play.com/NmM2YjMyYjE4MmMx/

https://mmma7811play.net/NmM2YjMyYjE4MmMx/

https://mmma7811play.xyz/NmM2YjMyYjE4MmMx/

https://mmma7811play.com/NmM2YjMyYjE4MmMx/
AES_key

Signatures

  • Octo

    Octo is a banking malware with remote access capabilities first seen in April 2022.

    bankertrojaninfostealerratocto
  • Octo family
    octo
  • Octo payload 1 IoCs
  • Loads dropped Dex/Jar 1 TTPs 1 IoCs

    Runs executable file dropped to the device during analysis.

    evasion
  • Makes use of the framework's Accessibility service 4 TTPs 3 IoCs

    Retrieves information displayed on the phone screen using AccessibilityService.

    collectionevasioncredential_access
  • Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
    bankerdiscovery
  • Queries the phone number (MSISDN for GSM devices) 1 TTPs
    discovery
  • Acquires the wake lock 1 IoCs
  • Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs

    Application may abuse the framework's foreground service to continue running in the foreground.

    evasionpersistence
  • Performs UI accessibility actions on behalf of the user 1 TTPs 1 IoCs

    Application may abuse the accessibility service to prevent their removal.

    evasion
  • Queries the mobile country code (MCC) 1 TTPs 1 IoCs
    discovery
  • Reads information about phone network operator. 1 TTPs
    discovery
  • Requests accessing notifications (often used to intercept notifications before users become aware). 1 TTPs 1 IoCs
    collectioncredential_access
  • Requests disabling of battery optimizations (often used to enable hiding in the background). 1 TTPs 1 IoCs
    evasion
  • Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs
    impact

Processes

  • com.unitrulet
    1⤵
    • Loads dropped Dex/Jar
    • Makes use of the framework's Accessibility service
    • Acquires the wake lock
    • Makes use of the framework's foreground persistence service
    • Performs UI accessibility actions on behalf of the user
    • Queries the mobile country code (MCC)
    • Requests accessing notifications (often used to intercept notifications before users become aware).
    • Requests disabling of battery optimizations (often used to enable hiding in the background).
    • Uses Crypto APIs (Might try to encrypt user data)
    PID:4316

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • /data/user/0/com.unitrulet/cache/dooztfqy
    Filesize

    449KB

    MD5

    a38bf1a4d940f39a88ddde1d16608cfe

    SHA1

    f22ca8a4257c25a9634ee929f848ca0f291ac139

    SHA256

    c66a314b1b04004defbeec0dc2bf3de006b023a405b4a478f824333f2c1de0b1

    SHA512

    3b2599c35a499e0d64b18cc5a16a9cf4c73838c3f284f5c5ed52c75823bf52d4cd01a8a5e71b91164565ec8c1e900afdf649b86428e16700e327257bb63d0a13

    Download Submit

  • /data/user/0/com.unitrulet/cache/oat/dooztfqy.cur.prof
    Filesize

    363B

    MD5

    9e337a9dbbe9c85022c3e279ad434be2

    SHA1

    dca2cdc8feaf65d589d2bf2d2642a1972b27a129

    SHA256

    75290333c7e2669a1a69c8b48c45a40adf255f6f386d07d5b255c81f7f7b9e0e

    SHA512

    14db173bf964b8f152c915a78645d54dc83cdc811d48c8edf8c99a85c8bced2ab1c85559c77609713a74803d3425758cc658e4d3c68b5df18d7f5d0f74acfb40

    Download Submit

  • /data/user/0/com.unitrulet/cache/oat/dooztfqy.cur.prof
    Filesize

    381B

    MD5

    3f290034148b573cdda9716f4dacf6fc

    SHA1

    a581b6753b515526ab79f2980c9421349b3dac79

    SHA256

    978b263ee1389377cc7b29f204d6cc507403e3ca2751a3c8abf84270831d3d56

    SHA512

    df8201b1440036adfed193e7008d85f7610b8439c93832bef01baee45f0780c6253fd51825e31e96d0a8e876bdb2b85a9ab1b0d026aab91f1f00a56d7445b6f6

    Download Submit