Overview

overview

10

Static

static

6

60b759978c...8f.apk

android-9-x86

10

60b759978c...8f.apk

android-13-x64

10

Analysis

  • max time kernel
    145s
  • max time network
    156s
  • platform
    android_x64
  • resource
    android-33-x64-arm64-20240624-en
  • resource tags

    androidarch:arm64arch:x64image:android-33-x64-arm64-20240624-enlocale:en-usos:android-13-x64system
  • submitted
    14-01-2025 22:03

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    60b759978c73e52f26279ec47aadd2ae6c392c9e1aba6db82c9982b64473448f.apk

  • Size

    2.4MB

  • MD5

    103a5abdaf822d25c411bfad85703057

  • SHA1

    a305a0e720ea194e737b114c0a319fc43d51dada

  • SHA256

    60b759978c73e52f26279ec47aadd2ae6c392c9e1aba6db82c9982b64473448f

  • SHA512

    02f7894c7b6fd01ef961fd7b889f0d9b0a52b91b13f042150752367bc8e6452abfa47213699d2ec0a951bca5fb659454ed2f03cb230705d1486d8201b12d2d58

  • SSDEEP

    49152:ud1irQZ/zvjVlSI3PbbF9IG2rchsCzUHbQDIRg/rQ:cnZ/zvhR9IG24FzUHbQDIRwM

Score
10/10
octobankercollectioncredential_accessdiscoveryevasionimpactinfostealerpersistencerattrojan

Malware Config

Extracted

Family

octo

C2

https://mutezallentan31.com/NWNiNWRmMmZjZTdl/

https://kiymamakinesi345.com/NWNiNWRmMmZjZTdl/

https://kraliyetinoglu3412.com/NWNiNWRmMmZjZTdl/

https://sonkraliyetbukucu1.com/NWNiNWRmMmZjZTdl/

https://kraliyetkurdu22.com/NWNiNWRmMmZjZTdl/
rc4.plain

Extracted

Family

octo

C2

https://mutezallentan31.com/NWNiNWRmMmZjZTdl/

https://kiymamakinesi345.com/NWNiNWRmMmZjZTdl/

https://kraliyetinoglu3412.com/NWNiNWRmMmZjZTdl/

https://sonkraliyetbukucu1.com/NWNiNWRmMmZjZTdl/

https://kraliyetkurdu22.com/NWNiNWRmMmZjZTdl/
AES_key

Signatures

  • Octo

    Octo is a banking malware with remote access capabilities first seen in April 2022.

    bankertrojaninfostealerratocto
  • Octo family
    octo
  • Octo payload 1 IoCs
  • Loads dropped Dex/Jar 1 TTPs 1 IoCs

    Runs executable file dropped to the device during analysis.

    evasion
  • Makes use of the framework's Accessibility service 4 TTPs 2 IoCs

    Retrieves information displayed on the phone screen using AccessibilityService.

    collectionevasioncredential_access
  • Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
    bankerdiscovery
  • Queries the phone number (MSISDN for GSM devices) 1 TTPs
    discovery
  • Acquires the wake lock 1 IoCs
  • Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs

    Application may abuse the framework's foreground service to continue running in the foreground.

    evasionpersistence
  • Performs UI accessibility actions on behalf of the user 1 TTPs 4 IoCs

    Application may abuse the accessibility service to prevent their removal.

    evasion
  • Queries the mobile country code (MCC) 1 TTPs 1 IoCs
    discovery
  • Reads information about phone network operator. 1 TTPs
    discovery
  • Requests accessing notifications (often used to intercept notifications before users become aware). 1 TTPs 1 IoCs
    collectioncredential_access
  • Requests disabling of battery optimizations (often used to enable hiding in the background). 1 TTPs 1 IoCs
    evasion
  • Requests modifying system settings. 1 IoCs
    evasion
  • Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs
    impact

Processes

  • com.thousandcareabev
    1⤵
    • Loads dropped Dex/Jar
    • Makes use of the framework's Accessibility service
    • Acquires the wake lock
    • Makes use of the framework's foreground persistence service
    • Performs UI accessibility actions on behalf of the user
    • Queries the mobile country code (MCC)
    • Requests accessing notifications (often used to intercept notifications before users become aware).
    • Requests disabling of battery optimizations (often used to enable hiding in the background).
    • Requests modifying system settings.
    • Uses Crypto APIs (Might try to encrypt user data)
    PID:4323

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • /data/data/com.thousandcareabev/cache/oat/yqymegrwodld.cur.prof
    Filesize

    428B

    MD5

    ca82d21c13fc544ed262123c011e8ae4

    SHA1

    75867c47842090b824d264aff9814a79c55a8aee

    SHA256

    53f13bf560757922900bd3f6e757f668fef27810ea71e5c814323b22ca4219d1

    SHA512

    afbe95ecdd6bfa301086f2f4437e6657925390fcecaed4be50bd9cab89f78018fb1a578b04fd516c1c711db7e739d8a639efc8a3746e5e912c890b174f68b52a

    Download Submit

  • /data/data/com.thousandcareabev/cache/yqymegrwodld
    Filesize

    2.3MB

    MD5

    1c141c6d89e1eed9e80ad6cbe243dfb3

    SHA1

    d313997d4ccfa6d0fbd77d2653e4a260bee2331b

    SHA256

    0799e7c60e31a4ced7c8fe3e73c0f0e8d2219a166478f4a973a7752bec485c16

    SHA512

    42845bb1d87780bf34363bef3de0f892fd231dec891e39fc7fa6ec754d5d3c9c5939a1138e27ad6a3d180b1eb7ede0d68ebdfa32e796a20cbb127f8649f4327e

    Download Submit