Analysis
-
max time kernel
149s -
max time network
148s -
platform
android-10_x64 -
resource
android-x64-20240910-en -
resource tags
-
submitted
05-01-2025 22:06
General
-
Target
2b0860de70f1b0a1a37736a41c031a0ce0701b77e3fe3c72a981e3e1b1d893cb.apk
-
Size
517KB
-
MD5
4ba90e86b6ee1d0147e60b91317ab1ee
-
SHA1
de9c15d898a48d987843f5e82c2e8ac9740b7423
-
SHA256
2b0860de70f1b0a1a37736a41c031a0ce0701b77e3fe3c72a981e3e1b1d893cb
-
SHA512
dc464b07e1a643a46bcf9f8f75bae32d8c26551a3e84e4b40281e43309e902a38294fdab4fa942abe0cdf293e0ec428c029748b67d7e8b6a4bea91e2fcf8a437
-
SSDEEP
12288:SR5fg71waO72T+703D13xvRTzWXf3UYqQ50dWNXRjKTKnP:S7j7I+gxVCNKWNXRvnP
Malware Config
Extracted
octo
https://185.161.248.142/MTU2OWE0NzJjNGY5/
Extracted
octo
https://185.161.248.142/MTU2OWE0NzJjNGY5/
Signatures
-
Octo
Octo is a banking malware with remote access capabilities first seen in April 2022.
-
Octo family
-
Octo payload 1 IoCs
-
Loads dropped Dex/Jar 1 TTPs 2 IoCs
Runs executable file dropped to the device during analysis.
-
Makes use of the framework's Accessibility service 4 TTPs 2 IoCs
Retrieves information displayed on the phone screen using AccessibilityService.
-
Obtains sensitive information copied to the device clipboard 2 TTPs 1 IoCs
Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.
-
Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
-
Queries the phone number (MSISDN for GSM devices) 1 TTPs
-
Acquires the wake lock 1 IoCs
-
Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs
Application may abuse the framework's foreground service to continue running in the foreground.
-
Performs UI accessibility actions on behalf of the user 1 TTPs 4 IoCs
Application may abuse the accessibility service to prevent their removal.
-
Queries the mobile country code (MCC) 1 TTPs 1 IoCs
-
Reads information about phone network operator. 1 TTPs
-
Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs
-
Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs
-
Checks CPU information 2 TTPs 1 IoCs
-
Checks memory information 2 TTPs 1 IoCs
Processes
-
com.movevoicet1⤵
- Loads dropped Dex/Jar
- Makes use of the framework's Accessibility service
- Obtains sensitive information copied to the device clipboard
- Acquires the wake lock
- Makes use of the framework's foreground persistence service
- Performs UI accessibility actions on behalf of the user
- Queries the mobile country code (MCC)
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Uses Crypto APIs (Might try to encrypt user data)
- Checks CPU information
- Checks memory information
Network
MITRE ATT&CK Mobile v15
Persistence
Event Triggered Execution
1Broadcast Receivers
1Foreground Persistence
1Defense Evasion
Download New Code at Runtime
1Foreground Persistence
1Impair Defenses
1Prevent Application Removal
1Input Injection
1Virtualization/Sandbox Evasion
2System Checks
2Credential Access
Clipboard Data
1Input Capture
2GUI Input Capture
1Keylogging
1Discovery
Software Discovery
1Security Software Discovery
1System Information Discovery
2System Network Configuration Discovery
3Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
455KB
MD5ec35fa00979a5fa5eb85d4b214e68118
SHA1a4263840787afab1206f00be34c08392379081ad
SHA2566553bd4b8953f3e810bae7acf9c4a666429cb754438ed52898cf8a790695fb3b
SHA512cb538b807b778b1f5c7a8751015ea612fa9081eae986187ec442d09c987943a48ab3834a9dd92552783d2f587906cbae5b6cb96b2c79a3ffc976a613c7a2bd92
-
Filesize
485B
MD5cd1833338d54e96daf9833d2e63eabf5
SHA163fc478f4e4ceaae32166add6763b5b55e35f7b7
SHA256ce9d9fe122a12ff651f3b98ab5ee2e630be29178588d2d14d8fac76ec6ec123d
SHA5122e525c6c9729c7da7b7012b9d49b58e06ab6f63ed0dd10ceb4e4248e9b72780fefe579c2b23f6f54c1ac66aa4cf9751905a595d40c7ca9413f60200427ffb161
-
Filesize
28B
MD56311c3fd15588bb5c126e6c28ff5fffe
SHA1ce81d136fce31779f4dd62e20bdaf99c91e2fc57
SHA2568b82f6032e29a2b5c96031a3630fb6173d12ff0295bc20bb21b877d08f0812d8
SHA5122975fe2e94b6a8adc9cfc1a865ad113772b54572883a537b02a16dd2d029c0f7d9cca3b154fd849bdfe978e18b396bcf9fa6e67e7c61f92bdc089a29a9c355c6
-
Filesize
237B
MD5114aee5d81b3568213555a0c99810b53
SHA14aea3d03786666c63729365f8fff99cd32562de7
SHA25677f1dd65fe77c0fa8d9b64a5b9ab7ab878aadd8e4f0461bd566d8e9fe294cb23
SHA512035fb46b120caacd7dc4d967b9c02968803c4d110ac49fc17fc070e83d0543d90472e356af15d14645af3ebc39bcc7c4a731b3301208f71e6e817791e2b8ca5d
-
Filesize
68B
MD598bb2fd4dcaa82f193b35a4ed8eb2cb2
SHA137eee071de86040c2d31847bffff17c0ed55902e
SHA2562750e84f3f678dc88809354aa53775a5de08a94a7611bf8615a9cbf55163ebb5
SHA51252fa9cb4e23f7613796864f9a01f0d26cf15755eef54607036ba9d6a91b57da0c80c21c928606f8102a695dfeed4b922702ab4ab49a75fcf59362a3808c7f42b
-
Filesize
68B
MD58ae2113d24e4f0d3066aacfd014d5a05
SHA191682b5bf8831253c330a9b386a696b71c264826
SHA256caf4474325c7a332fe7d743809caaa759b1feaf3cf93931c7e782d2227d39ffb
SHA5124773821fd2f4a84e780ab21489da04440ed6e100c2e4fd3fde787846a18c4bb6e5963bd304a4ccad952647936723c645ef4444b7f769c666cb9f5f4107a10221