Analysis
-
max time kernel
22s -
max time network
35s -
platform
android_x86 -
resource
android-x86-arm-20240624-en -
resource tags
-
submitted
28-10-2024 15:34
General
-
Target
d4116b79d56558ca884e6c3ca8aef8e9dd843e574dba7951aa5559cb632e269a.apk
-
Size
7.6MB
-
MD5
cb5527f3c324592434e16f40c5d53dc6
-
SHA1
0e09d9db0c3e5e5638adec9aff58aa6b20fa3bc8
-
SHA256
d4116b79d56558ca884e6c3ca8aef8e9dd843e574dba7951aa5559cb632e269a
-
SHA512
758ce6fb4987f6c7e1c1e5862372b103fc2ee011aae90c9abdf560f7bdc627d15873252833802b662a777add1ae8f927837b350da5d1e19c60f917521d1291f9
-
SSDEEP
98304:NUcRsQDMyP0a5iSRG1eVK6u3hI6ixO3XRRsY9WcdmY553v5qmGqiLin:NXXcarlUP3fi03XRRZfdKen
Malware Config
Extracted
octo
Signatures
-
Octo
Octo is a banking malware with remote access capabilities first seen in April 2022.
-
Octo family
-
Octo payload 1 IoCs
-
Checks Android system properties for emulator presence. 1 TTPs 1 IoCs
-
Loads dropped Dex/Jar 1 TTPs 3 IoCs
Runs executable file dropped to the device during analysis.
-
Makes use of the framework's Accessibility service 4 TTPs 2 IoCs
Retrieves information displayed on the phone screen using AccessibilityService.
-
Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
-
Queries the phone number (MSISDN for GSM devices) 1 TTPs
-
Acquires the wake lock 1 IoCs
-
Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs
Application may abuse the framework's foreground service to continue running in the foreground.
-
Queries the mobile country code (MCC) 1 TTPs 1 IoCs
-
Queries the unique device ID (IMEI, MEID, IMSI) 1 TTPs
-
Reads information about phone network operator. 1 TTPs
-
Requests disabling of battery optimizations (often used to enable hiding in the background). 1 TTPs 1 IoCs
-
Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs
-
Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs
-
Checks CPU information 2 TTPs 1 IoCs
-
Checks memory information 2 TTPs 1 IoCs
Processes
-
com.trashmoverv51⤵
- Checks Android system properties for emulator presence.
- Loads dropped Dex/Jar
- Makes use of the framework's Accessibility service
- Acquires the wake lock
- Makes use of the framework's foreground persistence service
- Queries the mobile country code (MCC)
- Requests disabling of battery optimizations (often used to enable hiding in the background).
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Uses Crypto APIs (Might try to encrypt user data)
- Checks CPU information
- Checks memory information
-
/system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.trashmoverv5/app_art/DmsUEJw.json --output-vdex-fd=41 --oat-fd=42 --oat-location=/data/user/0/com.trashmoverv5/app_art/oat/x86/DmsUEJw.odex --compiler-filter=quicken --class-loader-context=&2⤵
- Loads dropped Dex/Jar
-
Network
MITRE ATT&CK Mobile v15
Persistence
Event Triggered Execution
1Broadcast Receivers
1Foreground Persistence
1Defense Evasion
Download New Code at Runtime
1Foreground Persistence
1Hide Artifacts
1User Evasion
1Input Injection
1Virtualization/Sandbox Evasion
3System Checks
3Discovery
Software Discovery
1Security Software Discovery
1System Information Discovery
2System Network Configuration Discovery
4Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
48B
MD5046a414913add6f5bb60072c7db819b6
SHA1451ee4f6809260aec622d772fd329c7d0297a842
SHA256b66c1320cb063a1d391c94273572ea6edae76c8c8b0a07f8d75c88686f0df72a
SHA5124e6355f3051ed5e811ab030abde1f5be7f5e1cf33be99cd08477e9b6c015deb1d8bd75a09fb9c7176b8511c5ad0a67abc0902a3531e97564ccb6afc57496a47c
-
Filesize
1013B
MD53ff51e4413998a0cd95c20a16c1496f8
SHA1594b1c164dd919eb5b4bc1389c3a60c3d3fee6f4
SHA25690c0e9c72c48790db05607aa23773aa545ad9abe1e5984265e7c4c750a04e2ee
SHA512ebc4b09fbea53ecc0ad7cc016410d148767a8bcc1567d4b805d7c199fd798b58ca0e8bdec94931e4164f05384a63cf828c9121c608beff1629f624679c5f3c2a
-
Filesize
1013B
MD58a992e3c0614ea29970dda8ba59e6821
SHA16196377bd3af71ece0620cb870009da60d44818b
SHA25631a0cbe50014fd4ab6ae968276cbf7a4cf2bc21d2d779e545179213a4fc3c18b
SHA512b821a6d56d9c8f26a2ee6f1398f2066075e3c2bc357ef45f68437c01f7b60e11d7be916e1b8fc38a31db76bee451cd336c45394bad2194c7a63a699df105bc69
-
Filesize
307KB
MD54e73947cabb5db3f92ca85004981b754
SHA16d9667fdb0280ed2dcb782b4683e422a51bdc601
SHA2566db94232e756b90ed437f1bc87dc38cf20fb2e7c7a19a5e40c6c17254b7e234c
SHA512be8b500a7070af1dfb53b0cf1a7b327dadc4e163a6dad905496ac228c58cd1ed87b054533917924455d35e9b300683ae33e1bcdd91935a5dbae1d693c3e13d69
-
Filesize
1KB
MD5001f11b327941cb09ccf3bfb517602a2
SHA1bade423f2956767472f1140cebca28f26accf84f
SHA256399c601b81caa990fb937c83386ec4b21dcc295bf4b3c01d869d15ecff09a893
SHA51295ab711cde3b89591ff806750d0ab4ddc9b659d687117db279129c1642e94db75a0498193de7bcb900390d7cc5b3a9d4e068cb60ebac0d63af9319d3e4d7c991
-
Filesize
1KB
MD5522606114b2751229f8d8f0aefd4f62a
SHA1fd050eee77f3e20c0874d002a9a65e31de8b9b74
SHA256257a814345dd702c1e65a1cc70552ad4d87b45adfbbe450dba71a125bc564fbc
SHA512ff18bbc780168ce1610196f29df5dd7c1d813daebf29117842e79d3533d145a7dcd5f1ea7f87828f589888812152d2a6efcc86bafcf4de9e0db7c89ce7ce2d21
-
Filesize
525KB
MD5313d08d1cebf5b2ec2cd8106520da093
SHA1efb36649c8f9641b4685dd108d77561b3c6fbed9
SHA256ad03130d79cda628062462a3a9fa6d694b2ca8497cc380662b4639dc02d8549d
SHA5124c27cc59491eb3e3fd9a58f7327d213d9c73fe748f4b53cb0e8a2f5731d431aff0353d507390ef88d25b1149c3d4db55e0c12392e249f8df6bc6ca3b3b3a22d0