Analysis
-
max time kernel
178s -
max time network
187s -
platform
android_x64 -
resource
android-x64-20240624-en -
resource tags
androidarch:x64arch:x86image:android-x64-20240624-enlocale:en-usos:android-10-x64system -
submitted
30-06-2024 22:12
Static task
static1
Behavioral task
behavioral1
Sample
b9bbc7219caa86952062dbf717ba5640fb8a2a6c73765c8a5cc0df8bf9088474.apk
Resource
android-x86-arm-20240624-en
Behavioral task
behavioral2
Sample
b9bbc7219caa86952062dbf717ba5640fb8a2a6c73765c8a5cc0df8bf9088474.apk
Resource
android-x64-20240624-en
General
-
Target
b9bbc7219caa86952062dbf717ba5640fb8a2a6c73765c8a5cc0df8bf9088474.apk
-
Size
509KB
-
MD5
423897405093b562c0d54df05b64d2d3
-
SHA1
e557405b3b12d24ffdb2a84bf1375db301cb9de5
-
SHA256
b9bbc7219caa86952062dbf717ba5640fb8a2a6c73765c8a5cc0df8bf9088474
-
SHA512
45639211ac23fca6c88bca3a8fbcdf67cc083a1e2873924bb26435ada8c684b5c768969908e96d674eb908f4fb6ab84f5639ddae64a291079169acd58dec398e
-
SSDEEP
12288:lxrkYJ0QP+rSnVHTOJnLdKe/Xo28NBBOGYuj7T/+fzEKYFTbUA:lfHCJnB/ohNBBO2j3/7tYA
Malware Config
Extracted
octo
https://basgaancosturuyor.com/YzBlNzk4NmVlZDA0/
https://biribasganidurdursunn.com/YzBlNzk4NmVlZDA0/
https://bassganndomaingitti.com/YzBlNzk4NmVlZDA0/
https://usomapompaliyorum.com/YzBlNzk4NmVlZDA0/
https://usomukarimyaptimbasgaaan.com/YzBlNzk4NmVlZDA0/
https://basgaaanpompaaa.com/YzBlNzk4NmVlZDA0/
Signatures
-
Octo
Octo is a banking malware with remote access capabilities first seen in April 2022.
-
Octo payload 1 IoCs
Processes:
resource yara_rule /data/data/com.likepower5/cache/otoldkpbbkjxq family_octo -
Loads dropped Dex/Jar 1 TTPs 2 IoCs
Runs executable file dropped to the device during analysis.
Processes:
com.likepower5ioc pid process /data/user/0/com.likepower5/cache/otoldkpbbkjxq 5052 com.likepower5 /data/user/0/com.likepower5/cache/otoldkpbbkjxq 5052 com.likepower5 -
Makes use of the framework's Accessibility service 4 TTPs 2 IoCs
Retrieves information displayed on the phone screen using AccessibilityService.
Processes:
com.likepower5description ioc process Framework service call android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByViewId com.likepower5 Framework service call android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId com.likepower5 -
Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
-
Queries the phone number (MSISDN for GSM devices) 1 TTPs
-
Acquires the wake lock 1 IoCs
Processes:
com.likepower5description ioc process Framework service call android.os.IPowerManager.acquireWakeLock com.likepower5 -
Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs
Application may abuse the framework's foreground service to continue running in the foreground.
Processes:
com.likepower5description ioc process Framework service call android.app.IActivityManager.setServiceForeground com.likepower5 -
Performs UI accessibility actions on behalf of the user 1 TTPs 4 IoCs
Application may abuse the accessibility service to prevent their removal.
Processes:
com.likepower5ioc process android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction com.likepower5 android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction com.likepower5 android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction com.likepower5 android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction com.likepower5 -
Queries the mobile country code (MCC) 1 TTPs 1 IoCs
Processes:
com.likepower5description ioc process Framework service call com.android.internal.telephony.ITelephony.getNetworkCountryIsoForPhone com.likepower5 -
Reads information about phone network operator. 1 TTPs
-
Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs
Processes:
com.likepower5description ioc process Framework service call android.app.IActivityManager.registerReceiver com.likepower5 -
Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs
Processes:
com.likepower5description ioc process Framework API call javax.crypto.Cipher.doFinal com.likepower5
Processes
-
com.likepower51⤵
- Loads dropped Dex/Jar
- Makes use of the framework's Accessibility service
- Acquires the wake lock
- Makes use of the framework's foreground persistence service
- Performs UI accessibility actions on behalf of the user
- Queries the mobile country code (MCC)
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Uses Crypto APIs (Might try to encrypt user data)
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
/data/data/com.likepower5/cache/oat/otoldkpbbkjxq.cur.profFilesize
462B
MD5608c4a5b203b466ca2c15f5d38106ef5
SHA1a709f46fc1856206e607b62d144c5ca256fe45de
SHA256c168624a92f97a5e7b6eb3812ae9a0604367da9aa794199493201057bdc6d850
SHA5124d4687e76031f4e7a61d2448d858385befd5b47f21f5aab9b8576b448db79780393addc1c2946d8d3bbb583de7ac2cf9cec935d0a6a71d274cba77145c7b0a7e
-
/data/data/com.likepower5/cache/otoldkpbbkjxqFilesize
448KB
MD5f622adf41258559be800657401679fb4
SHA14a6f62b4e4a962293f6c7d89e7d53f714efc673f
SHA2565ef51cfa64a0ed13c6965721837eb455ddd9d3d9172e059a8955457141778daa
SHA512355f3283a47d9112b0500de70baa08e7a4de75407e4497d5bfaadc5f5b86d155aa8e4bb26a7c9915c95daaa9a548aa83ae489808c340a43e33be3dd3becc1c58