Analysis
-
max time kernel
149s -
max time network
159s -
platform
android_x64 -
resource
android-x64-arm64-20240624-en -
resource tags
-
submitted
28-10-2024 15:41
General
-
Target
4386e5cda809e8ad478ec338e88e064030f9d009c050d25dc6ccfd680b8cea06.apk
-
Size
9.4MB
-
MD5
6894ef37420fc686f0576149bfc5d2e9
-
SHA1
ff4c8ac88813cb8c3ef7edb9c7abc499bce89cb9
-
SHA256
4386e5cda809e8ad478ec338e88e064030f9d009c050d25dc6ccfd680b8cea06
-
SHA512
0ee4ecc111930bfef8d4f272bb41a9944bc3f6e760b6efd65c43fc05aaaacec0457246525c55d26a19cf63b68951657984b2234b59de36e3e4ffb8b68329cc0a
-
SSDEEP
98304:1IYdaO2yvdMNGj71Rs7RMVKYO5iSRGfRZ8mtdPMM7BF+DyG:1Bv+cj71RIMUvr2Z8yPM/
Malware Config
Extracted
octo
Signatures
-
Octo
Octo is a banking malware with remote access capabilities first seen in April 2022.
-
Octo family
-
Octo payload 1 IoCs
-
Loads dropped Dex/Jar 1 TTPs 2 IoCs
Runs executable file dropped to the device during analysis.
-
Makes use of the framework's Accessibility service 4 TTPs 2 IoCs
Retrieves information displayed on the phone screen using AccessibilityService.
-
Obtains sensitive information copied to the device clipboard 2 TTPs 1 IoCs
Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.
-
Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
-
Queries the phone number (MSISDN for GSM devices) 1 TTPs
-
Acquires the wake lock 1 IoCs
-
Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs
Application may abuse the framework's foreground service to continue running in the foreground.
-
Queries the mobile country code (MCC) 1 TTPs 1 IoCs
-
Reads information about phone network operator. 1 TTPs
-
Requests disabling of battery optimizations (often used to enable hiding in the background). 1 TTPs 1 IoCs
-
Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs
-
Checks CPU information 2 TTPs 1 IoCs
-
Checks memory information 2 TTPs 1 IoCs
Processes
-
com.gmmulti26restorephotos1⤵
- Loads dropped Dex/Jar
- Makes use of the framework's Accessibility service
- Obtains sensitive information copied to the device clipboard
- Acquires the wake lock
- Makes use of the framework's foreground persistence service
- Queries the mobile country code (MCC)
- Requests disabling of battery optimizations (often used to enable hiding in the background).
- Uses Crypto APIs (Might try to encrypt user data)
- Checks CPU information
- Checks memory information
Network
MITRE ATT&CK Mobile v15
Defense Evasion
Download New Code at Runtime
1Foreground Persistence
1Hide Artifacts
1User Evasion
1Input Injection
1Virtualization/Sandbox Evasion
2System Checks
2Credential Access
Clipboard Data
1Input Capture
2GUI Input Capture
1Keylogging
1Discovery
Software Discovery
1Security Software Discovery
1System Information Discovery
2System Network Configuration Discovery
3Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
48B
MD5046a414913add6f5bb60072c7db819b6
SHA1451ee4f6809260aec622d772fd329c7d0297a842
SHA256b66c1320cb063a1d391c94273572ea6edae76c8c8b0a07f8d75c88686f0df72a
SHA5124e6355f3051ed5e811ab030abde1f5be7f5e1cf33be99cd08477e9b6c015deb1d8bd75a09fb9c7176b8511c5ad0a67abc0902a3531e97564ccb6afc57496a47c
-
Filesize
1019B
MD5f295242545beacd1d6b351d96d21907d
SHA1fe51db5322e3b04a8ec44950543f6fcd01253317
SHA2566af8b14982410b07ecea983bf6ccd2b061915ae9936d55a1f6abceedbf3a0883
SHA51243ece9e0a017caa0c71ffc00a1ced1cdfea9f3d480d9f307a84cede510b062c63e3c1832065c535b5bef2a85d86ad926bb2283a555654112282159a91dad4a5c
-
Filesize
1019B
MD5cd2bd9ddaf454619bcbcb1b71b613492
SHA18750defbb9e15e47df800f7fc89c10f34acfab90
SHA25606bcd265b389b2d8daeb8c032457c52d7579d65e554315d67c318566035ebbba
SHA5120143dba8c06f5a56668055708aefad1b9b591055f78d21a76b9b5b437e4f23697b4d54c9d1e77ceb759cf313f1cab5f4978b3aa195288f12ffce9b4dea124dd6
-
Filesize
322KB
MD577dc50489b9323274732d27dc8a4e803
SHA10e02a3595b62489d0739d771881da8604d117c65
SHA256c5684e792d1ebefea6aac09fed45911703fd58c899f8a08133d49dd91429a820
SHA5120684a92f3e9c525384cfa53f531afba61e5930e1c27032a7e27e3315f72761b62e122dc34768d8162ba08f9bed53d148aa8dc034b46456bdd211f230637eba58
-
Filesize
486B
MD560fe8211215db1d621aefe2ed7fe482b
SHA15430e29da7ea9117db15b6a2db423de334a25bd6
SHA25609fa0642607996ed0aa3db78b2cab1f4bdbf6b0f364379cdba4153f727ba802e
SHA5126f715d84d5e718e86fe13545b923c0d6ed2bee2410229b6a0294b03ff836902d5e72949afe5f3597e9c639ee22599dcce97dafa45abc8cb3a927fa9f19686b11
-
Filesize
526KB
MD5ffaaa9cf7148267fac910215658259fb
SHA1bc46a30baeeaed4e6e574891cc8943671977a754
SHA256c60bc78a452dd65aecd6bd3fd5189253762debf00fbd2235bc18a8b0d95a50f1
SHA512d89816daceb01f7d015835df7e9e6f5d7bbd408a608b40fc109b78e541d29a2ce7164f68e3c577bf9439e720840ca9be9f25e7a06d86624e20272cf00e727bde
-
Filesize
1KB
MD5caf6b8d3d1efc7e7047985a8b174fb4d
SHA1495796e9fe7427a627fe2444842ab848db77c64c
SHA25611b8a6a0de32af75f935869fe844454741d47bb6a4e19b2becc54a254ac7fea4
SHA512a1b8654d5e9c59cbff57a74a226d738cef0506d8e864c42fb3d2d19a72fd984df86f02a47e677b048501b4bcfc3caa94a20bcd450c4988fbc74eb9a4c9b1e4dc