Analysis
-
max time kernel
139s -
max time network
136s -
platform
android_x86 -
resource
android-x86-arm-20240624-en -
resource tags
-
submitted
11-01-2025 14:19
General
-
Target
c2ca36526b7b42a17d3a0ca8df2af5b6d03669ba0c1453d962bfabd4cd92e4b3.apk
-
Size
7.1MB
-
MD5
15278c6c8cd7ee51397be5ecaa1f7404
-
SHA1
65a556ab9eab2eea657978dd75127de90e6d2657
-
SHA256
c2ca36526b7b42a17d3a0ca8df2af5b6d03669ba0c1453d962bfabd4cd92e4b3
-
SHA512
d9bb1f50b07cca040d9490260971d22429e897e24b6c971142da9e4ded930d6f48a0485fb1d72a9c021325a923b881cc57f8901f2deeb037d4eb47ccc982624f
-
SSDEEP
98304:/y+q5iSRG9iRskfeM+/kUiQUDLVKgya8j7axcDpI:arrvRpmhFEfUfBj7vi
Malware Config
Extracted
octo
Signatures
-
Octo
Octo is a banking malware with remote access capabilities first seen in April 2022.
-
Octo family
-
Octo payload 1 IoCs
-
Checks Android system properties for emulator presence. 1 TTPs 1 IoCs
-
Loads dropped Dex/Jar 1 TTPs 3 IoCs
Runs executable file dropped to the device during analysis.
-
Makes use of the framework's Accessibility service 4 TTPs 2 IoCs
Retrieves information displayed on the phone screen using AccessibilityService.
-
Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
-
Queries the phone number (MSISDN for GSM devices) 1 TTPs
-
Acquires the wake lock 1 IoCs
-
Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs
Application may abuse the framework's foreground service to continue running in the foreground.
-
Queries the mobile country code (MCC) 1 TTPs 1 IoCs
-
Queries the unique device ID (IMEI, MEID, IMSI) 1 TTPs
-
Reads information about phone network operator. 1 TTPs
-
Requests disabling of battery optimizations (often used to enable hiding in the background). 1 TTPs 1 IoCs
-
Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs
-
Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs
-
Checks CPU information 2 TTPs 1 IoCs
-
Checks memory information 2 TTPs 1 IoCs
Processes
-
com.dfaccess65billingcontroller1⤵
- Checks Android system properties for emulator presence.
- Loads dropped Dex/Jar
- Makes use of the framework's Accessibility service
- Acquires the wake lock
- Makes use of the framework's foreground persistence service
- Queries the mobile country code (MCC)
- Requests disabling of battery optimizations (often used to enable hiding in the background).
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Uses Crypto APIs (Might try to encrypt user data)
- Checks CPU information
- Checks memory information
-
/system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.dfaccess65billingcontroller/app_mountain/WiEr.json --output-vdex-fd=41 --oat-fd=42 --oat-location=/data/user/0/com.dfaccess65billingcontroller/app_mountain/oat/x86/WiEr.odex --compiler-filter=quicken --class-loader-context=&2⤵
- Loads dropped Dex/Jar
-
Network
MITRE ATT&CK Mobile v15
Persistence
Event Triggered Execution
1Broadcast Receivers
1Foreground Persistence
1Defense Evasion
Download New Code at Runtime
1Foreground Persistence
1Hide Artifacts
1User Evasion
1Input Injection
1Virtualization/Sandbox Evasion
3System Checks
3Discovery
Software Discovery
1Security Software Discovery
1System Information Discovery
2System Network Configuration Discovery
4Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
48B
MD5046a414913add6f5bb60072c7db819b6
SHA1451ee4f6809260aec622d772fd329c7d0297a842
SHA256b66c1320cb063a1d391c94273572ea6edae76c8c8b0a07f8d75c88686f0df72a
SHA5124e6355f3051ed5e811ab030abde1f5be7f5e1cf33be99cd08477e9b6c015deb1d8bd75a09fb9c7176b8511c5ad0a67abc0902a3531e97564ccb6afc57496a47c
-
Filesize
1009B
MD58c6da5422bc0765e03a088df68a409a4
SHA17b919dca5b1bed47f46de95b2e2ffd6289c91263
SHA256323cd299a88fa015afe7eea5b870910647da7a70079aad73315c0a02206b157e
SHA512533f9025186b7d08fea82d9dba953c2730014ff5692921c12bd7c093220fe89941120583d1fe53f41bc6a1173d0cb1b7d1d11a1c8aaccd7b1ce86b7c1dcb053d
-
Filesize
1009B
MD550cb964584868ce157c7c908f8857ecc
SHA13f098dffefcbaa98a864f69154bec89fbfe0d9ab
SHA2560da24a5503fcbd788802fd02434deeaf780e8f032d611999e2000b271a815ed4
SHA512f80afbf9e35ea4d7ab8bc16c73982787b2fd9ea902b7a9677e73e5aa3ed718310f196af300402b0d65bc35ec536db374d1511980ecda05fc25f422d3e17da27e
-
Filesize
307KB
MD54e73947cabb5db3f92ca85004981b754
SHA16d9667fdb0280ed2dcb782b4683e422a51bdc601
SHA2566db94232e756b90ed437f1bc87dc38cf20fb2e7c7a19a5e40c6c17254b7e234c
SHA512be8b500a7070af1dfb53b0cf1a7b327dadc4e163a6dad905496ac228c58cd1ed87b054533917924455d35e9b300683ae33e1bcdd91935a5dbae1d693c3e13d69
-
Filesize
1KB
MD5ec8e8cf6f4dc06db1373a21f23e10b85
SHA148ba6046b43e7c2c8714e68777aef9b540c355e3
SHA2565d09e226c8dc230ee74a2b67ddfa13db75d1b1bf665137f61b9be903d2e73ca8
SHA512366f807165a5836393a48e6afc6dc2f2bf95bc6725c781076ae07d698f6b844ce4d980ced0b720b4210d110fb58ca3f74eb13b5cd15228a04cb5b275c2b677c9
-
Filesize
1KB
MD501b3e29675f386ea9efda6082438e915
SHA19b411b673601b2ac52242f2eabf9015f810c95e6
SHA256da8cdbd726b25cd8037bc3b35370313def966fdfa65d15b5db4646711a6273f9
SHA51219ecb96e6a31ac89afba2d812cf9e982ca5308ffcbf98a1a9cb502c63c850b7af253902ca32af31a64b65822a2082f0ff92538a8ae8a82c5a3ce7bd9e59cb447
-
Filesize
526KB
MD5ae267a57b5569380b05aed48b9e90850
SHA1c5263735da0a9ea361d39d276daa0b3a7e829749
SHA256dd314d9c0e81bc332c83711645d5c8276d54a35509b9129f091147758ed41ec3
SHA51289b7e3b94ecae87e0a4a2ff477ca864762bfa46368b47c475a8d5703c05499e823e7c4cb6c306fb2b69e1a02d2e7050747c9572526df31718f55a8fbff973b0c