Analysis

  • max time kernel
    149s
  • max time network
    156s
  • platform
    android-10_x64
  • resource
    android-x64-20240910-en
  • resource tags

    arch:x64arch:x86image:android-x64-20240910-enlocale:en-usos:android-10-x64system
  • submitted
    20/01/2025, 22:04

General

  • Target

    d5c283780314b43d199a8601305917769c13cab758ac912c8d87f5ab70855fd3.apk

  • Size

    1.7MB

  • MD5

    127e7dcd6cd684623e2fa054173cb896

  • SHA1

    a448b0439462e121390d72cadf484e6b299bd1af

  • SHA256

    d5c283780314b43d199a8601305917769c13cab758ac912c8d87f5ab70855fd3

  • SHA512

    1f564143c07269c693c2e3715c4a4c7f733bdd5117f6d9e497abe853bc4b73cf032710bc2dfe0b93299daa76429cf2b59c993d4a41cd23d6ab4b453dedee4d1a

  • SSDEEP

    49152:ggsnafuxnd0qApFrVKV2SEHgUO13IbwpDoO3sYGAAE:ZsnafW0TzVKV2xH2NNoEs3AAE

Malware Config

Extracted

Family

octo

C2

https://ruceayipma.xyz/YjVmNGU0NmNhODlm/

https://yapayzekaisyanlari.xyz/YjVmNGU0NmNhODlm/

https://makineordulariyukseliyor.xyz/YjVmNGU0NmNhODlm/

https://teknolojinisyanhikayesi.xyz/YjVmNGU0NmNhODlm/

https://robotkorsanlargeliyor.xyz/YjVmNGU0NmNhODlm/

https://dunyayirobotlarkapliyor.xyz/YjVmNGU0NmNhODlm/

https://mekanikordularinintikam.xyz/YjVmNGU0NmNhODlm/

https://otomasyonkalesindemucadele.xyz/YjVmNGU0NmNhODlm/

https://robotlarvemakineisyanlari.xyz/YjVmNGU0NmNhODlm/

https://teknolojikseferberlik.xyz/YjVmNGU0NmNhODlm/

https://yapayordularinhikayesi.xyz/YjVmNGU0NmNhODlm/

https://makinevekodisyancilari.xyz/YjVmNGU0NmNhODlm/

https://mekanikorduyolculugu.xyz/YjVmNGU0NmNhODlm/

https://robotikturunculer.xyz/YjVmNGU0NmNhODlm/

https://mekanikisyanveteknoloji.xyz/YjVmNGU0NmNhODlm/

https://makineuyanikaynaklari.xyz/YjVmNGU0NmNhODlm/

https://mekanikseferisyani.xyz/YjVmNGU0NmNhODlm/

https://yapayzekauyanislari.xyz/YjVmNGU0NmNhODlm/

https://robotinsanvedunyavasfi.xyz/YjVmNGU0NmNhODlm/

https://dunyayisaranmekanik.xyz/YjVmNGU0NmNhODlm/

rc4.plain

Extracted

Family

octo

C2

https://ruceayipma.xyz/YjVmNGU0NmNhODlm/

https://yapayzekaisyanlari.xyz/YjVmNGU0NmNhODlm/

https://makineordulariyukseliyor.xyz/YjVmNGU0NmNhODlm/

https://teknolojinisyanhikayesi.xyz/YjVmNGU0NmNhODlm/

https://robotkorsanlargeliyor.xyz/YjVmNGU0NmNhODlm/

https://dunyayirobotlarkapliyor.xyz/YjVmNGU0NmNhODlm/

https://mekanikordularinintikam.xyz/YjVmNGU0NmNhODlm/

https://otomasyonkalesindemucadele.xyz/YjVmNGU0NmNhODlm/

https://robotlarvemakineisyanlari.xyz/YjVmNGU0NmNhODlm/

https://teknolojikseferberlik.xyz/YjVmNGU0NmNhODlm/

https://yapayordularinhikayesi.xyz/YjVmNGU0NmNhODlm/

https://makinevekodisyancilari.xyz/YjVmNGU0NmNhODlm/

https://mekanikorduyolculugu.xyz/YjVmNGU0NmNhODlm/

https://robotikturunculer.xyz/YjVmNGU0NmNhODlm/

https://mekanikisyanveteknoloji.xyz/YjVmNGU0NmNhODlm/

https://makineuyanikaynaklari.xyz/YjVmNGU0NmNhODlm/

https://mekanikseferisyani.xyz/YjVmNGU0NmNhODlm/

https://yapayzekauyanislari.xyz/YjVmNGU0NmNhODlm/

https://robotinsanvedunyavasfi.xyz/YjVmNGU0NmNhODlm/

