Analysis
-
max time kernel
21s -
max time network
35s -
platform
android_x86 -
resource
android-x86-arm-20240624-en -
resource tags
-
submitted
28-10-2024 15:07
General
-
Target
253f17461d8627a8db2823512a2dbd1a14f0e1721698cdb8f832c313b5b79990.apk
-
Size
7.6MB
-
MD5
006251bc39f9a5a05e66ff8a6f2783d0
-
SHA1
e7fce65c74a03eb22bff94f11bc20e5641925baf
-
SHA256
253f17461d8627a8db2823512a2dbd1a14f0e1721698cdb8f832c313b5b79990
-
SHA512
0ed1d11119414bdd613c259f88326369248d370ecf78463c9eddd064e98c83fd1aca394296dc6eaaac46907c955fa9eb56ff5feafbaaf542e7074266d9b55e94
-
SSDEEP
196608:13431RGycj7aUirakcBc+JnZ7KqnJJPa0L:O33raX77PPa0L
Malware Config
Extracted
octo
Signatures
-
Octo
Octo is a banking malware with remote access capabilities first seen in April 2022.
-
Octo family
-
Octo payload 1 IoCs
-
Checks Android system properties for emulator presence. 1 TTPs 1 IoCs
-
Loads dropped Dex/Jar 1 TTPs 4 IoCs
Runs executable file dropped to the device during analysis.
-
Makes use of the framework's Accessibility service 4 TTPs 2 IoCs
Retrieves information displayed on the phone screen using AccessibilityService.
-
Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
-
Queries the phone number (MSISDN for GSM devices) 1 TTPs
-
Acquires the wake lock 1 IoCs
-
Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs
Application may abuse the framework's foreground service to continue running in the foreground.
-
Queries the mobile country code (MCC) 1 TTPs 1 IoCs
-
Queries the unique device ID (IMEI, MEID, IMSI) 1 TTPs
-
Reads information about phone network operator. 1 TTPs
-
Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs
-
Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs
-
Checks CPU information 2 TTPs 1 IoCs
-
Checks memory information 2 TTPs 1 IoCs
Processes
-
com.cstar76accesspair1⤵
- Checks Android system properties for emulator presence.
- Loads dropped Dex/Jar
- Makes use of the framework's Accessibility service
- Acquires the wake lock
- Makes use of the framework's foreground persistence service
- Queries the mobile country code (MCC)
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Uses Crypto APIs (Might try to encrypt user data)
- Checks CPU information
- Checks memory information
-
/system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.cstar76accesspair/app_dex/classes.dex --output-vdex-fd=41 --oat-fd=42 --oat-location=/data/user/0/com.cstar76accesspair/app_dex/oat/x86/classes.odex --compiler-filter=quicken --class-loader-context=&2⤵
- Loads dropped Dex/Jar
-
Network
MITRE ATT&CK Mobile v15
Persistence
Event Triggered Execution
1Broadcast Receivers
1Foreground Persistence
1Defense Evasion
Download New Code at Runtime
1Foreground Persistence
1Input Injection
1Virtualization/Sandbox Evasion
3System Checks
3Discovery
Software Discovery
1Security Software Discovery
1System Information Discovery
2System Network Configuration Discovery
4Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
48B
MD5046a414913add6f5bb60072c7db819b6
SHA1451ee4f6809260aec622d772fd329c7d0297a842
SHA256b66c1320cb063a1d391c94273572ea6edae76c8c8b0a07f8d75c88686f0df72a
SHA5124e6355f3051ed5e811ab030abde1f5be7f5e1cf33be99cd08477e9b6c015deb1d8bd75a09fb9c7176b8511c5ad0a67abc0902a3531e97564ccb6afc57496a47c
-
Filesize
1KB
MD535c77f7715326b9f46ec6a05131012ce
SHA1d2cd677f1d543b133fe81e1c117e7516dbee586f
SHA256a88d8836b92b8971507ea97d63eac134d4100274514d700c53fe191c9ba9e8ac
SHA512b7ff517a659eba8375fd8a083d8431a5f6821b0eb85049538eb799f32a345047b1e508e99e0139cf323e002849e9fbbf8fea060f1ed9f2af16a3ec0645969b31
-
Filesize
1KB
MD5dfa2c73a2c38e6dc85aefa508e666e37
SHA1c9b021a5ff7511a029a851ac7c8a963556d042ac
SHA256f3e06acd6f29154ad88b069a9cc3482824aef7df2a2e0d22215bf64b765ab91a
SHA512750ce21625927e91e6d568a62e9fee9f6db656840b3b513bd502bc8f18ae8ac96115258e6a705a172167c84cd16cf085bc76899663ecff6d902172d3c19f67ca
-
Filesize
1KB
MD593bf833de33f74766f612f5aae49f0d3
SHA18e0ac819e2991b99e3b6c5d3d234348ae38bf094
SHA25690cd3ea3ed8cf1e71a761facf5b5a3a1fc51b6798aacae2285f8867127f019fa
SHA512cd4271d90ecc1954e0ba20aa36256e1fb38da87252db31405519b297ad5cce096f0a4f8fbf50aae1e749b2a1dc16714a7963f07e1452ea3d50d1a3055fb39985
-
Filesize
307KB
MD54e73947cabb5db3f92ca85004981b754
SHA16d9667fdb0280ed2dcb782b4683e422a51bdc601
SHA2566db94232e756b90ed437f1bc87dc38cf20fb2e7c7a19a5e40c6c17254b7e234c
SHA512be8b500a7070af1dfb53b0cf1a7b327dadc4e163a6dad905496ac228c58cd1ed87b054533917924455d35e9b300683ae33e1bcdd91935a5dbae1d693c3e13d69
-
Filesize
1KB
MD5b7b57a09f6023e8beb2fa7674bf8146e
SHA1c24d1a4039b1e56f27244905aaef3205f0f0e1aa
SHA2563ce379ae109e4e7bb2051cbcc0bb79685b36a485a78ab2a773fb034506d8c1be
SHA512d30ff87456df74cc95d705c800b4a94fd8ad7206ec2ef35675ff2ff5828dfeb696b600f55025d0705f7566e825c87bb21c21ae87109162042cf0a8f2edb3afe7
-
Filesize
525KB
MD5928b0bd38c3780b351c648456942fa74
SHA1fe75a59058100c402b6dde09a7182552b71d0b4d
SHA25622266695f0f4c72cdd368e9bad4da01f18a79eb369cf430c785ef4e1f16c0f96
SHA5122032219b8244dcad1402b705832e388ab4eb09a3ea84ca496dcda44233f6e6ebd3578a2095552b7da40d4314a0a8a78accb7c9951bc113ce47a276f46cdab0ee