Analysis
-
max time kernel
899s -
max time network
904s -
platform
android_x64 -
resource
android-33-x64-arm64-20240624-en -
resource tags
-
submitted
11-01-2025 16:58
General
-
Target
4dd84cc9bc28bd3e7e2f83df86b14393ba88b56d6824342aeba204804d014097.apk
-
Size
8.6MB
-
MD5
b2444c1e5b9f06ff1a491010091c146e
-
SHA1
d50460d7d2b885a7ae77f48ba746ab38dbd8bb63
-
SHA256
4dd84cc9bc28bd3e7e2f83df86b14393ba88b56d6824342aeba204804d014097
-
SHA512
a50838c7383f89f7e1fcd8b9aef2dd32b90b7d4928cfd590824782752106fe16a07689e567563cd6149824a02d4db1ac30b5d306934a2a18368e39b01490ee67
-
SSDEEP
98304:QWk2FFj70Rskv5iSRGHAVKaK/2WjN5g4xr83+BlCpB8:QD2Xj70R9rZU7lN5g4lBs8
Malware Config
Extracted
octo
https://d5abaaa83590ecf7b2432196e08081a8.biz
Signatures
-
Octo
Octo is a banking malware with remote access capabilities first seen in April 2022.
-
Octo family
-
Octo payload 1 IoCs
-
Loads dropped Dex/Jar 1 TTPs 2 IoCs
Runs executable file dropped to the device during analysis.
-
Makes use of the framework's Accessibility service 4 TTPs 2 IoCs
Retrieves information displayed on the phone screen using AccessibilityService.
-
Obtains sensitive information copied to the device clipboard 2 TTPs 1 IoCs
Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.
-
Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
-
Queries the phone number (MSISDN for GSM devices) 1 TTPs
-
Acquires the wake lock 1 IoCs
-
Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs
Application may abuse the framework's foreground service to continue running in the foreground.
-
Queries the mobile country code (MCC) 1 TTPs 1 IoCs
-
Reads information about phone network operator. 1 TTPs
-
Requests disabling of battery optimizations (often used to enable hiding in the background). 1 TTPs 1 IoCs
-
Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs
-
Checks CPU information 2 TTPs 1 IoCs
-
Checks memory information 2 TTPs 1 IoCs
Processes
-
com.nuwb_auto91⤵
- Loads dropped Dex/Jar
- Makes use of the framework's Accessibility service
- Obtains sensitive information copied to the device clipboard
- Acquires the wake lock
- Makes use of the framework's foreground persistence service
- Queries the mobile country code (MCC)
- Requests disabling of battery optimizations (often used to enable hiding in the background).
- Uses Crypto APIs (Might try to encrypt user data)
- Checks CPU information
- Checks memory information
Network
MITRE ATT&CK Mobile v15
Defense Evasion
Download New Code at Runtime
1Foreground Persistence
1Hide Artifacts
1User Evasion
1Input Injection
1Virtualization/Sandbox Evasion
2System Checks
2Credential Access
Clipboard Data
1Input Capture
2GUI Input Capture
1Keylogging
1Discovery
Software Discovery
1Security Software Discovery
1System Information Discovery
2System Network Configuration Discovery
3Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
48B
MD5046a414913add6f5bb60072c7db819b6
SHA1451ee4f6809260aec622d772fd329c7d0297a842
SHA256b66c1320cb063a1d391c94273572ea6edae76c8c8b0a07f8d75c88686f0df72a
SHA5124e6355f3051ed5e811ab030abde1f5be7f5e1cf33be99cd08477e9b6c015deb1d8bd75a09fb9c7176b8511c5ad0a67abc0902a3531e97564ccb6afc57496a47c
-
Filesize
1007B
MD5fc9c8c328b78afa4f0bf2143495e4d3d
SHA122efac2c1a7912c7b08c7d9db3314adda1664fdc
SHA2565625319bf7cf414ecad577fd3082924012532577f67e0c93dffee57b857d28c8
SHA512f6bc91155be09a83f20d579b0f334e5150e59fadd8299fae87062a195d92b66fcf189a45e7aec751bba1eead2e4a710a0adb2a8e7e820dc8cd6de04921fea4e1
-
Filesize
1007B
MD575866875b01e6c5841dc76c90795e46c
SHA1b391b00f968599fdd015c30a156b9d6a8e47542c
SHA2567ea35edaa789230d11e0a93da27fa18bc857cb6e3ff6b8fe250623e816151ca3
SHA512521340bf0619aaf2c27c996bd07209b3b28b7503bcdb992683f96063524a6bd3924cf60a5199405f817fdabdae3d63925cdb79dd2f6afa5acc6d77764270dc12
-
Filesize
322KB
MD577dc50489b9323274732d27dc8a4e803
SHA10e02a3595b62489d0739d771881da8604d117c65
SHA256c5684e792d1ebefea6aac09fed45911703fd58c899f8a08133d49dd91429a820
SHA5120684a92f3e9c525384cfa53f531afba61e5930e1c27032a7e27e3315f72761b62e122dc34768d8162ba08f9bed53d148aa8dc034b46456bdd211f230637eba58
-
Filesize
13KB
MD515e84507f24a28cd57aca3c30165d5f9
SHA134644619282087f588792f2d539ee6375156367c
SHA25650537e1fd68ad905d6fa2db9930e2426e68bd8ecbb0efa75ccd7dd413e669106
SHA5120f792144455eb9346d58b2f791f0bb5e794a0af8d8c48082f7a09eb349fcb84317c9a7f2047df18cc4a5be385800a5c2380881170cc7e8ad3161694d7759cb31
-
Filesize
525KB
MD57c6eb758f59b2946982a7c8a6978fcd5
SHA1a8c053d1c42594f9090c71748becf85d3af63135
SHA25690618941048ab3eafa34f04499f877ca093139c912ca885f441866276425780f
SHA512586488e46a47cec2ad0e182c217eee7818c59649f909b6e1e5a5379ac7004e667954da30a9060d48ce4b4b52272bfd49c247e85873325cc38f2103c73aebe3b9
-
Filesize
1KB
MD55cc77d3cd68e58ec8849b61ca6da1a37
SHA1ae9d56379983b92fdd4e0daff6ce247e3b95f82b
SHA2565d17dda695dcdeac560e3cd0fb98cd7987cdefd585d63bd9d5c7999130c724eb
SHA512fd5598902c112783f9e449e33dce16911415668722589f7a4fa4c5b8663cc6f244cb47e1b30e1c90afb1f3f62f2714adee50cb5a5960f305746f22a7d9045fab