https://dunyayisaranmekanik.xyz/YjVmNGU0NmNhODlm/

AES_key

Signatures

  • Octo

    Octo is a banking malware with remote access capabilities first seen in April 2022.

  • Octo family
  • Octo payload 1 IoCs
  • Loads dropped Dex/Jar 1 TTPs 1 IoCs

    Runs executable file dropped to the device during analysis.

  • Makes use of the framework's Accessibility service 4 TTPs 2 IoCs

    Retrieves information displayed on the phone screen using AccessibilityService.

  • Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
  • Queries the phone number (MSISDN for GSM devices) 1 TTPs
  • Acquires the wake lock 1 IoCs
  • Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs

    Application may abuse the framework's foreground service to continue running in the foreground.

  • Performs UI accessibility actions on behalf of the user 1 TTPs 4 IoCs

    Application may abuse the accessibility service to prevent their removal.

  • Queries the mobile country code (MCC) 1 TTPs 1 IoCs
  • Reads information about phone network operator. 1 TTPs
  • Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs
  • Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs

Processes

  • com.mention.edit
    1⤵
    • Loads dropped Dex/Jar
    • Makes use of the framework's Accessibility service
    • Acquires the wake lock
    • Makes use of the framework's foreground persistence service
    • Performs UI accessibility actions on behalf of the user
    • Queries the mobile country code (MCC)
    • Registers a broadcast receiver at runtime (usually for listening for system events)
    • Uses Crypto APIs (Might try to encrypt user data)
    PID:5109

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • /data/data/com.mention.edit/app_detail/uuK.json

    Filesize

    153KB

    MD5

    082f6e926c443bfc07984b6b137f6941

    SHA1

    4e948789a971b6acd9464556d5e309ac3184daf4

    SHA256

    aca1f99cd452c9d60d2f7012a9e568520d5a2fbb3db4aa2ee37de2d18f1e857b

    SHA512

    5cfbb1debd2e8e79b561542e45423ddde6210f5b9a0e9d980c9d93dc844509661d46c470270385eb50954197894e0d9bb3f975c45a42a8f2efd7c04a8fa4d3e1

  • /data/data/com.mention.edit/app_detail/uuK.json

    Filesize

    153KB

    MD5

    17187d2e6b80a8780f563c5a340c01ae

    SHA1

    c9f6713af4726fbddaa5a981a1445cbaa1ce11f1

    SHA256

    15eb770d3c931cb3aceb166c381def3f81800e84d80b9917d863231eec65255d

    SHA512

    d6cfe3ce6e50eda23562c7a581cc178616e594175b9f3b44ce13fd60bb4519e5a454093aecef37decd3bfd5dea85780403116d1239a0d9c1c996a9c2be6e9eb4

  • /data/user/0/com.mention.edit/app_detail/uuK.json

    Filesize

    450KB

    MD5

    3cf9126561616e18634e79f834105cee

    SHA1

    74c04564abd71075186251f4c37d605a3cae68e6

    SHA256

    87b8b0eae12a763f0ac79353b1eaa75f6a60c7c7b7aaafc4d991f77af5c6c42b

    SHA512

    d131e08cdbbd31238273745d1939992e366297d0a2e80db32807ced1c7d109654a203b07fc105d5188b70ba8299d97a5a6434dd57fb62b23c8a50b56c96b17d1