Analysis
-
max time kernel
149s -
max time network
148s -
platform
android-9_x86 -
resource
android-x86-arm-20240910-en -
resource tags
-
submitted
05-01-2025 22:06
General
-
Target
2b0860de70f1b0a1a37736a41c031a0ce0701b77e3fe3c72a981e3e1b1d893cb.apk
-
Size
517KB
-
MD5
4ba90e86b6ee1d0147e60b91317ab1ee
-
SHA1
de9c15d898a48d987843f5e82c2e8ac9740b7423
-
SHA256
2b0860de70f1b0a1a37736a41c031a0ce0701b77e3fe3c72a981e3e1b1d893cb
-
SHA512
dc464b07e1a643a46bcf9f8f75bae32d8c26551a3e84e4b40281e43309e902a38294fdab4fa942abe0cdf293e0ec428c029748b67d7e8b6a4bea91e2fcf8a437
-
SSDEEP
12288:SR5fg71waO72T+703D13xvRTzWXf3UYqQ50dWNXRjKTKnP:S7j7I+gxVCNKWNXRvnP
Malware Config
Extracted
octo
https://185.161.248.142/MTU2OWE0NzJjNGY5/
Extracted
octo
https://185.161.248.142/MTU2OWE0NzJjNGY5/
Signatures
-
Octo
Octo is a banking malware with remote access capabilities first seen in April 2022.
-
Octo family
-
Octo payload 1 IoCs
-
Removes its main activity from the application launcher 1 TTPs 1 IoCs
-
Loads dropped Dex/Jar 1 TTPs 2 IoCs
Runs executable file dropped to the device during analysis.
-
Makes use of the framework's Accessibility service 4 TTPs 2 IoCs
Retrieves information displayed on the phone screen using AccessibilityService.
-
Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
-
Queries the phone number (MSISDN for GSM devices) 1 TTPs
-
Acquires the wake lock 1 IoCs
-
Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs
Application may abuse the framework's foreground service to continue running in the foreground.
-
Performs UI accessibility actions on behalf of the user 1 TTPs 4 IoCs
Application may abuse the accessibility service to prevent their removal.
-
Queries the mobile country code (MCC) 1 TTPs 1 IoCs
-
Queries the unique device ID (IMEI, MEID, IMSI) 1 TTPs
-
Reads information about phone network operator. 1 TTPs
-
Requests accessing notifications (often used to intercept notifications before users become aware). 1 TTPs 1 IoCs
-
Requests disabling of battery optimizations (often used to enable hiding in the background). 1 TTPs 1 IoCs
-
Requests modifying system settings. 1 IoCs
-
Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs
-
Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs
-
Checks CPU information 2 TTPs 1 IoCs
-
Checks memory information 2 TTPs 1 IoCs
Processes
-
com.movevoicet1⤵
- Removes its main activity from the application launcher
- Loads dropped Dex/Jar
- Makes use of the framework's Accessibility service
- Acquires the wake lock
- Makes use of the framework's foreground persistence service
- Performs UI accessibility actions on behalf of the user
- Queries the mobile country code (MCC)
- Requests accessing notifications (often used to intercept notifications before users become aware).
- Requests disabling of battery optimizations (often used to enable hiding in the background).
- Requests modifying system settings.
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Uses Crypto APIs (Might try to encrypt user data)
- Checks CPU information
- Checks memory information
Network
MITRE ATT&CK Mobile v15
Persistence
Event Triggered Execution
1Broadcast Receivers
1Foreground Persistence
1Defense Evasion
Download New Code at Runtime
1Foreground Persistence
1Hide Artifacts
2Suppress Application Icon
1User Evasion
1Impair Defenses
1Prevent Application Removal
1Input Injection
1Virtualization/Sandbox Evasion
2System Checks
2Credential Access
Access Notifications
1Input Capture
2GUI Input Capture
1Keylogging
1Discovery
Software Discovery
1Security Software Discovery
1System Information Discovery
2System Network Configuration Discovery
4Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
455KB
MD5ec35fa00979a5fa5eb85d4b214e68118
SHA1a4263840787afab1206f00be34c08392379081ad
SHA2566553bd4b8953f3e810bae7acf9c4a666429cb754438ed52898cf8a790695fb3b
SHA512cb538b807b778b1f5c7a8751015ea612fa9081eae986187ec442d09c987943a48ab3834a9dd92552783d2f587906cbae5b6cb96b2c79a3ffc976a613c7a2bd92
-
Filesize
466B
MD5d19029bdb715b5d006fbb83bf47c5ea1
SHA174dfdbd68c7013b68819fc5e0276d2f1427476f4
SHA256f7292462fe40d890c2cf1f9c0f7d7ec7fd9bf7e0de3445d0ad3fe7ef411971f7
SHA512e107e0d66fd2d2460c0b56597ee93f539ac547f52a7e06407dd9036b7cd272eb0347b8ca3b85d58b667aeb0dae233ce19f7e0b8820c344eed9ebdcc80d269bf3
-
Filesize
28B
MD56311c3fd15588bb5c126e6c28ff5fffe
SHA1ce81d136fce31779f4dd62e20bdaf99c91e2fc57
SHA2568b82f6032e29a2b5c96031a3630fb6173d12ff0295bc20bb21b877d08f0812d8
SHA5122975fe2e94b6a8adc9cfc1a865ad113772b54572883a537b02a16dd2d029c0f7d9cca3b154fd849bdfe978e18b396bcf9fa6e67e7c61f92bdc089a29a9c355c6
-
Filesize
237B
MD556eb6421d89ea401fdef52bc4f1ff599
SHA133b206d2ab909244586e878f3891ec58c08413f1
SHA256affc0e3ccd7f29661b60c0404cab70412dbcb5fc8208e3b6d03a9c6299292831
SHA51236a5cb19d86ecb60673aa198ebfa703b4b0b3586cab6dac4544559d71663e8949ccc0f9b5285e063f08cd321a6db32e2ef0d3121c18a17ca9cacef812910ca50
-
Filesize
54B
MD525589e4494310ca7206797adfd55c12c
SHA1f62ba955cedf8cbb20432290d0a43564f27d4df1
SHA2562d6e1fcb8052e7937bd8caf48390b01565762e1e63c34455286256f144f3293d
SHA51246e55ebb97ae449b4396bde2740ed953b4a1e3bba51d5d0e1265327c70ff12eaa52cfc771ee023d1fa74a5142aa636e89381ee84443ab649b19b6b6790089b46
-
Filesize
63B
MD5942bf4e197682283ba43b93f234cc2af
SHA1ff9f737f70a1dda6e0c01bfb8480b449944e7839
SHA256ca5d1605177ee8260d7bb01221bc2abf8d49f88251931abfa177cfc4b685b4b8
SHA5129f9a03aac3e88809ee45ea5f7dae1c5ae28f56d95a508b52c90b0dcf228e6a9007b8807b46236627d497d5e4b4d85125bddb3793ee9ca74abd291bdbd98a3b07
-
Filesize
437B
MD50f79d7953d817f60746832aa4ca175e4
SHA10437a30b8e3812104566ed7f5456b5673a901897
SHA256d0bb4896940f3bec1ed5e08441cf5d685136499f59598ad7e562416df1ad97b1
SHA512dfb0a822a3aa69849d1073dff226c7d25f4abcc50d51eeab007ab5f2b2177bf1a26513b4ba65d28292a72d697b0067123859c740fb5585616a8673d08d2da15f