Analysis
-
max time kernel
149s -
max time network
161s -
platform
android_x64 -
resource
android-33-x64-arm64-20240624-en -
resource tags
-
submitted
11-01-2025 16:54
General
-
Target
d5adf7ab5328e4acea7217af18d5f1720ce1200ad68c8ecb2916d45ad90b4903.apk
-
Size
8.0MB
-
MD5
a161a1dc09d6144cd8b1140c5f02f52b
-
SHA1
583c017533b40e6eef6095a43e7caa59f2e36793
-
SHA256
d5adf7ab5328e4acea7217af18d5f1720ce1200ad68c8ecb2916d45ad90b4903
-
SHA512
79aabc9b169cee6918bd6f6b7b9e85076922792040f37d2a48129c2f074b65da7956dec32fc74caee4e3eda5e29af16a469c7400f47ce52353d66fbdafa4aa50
-
SSDEEP
196608:FQUHOj7c7uZa4LIwia+SjYMvSgNU8TrMRd2c+0:FQM7uAbwRQxgN7Tr9cz
Malware Config
Extracted
octo
https://d321b219cadffcdc5d074a87b6c0279b.info
Signatures
-
Octo
Octo is a banking malware with remote access capabilities first seen in April 2022.
-
Octo family
-
Octo payload 1 IoCs
-
Loads dropped Dex/Jar 1 TTPs 2 IoCs
Runs executable file dropped to the device during analysis.
-
Makes use of the framework's Accessibility service 4 TTPs 2 IoCs
Retrieves information displayed on the phone screen using AccessibilityService.
-
Obtains sensitive information copied to the device clipboard 2 TTPs 1 IoCs
Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.
-
Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
-
Queries the phone number (MSISDN for GSM devices) 1 TTPs
-
Acquires the wake lock 1 IoCs
-
Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs
Application may abuse the framework's foreground service to continue running in the foreground.
-
Queries the mobile country code (MCC) 1 TTPs 1 IoCs
-
Reads information about phone network operator. 1 TTPs
-
Requests disabling of battery optimizations (often used to enable hiding in the background). 1 TTPs 1 IoCs
-
Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs
-
Checks CPU information 2 TTPs 1 IoCs
-
Checks memory information 2 TTPs 1 IoCs
Processes
-
com.mlegal57_gestural1⤵
- Loads dropped Dex/Jar
- Makes use of the framework's Accessibility service
- Obtains sensitive information copied to the device clipboard
- Acquires the wake lock
- Makes use of the framework's foreground persistence service
- Queries the mobile country code (MCC)
- Requests disabling of battery optimizations (often used to enable hiding in the background).
- Uses Crypto APIs (Might try to encrypt user data)
- Checks CPU information
- Checks memory information
Network
MITRE ATT&CK Mobile v15
Defense Evasion
Download New Code at Runtime
1Foreground Persistence
1Hide Artifacts
1User Evasion
1Input Injection
1Virtualization/Sandbox Evasion
2System Checks
2Credential Access
Clipboard Data
1Input Capture
2GUI Input Capture
1Keylogging
1Discovery
Software Discovery
1Security Software Discovery
1System Information Discovery
2System Network Configuration Discovery
3Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
48B
MD5046a414913add6f5bb60072c7db819b6
SHA1451ee4f6809260aec622d772fd329c7d0297a842
SHA256b66c1320cb063a1d391c94273572ea6edae76c8c8b0a07f8d75c88686f0df72a
SHA5124e6355f3051ed5e811ab030abde1f5be7f5e1cf33be99cd08477e9b6c015deb1d8bd75a09fb9c7176b8511c5ad0a67abc0902a3531e97564ccb6afc57496a47c
-
Filesize
1KB
MD56421acc03a941716b59e43d34e3e26a5
SHA1bc55401f83caee22d130d5127766a40dccdb5f80
SHA256a4807f29f322b54ce494ea42e7d0603cb158d52705312c5739056beb4326dd5e
SHA512c77a566fade956546d789b19f82def8447d8020c116f35e9beba6e7a5bc2fcc17b206a7a840c5700068ac5172cb11de466b3d7d3a44c3b1049fb5ccadd638e91
-
Filesize
1KB
MD506e7c17081ef7ec38df2c19f74e51eab
SHA15a95fa4858fd0fe0537849caaa00fa26061ee50e
SHA25689f0062466e4d167b0370be912eb48940b451f40f0e9710f32af1983d9279330
SHA5124ed691e1f48af33694ccbb52d4e959e72b111d36a3380700f175f3798b2d162157310b676bbcf8e0774971bfff489b7aac82561114ad6450087817e1658b06d4
-
Filesize
1KB
MD525b0fa153fd3d2b0626f9798b8f14f30
SHA18684f8bfbd8b10304a31ab93970f0e898bb3a2c8
SHA256d8a894e1518c90e69ad34ad6ec2f94568dda7957e6caa057b1dccc4f4b68e91d
SHA51285967d4553473d23c187fd895bec7d0c3665745f0c047129d70fe5801f19cf1135b2d1ae88dd118c1d20c9a7a7fcb28f3cf3ae186081f671295500ad8f7e7c43
-
Filesize
322KB
MD577dc50489b9323274732d27dc8a4e803
SHA10e02a3595b62489d0739d771881da8604d117c65
SHA256c5684e792d1ebefea6aac09fed45911703fd58c899f8a08133d49dd91429a820
SHA5120684a92f3e9c525384cfa53f531afba61e5930e1c27032a7e27e3315f72761b62e122dc34768d8162ba08f9bed53d148aa8dc034b46456bdd211f230637eba58
-
Filesize
13KB
MD51e26015e4dcb3bbd0ab0ce4d5ec86b84
SHA199992460fdbe11dbb395bd810e8d811bba599b59
SHA256442293fbbcfcbac5b94f604e16dd5bd43048910c4b0bc3cfe150eaf8f2ca7c20
SHA5120ee676b2864615b897d1a90891ab458bd91ebbc3598f1942fb270dd187629abb9c4165ae775a653ddbb96f98a198f083853f3e66b2b40160f88b7c22da9ac1fa
-
Filesize
525KB
MD5445eb7b6b7aa907823519cfbb11e03d3
SHA1301c327de5ab7f39b0ac0c66610ad5e1fff8ddfe
SHA2562d6b7ea79125e59cb1ea087860f363a2f19b4f93c792eac699f305ef0859afad
SHA512e419454b7f7ebc453a21df46fc644479e099652121252478878042474698bdc0e7e691343c56408f4ad5fa2c1fcf455ca6d0122d00585f19b63788403eaf9a99