Analysis
-
max time kernel
145s -
max time network
150s -
platform
android_x86 -
resource
android-x86-arm-20240624-en -
resource tags
-
submitted
14-01-2025 22:03
General
-
Target
60b759978c73e52f26279ec47aadd2ae6c392c9e1aba6db82c9982b64473448f.apk
-
Size
2.4MB
-
MD5
103a5abdaf822d25c411bfad85703057
-
SHA1
a305a0e720ea194e737b114c0a319fc43d51dada
-
SHA256
60b759978c73e52f26279ec47aadd2ae6c392c9e1aba6db82c9982b64473448f
-
SHA512
02f7894c7b6fd01ef961fd7b889f0d9b0a52b91b13f042150752367bc8e6452abfa47213699d2ec0a951bca5fb659454ed2f03cb230705d1486d8201b12d2d58
-
SSDEEP
49152:ud1irQZ/zvjVlSI3PbbF9IG2rchsCzUHbQDIRg/rQ:cnZ/zvhR9IG24FzUHbQDIRwM
Malware Config
Extracted
octo
https://mutezallentan31.com/NWNiNWRmMmZjZTdl/
https://kiymamakinesi345.com/NWNiNWRmMmZjZTdl/
https://kraliyetinoglu3412.com/NWNiNWRmMmZjZTdl/
https://sonkraliyetbukucu1.com/NWNiNWRmMmZjZTdl/
https://kraliyetkurdu22.com/NWNiNWRmMmZjZTdl/
Extracted
octo
https://mutezallentan31.com/NWNiNWRmMmZjZTdl/
https://kiymamakinesi345.com/NWNiNWRmMmZjZTdl/
https://kraliyetinoglu3412.com/NWNiNWRmMmZjZTdl/
https://sonkraliyetbukucu1.com/NWNiNWRmMmZjZTdl/
https://kraliyetkurdu22.com/NWNiNWRmMmZjZTdl/
Signatures
-
Octo
Octo is a banking malware with remote access capabilities first seen in April 2022.
-
Octo family
-
Octo payload 1 IoCs
-
Removes its main activity from the application launcher 1 TTPs 1 IoCs
-
Loads dropped Dex/Jar 1 TTPs 2 IoCs
Runs executable file dropped to the device during analysis.
-
Makes use of the framework's Accessibility service 4 TTPs 2 IoCs
Retrieves information displayed on the phone screen using AccessibilityService.
-
Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
-
Queries the phone number (MSISDN for GSM devices) 1 TTPs
-
Acquires the wake lock 1 IoCs
-
Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs
Application may abuse the framework's foreground service to continue running in the foreground.
-
Performs UI accessibility actions on behalf of the user 1 TTPs 4 IoCs
Application may abuse the accessibility service to prevent their removal.
-
Queries the mobile country code (MCC) 1 TTPs 1 IoCs
-
Queries the unique device ID (IMEI, MEID, IMSI) 1 TTPs
-
Reads information about phone network operator. 1 TTPs
-
Requests accessing notifications (often used to intercept notifications before users become aware). 1 TTPs 1 IoCs
-
Requests disabling of battery optimizations (often used to enable hiding in the background). 1 TTPs 1 IoCs
-
Requests modifying system settings. 1 IoCs
-
Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs
-
Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs
Processes
-
com.thousandcareabev1⤵
- Removes its main activity from the application launcher
- Loads dropped Dex/Jar
- Makes use of the framework's Accessibility service
- Acquires the wake lock
- Makes use of the framework's foreground persistence service
- Performs UI accessibility actions on behalf of the user
- Queries the mobile country code (MCC)
- Requests accessing notifications (often used to intercept notifications before users become aware).
- Requests disabling of battery optimizations (often used to enable hiding in the background).
- Requests modifying system settings.
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Uses Crypto APIs (Might try to encrypt user data)
Network
MITRE ATT&CK Mobile v15
Persistence
Event Triggered Execution
1Broadcast Receivers
1Foreground Persistence
1Defense Evasion
Download New Code at Runtime
1Foreground Persistence
1Hide Artifacts
2Suppress Application Icon
1User Evasion
1Impair Defenses
1Prevent Application Removal
1Input Injection
1Credential Access
Access Notifications
1Input Capture
2GUI Input Capture
1Keylogging
1Discovery
Software Discovery
1Security Software Discovery
1System Network Configuration Discovery
4Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
527B
MD53523075c0a1932ae7316e4bce5a25a00
SHA107fc463e2d985e8b88ed0c6afc3dc3f08bb3d4b1
SHA2565eca54f81239a48086f760c13e9f61c35386751cabcb036f9347a72ea94e0eb8
SHA51293bf228a6c0e79d5d888966f6baf21bd6684c20448ad1d255c08713b87ecec41118d841fdd6afc87a4a253a609f573af4c373aebc4089d181947a465292ccc41
-
Filesize
2.3MB
MD51c141c6d89e1eed9e80ad6cbe243dfb3
SHA1d313997d4ccfa6d0fbd77d2653e4a260bee2331b
SHA2560799e7c60e31a4ced7c8fe3e73c0f0e8d2219a166478f4a973a7752bec485c16
SHA51242845bb1d87780bf34363bef3de0f892fd231dec891e39fc7fa6ec754d5d3c9c5939a1138e27ad6a3d180b1eb7ede0d68ebdfa32e796a20cbb127f8649f4327e