Analysis
-
max time kernel
22s -
max time network
36s -
platform
android_x86 -
resource
android-x86-arm-20240624-en -
resource tags
-
submitted
11-01-2025 14:13
General
-
Target
ecdd49645b5e8ae87b298df3ef45e5445aaad0465b7cd9d7acb8a8ee74d5e851.apk
-
Size
9.5MB
-
MD5
a3ab8ac48bfd2b7f61d77d31f21f4f9c
-
SHA1
3320b8b33474e060d6e7c268ba406900ade0bb3a
-
SHA256
ecdd49645b5e8ae87b298df3ef45e5445aaad0465b7cd9d7acb8a8ee74d5e851
-
SHA512
158957e472dd67ffd77cda26a5a382d80d19d71c27f34c079c865b58e754c0f6296cdb03ac5656d619da45e7d14de410256355dc9616473f257fe72c907432af
-
SSDEEP
196608:pMTsR9aZkdCXZgtgS8Y8d1BrZrTU+L3XgDKZ5wvf:pMuukoZgtgSEBNrT0Gw
Malware Config
Extracted
octo
Signatures
-
Octo
Octo is a banking malware with remote access capabilities first seen in April 2022.
-
Octo family
-
Octo payload 1 IoCs
-
Checks Android system properties for emulator presence. 1 TTPs 1 IoCs
-
Loads dropped Dex/Jar 1 TTPs 3 IoCs
Runs executable file dropped to the device during analysis.
-
Makes use of the framework's Accessibility service 4 TTPs 2 IoCs
Retrieves information displayed on the phone screen using AccessibilityService.
-
Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
-
Queries the phone number (MSISDN for GSM devices) 1 TTPs
-
Acquires the wake lock 1 IoCs
-
Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs
Application may abuse the framework's foreground service to continue running in the foreground.
-
Queries the mobile country code (MCC) 1 TTPs 1 IoCs
-
Queries the unique device ID (IMEI, MEID, IMSI) 1 TTPs
-
Requests disabling of battery optimizations (often used to enable hiding in the background). 1 TTPs 1 IoCs
-
Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs
-
Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs
-
Checks CPU information 2 TTPs 1 IoCs
-
Checks memory information 2 TTPs 1 IoCs
Processes
-
com.modevolume_tools31⤵
- Checks Android system properties for emulator presence.
- Loads dropped Dex/Jar
- Makes use of the framework's Accessibility service
- Acquires the wake lock
- Makes use of the framework's foreground persistence service
- Queries the mobile country code (MCC)
- Requests disabling of battery optimizations (often used to enable hiding in the background).
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Uses Crypto APIs (Might try to encrypt user data)
- Checks CPU information
- Checks memory information
-
/system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.modevolume_tools3/app_ladder/gFNNaoj.json --output-vdex-fd=41 --oat-fd=42 --oat-location=/data/user/0/com.modevolume_tools3/app_ladder/oat/x86/gFNNaoj.odex --compiler-filter=quicken --class-loader-context=&2⤵
- Loads dropped Dex/Jar
-
Network
MITRE ATT&CK Mobile v15
Persistence
Event Triggered Execution
1Broadcast Receivers
1Foreground Persistence
1Defense Evasion
Download New Code at Runtime
1Foreground Persistence
1Hide Artifacts
1User Evasion
1Input Injection
1Virtualization/Sandbox Evasion
3System Checks
3Discovery
Software Discovery
1Security Software Discovery
1System Information Discovery
2System Network Configuration Discovery
3Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
48B
MD5046a414913add6f5bb60072c7db819b6
SHA1451ee4f6809260aec622d772fd329c7d0297a842
SHA256b66c1320cb063a1d391c94273572ea6edae76c8c8b0a07f8d75c88686f0df72a
SHA5124e6355f3051ed5e811ab030abde1f5be7f5e1cf33be99cd08477e9b6c015deb1d8bd75a09fb9c7176b8511c5ad0a67abc0902a3531e97564ccb6afc57496a47c
-
Filesize
1007B
MD5432f7930f8d6a900a90655548fadf79c
SHA1decfacf018484a956bf0fe6bd9e39476e509191f
SHA2562a04035947d5d214c1ed26fcd8841f826b663c8e63bb56991f07b289a116d568
SHA512fbd11b77d5d6e7e4609db8b41371a65180b2b69aed398dfc9b18423fa5e341db438e99ff3d24c4e4c43d9c810899016ea6b458d37d93b122631174db7492954f
-
Filesize
1007B
MD505019910152140c0ca647660862a21fd
SHA1223a4f7100d40d3b10dca1cd1de781ccde335bed
SHA2566d18d2339d8fa48d21361e0b8b80b5e3a179266b3e5360cdabbcff0ed02e2ccb
SHA512f98d4b515dd881ad9e9da54f5416d42a5eaeb5c15980a23f82319d4b2a78183cc8f6022b25d455dda222f5da5b9e954fe0609fe543eb267872c20bcecc925042
-
Filesize
307KB
MD54e73947cabb5db3f92ca85004981b754
SHA16d9667fdb0280ed2dcb782b4683e422a51bdc601
SHA2566db94232e756b90ed437f1bc87dc38cf20fb2e7c7a19a5e40c6c17254b7e234c
SHA512be8b500a7070af1dfb53b0cf1a7b327dadc4e163a6dad905496ac228c58cd1ed87b054533917924455d35e9b300683ae33e1bcdd91935a5dbae1d693c3e13d69
-
Filesize
1KB
MD538616e308ccc14ef94ce6bc96a265d4d
SHA1e610f05a7ef9d7ed38a1d5393bdf61e0035a8785
SHA2568ba0c688013cebdca74b2d2cfd701b84e27e30b2e728e2a41782e8193ab63ad2
SHA51269a917c7f93d777a951e4cbe9656156ceb325e726d005f65c69b63d2d582863c2fa9348df6552203f6c91074e75b2f275706bcba1701c8c95334f0884dea0391
-
Filesize
1KB
MD51c1e168882a6a727636e6ef34304d6aa
SHA1925c2f21f1123b4483d1acaf3e6ea2a0a2f2a3af
SHA256a534496e0f30157b9f33b12c6d0f971375c7116eea3d920ab930c07948aeb9b7
SHA5120f2445a06f3753bbb666400785c92b1dfbd51def49f825855202d1fc317c9fad8dddbf965d6fae1c513e488693a4c9c01e02fd80b0b04f2a5bdd16ffe5e51cf3
-
Filesize
525KB
MD5722984946cc879125dda4ab36403431d
SHA199505a0821edc83893fb8feb75c7d6ed4bc7da2f
SHA2565169696fb4f51f879ab8f9192dcc8af79277740bd04d2aec06b8c164508eb42a
SHA512aeee71434181e69b457bc0e03d14db03b9d9b3979a482c83338f136bd54d59c740c1fdaab474d78ffb079f98784922db0a77da5e7b269795792a4394dac3a37a