Overview

overview

10

Static

static

6

ecfa480387...ca.apk

android-9-x86

10

Analysis

  • max time kernel
    21s
  • max time network
    36s
  • platform
    android_x86
  • resource
    android-x86-arm-20240624-en
  • resource tags

    androidarch:armarch:x86image:android-x86-arm-20240624-enlocale:en-usos:android-9-x86system
  • submitted
    01-12-2024 22:19

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    ecfa4803876c011f655d963642c30821b7b168a049778087a79efe6f7489e7ca.apk

  • Size

    7.9MB

  • MD5

    c559ced78830dbbd7c98fef2b968e4e8

  • SHA1

    10f916edb31b7f9aef58fe6b8fb178d8294511ec

  • SHA256

    ecfa4803876c011f655d963642c30821b7b168a049778087a79efe6f7489e7ca

  • SHA512

    be2db74b9610349630b135b6a1c0acd3c540c4b8fdc3c7d7ed151ed01e48bd14e907765fd617e7be5532f19de142646868609b77cf1e1cbb4d82132117e12289

  • SSDEEP

    98304:6urTIa34VKnk8Mq3Xa5iSRGXjRs9JKUteNet18KqPQwwCfOZ:1ga34Uk8p3XaroRcJKE7uQ5/

Score
10/10
octobankercollectioncredential_accessdiscoveryevasionimpactinfostealerpersistencerattrojan

Malware Config

Extracted

Family

octo

AES_key
AES_key

Signatures

  • Octo

    Octo is a banking malware with remote access capabilities first seen in April 2022.

    bankertrojaninfostealerratocto
  • Octo family
    octo
  • Octo payload 1 IoCs
  • Checks Android system properties for emulator presence. 1 TTPs 1 IoCs
    evasion
  • Loads dropped Dex/Jar 1 TTPs 3 IoCs

    Runs executable file dropped to the device during analysis.

    evasion
  • Makes use of the framework's Accessibility service 4 TTPs 2 IoCs

    Retrieves information displayed on the phone screen using AccessibilityService.

    collectionevasioncredential_access
  • Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
    bankerdiscovery
  • Queries the phone number (MSISDN for GSM devices) 1 TTPs
    discovery
  • Acquires the wake lock 1 IoCs
  • Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs

    Application may abuse the framework's foreground service to continue running in the foreground.

    evasionpersistence
  • Queries the mobile country code (MCC) 1 TTPs 1 IoCs
    discovery
  • Queries the unique device ID (IMEI, MEID, IMSI) 1 TTPs
    discovery
  • Reads information about phone network operator. 1 TTPs
    discovery
  • Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs
    persistence
  • Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs
    impact
  • Checks CPU information 2 TTPs 1 IoCs
  • Checks memory information 2 TTPs 1 IoCs

Processes

  • com.hand_marketk91
    1⤵
    • Checks Android system properties for emulator presence.
    • Loads dropped Dex/Jar
    • Makes use of the framework's Accessibility service
    • Acquires the wake lock
    • Makes use of the framework's foreground persistence service
    • Queries the mobile country code (MCC)
    • Registers a broadcast receiver at runtime (usually for listening for system events)
    • Uses Crypto APIs (Might try to encrypt user data)
    • Checks CPU information
    • Checks memory information
    PID:4253
    • /system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.hand_marketk91/app_critic/dUjLk.json --output-vdex-fd=41 --oat-fd=42 --oat-location=/data/user/0/com.hand_marketk91/app_critic/oat/x86/dUjLk.odex --compiler-filter=quicken --class-loader-context=&
      2⤵
      • Loads dropped Dex/Jar
      PID:4278

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • /data/data/com.hand_marketk91/.global.com.hand_marketk91
    Filesize

    48B

    MD5

    046a414913add6f5bb60072c7db819b6

    SHA1

    451ee4f6809260aec622d772fd329c7d0297a842

    SHA256

    b66c1320cb063a1d391c94273572ea6edae76c8c8b0a07f8d75c88686f0df72a

    SHA512

    4e6355f3051ed5e811ab030abde1f5be7f5e1cf33be99cd08477e9b6c015deb1d8bd75a09fb9c7176b8511c5ad0a67abc0902a3531e97564ccb6afc57496a47c

