Overview

overview

10

Static

static

6

8c365dad91...5f.apk

android-9-x86

10

Analysis

  • max time kernel
    17s
  • max time network
    26s
  • platform
    android-9_x86
  • resource
    android-x86-arm-20240910-en
  • resource tags

    arch:armarch:x86image:android-x86-arm-20240910-enlocale:en-usos:android-9-x86system
  • submitted
    11-01-2025 16:18

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    8c365dad91a9f14e01ad15f0d25ac1c717af76bace34b38858a91ff32767a55f.apk

  • Size

    7.0MB

  • MD5

    b10286d9db8c141d7363c7aaa5d4510f

  • SHA1

    2a2d0388bbb04c45938eb9a841783d55b2eee3e7

  • SHA256

    8c365dad91a9f14e01ad15f0d25ac1c717af76bace34b38858a91ff32767a55f

  • SHA512

    73a45085969eb8c389b2bc5ccc80be745668b4abb1e393b8818e099a5528757ee252d226dd821cc53c821a9dee75f254971bf8287d97aae867bb166f3d482388

  • SSDEEP

    98304:ZWPjUVKRyeh3Xe5iSRG/k+KZcn+g2te5Rs/UZVCB1P38H:YPIUU83Xer5+/7bRam4B1P4

Score
10/10
octobankercollectioncredential_accessdiscoveryevasionimpactinfostealerpersistencerattrojan

Malware Config

Extracted

Family

octo

AES_key
AES_key

Signatures

  • Octo

    Octo is a banking malware with remote access capabilities first seen in April 2022.

    bankertrojaninfostealerratocto
  • Octo family
    octo
  • Octo payload 1 IoCs
  • Loads dropped Dex/Jar 1 TTPs 3 IoCs

    Runs executable file dropped to the device during analysis.

    evasion
  • Makes use of the framework's Accessibility service 4 TTPs 2 IoCs

    Retrieves information displayed on the phone screen using AccessibilityService.

    collectionevasioncredential_access
  • Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
    bankerdiscovery
  • Queries the phone number (MSISDN for GSM devices) 1 TTPs
    discovery
  • Acquires the wake lock 1 IoCs
  • Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs

    Application may abuse the framework's foreground service to continue running in the foreground.

    evasionpersistence
  • Queries the mobile country code (MCC) 1 TTPs 1 IoCs
    discovery
  • Queries the unique device ID (IMEI, MEID, IMSI) 1 TTPs
    discovery
  • Reads information about phone network operator. 1 TTPs
    discovery
  • Requests disabling of battery optimizations (often used to enable hiding in the background). 1 TTPs 1 IoCs
    evasion
  • Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs
    persistence
  • Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs
    impact
  • Checks CPU information 2 TTPs 1 IoCs
  • Checks memory information 2 TTPs 1 IoCs

Processes

  • com.fcom5_mode
    1⤵
    • Loads dropped Dex/Jar
    • Makes use of the framework's Accessibility service
    • Acquires the wake lock
    • Makes use of the framework's foreground persistence service
    • Queries the mobile country code (MCC)
    • Requests disabling of battery optimizations (often used to enable hiding in the background).
    • Registers a broadcast receiver at runtime (usually for listening for system events)
    • Uses Crypto APIs (Might try to encrypt user data)
    • Checks CPU information
    • Checks memory information
    PID:4211
    • /system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.fcom5_mode/app_panther/mLBYH.json --output-vdex-fd=41 --oat-fd=42 --oat-location=/data/user/0/com.fcom5_mode/app_panther/oat/x86/mLBYH.odex --compiler-filter=quicken --class-loader-context=&
      2⤵
      • Loads dropped Dex/Jar
      PID:4238

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Event Triggered Execution

1
T1624

Broadcast Receivers

1
T1624.001

Foreground Persistence

1
T1541

Privilege Escalation

Defense Evasion

Download New Code at Runtime

1
T1407

Foreground Persistence

1
T1541

Hide Artifacts

1
T1628

User Evasion

1
T1628.002

Input Injection

1
T1516

Virtualization/Sandbox Evasion

2
T1633

System Checks

2
T1633.001

Credential Access

Input Capture

2
T1417

GUI Input Capture

1
T1417.002

Keylogging

1
T1417.001

Discovery

Software Discovery

1
T1418

Security Software Discovery

1
T1418.001

System Information Discovery

2
T1426

System Network Configuration Discovery

4
T1422

Lateral Movement

Collection

Input Capture

2
T1417

GUI Input Capture

1
T1417.002

Keylogging

1
T1417.001

Screen Capture

1
T1513

Command and Control

Exfiltration

Impact

Data Encrypted for Impact

1
T1471

Input Injection

1
T1516

Replay Monitor

Loading Replay Monitor...

