Analysis
-
max time kernel
25s -
max time network
29s -
platform
android-9_x86 -
resource
android-x86-arm-20240910-en -
resource tags
arch:armarch:x86image:android-x86-arm-20240910-enlocale:en-usos:android-9-x86system -
submitted
01-12-2024 21:54
Static task
static1
Behavioral task
behavioral1
Sample
538ccdc32092346469ba9811db69518e617e1415f4f399087c7a0d370feae639.apk
Resource
android-x86-arm-20240910-en
General
-
Target
538ccdc32092346469ba9811db69518e617e1415f4f399087c7a0d370feae639.apk
-
Size
9.4MB
-
MD5
8faff798500ebdee3d375eb840af542b
-
SHA1
6799e2386333239f37d6b827f79cc918f13d2591
-
SHA256
538ccdc32092346469ba9811db69518e617e1415f4f399087c7a0d370feae639
-
SHA512
394530d774dfb4cfce5c0d54b836e740e1027550769ce203cf0da7f47d59a42516c5d28ee019c93b236ca7050f64d0b9f580a9353a928eddd5db4d5bb1bd08dd
-
SSDEEP
98304:ugaOyaXYdkFJLRsNrmdWztNVKxqEE3OnsZpqiL5iSRGJHVKtL7wXj7i4kfSI:VP6k9RMidWzTVnJLrUUtnQj7in6I
Malware Config
Extracted
octo
Signatures
-
Octo
Octo is a banking malware with remote access capabilities first seen in April 2022.
-
Octo family
-
Octo payload 1 IoCs
resource yara_rule behavioral1/memory/4221-1.dex family_octo -
Loads dropped Dex/Jar 1 TTPs 3 IoCs
Runs executable file dropped to the device during analysis.
ioc pid Process /data/user/0/com.mservice_mover00/app_cover/yLbku.json 4245 /system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.mservice_mover00/app_cover/yLbku.json --output-vdex-fd=41 --oat-fd=42 --oat-location=/data/user/0/com.mservice_mover00/app_cover/oat/x86/yLbku.odex --compiler-filter=quicken --class-loader-context=& /data/user/0/com.mservice_mover00/app_cover/yLbku.json 4221 com.mservice_mover00 Anonymous-DexFile@0xcfe7c000-0xcfeff764 4221 com.mservice_mover00 -
Makes use of the framework's Accessibility service 4 TTPs 2 IoCs
Retrieves information displayed on the phone screen using AccessibilityService.
description ioc Process Framework service call android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId com.mservice_mover00 Framework service call android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByViewId com.mservice_mover00 -
Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
-
Queries the phone number (MSISDN for GSM devices) 1 TTPs
-
Acquires the wake lock 1 IoCs
description ioc Process Framework service call android.os.IPowerManager.acquireWakeLock com.mservice_mover00 -
Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs
Application may abuse the framework's foreground service to continue running in the foreground.
description ioc Process Framework service call android.app.IActivityManager.setServiceForeground com.mservice_mover00 -
Queries the mobile country code (MCC) 1 TTPs 1 IoCs
description ioc Process Framework service call com.android.internal.telephony.ITelephony.getNetworkCountryIsoForPhone com.mservice_mover00 -
Queries the unique device ID (IMEI, MEID, IMSI) 1 TTPs
-
Reads information about phone network operator. 1 TTPs
-
Requests disabling of battery optimizations (often used to enable hiding in the background). 1 TTPs 1 IoCs
description ioc Process Intent action android.settings.REQUEST_IGNORE_BATTERY_OPTIMIZATIONS com.mservice_mover00 -
Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs
description ioc Process Framework service call android.app.IActivityManager.registerReceiver com.mservice_mover00 -
Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs
description ioc Process Framework API call javax.crypto.Cipher.doFinal com.mservice_mover00 -
Checks CPU information 2 TTPs 1 IoCs
description ioc Process File opened for read /proc/cpuinfo com.mservice_mover00 -
Checks memory information 2 TTPs 1 IoCs
description ioc Process File opened for read /proc/meminfo com.mservice_mover00
Processes
-
com.mservice_mover001⤵
- Loads dropped Dex/Jar
- Makes use of the framework's Accessibility service
- Acquires the wake lock
- Makes use of the framework's foreground persistence service
- Queries the mobile country code (MCC)
- Requests disabling of battery optimizations (often used to enable hiding in the background).