    Download Submit

  • /data/data/com.hand_marketk91/app_critic/dUjLk.json
    Filesize

    1012B

    MD5

    ba481af40b78821d183bcd96882aefe6

    SHA1

    f712165becf9d2138f666d9192c4786695a87a57

    SHA256

    2a9ce2ddbda32d576c93da399ad1928bd765b4a848158faa34ec95025f14a055

    SHA512

    21c68ff363bd4a62e8d057393dbe50313c7d8f5c98e292021dcb67512ade8d51390b2eedbef7ba993d607b6ff4709ecc86821805611204f258650e1f89fda125

    Download Submit

  • /data/data/com.hand_marketk91/app_critic/dUjLk.json
    Filesize

    1012B

    MD5

    2074dab153f4dcfc1f9cd547baa0af20

    SHA1

    c6e7716e3cd186a5cc1947873374b7ace83101b4

    SHA256

    5920ef3221bdffb59906c1d3921ba734e9de8920db537fd9a490aa5e5ff9108c

    SHA512

    a6c5c1de5d2b3e7a6deeaaf4f794c7f48de7b0ca6080020fffae840430ced283d9198ec5f781773d9f3df672a961855c6724860d227a9bad67530e40931d796d

    Download Submit

  • /data/data/com.hand_marketk91/files/.t
    Filesize

    307KB

    MD5

    4e73947cabb5db3f92ca85004981b754

    SHA1

    6d9667fdb0280ed2dcb782b4683e422a51bdc601

    SHA256

    6db94232e756b90ed437f1bc87dc38cf20fb2e7c7a19a5e40c6c17254b7e234c

    SHA512

    be8b500a7070af1dfb53b0cf1a7b327dadc4e163a6dad905496ac228c58cd1ed87b054533917924455d35e9b300683ae33e1bcdd91935a5dbae1d693c3e13d69

    Download Submit

  • /data/user/0/com.hand_marketk91/app_critic/dUjLk.json
    Filesize

    1KB

    MD5

    0610c367e347e5c239f1b7bf2650d45e

    SHA1

    1678fabc8f24881f9481ecb6ce3bf6bd57fcd7b6

    SHA256

    14a84445b808da2ed256c32877f59bd0110b4d8c4c587664521e6b731ffb6a6d

    SHA512

    7dd71246ec16db31e5520324ba9098645ce9205933d2208ba2b9fcee815d5c20121c742af4050e1dde440c7ef95607c5cc2af170192f9aaec5768bc89b032d43

    Download Submit

  • /data/user/0/com.hand_marketk91/app_critic/dUjLk.json
    Filesize

    1KB

    MD5

    d488afeed4dafb4c7555fd478314e031

    SHA1

    4e7df7ef33fd0d5c1e2fd29257a631acec5c7e70

    SHA256

    258e29527c5035d29e029dfe5f84fadef00ff99b332a2a7dd6582e0891681d55

    SHA512

    3eb489fa1b9b419418fab9417ea52655088ccf57e30d813beafa785021c4c8beae9f3f898abd9b1c9a99ebee500d8e7dc2e411f4dda9e9a6a298ac5dfc309c0b

    Download Submit

  • Anonymous-DexFile@0xcb8c1000-0xcb944694
    Filesize

    525KB

    MD5

    b534cc103a2e7d7dff5e08f9b031606a

    SHA1

    553a99814463608737930dbb3926c26ca7455407

    SHA256

    d6c3961378a18c0186685d59f59ebacc76d341894c44cb29a6e92c2a9bd2db46

    SHA512

    dedb5d59e5d8344cb9b1dede2b9ccd3c685495b9dddc0f61b548714e1f915e46304e9f3cc156bbf9e824bef2a8395e60cc28d6e0db4eb71589b38c862814ac98

    Download Submit