Analysis
-
max time kernel
22s -
max time network
37s -
platform
android_x86 -
resource
android-x86-arm-20240624-en -
resource tags
-
submitted
11-11-2024 09:46
General
-
Target
base.apk
-
Size
8.9MB
-
MD5
c7d05707685d07e5ccdcbf148043121c
-
SHA1
5bb2cf2055fb14a1fd8d31e1b6b5e46b672de0a5
-
SHA256
999714b5aacaa1c666a64f16ac24a1a34482f5ee21f527552609e9e1b58c6662
-
SHA512
787e25bc473e1ff558f8d7c560849207680dedb985cc9820ab55b3997389394f0c07ae42747b226fe1a2837f485be9cf30a02ab5db49df03fef13373769cba7b
-
SSDEEP
98304:KnckaupqDIkp9B9tofKEfBC+5iSRGM6VKsTM7Sw/YmvZ7IivY3XORsOkdZV9NwJK:Knck1Ax+rwUN7Sw9Z79w3XOR6ZfSJK
Malware Config
Extracted
octo
Signatures
-
Octo
Octo is a banking malware with remote access capabilities first seen in April 2022.
-
Octo family
-
Octo payload 1 IoCs
-
Checks Android system properties for emulator presence. 1 TTPs 1 IoCs
-
Loads dropped Dex/Jar 1 TTPs 3 IoCs
Runs executable file dropped to the device during analysis.
-
Makes use of the framework's Accessibility service 4 TTPs 2 IoCs
Retrieves information displayed on the phone screen using AccessibilityService.
-
Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
-
Queries the phone number (MSISDN for GSM devices) 1 TTPs
-
Acquires the wake lock 1 IoCs
-
Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs
Application may abuse the framework's foreground service to continue running in the foreground.
-
Queries the mobile country code (MCC) 1 TTPs 1 IoCs
-
Queries the unique device ID (IMEI, MEID, IMSI) 1 TTPs
-
Reads information about phone network operator. 1 TTPs
-
Requests disabling of battery optimizations (often used to enable hiding in the background). 1 TTPs 1 IoCs
-
Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs
-
Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs
-
Checks CPU information 2 TTPs 1 IoCs
-
Checks memory information 2 TTPs 1 IoCs
Processes
-
com.bluetooth_internalx551⤵
- Checks Android system properties for emulator presence.
- Loads dropped Dex/Jar
- Makes use of the framework's Accessibility service
- Acquires the wake lock
- Makes use of the framework's foreground persistence service
- Queries the mobile country code (MCC)
- Requests disabling of battery optimizations (often used to enable hiding in the background).
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Uses Crypto APIs (Might try to encrypt user data)
- Checks CPU information
- Checks memory information
-
/system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.bluetooth_internalx55/app_sauce/jJljSTq.json --output-vdex-fd=41 --oat-fd=42 --oat-location=/data/user/0/com.bluetooth_internalx55/app_sauce/oat/x86/jJljSTq.odex --compiler-filter=quicken --class-loader-context=&2⤵
- Loads dropped Dex/Jar
-
Network
MITRE ATT&CK Mobile v15
Persistence
Event Triggered Execution
1Broadcast Receivers
1Foreground Persistence
1Defense Evasion
Download New Code at Runtime
1Foreground Persistence
1Hide Artifacts
1User Evasion
1Input Injection
1Virtualization/Sandbox Evasion
3System Checks
3Discovery
Software Discovery
1Security Software Discovery
1System Information Discovery
2System Network Configuration Discovery
4Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
48B
MD5046a414913add6f5bb60072c7db819b6
SHA1451ee4f6809260aec622d772fd329c7d0297a842
SHA256b66c1320cb063a1d391c94273572ea6edae76c8c8b0a07f8d75c88686f0df72a
SHA5124e6355f3051ed5e811ab030abde1f5be7f5e1cf33be99cd08477e9b6c015deb1d8bd75a09fb9c7176b8511c5ad0a67abc0902a3531e97564ccb6afc57496a47c
-
Filesize
1002B
MD53bd4c37d15f2cb4118eb91fcfc769133
SHA16ae33e1907f0b3899d8770ee07aeef9d24d251f8
SHA256db6e8878b72ef5ede5af28fd2322c429de313b12916591bfc57c9d8cf111d29b
SHA5122cf49630c0c97e526f87f6e99713ec79c19c058433cdeb24e61fe4337bb8e2fa6f832e54adc2528b380fa1030b54475f5775010e2e0940ed045c50047c268ebd
-
Filesize
1002B
MD55887d83c031f1cdb06e5925a7e50bbc5
SHA1942297d540b74d27305554e5a4cd5e90daa816b4
SHA256e5eac6e68d028984022a319230b22dd951390705c8ac017d8bc030f5534f16d3
SHA5124688df60fa3da5f40e32aefcd9ee153fedb89a1e41db8a3ab44934d709249cd8bff3d6046194a8a8d1234199a0bfddfcfadd6ddef6f755be7c8c955f4ef084cd
-
Filesize
307KB
MD54e73947cabb5db3f92ca85004981b754
SHA16d9667fdb0280ed2dcb782b4683e422a51bdc601
SHA2566db94232e756b90ed437f1bc87dc38cf20fb2e7c7a19a5e40c6c17254b7e234c
SHA512be8b500a7070af1dfb53b0cf1a7b327dadc4e163a6dad905496ac228c58cd1ed87b054533917924455d35e9b300683ae33e1bcdd91935a5dbae1d693c3e13d69
-
Filesize
1KB
MD571a6bd0c8ee2082f5733f74e2644f07a
SHA1e458992c9379bd508cf4a370223a7d654cc31c06
SHA256b5b3dcd660cf1204632956d2f9b77536946cf70866b54b33582fdbd70dddcaea
SHA512629863e988e10ff1af62b9a8e526a3ce4fa532882552e9adb4eebba8c34763726fbf4fd441a6dc0878ec5fc4cdba89ea79e11e15a35c53e4a81dfac62f1da990
-
Filesize
1KB
MD55c1088e942da4166e768b1692ae6fb86
SHA12be4357e2219a0f47de7cd49a235670e0d7dc0ee
SHA256b61d8f29ef607c6d2b6555cb833ac803d56ff1c1e403cb5a29e17af33df41e1a
SHA5122764556e51cf03bb893e9f31a60de1ea8ed9cb356b38fc2900adb847ad330d8c04e80b0d22b5cb1bb52c2307db1a10d728347c852913ad21f402ea50161e2b8c
-
Filesize
526KB
MD530d19a79022f0c0a6231de708c1619e7
SHA181c0d4f2583195f3c938e94f7b73ef0b51473a7d
SHA256126acc1f945ee556adfcd76bad84619a26c88d73293449d2aba5acb8765be2a3
SHA51279b59a6baf59e23c30f4b5f924eda928bb544989c3984fcf0d4cf13e7b57040e777707752002341d9ac670f7fb633aa828c494cbda7680b0c492aba34fc347d5