Downloads

  • /data/data/com.fcom5_mode/.global.com.fcom5_mode
    Filesize

    48B

    MD5

    046a414913add6f5bb60072c7db819b6

    SHA1

    451ee4f6809260aec622d772fd329c7d0297a842

    SHA256

    b66c1320cb063a1d391c94273572ea6edae76c8c8b0a07f8d75c88686f0df72a

    SHA512

    4e6355f3051ed5e811ab030abde1f5be7f5e1cf33be99cd08477e9b6c015deb1d8bd75a09fb9c7176b8511c5ad0a67abc0902a3531e97564ccb6afc57496a47c

    Download Submit

  • /data/data/com.fcom5_mode/app_panther/mLBYH.json
    Filesize

    1006B

    MD5

    92b9693685a8479bf31c8d55a8578898

    SHA1

    e4b6dafd1191590ba03ba4c7ad666000215b8e1f

    SHA256

    98a441f1fe604f2e408981d97a0b4dea87966beb6c03dd0d0f08f7d51b5e3ea3

    SHA512

    fe8b19b1b9ed0b0c0261b9485f311dde2af0561b8fe42b44fe3ab215bd172e50a50d7f32ba9e3bd4da4356edd34013f17e5b25c49bb42e7f5274a50bb7cfcad6

    Download Submit

  • /data/data/com.fcom5_mode/app_panther/mLBYH.json
    Filesize

    1006B

    MD5

    0668e84237f44944c95601f843f627ab

    SHA1

    a4cfe25bf0af43c02e54957fed44e25d4e7f7093

    SHA256

    c629224d2aa3036f67d96e43d1274603662ede9f4195a07edda2c2a2604fb244

    SHA512

    68632839a88f478c031f24f1361402df47830fbe3a4ca8ae0fa0b7aec4b95b3c018f7b368d26efd45505fa9ec6f15f2f27a7eea1cedfd5e8e0a84d37b59b8d28

    Download Submit

  • /data/data/com.fcom5_mode/files/.o
    Filesize

    307KB

    MD5

    4e73947cabb5db3f92ca85004981b754

    SHA1

    6d9667fdb0280ed2dcb782b4683e422a51bdc601

    SHA256

    6db94232e756b90ed437f1bc87dc38cf20fb2e7c7a19a5e40c6c17254b7e234c

    SHA512

    be8b500a7070af1dfb53b0cf1a7b327dadc4e163a6dad905496ac228c58cd1ed87b054533917924455d35e9b300683ae33e1bcdd91935a5dbae1d693c3e13d69

    Download Submit

  • /data/user/0/com.fcom5_mode/app_panther/mLBYH.json
    Filesize

    1KB

    MD5

    5a005be58518894e473b4c0b74d6049f

    SHA1

    76e8b707b0560ba786657e0e2a394e5ae85c00cd

    SHA256

    a8e8cf961eb288da458a00483bb710aea8d4a0e165f935541890e2815ee61d34

    SHA512

    340443b200b4b4666dbbfcdd1b3c5ab22d1378699016447420683ce55923e710fae17de68c731508e792e688458b9b9e7ab2f46da5cc3d4820dd5007634b77be

    Download Submit

  • /data/user/0/com.fcom5_mode/app_panther/mLBYH.json
    Filesize

    1KB

    MD5

    ac9149e5ab392b7048dc5820aa0613f8

    SHA1

    0c9414a3ddd7288dcb4a62060083aadefc719d8b

    SHA256

    6d387f72fe1516cd06a053b4c2684aa3f7a6cf0a455783ca269f1ce7fe5f71e6

    SHA512

    dc481f366e4407e978c0dd5a16174d4c7389814f095615728939b94a39e236e07c05b616d9db8827626cfbef34d43a4c3b02d901a620b8a88cbbc1fe81016794

    Download Submit

  • Anonymous-DexFile@0xd2278000-0xd22fb49c
    Filesize

    525KB

    MD5

    9a5471be72448449a0505378d736219b

    SHA1

    9cf90b0d5290fced50539322468d0f1af97b42ae

    SHA256

    65317c643077add652d90c1456931976cd639d240b96557fd792be5234eca140

    SHA512

    3267b9e4e8124fee118c569b7dc5d1576a328c1644363ecd8cccd7c35b698d21e59c39cff1d237e90bfa89ea0074716eac1f43f4459f398b4802ad2bf5b635aa

    Download Submit