Overview

overview

10

Static

static

6

0c0a1d4950...63.apk

android-9-x86

10

Analysis

  • max time kernel
    25s
  • max time network
    39s
  • platform
    android_x86
  • resource
    android-x86-arm-20240624-en
  • resource tags

    androidarch:armarch:x86image:android-x86-arm-20240624-enlocale:en-usos:android-9-x86system
  • submitted
    28-10-2024 15:35

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    0c0a1d49508a42185eaa833f3e77555c7b0622b674ac647e215417459e0ffb63.apk

  • Size

    10.9MB

  • MD5

    f4c6363768f2b6b6d807acbde027a33b

  • SHA1

    30913a5e066ec4b0a94f9956f7ab86f26ab98f1d

  • SHA256

    0c0a1d49508a42185eaa833f3e77555c7b0622b674ac647e215417459e0ffb63

  • SHA512

    bd0dbd9ddb66b564a81dcde17f694907ae44e6198b2168448f75e4bcb5f93ed5d0f95f589b34d6ce5553e87b68555a162f0e754c9d1826f6756d512a5fa988d3

  • SSDEEP

    98304:4JwCfOcmISrQZbMhbULwKbxjVKNqnMx3XT5iSRGoRRsp97BSwNysAe3ra69kYhPb:UO38UN063XTr7R49BDNda69kYhPuM

Score
10/10
octobankercollectioncredential_accessdiscoveryevasionimpactinfostealerpersistencerattrojan

Malware Config

Extracted

Family

octo

AES_key
AES_key

Signatures

  • Octo

    Octo is a banking malware with remote access capabilities first seen in April 2022.

    bankertrojaninfostealerratocto
  • Octo family
    octo
  • Octo payload 1 IoCs
  • Loads dropped Dex/Jar 1 TTPs 3 IoCs

    Runs executable file dropped to the device during analysis.

    evasion
  • Makes use of the framework's Accessibility service 4 TTPs 2 IoCs

    Retrieves information displayed on the phone screen using AccessibilityService.

    collectionevasioncredential_access
  • Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
    bankerdiscovery
  • Queries the phone number (MSISDN for GSM devices) 1 TTPs
    discovery
  • Acquires the wake lock 1 IoCs
  • Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs

    Application may abuse the framework's foreground service to continue running in the foreground.

    evasionpersistence
  • Queries the mobile country code (MCC) 1 TTPs 1 IoCs
    discovery
  • Queries the unique device ID (IMEI, MEID, IMSI) 1 TTPs
    discovery
  • Requests disabling of battery optimizations (often used to enable hiding in the background). 1 TTPs 1 IoCs
    evasion
  • Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs
    persistence
  • Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs
    impact
  • Checks CPU information 2 TTPs 1 IoCs
  • Checks memory information 2 TTPs 1 IoCs

Processes

  • com.ftrim_navbarbc
    1⤵
    • Loads dropped Dex/Jar
    • Makes use of the framework's Accessibility service
    • Acquires the wake lock
    • Makes use of the framework's foreground persistence service
    • Queries the mobile country code (MCC)
    • Requests disabling of battery optimizations (often used to enable hiding in the background).
    • Registers a broadcast receiver at runtime (usually for listening for system events)
    • Uses Crypto APIs (Might try to encrypt user data)
    • Checks CPU information
    • Checks memory information
    PID:4233
    • /system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.ftrim_navbarbc/app_swing/AtlA.json --output-vdex-fd=41 --oat-fd=42 --oat-location=/data/user/0/com.ftrim_navbarbc/app_swing/oat/x86/AtlA.odex --compiler-filter=quicken --class-loader-context=&
      2⤵
      • Loads dropped Dex/Jar
      PID:4262

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Event Triggered Execution

1
T1624

Broadcast Receivers

1
T1624.001

Foreground Persistence

1
T1541

Privilege Escalation

Defense Evasion

Download New Code at Runtime

1
T1407

Foreground Persistence

1
T1541

Hide Artifacts

1
T1628

User Evasion

1
T1628.002

Input Injection

1
T1516

Virtualization/Sandbox Evasion

2
T1633

System Checks

2
T1633.001

Credential Access

Input Capture

2
T1417

GUI Input Capture

1
T1417.002

Keylogging

1
T1417.001

Discovery

Software Discovery

1
T1418

Security Software Discovery

1
T1418.001

System Information Discovery

2
T1426

System Network Configuration Discovery

3
T1422

Lateral Movement

Collection

Input Capture

2
T1417

GUI Input Capture

1
T1417.002

Keylogging

1
T1417.001

Screen Capture

1
T1513

Command and Control

Exfiltration

Impact

Data Encrypted for Impact

1
T1471

Input Injection

1
T1516

Replay Monitor

Loading Replay Monitor...

