Analysis
-
max time kernel
179s -
max time network
187s -
platform
android_x64 -
resource
android-33-x64-arm64-20240624-en -
resource tags
androidarch:arm64arch:x64image:android-33-x64-arm64-20240624-enlocale:en-usos:android-13-x64system -
submitted
30-06-2024 22:12
Static task
static1
Behavioral task
behavioral1
Sample
cc0baf15ed7406cfd19465495b75c29e381db401188c9f14f10654da775a3ab6.apk
Resource
android-x86-arm-20240624-en
Behavioral task
behavioral2
Sample
cc0baf15ed7406cfd19465495b75c29e381db401188c9f14f10654da775a3ab6.apk
Resource
android-33-x64-arm64-20240624-en
General
-
Target
cc0baf15ed7406cfd19465495b75c29e381db401188c9f14f10654da775a3ab6.apk
-
Size
505KB
-
MD5
9343c9fc162ca2952b61de9f3fbc49ac
-
SHA1
d6857dd489a61101accd159bbea6ca4b4210469b
-
SHA256
cc0baf15ed7406cfd19465495b75c29e381db401188c9f14f10654da775a3ab6
-
SHA512
e223919b4bc5ef029f98d172c06734cc90b41aeab01ef6b6f47c1a0b11a142d3dcf36c2f7a3d3b6eb613860804978bb1aa38fc439fd75d06adb4403bdbaf25ae
-
SSDEEP
12288:VpighaDnQHxuR9gCd5tOounxAH0fCFML3OYXCqWc24:94zAxuR9T70ouxACC6LZCqWs
Malware Config
Extracted
octo
https://basgaancosturuyor.com/YzBlNzk4NmVlZDA0/
https://biribasganidurdursunn.com/YzBlNzk4NmVlZDA0/
https://bassganndomaingitti.com/YzBlNzk4NmVlZDA0/
https://usomapompaliyorum.com/YzBlNzk4NmVlZDA0/
https://usomukarimyaptimbasgaaan.com/YzBlNzk4NmVlZDA0/
https://basgaaanpompaaa.com/YzBlNzk4NmVlZDA0/
Signatures
-
Octo
Octo is a banking malware with remote access capabilities first seen in April 2022.
-
Octo payload 1 IoCs
Processes:
resource yara_rule /data/data/com.quickletter5/cache/ifgkabesekgqv family_octo -
Loads dropped Dex/Jar 1 TTPs 1 IoCs
Runs executable file dropped to the device during analysis.
Processes:
com.quickletter5ioc pid process /data/user/0/com.quickletter5/cache/ifgkabesekgqv 4341 com.quickletter5 -
Makes use of the framework's Accessibility service 4 TTPs 2 IoCs
Retrieves information displayed on the phone screen using AccessibilityService.
Processes:
com.quickletter5description ioc process Framework service call android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId com.quickletter5 Framework service call android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByViewId com.quickletter5 -
Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
-
Queries the phone number (MSISDN for GSM devices) 1 TTPs
-
Acquires the wake lock 1 IoCs
Processes:
com.quickletter5description ioc process Framework service call android.os.IPowerManager.acquireWakeLock com.quickletter5 -
Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs
Application may abuse the framework's foreground service to continue running in the foreground.
Processes:
com.quickletter5description ioc process Framework service call android.app.IActivityManager.setServiceForeground com.quickletter5 -
Performs UI accessibility actions on behalf of the user 1 TTPs 2 IoCs
Application may abuse the accessibility service to prevent their removal.
Processes:
com.quickletter5ioc process android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction com.quickletter5 android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction com.quickletter5 -
Queries the mobile country code (MCC) 1 TTPs 1 IoCs
Processes:
com.quickletter5description ioc process Framework service call com.android.internal.telephony.ITelephony.getNetworkCountryIsoForPhone com.quickletter5 -
Reads information about phone network operator. 1 TTPs
-
Requests accessing notifications (often used to intercept notifications before users become aware). 1 TTPs 1 IoCs
Processes:
com.quickletter5description ioc process Intent action android.settings.ACTION_NOTIFICATION_LISTENER_SETTINGS com.quickletter5 -
Requests disabling of battery optimizations (often used to enable hiding in the background). 1 TTPs 1 IoCs
Processes:
com.quickletter5description ioc process Intent action android.settings.REQUEST_IGNORE_BATTERY_OPTIMIZATIONS com.quickletter5 -
Requests modifying system settings. 1 IoCs
Processes:
com.quickletter5description ioc process Intent action android.settings.action.MANAGE_WRITE_SETTINGS com.quickletter5 -
Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs
Processes:
com.quickletter5description ioc process Framework API call javax.crypto.Cipher.doFinal com.quickletter5
Processes
-
com.quickletter51⤵
- Loads dropped Dex/Jar
- Makes use of the framework's Accessibility service
- Acquires the wake lock
- Makes use of the framework's foreground persistence service
- Performs UI accessibility actions on behalf of the user
- Queries the mobile country code (MCC)
- Requests accessing notifications (often used to intercept notifications before users become aware).
- Requests disabling of battery optimizations (often used to enable hiding in the background).
- Requests modifying system settings.
- Uses Crypto APIs (Might try to encrypt user data)
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
/data/data/com.quickletter5/cache/ifgkabesekgqvFilesize
448KB
MD556320cfe7cf4ae96fa8f2221cbd66ce7
SHA1a9beaee2256f6803e7e0197e100c7db8473e087c
SHA256fa5708b8740601276a5140c11ab214ac04a0217f5491f1298f84fc7713c6ba1b
SHA5121df5ba046749930fb84aab260f00c137b04aa1f33826f130d91bd1431cbdc0861c9be6575f3b32f097070b17c3fe058317a6cb0c76fff9da7fe018a63785d557
-
/data/data/com.quickletter5/cache/oat/ifgkabesekgqv.cur.profFilesize
370B
MD5000bfca16531c955250791a64c2fa84f
SHA19553e55cdc4dffd1e671c6a86f6e6dcf8521cdbd
SHA256c02e1e6282bf47ecd1d208b4080dcd39f0210875369886a3177401b538ebaee3
SHA5121c2e7a4d38a720111a9a88885b95ff1b8a24d3c82597b8ff465b4b1419011b5b2677e729e3313f1201ee2b42b8eea7c5b48517a1cfe2e5c28b185bdbf35cdbeb