Analysis
-
max time kernel
862s -
max time network
760s -
platform
android-10_x64 -
resource
android-x64-20240910-en -
resource tags
-
submitted
11-01-2025 16:59
General
-
Target
3a058e837c817aa8179202f754850a1bebdeca1a22421b17b9947c3e75ab923c.apk
-
Size
8.6MB
-
MD5
3f08d0978d80de888fd1c7c2e37e6a53
-
SHA1
4fabace698ba3f8923217bf0282096d250232456
-
SHA256
3a058e837c817aa8179202f754850a1bebdeca1a22421b17b9947c3e75ab923c
-
SHA512
9534e0b05b44e37398c8f7d9a08a95e59f3220a6f98ea5f23eeb84d603cee2a46c53a87d45803a5b8058af58d39597e9a9165b427f12d68c5b27746d6b9e376d
-
SSDEEP
98304:0idbxVKJ2vn3Xc5iSRGt8RsPE+ZeNe4E3KVFozsswwCfO:0ibxUIP3XcrBRzlJoz95H
Malware Config
Extracted
octo
https://f3ad8ca1cecfb4942d9b6cec53bbfe94.org
https://c741e321a625f9195ee4b22f53b8f386.info
https://8caf6a13209282f9dadc9eac58c5007e.com
Signatures
-
Octo
Octo is a banking malware with remote access capabilities first seen in April 2022.
-
Octo family
-
Octo payload 1 IoCs
-
Loads dropped Dex/Jar 1 TTPs 2 IoCs
Runs executable file dropped to the device during analysis.
-
Makes use of the framework's Accessibility service 4 TTPs 2 IoCs
Retrieves information displayed on the phone screen using AccessibilityService.
-
Obtains sensitive information copied to the device clipboard 2 TTPs 1 IoCs
Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.
-
Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
-
Queries the phone number (MSISDN for GSM devices) 1 TTPs
-
Acquires the wake lock 1 IoCs
-
Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs
Application may abuse the framework's foreground service to continue running in the foreground.
-
Queries the mobile country code (MCC) 1 TTPs 1 IoCs
-
Reads information about phone network operator. 1 TTPs
-
Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs
-
Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs
-
Checks CPU information 2 TTPs 1 IoCs
-
Checks memory information 2 TTPs 1 IoCs
Processes
-
com.marketintelligenceklms711⤵
- Loads dropped Dex/Jar
- Makes use of the framework's Accessibility service
- Obtains sensitive information copied to the device clipboard
- Acquires the wake lock
- Makes use of the framework's foreground persistence service
- Queries the mobile country code (MCC)
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Uses Crypto APIs (Might try to encrypt user data)
- Checks CPU information
- Checks memory information
Network
MITRE ATT&CK Mobile v15
Persistence
Event Triggered Execution
1Broadcast Receivers
1Foreground Persistence
1Defense Evasion
Download New Code at Runtime
1Foreground Persistence
1Input Injection
1Virtualization/Sandbox Evasion
2System Checks
2Credential Access
Clipboard Data
1Input Capture
2GUI Input Capture
1Keylogging
1Discovery
Software Discovery
1Security Software Discovery
1System Information Discovery
2System Network Configuration Discovery
3Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
48B
MD5046a414913add6f5bb60072c7db819b6
SHA1451ee4f6809260aec622d772fd329c7d0297a842
SHA256b66c1320cb063a1d391c94273572ea6edae76c8c8b0a07f8d75c88686f0df72a
SHA5124e6355f3051ed5e811ab030abde1f5be7f5e1cf33be99cd08477e9b6c015deb1d8bd75a09fb9c7176b8511c5ad0a67abc0902a3531e97564ccb6afc57496a47c
-
Filesize
1020B
MD575c1f9b930fc4ea29de3f23fcf278537
SHA1fb12d6d8126771b395beb17520d3600918f290c0
SHA2569f48f2dd8ee77db4f4ae8dac2d36bbd6ca658e2eb3a1c4e14c70f04794e529fd
SHA5124c69ec16701a0a6d881f0ffffe049dfefbef532d77a4373b7b7c0b55949ec78e7f65621f5a88301044484c6cecc582e13d47b2e9f63ddb02828273fde02f4d5c
-
Filesize
1020B
MD5dbd45af644fb8251733ebb7ee5953698
SHA1e5cfc8d3e8a88a101ae59c6ca0e9d0d5e3e4528a
SHA25682a3d5bff9763a46954dbf066dff8b6e2b111bc3dc014cbe8ae8b5d79eda42cb
SHA512412627187e40b4f104dae83a1944f3d99e778b625584a37a8f2086547ee41f626c24792f4f673b6cf089f44eba0c53806eabcddfc84d0307efb8ceccb1f3c92c
-
Filesize
322KB
MD577dc50489b9323274732d27dc8a4e803
SHA10e02a3595b62489d0739d771881da8604d117c65
SHA256c5684e792d1ebefea6aac09fed45911703fd58c899f8a08133d49dd91429a820
SHA5120684a92f3e9c525384cfa53f531afba61e5930e1c27032a7e27e3315f72761b62e122dc34768d8162ba08f9bed53d148aa8dc034b46456bdd211f230637eba58
-
Filesize
304B
MD5f6d8220355f4f7e3d26d8461de42394f
SHA19e09e030fe2bd6b6ba723091dd774e62b02ea0e2
SHA256f93bd68c4c1e8d77c96845bf6dbb7901b2f4271999aeb2522afd08b8d2b01402
SHA512614c5929cf30a881ac551040e39b4d807644d88abe025205959470a496a81649a1795708b216cef7c2f5bbf2e86fd2ed664a8997952e6054a13a577ba00a8a26
-
Filesize
526KB
MD53d399c409f180e05a105ecf5c06703e1
SHA1963b98a8cda502bebba98a084c9d5f95d351ffb9
SHA2563352cbfad9a0ea1a67b48096c13e31573f2e56d604b097cc53481a11e852da1a
SHA512cc6de73e55ca1e5ec2c503633d6f0ca1a62aef1d5bf2878bafbc76103f8decc302cd3356c4222b391a9ab04c8c568225cdb7f22f44155f3643c257e25cfda34f
-
Filesize
1KB
MD521bc926ffbb89b059316f2c38698a51f
SHA1d7b1c571c8ea5382fb42710cb4258f3a341bfa10
SHA2563ac80d4d248536ffc16298aa38b0de533f649f711d6c348c85e95303e500dada
SHA512b941c4ebdf481510e5d784567ef549aa3856c47cf90cd49e044f730343acc240a20a1e8a61ab76d440d498bf112a683cea1fe5deb7a735bd41b4f880366c0f8b