Analysis
-
max time kernel
21s -
max time network
36s -
platform
android_x64 -
resource
android-33-x64-arm64-20240624-en -
resource tags
-
submitted
08-10-2024 14:39
General
-
Target
9fa200233ee1f6540fadbfe452f0718143794af775369dfc21ac04c174c7e3ba.apk
-
Size
7.7MB
-
MD5
f8501cf8d0b78aa207b601376b5d6bf4
-
SHA1
401b7c5ebf334576c03786ef415b55488424421f
-
SHA256
9fa200233ee1f6540fadbfe452f0718143794af775369dfc21ac04c174c7e3ba
-
SHA512
b3422ea6708453487c5ca1af8dbad7f6687cf310aa361b6e0f29038deb0e53431d318a46334547630274da562286ac2bdfe96e8505b80a6ac307421a75848b0a
-
SSDEEP
98304:0jQYx9VKGhcN65j7J5iSRGS9Rs62dvg52X2klYSOJOHEob5:0jQYHUycNcj7JrJRv6I2ZY9M1
Malware Config
Extracted
octo
Signatures
-
Octo
Octo is a banking malware with remote access capabilities first seen in April 2022.
-
Octo payload 1 IoCs
-
Loads dropped Dex/Jar 1 TTPs 2 IoCs
Runs executable file dropped to the device during analysis.
-
Makes use of the framework's Accessibility service 4 TTPs 1 IoCs
Retrieves information displayed on the phone screen using AccessibilityService.
-
Obtains sensitive information copied to the device clipboard 2 TTPs 1 IoCs
Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.
-
Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
-
Queries the phone number (MSISDN for GSM devices) 1 TTPs
-
Acquires the wake lock 1 IoCs
-
Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs
Application may abuse the framework's foreground service to continue running in the foreground.
-
Queries the mobile country code (MCC) 1 TTPs 1 IoCs
-
Reads information about phone network operator. 1 TTPs
-
Requests disabling of battery optimizations (often used to enable hiding in the background). 1 TTPs 1 IoCs
-
Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs
-
Checks CPU information 2 TTPs 1 IoCs
-
Checks memory information 2 TTPs 1 IoCs
Processes
-
com.viewerform51⤵
- Loads dropped Dex/Jar
- Makes use of the framework's Accessibility service
- Obtains sensitive information copied to the device clipboard
- Acquires the wake lock
- Makes use of the framework's foreground persistence service
- Queries the mobile country code (MCC)
- Requests disabling of battery optimizations (often used to enable hiding in the background).
- Uses Crypto APIs (Might try to encrypt user data)
- Checks CPU information
- Checks memory information
Network
MITRE ATT&CK Mobile v15
Defense Evasion
Download New Code at Runtime
1Foreground Persistence
1Hide Artifacts
1User Evasion
1Input Injection
1Virtualization/Sandbox Evasion
2System Checks
2Credential Access
Clipboard Data
1Input Capture
2GUI Input Capture
1Keylogging
1Discovery
Software Discovery
1Security Software Discovery
1System Information Discovery
2System Network Configuration Discovery
3Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
48B
MD5046a414913add6f5bb60072c7db819b6
SHA1451ee4f6809260aec622d772fd329c7d0297a842
SHA256b66c1320cb063a1d391c94273572ea6edae76c8c8b0a07f8d75c88686f0df72a
SHA5124e6355f3051ed5e811ab030abde1f5be7f5e1cf33be99cd08477e9b6c015deb1d8bd75a09fb9c7176b8511c5ad0a67abc0902a3531e97564ccb6afc57496a47c
-
Filesize
1009B
MD511ab56a1c194f88db7e215811787c9a3
SHA1bc12c837aacb76019bbbf41fa99cfd6a63c14222
SHA256cc0e27f9dc10c2f633b25d7139f3b91a0a3a5b1ab6e40783ae8c0e5642b33d0e
SHA512ea4d3288788a24681bf8160ba71b6b707598cdc2cc880a07aaacdd2b0b0b13268ed74e0c2895cc6c640cb1fde1b8fa00c35f710f87bd234835b16d3c9b833417
-
Filesize
1009B
MD5d519385a84ee3223f72fa546ef447e4d
SHA1aa4afaca3f28bdf22d5542e1458286f17965ae10
SHA2560573e9dd0d29d85c84d40ac7d825fe8487d18a3d4aef17d917209df039847dea
SHA5122a527c66042337313ccedc42d623e06467d865d902ded1c329746578f32c97974e8bda8a23a9914c0c2e37250e264721caba8ee2bab9ce0e38c894cecde50d0c
-
Filesize
322KB
MD577dc50489b9323274732d27dc8a4e803
SHA10e02a3595b62489d0739d771881da8604d117c65
SHA256c5684e792d1ebefea6aac09fed45911703fd58c899f8a08133d49dd91429a820
SHA5120684a92f3e9c525384cfa53f531afba61e5930e1c27032a7e27e3315f72761b62e122dc34768d8162ba08f9bed53d148aa8dc034b46456bdd211f230637eba58
-
Filesize
13KB
MD58b94ff196120b29c89c5b7fa628dfcbe
SHA19313be521827656fcd9f05aa79a30c0859240fbc
SHA256f3cd0e8c0e41749b754990f345e2f05da510ead617ec15b0b8220e713444c6e8
SHA51212cffcd8a5ac1550a1c5544753e56374ec85ff894446998aaf2321727493a07eddb0bfa85e3c239b060d3b065e6eb9bbad3a8087b43ae749cad47e8f0a730b12
-
Filesize
525KB
MD5e69479005732f26e642cba1268168aba
SHA1a6828b2303cd2b3d8c231a8a07b5fe501de7f944
SHA2561dd99a05722e050a413e2912c8444dcb9838777acfe0db8631d6e348ffa9b115
SHA5123c34fc2d6ef99bc14f5f88ecf6adee54a353de36c764ad8540697142d97714462ce757e0d588591ee34bb9abed912b28141288aab3b4a9bc2df532735c3fefd5
-
Filesize
1KB
MD59aba8e7318bd8a665d84c001e03391a3
SHA14de57ab481d4268af59086ad16af3800811ff2f6
SHA256aadede467d4039fa1b551a57aa1b3e95ca0e1e882f75807f56a72cf787c0ceb6
SHA5127bec495d64ed74ded9aa0ccb92a78a9cdeab7a9945b4249b51d0be3cdc98e7b50366283160619b8ed111a8c15a50ae7823d71c4ca062357e2caf4df7522b63b0