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Uses Crypto APIs (Might try to encrypt user data)
- Checks CPU information
- Checks memory information
PID:4221 -
/system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.mservice_mover00/app_cover/yLbku.json --output-vdex-fd=41 --oat-fd=42 --oat-location=/data/user/0/com.mservice_mover00/app_cover/oat/x86/yLbku.odex --compiler-filter=quicken --class-loader-context=&2⤵
- Loads dropped Dex/Jar
PID:4245
-
Network
MITRE ATT&CK Mobile v15
Persistence
Event Triggered Execution
1Broadcast Receivers
1Foreground Persistence
1Defense Evasion
Download New Code at Runtime
1Foreground Persistence
1Hide Artifacts
1User Evasion
1Input Injection
1Virtualization/Sandbox Evasion
2System Checks
2Discovery
Software Discovery
1Security Software Discovery
1System Information Discovery
2System Network Configuration Discovery
4Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
48B
MD5046a414913add6f5bb60072c7db819b6
SHA1451ee4f6809260aec622d772fd329c7d0297a842
SHA256b66c1320cb063a1d391c94273572ea6edae76c8c8b0a07f8d75c88686f0df72a
SHA5124e6355f3051ed5e811ab030abde1f5be7f5e1cf33be99cd08477e9b6c015deb1d8bd75a09fb9c7176b8511c5ad0a67abc0902a3531e97564ccb6afc57496a47c
-
Filesize
1006B
MD53f221694de5bbea1cbcb5688c2bac43a
SHA1b7fa735250b4c83b0f5d60c7b403b840939b7909
SHA256187733bf5963b2c1ea78aca8c3f69ad531b458cc54873b73a60841f582a17e26
SHA5120535d00541a621596b4659be13b8be3a6462b16bcffda5b9bac609cc48f4ecef440b5121ea102fd62df9242c154132bd7e4d31038f0dbde987523b76b5b0db71
-
Filesize
1006B
MD5660e874b9537925d482bb62b374ab179
SHA11ea8d2be129f753f6f674df598fb2e71f874490e
SHA256a56d3accf3d4cd4ee09c20e7619f948230ddcf2cb92646c4bfb33d3da0e26a0e
SHA5124f085388614fd12c5446c5bbaaa864d700fd85070447931da818260eba71b14453ce41b508909f97966030622b3c3aea1cdf41241a3beba4590e778dd9ce0744
-
Filesize
307KB
MD54e73947cabb5db3f92ca85004981b754
SHA16d9667fdb0280ed2dcb782b4683e422a51bdc601
SHA2566db94232e756b90ed437f1bc87dc38cf20fb2e7c7a19a5e40c6c17254b7e234c
SHA512be8b500a7070af1dfb53b0cf1a7b327dadc4e163a6dad905496ac228c58cd1ed87b054533917924455d35e9b300683ae33e1bcdd91935a5dbae1d693c3e13d69
-
Filesize
1KB
MD5e5609948d15ab46517fff49982be437a
SHA175dc65d1265046eb07aca0581232de6e818f2c99
SHA256de133a467743011e4c4744a41c4cd95155c6a9394864c1744e49091b1c1a3d9a
SHA512aa34d60bd70c951014244a828f6896a6da0315732e89a989a59e91428f5782f6ad8830a575091b41026fd5bcfe1dc0250ad0e7a4f9953aca803e0282ff5b3dd7
-
Filesize
1KB
MD515959a4b2c17e08ac602c6d6c4b42e10
SHA1337a3a3b9d2490a1312c443daa00df3afc281f5c
SHA256b29a4d1163b65f5f18db8cfad7b004efe989a3d091454ea2af91be08f0868229
SHA512a92b554776b37be80420fd21548bf798f118fe0528830781a20f08965e6a30ae98ac1882ec89853dea76d356f938cb5090d68b492ead72f74581e35c9e3a0a8f
-
Filesize
525KB
MD51429778a133d569f564003e474a4941a
SHA14b183b9a78ad1fda798cb30eab28a5d14072a0e8
SHA25666c23e7e8ca124b75b77fc69bb442bcb79f486f860902641e287f4bdfc9cc3bd
SHA512f72fed120d1952807bf0a5a94a8571aad08aa75bcb201cd65f09e7b03d00eb35447952187e46147791d15e04bc07ffb8a53d636f4e85086cc4b13870f139cd49