Resubmissions
11-01-2025 15:41
250111-s4sylavngk 1011-01-2025 14:52
250111-r866ca1rav 1011-01-2025 14:28
250111-rtbe5a1naz 1011-01-2025 14:17
250111-rlpb1stlhk 10Analysis
-
max time kernel
899s -
max time network
898s -
platform
android-10_x64 -
resource
android-x64-20240910-en -
resource tags
-
submitted
11-01-2025 14:28
General
-
Target
20a549f1ef09d45e66cd1f3a22554e64e711cd5e83b4819116dd673b54ebed8c.apk
-
Size
9.3MB
-
MD5
d019f5e6c5c764e88dbe9e698d3531a9
-
SHA1
0210da276565c1c7c6e3ea2aad37f09fbe0203a1
-
SHA256
20a549f1ef09d45e66cd1f3a22554e64e711cd5e83b4819116dd673b54ebed8c
-
SHA512
02136b38aeb3a3e4d183481fe3c55a9ee6e0cf78a1d57ff6b2f7e2d112917f85d6f66b223997a1bf020c1b765a3d499198edd4ea1004813283f2b88c9f66d74d
-
SSDEEP
98304:qHRJmSbXKRbBRcQl/j7AVKpL5iSRG8XLC6BN4yyt7A339mW4RsHd:q3Slj7AUZrV+63gjRy
Malware Config
Extracted
octo
https://d5abaaa83590ecf7b2432196e08081a8.biz
Signatures
-
Octo
Octo is a banking malware with remote access capabilities first seen in April 2022.
-
Octo family
-
Octo payload 1 IoCs
-
Loads dropped Dex/Jar 1 TTPs 2 IoCs
Runs executable file dropped to the device during analysis.
-
Makes use of the framework's Accessibility service 4 TTPs 2 IoCs
Retrieves information displayed on the phone screen using AccessibilityService.
-
Obtains sensitive information copied to the device clipboard 2 TTPs 1 IoCs
Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.
-
Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
-
Queries the phone number (MSISDN for GSM devices) 1 TTPs
-
Acquires the wake lock 1 IoCs
-
Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs
Application may abuse the framework's foreground service to continue running in the foreground.
-
Queries the mobile country code (MCC) 1 TTPs 1 IoCs
-
Reads information about phone network operator. 1 TTPs
-
Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs
-
Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs
-
Checks CPU information 2 TTPs 1 IoCs
-
Checks memory information 2 TTPs 1 IoCs
Processes
-
com.wgenerated_labs21⤵
- Loads dropped Dex/Jar
- Makes use of the framework's Accessibility service
- Obtains sensitive information copied to the device clipboard
- Acquires the wake lock
- Makes use of the framework's foreground persistence service
- Queries the mobile country code (MCC)
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Uses Crypto APIs (Might try to encrypt user data)
- Checks CPU information
- Checks memory information
Network
MITRE ATT&CK Mobile v15
Persistence
Event Triggered Execution
1Broadcast Receivers
1Foreground Persistence
1Defense Evasion
Download New Code at Runtime
1Foreground Persistence
1Input Injection
1Virtualization/Sandbox Evasion
2System Checks
2Credential Access
Clipboard Data
1Input Capture
2GUI Input Capture
1Keylogging
1Discovery
Software Discovery
1Security Software Discovery
1System Information Discovery
2System Network Configuration Discovery
3Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
48B
MD5046a414913add6f5bb60072c7db819b6
SHA1451ee4f6809260aec622d772fd329c7d0297a842
SHA256b66c1320cb063a1d391c94273572ea6edae76c8c8b0a07f8d75c88686f0df72a
SHA5124e6355f3051ed5e811ab030abde1f5be7f5e1cf33be99cd08477e9b6c015deb1d8bd75a09fb9c7176b8511c5ad0a67abc0902a3531e97564ccb6afc57496a47c
-
Filesize
1018B
MD50c3f5971bd801f81edbe9f1bb317464c
SHA1637ee817d458d09d7798ad7e006d56bd93661eab
SHA256260227d0f3125609f687acb587c15b096405325102cd20fdd99eae5a0222f4c4
SHA51282db5c7c919001573aef65fb32f817fa65dd1782a828311afe16abfb04df628d7a7b352364222481430ed3794e36a8c81af65315d5ee3688e60e56dd97dcaf39
-
Filesize
1018B
MD5c6f9e6be8a9ea19957ce7a00caeb25db
SHA14dc409b604f00c92937612e7fd33a5a1cdacd99a
SHA2569b58680c34a5a1e4be5089a243fcd621cbe90ca946e793876cbb047f9d9c0912
SHA512ccf0d04e1d43355b12141635a3defd745d5fcb17a1e3abd2c8b1e2445940e765912c074e5a9e5dd3d398aa3d18700c0a3e874f92c3969524ca926f10cc9babbf
-
Filesize
322KB
MD577dc50489b9323274732d27dc8a4e803
SHA10e02a3595b62489d0739d771881da8604d117c65
SHA256c5684e792d1ebefea6aac09fed45911703fd58c899f8a08133d49dd91429a820
SHA5120684a92f3e9c525384cfa53f531afba61e5930e1c27032a7e27e3315f72761b62e122dc34768d8162ba08f9bed53d148aa8dc034b46456bdd211f230637eba58
-
Filesize
290B
MD50f73bb2830462f67fad5767822fde05e
SHA15b8de3fd4084402b933f40e8d943335179a270c4
SHA256b034883d8910023883683f47c9c304aff2cd9ee85e3f6ade24625debde6efa94
SHA512c4c92b327ed1fe36cd0e54a1b4feb592f93f125c8804a3e880a09c8dfccb8aa9ddef370c0da5b2d45dbc759b52aab2e0a07579488e457571490356c499f1e850
-
Filesize
525KB
MD5b4ba7d6db1871e8c66f9ac58a203798b
SHA166932ffb23b362fb381f9943e99db8acf550fc33
SHA25600b8ab2a5a4e83e7e02165e433cca027273626983537fee7d4a85ee722dd86d3
SHA512dafdcbb08b36827647922ca6a5bf46c2a170bcec9fbccf606d1af5b10e697b1201f7b95506fb8adc1a9328227bdab9634eb3e4d079e66c22ab478b110162eb9e
-
Filesize
1KB
MD5f5292792ab6971a97dd006992641a9e4
SHA1325a9e59822b35665c6d4220f3a8a95defc85ce4
SHA256c65c30347e74c99ca486509f04126ff52ea426397b1301b656f1411b24ad483b
SHA512c385245f73ce31296d2fae083bc15714a5825697865d4ea48e0fcd67e8116c292e514c1b514c3733bf9a8e9dea43cec761715f6c88ad8e54fe589312fbcaca84