Downloads

  • /data/data/com.ftrim_navbarbc/.global.com.ftrim_navbarbc
    Filesize

    48B

    MD5

    046a414913add6f5bb60072c7db819b6

    SHA1

    451ee4f6809260aec622d772fd329c7d0297a842

    SHA256

    b66c1320cb063a1d391c94273572ea6edae76c8c8b0a07f8d75c88686f0df72a

    SHA512

    4e6355f3051ed5e811ab030abde1f5be7f5e1cf33be99cd08477e9b6c015deb1d8bd75a09fb9c7176b8511c5ad0a67abc0902a3531e97564ccb6afc57496a47c

    Download Submit

  • /data/data/com.ftrim_navbarbc/app_swing/AtlA.json
    Filesize

    1006B

    MD5

    38642fd693e7e5163a06fb798728af0b

    SHA1

    ff67431ed033c91cfb65d18be85d69b12416ebd1

    SHA256

    80f833f0c2948e261abc3bcbbaf4432e15405168eeb0b173eb2ab1438c7d2744

    SHA512

    bd62a2f24b9c26d9df4ac7daaa551417560954e6272d99d4c9edeb8931233deb64ba1f5673126b84a1ceaa5c3ca724a92e94e94ce1c39e43802a6edb6d0774ac

    Download Submit

  • /data/data/com.ftrim_navbarbc/app_swing/AtlA.json
    Filesize

    1006B

    MD5

    09b8c3cb2ce4ce2ee217838f71139d06

    SHA1

    aeeeaf14f0c24bcc277d2719323c448a435268d1

    SHA256

    bd73cb0d8dd4726c97be2f07b39d69dd7a11da594d9e0057ffa2865fc08bf4b5

    SHA512

    abdf01beba72fb3c8c6ef0ceed37a96e58dc0bb37e2e213af5a312cdf17f1f3c4a91e6581e140887758cea64c60f5b9a9f67e72d942ea895cba4dd2012235298

    Download Submit

  • /data/data/com.ftrim_navbarbc/files/.m
    Filesize

    307KB

    MD5

    4e73947cabb5db3f92ca85004981b754

    SHA1

    6d9667fdb0280ed2dcb782b4683e422a51bdc601

    SHA256

    6db94232e756b90ed437f1bc87dc38cf20fb2e7c7a19a5e40c6c17254b7e234c

    SHA512

    be8b500a7070af1dfb53b0cf1a7b327dadc4e163a6dad905496ac228c58cd1ed87b054533917924455d35e9b300683ae33e1bcdd91935a5dbae1d693c3e13d69

    Download Submit

  • /data/user/0/com.ftrim_navbarbc/app_swing/AtlA.json
    Filesize

    1KB

    MD5

    ed968f662810e0c5aca3acbb495442aa

    SHA1

    9d8889649d8ab304081ae9a7977a5c1ec1d24111

    SHA256

    7ce52145797436d6b17828408e3e52019f63f282463cfd2e160f527cc4944a52

    SHA512

    49f75430e5fe98acb9c5c70b4a3df82f8b7243fb4b36d2857b264dec6de1f63fdc2acd0b491c21f9141e90ca9e9346c381d15ed0e8f228c38eae258075928b1c

    Download Submit

  • /data/user/0/com.ftrim_navbarbc/app_swing/AtlA.json
    Filesize

    1KB

    MD5

    a2c1e51eadb0be88a4d7874b59b33668

    SHA1

    641de20ebb74d98f0155b3fd0455866f90f86bf8

    SHA256

    465ccb7553fe96bc9fe777426c0f41c7e9751418804d0d27b72ab48b486bf7ff

    SHA512

    be3a60c4ee7888f3dd9c92d0317874d4a434916e683b2b3c93a05b5c2e5d0622b0c5a91225e943a378474b941f17b7c387d59f5fc5f70a21d964bf03dda263f4

    Download Submit

  • Anonymous-DexFile@0xc8a89000-0xc8b0c6bc
    Filesize

    525KB

    MD5

    b774f11f9cca662e4664f9edea1c9076

    SHA1

    d256903b6152baac70694ec5ffd989fc3e178b64

    SHA256

    4ef640fa26e275e5c341ac640b63930fde022bdbe626823da0350a2d36d112e7

    SHA512

    a84dc968c542576627e486eb05cbb2c028e6f19ccdda37f95376b892cc5a82669d389282ee993aaad75ca6b92d76a296e99dfa9a8563f746941f9afe1279809a

    Download Submit