Analysis
-
max time kernel
22s -
max time network
37s -
platform
android_x86 -
resource
android-x86-arm-20240624-en -
resource tags
-
submitted
16-12-2024 02:52
General
-
Target
f80ca61ce994c9367b0ee675aab3afb3e0cd161105a385740e0a47c2eb8824aa.apk
-
Size
8.4MB
-
MD5
d1350bf981ebeacc21704d253be5bfd1
-
SHA1
5a0a513144a7eff29762f48e02a89bd3ed28a7b2
-
SHA256
f80ca61ce994c9367b0ee675aab3afb3e0cd161105a385740e0a47c2eb8824aa
-
SHA512
47930395049a86dd9efb302f0f349c48ad86341523ecc3580694fbb9b0eee34bc71ecc2e5b18f3ed95b759ff157164cf61243820af0bd780c566c6bd51a5ee7b
-
SSDEEP
98304:kOyrjr1lN0JuqjP/QD2WexH35mB8XFmOCwVzGAApT3pVKdQlYLj7ZRsxcSgn5iSd:wffN4QD2XmOCOcUClUj7ZR6Er5/jP
Malware Config
Extracted
octo
Signatures
-
Octo
Octo is a banking malware with remote access capabilities first seen in April 2022.
-
Octo family
-
Octo payload 1 IoCs
-
Checks Android system properties for emulator presence. 1 TTPs 1 IoCs
-
Loads dropped Dex/Jar 1 TTPs 3 IoCs
Runs executable file dropped to the device during analysis.
-
Makes use of the framework's Accessibility service 4 TTPs 2 IoCs
Retrieves information displayed on the phone screen using AccessibilityService.
-
Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
-
Queries the phone number (MSISDN for GSM devices) 1 TTPs
-
Acquires the wake lock 1 IoCs
-
Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs
Application may abuse the framework's foreground service to continue running in the foreground.
-
Queries the mobile country code (MCC) 1 TTPs 1 IoCs
-
Queries the unique device ID (IMEI, MEID, IMSI) 1 TTPs
-
Requests disabling of battery optimizations (often used to enable hiding in the background). 1 TTPs 1 IoCs
-
Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs
-
Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs
-
Checks CPU information 2 TTPs 1 IoCs
-
Checks memory information 2 TTPs 1 IoCs
Processes
-
com.tproduct3_module1⤵
- Checks Android system properties for emulator presence.
- Loads dropped Dex/Jar
- Makes use of the framework's Accessibility service
- Acquires the wake lock
- Makes use of the framework's foreground persistence service
- Queries the mobile country code (MCC)
- Requests disabling of battery optimizations (often used to enable hiding in the background).
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Uses Crypto APIs (Might try to encrypt user data)
- Checks CPU information
- Checks memory information
-
/system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.tproduct3_module/app_steak/HJf.json --output-vdex-fd=41 --oat-fd=42 --oat-location=/data/user/0/com.tproduct3_module/app_steak/oat/x86/HJf.odex --compiler-filter=quicken --class-loader-context=&2⤵
- Loads dropped Dex/Jar
-
Network
MITRE ATT&CK Mobile v15
Persistence
Event Triggered Execution
1Broadcast Receivers
1Foreground Persistence
1Defense Evasion
Download New Code at Runtime
1Foreground Persistence
1Hide Artifacts
1User Evasion
1Input Injection
1Virtualization/Sandbox Evasion
3System Checks
3Discovery
Software Discovery
1Security Software Discovery
1System Information Discovery
2System Network Configuration Discovery
3Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
48B
MD5046a414913add6f5bb60072c7db819b6
SHA1451ee4f6809260aec622d772fd329c7d0297a842
SHA256b66c1320cb063a1d391c94273572ea6edae76c8c8b0a07f8d75c88686f0df72a
SHA5124e6355f3051ed5e811ab030abde1f5be7f5e1cf33be99cd08477e9b6c015deb1d8bd75a09fb9c7176b8511c5ad0a67abc0902a3531e97564ccb6afc57496a47c
-
Filesize
1008B
MD55d5119380accc1eebe5f012d9790f44b
SHA1e92ac3cb7344bd290fccdfd4fd2bbecef93211cb
SHA256e9e9eb450ea9da80b41da099f8ad2721451b76a184d597dbdfc4f36176df49d8
SHA51276dd8e180a1837982e910a1d81b0a4105ea7bf89cb97be84d0b42dc54319c0ff7563c7aa9b7c53f5a95bac75649d429970582e757ea11773cc6b444d573732b2
-
Filesize
1008B
MD5e76530d32ca9a6064eed80e43a58096d
SHA1f0f8298d7449e566d3dad3489998bdce262d1833
SHA25629671d9a41449675e56912dea7055cb0c059df8a4f88d788beaf54897ab206f5
SHA5120924390adc9b7c96b34084b3b69c16f4d8eed6f258bbf48ff39652a3f6bc5119a02713bd0ef7b6161b008fa5bb2fb4daa175f2def311945b85e66e27f2c11055
-
Filesize
307KB
MD54e73947cabb5db3f92ca85004981b754
SHA16d9667fdb0280ed2dcb782b4683e422a51bdc601
SHA2566db94232e756b90ed437f1bc87dc38cf20fb2e7c7a19a5e40c6c17254b7e234c
SHA512be8b500a7070af1dfb53b0cf1a7b327dadc4e163a6dad905496ac228c58cd1ed87b054533917924455d35e9b300683ae33e1bcdd91935a5dbae1d693c3e13d69
-
Filesize
1KB
MD5e4fcdb73896f4de4ed689b2576dd09ad
SHA1fa076692372efd4cade3af66ae299e57e416ef50
SHA25615feca0e5c473fc2244bfc22bed3c4da97c8159b9c1811c4e098fbc32896cc08
SHA512964775735b7cb0af81e91cf9520f0e169d2224f1e8d1931b2a1fcb17e8d4173cb0d252c0c80f7114d924fd1194ba10db747ac84d10087ee486a816c2dbff4cfb
-
Filesize
1KB
MD555e3853e18de3c91a2adaa1ab7737eb8
SHA1f8f08e00077a1514087182383735a8abbc62aa64
SHA25699fff5812d6758c94fb930f1fc5d09ad314ad937fa0d7b7de5dab27ea384c04a
SHA512f86e8b38c5c4a110f3db336b87d67579a670a1d97fa78d0209b86573576120a957783a1e98965c8fd25f3b0c188d2ad9f3f1ef4e5b6735f766d4ec5c53b4b74b
-
Filesize
525KB
MD5a211329b7baf4a79a7812bff0fd58fb1
SHA1fc794f90d94c6a925dfc49d1da1ccfa6298a1860
SHA2566da6ebf0c7f006e5bf32268ae53f125788765ca84eaac9e54194462ba6de7123
SHA51208fec70ab6b85c862097022d554d8fd0d1ead4229f6166a386a3d405bfc5c289b84f177f5fb5f5d4153582cdb3595709d8c116bb55a68726f63f22e03e1813e0