Analysis
-
max time kernel
149s -
max time network
154s -
platform
android-9_x86 -
resource
android-x86-arm-20240910-en -
resource tags
-
submitted
01-01-2025 22:02
General
-
Target
f7b510f2e312c6c00bd6fbf35a8498fa11fb2a6d890ac1ea477ac4381d3f1536.apk
-
Size
216KB
-
MD5
671210c3b78a539aa621984fdecc5d0f
-
SHA1
c73c09d64efaf77f61d6d8adc6dc526e9698393c
-
SHA256
f7b510f2e312c6c00bd6fbf35a8498fa11fb2a6d890ac1ea477ac4381d3f1536
-
SHA512
c518c27b42a1807f028e0f83dc15ff3cae27d29f0891bfb3477350f847d01a20942c73cc62ca0037c3ec40c9c681a51ed2f38236a12eb95c4cb7570e6f241421
-
SSDEEP
6144:MF85YWB+Xm8t1VZCfoZdqDVZUqnEprpz737:Ma5KXm8RZCUprpzj7
Malware Config
Extracted
octo
https://a101.uno/root/
Signatures
-
Octo
Octo is a banking malware with remote access capabilities first seen in April 2022.
-
Octo family
-
Removes its main activity from the application launcher 1 TTPs 1 IoCs
-
Makes use of the framework's Accessibility service 4 TTPs 2 IoCs
Retrieves information displayed on the phone screen using AccessibilityService.
-
Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
-
Queries the phone number (MSISDN for GSM devices) 1 TTPs
-
Acquires the wake lock 1 IoCs
-
Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs
Application may abuse the framework's foreground service to continue running in the foreground.
-
Performs UI accessibility actions on behalf of the user 1 TTPs 2 IoCs
Application may abuse the accessibility service to prevent their removal.
-
Queries the mobile country code (MCC) 1 TTPs 1 IoCs
-
Queries the unique device ID (IMEI, MEID, IMSI) 1 TTPs
-
Reads information about phone network operator. 1 TTPs
-
Requests accessing notifications (often used to intercept notifications before users become aware). 1 TTPs 1 IoCs
-
Requests disabling of battery optimizations (often used to enable hiding in the background). 1 TTPs 1 IoCs
-
Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs
-
Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs
-
Checks CPU information 2 TTPs 1 IoCs
-
Checks memory information 2 TTPs 1 IoCs
Processes
-
com.adaxffsfzfada.zbsvxgsvbxhdgs1⤵
- Removes its main activity from the application launcher
- Makes use of the framework's Accessibility service
- Acquires the wake lock
- Makes use of the framework's foreground persistence service
- Performs UI accessibility actions on behalf of the user
- Queries the mobile country code (MCC)
- Requests accessing notifications (often used to intercept notifications before users become aware).
- Requests disabling of battery optimizations (often used to enable hiding in the background).
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Uses Crypto APIs (Might try to encrypt user data)
- Checks CPU information
- Checks memory information
Network
MITRE ATT&CK Mobile v15
Persistence
Event Triggered Execution
1Broadcast Receivers
1Foreground Persistence
1Defense Evasion
Foreground Persistence
1Hide Artifacts
2Suppress Application Icon
1User Evasion
1Impair Defenses
1Prevent Application Removal
1Input Injection
1Virtualization/Sandbox Evasion
2System Checks
2Credential Access
Access Notifications
1Input Capture
2GUI Input Capture
1Keylogging
1Discovery
Software Discovery
1Security Software Discovery
1System Information Discovery
2System Network Configuration Discovery
4Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
28B
MD56311c3fd15588bb5c126e6c28ff5fffe
SHA1ce81d136fce31779f4dd62e20bdaf99c91e2fc57
SHA2568b82f6032e29a2b5c96031a3630fb6173d12ff0295bc20bb21b877d08f0812d8
SHA5122975fe2e94b6a8adc9cfc1a865ad113772b54572883a537b02a16dd2d029c0f7d9cca3b154fd849bdfe978e18b396bcf9fa6e67e7c61f92bdc089a29a9c355c6
-
Filesize
230B
MD5f34203749ec2355efdcc8b298c95d375
SHA1cfb35ffa978cfd1b91d22b587341f5ac0754b014
SHA2565e2ac5d6b12b2ea3d8f6a46897d5191faa5660dabfe7b8da2f0657e285eeef9f
SHA512b47c41fdf8b082b7a8190a3e038e52ebb72cb318dd5f7161d0ffca91b4f372afc50f79920e921b3951a11c6f0088171d02f553405d5ca14cb9bca14ee2c6d7fc
-
Filesize
54B
MD51301368b74e1c9ff3bbf42462fba05f6
SHA18997530cac43563c35e4c37d68ef21c683dd9c77
SHA2564152dbdf79a945501b6764861df16df5e3743ff79ccee34188cc14959cfee8d5
SHA512303cf70e03414533353243b9ef04e0011dfed3c519e1ec0fe1d058b6d6f3f8530f1f79018a4ebe933d517fbbdceb80d7a0d70298d0ebd86d3acf2b4909a752b2
-
Filesize
63B
MD565366448e7f75d2b48641720e78c268b
SHA1958762512d71959c821d80aaaa1d63cf3a300eb6
SHA256dc519866065e002bb6564d18709180c7f196724df9acd0c36c07d8a627b9be74
SHA5120e52aa92f604948bf25c50811904473e6d0f99590edb81feb2fbd0ff3f36d79181cf13d6f6eadb818f2834d6c05ef26a8d74f75be2e472aa0dc7c47769f0e8e4
-
Filesize
423B
MD5a857e0a8746d6e29cdf0dda85dbf7e7b
SHA15fcbd8bfe9be76721836a67a6781953f249108a3
SHA2568f1280c8f731fd06a85345c1b6c5bed3630f6e367ccfa242ef89c38bc00b8261
SHA512b588a922a233b6e801b4eb092a6f7e87b72868c6bcd929dd38b4024f0fa1ed88e4f128a475a1536086548a750f600af7fde9ec22702da0180fe4dfe5fa6a68d1