Analysis
-
max time kernel
140s -
max time network
146s -
platform
android-9_x86 -
resource
android-x86-arm-20240910-en -
resource tags
-
submitted
18/01/2025, 22:01
General
-
Target
cdd0c9e444fd1900be869eb5fdca0c2025578c24f9d0aa441133ebc24706d57c.apk
-
Size
2.4MB
-
MD5
d1e80d7c3deace6301bc602dd5c2c9ff
-
SHA1
4124a8e7586bd345570db13947c991fd685b4c90
-
SHA256
cdd0c9e444fd1900be869eb5fdca0c2025578c24f9d0aa441133ebc24706d57c
-
SHA512
5a9e219dc74e11f615ee74e34bc23bca440fa4cbb3f0e9efbb1db6d627e3ed83dcaa2962bc8e29eff9005c51544f4552d3be93350000c5a3190d541cd2554bb6
-
SSDEEP
49152:tkYsLNK75Sf8rFyOJScDusCcg1lypIv0OtFJJw+2g0PllanUJ0:7SitTrpIPJL+t25
Malware Config
Extracted
octo
https://kendimarkam.com/MWRlOTUyYjExM2Ew/
https://sporakademi4734/MWRlOTUyYjExM2Ew/
https://spormalzemeleri3414.com/MWRlOTUyYjExM2Ew/
https://malzemealmalisn552.com/MWRlOTUyYjExM2Ew/
https://designweb3413.com/MWRlOTUyYjExM2Ew/
Extracted
octo
https://kendimarkam.com/MWRlOTUyYjExM2Ew/
https://sporakademi4734/MWRlOTUyYjExM2Ew/
https://spormalzemeleri3414.com/MWRlOTUyYjExM2Ew/
https://malzemealmalisn552.com/MWRlOTUyYjExM2Ew/
https://designweb3413.com/MWRlOTUyYjExM2Ew/
Signatures
-
Octo
Octo is a banking malware with remote access capabilities first seen in April 2022.
-
Octo family
-
Octo payload 1 IoCs
-
Removes its main activity from the application launcher 1 TTPs 1 IoCs
-
Loads dropped Dex/Jar 1 TTPs 2 IoCs
Runs executable file dropped to the device during analysis.
-
Makes use of the framework's Accessibility service 4 TTPs 2 IoCs
Retrieves information displayed on the phone screen using AccessibilityService.
-
Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
-
Queries the phone number (MSISDN for GSM devices) 1 TTPs
-
Acquires the wake lock 1 IoCs
-
Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs
Application may abuse the framework's foreground service to continue running in the foreground.
-
Performs UI accessibility actions on behalf of the user 1 TTPs 4 IoCs
Application may abuse the accessibility service to prevent their removal.
-
Queries the mobile country code (MCC) 1 TTPs 1 IoCs
-
Queries the unique device ID (IMEI, MEID, IMSI) 1 TTPs
-
Reads information about phone network operator. 1 TTPs
-
Requests accessing notifications (often used to intercept notifications before users become aware). 1 TTPs 1 IoCs
-
Requests disabling of battery optimizations (often used to enable hiding in the background). 1 TTPs 1 IoCs
-
Requests modifying system settings. 1 IoCs
-
Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs
-
Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs
Processes
-
com.keepbetween631⤵
- Removes its main activity from the application launcher
- Loads dropped Dex/Jar
- Makes use of the framework's Accessibility service
- Acquires the wake lock
- Makes use of the framework's foreground persistence service
- Performs UI accessibility actions on behalf of the user
- Queries the mobile country code (MCC)
- Requests accessing notifications (often used to intercept notifications before users become aware).
- Requests disabling of battery optimizations (often used to enable hiding in the background).
- Requests modifying system settings.
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Uses Crypto APIs (Might try to encrypt user data)
Network
MITRE ATT&CK Mobile v15
Persistence
Event Triggered Execution
1Broadcast Receivers
1Foreground Persistence
1Defense Evasion
Download New Code at Runtime
1Foreground Persistence
1Hide Artifacts
2Suppress Application Icon
1User Evasion
1Impair Defenses
1Prevent Application Removal
1Input Injection
1Credential Access
Access Notifications
1Input Capture
2GUI Input Capture
1Keylogging
1Discovery
Software Discovery
1Security Software Discovery
1System Network Configuration Discovery
4Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
509B
MD53fd29cc7dad0816f939312b4d6a7002c
SHA1bd93fa35e559317899a25c788aaa42697f96bf61
SHA25660d8b672dd1754398e92ed5b6c1a71565a631569d60bf83167287943ff60dd56
SHA512c273b0a7e4ebd099b311237b74060bb1d6dac81d4dfc9abdc1a6b0f711890ff79adf36e65820da6c0d9f678595f15cfa4c7e5fd555a0c29c748a38334a1462a2
-
Filesize
2.3MB
MD5576358b1cd27a5c386f4cb555642e664
SHA1a5beae96453a97749e0c6b1a20b090dae6987712
SHA256c729f43bf22965c5cfa7058b861398e63e8eab71393686f69c25ec7ff45cb57e
SHA51279694104dd10ed51776e988bc6c96266d354e43c5594746896d4deafdfb7bf51b5c19fb58990a61a8716c1404b0d8b9f3ad725e83031d66f7a798d1c78f3700e