Analysis
-
max time kernel
138s -
max time network
131s -
platform
android_x86 -
resource
android-x86-arm-20240624-en -
resource tags
-
submitted
15-01-2025 12:48
General
-
Target
0172a93ab3f19b968c8bcf01d43022fb662c213b473fb43e6bdf25248ee1eadd.apk
-
Size
7.0MB
-
MD5
1f603e8cdd515bde64145eb1ff77f424
-
SHA1
23de762898566b70016715b928f05effaa7075f3
-
SHA256
0172a93ab3f19b968c8bcf01d43022fb662c213b473fb43e6bdf25248ee1eadd
-
SHA512
8f18df0deca158759e79360e6e6c2dd5eba1245c89acfd20964fdc811a4fc5efadafcb4af4b2a6a3b7e61c2322f6409c95b726e08b7e40abdd4ae5faa5b14253
-
SSDEEP
98304:2s75iSRGJeu2t+Si2M6ZRsUpDIaCj7aVKubTDlRZYcgOJ0:2s7rrt1i2MKR1yPj7aUSvlRZjJ0
Malware Config
Extracted
octo
Signatures
-
Octo
Octo is a banking malware with remote access capabilities first seen in April 2022.
-
Octo family
-
Octo payload 1 IoCs
-
Checks Android system properties for emulator presence. 1 TTPs 1 IoCs
-
Loads dropped Dex/Jar 1 TTPs 3 IoCs
Runs executable file dropped to the device during analysis.
-
Makes use of the framework's Accessibility service 4 TTPs 2 IoCs
Retrieves information displayed on the phone screen using AccessibilityService.
-
Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
-
Queries the phone number (MSISDN for GSM devices) 1 TTPs
-
Acquires the wake lock 1 IoCs
-
Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs
Application may abuse the framework's foreground service to continue running in the foreground.
-
Queries the mobile country code (MCC) 1 TTPs 1 IoCs
-
Queries the unique device ID (IMEI, MEID, IMSI) 1 TTPs
-
Reads information about phone network operator. 1 TTPs
-
Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs
-
Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs
-
Checks CPU information 2 TTPs 1 IoCs
-
Checks memory information 2 TTPs 1 IoCs
Processes
-
com.fcontacts_threeey1⤵
- Checks Android system properties for emulator presence.
- Loads dropped Dex/Jar
- Makes use of the framework's Accessibility service
- Acquires the wake lock
- Makes use of the framework's foreground persistence service
- Queries the mobile country code (MCC)
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Uses Crypto APIs (Might try to encrypt user data)
- Checks CPU information
- Checks memory information
-
/system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.fcontacts_threeey/app_false/Ue.json --output-vdex-fd=41 --oat-fd=42 --oat-location=/data/user/0/com.fcontacts_threeey/app_false/oat/x86/Ue.odex --compiler-filter=quicken --class-loader-context=&2⤵
- Loads dropped Dex/Jar
-
Network
MITRE ATT&CK Mobile v15
Persistence
Event Triggered Execution
1Broadcast Receivers
1Foreground Persistence
1Defense Evasion
Download New Code at Runtime
1Foreground Persistence
1Input Injection
1Virtualization/Sandbox Evasion
3System Checks
3Discovery
Software Discovery
1Security Software Discovery
1System Information Discovery
2System Network Configuration Discovery
4Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
48B
MD5046a414913add6f5bb60072c7db819b6
SHA1451ee4f6809260aec622d772fd329c7d0297a842
SHA256b66c1320cb063a1d391c94273572ea6edae76c8c8b0a07f8d75c88686f0df72a
SHA5124e6355f3051ed5e811ab030abde1f5be7f5e1cf33be99cd08477e9b6c015deb1d8bd75a09fb9c7176b8511c5ad0a67abc0902a3531e97564ccb6afc57496a47c
-
Filesize
1009B
MD51a775b04dd41d780ef03f33c4a056646
SHA1aaba70e56d9e7ce2e8443c88556a41ab83b160ab
SHA256e7615420fe98ab46cab25fa737e698ca7c5aa9d657b5633f7b5c10a4fd5d5553
SHA512995ba5a9f9e679757a47666b0ba227c098939176ee55cea1a5658d9e63ed0edc2e6f021b498d751ba6c67dfcdba3b0de0b163560b957a537615e619b4c59b381
-
Filesize
1009B
MD538e37940e70c3f985d7879ced9200b0a
SHA13a7771bc95b7711fc6262f062c7a42409cd2cf1a
SHA2567240ee0119f7de0a97983beda5deeecad487711b96938b2a0da6cb7c24c03f3e
SHA51246979e08da1b98adfe41caae8128ca9d7b8db933b18ac5f0b7c08b00a4cf2fb2b8b709fed44dca9144284007bd46a5a146fd3ebeaac98e7b38a84de486f3c5bf
-
Filesize
307KB
MD54e73947cabb5db3f92ca85004981b754
SHA16d9667fdb0280ed2dcb782b4683e422a51bdc601
SHA2566db94232e756b90ed437f1bc87dc38cf20fb2e7c7a19a5e40c6c17254b7e234c
SHA512be8b500a7070af1dfb53b0cf1a7b327dadc4e163a6dad905496ac228c58cd1ed87b054533917924455d35e9b300683ae33e1bcdd91935a5dbae1d693c3e13d69
-
Filesize
1KB
MD51e058b828df014c0d56a9a560140211e
SHA15948723d3d6c675121a4963dfab5af8fc03cdf7d
SHA256676080cc0c983e715e9eaa554093ff97f50d03e9ec5db42b806dd0caca17bab1
SHA5126089f983feeb85b2f62b7c729809b0cfaced194ea217528d973b973fbc1ae9322bcea3fb298710ca547b24004a7fb6036ac789a1b782bb1dd26ffe533275f59f
-
Filesize
1KB
MD58f95870b5ac5b96f85ac633cdc50b059
SHA156c50fac0aa24dbb717fe181272992b5cb1001a0
SHA256ab309d34a2f834c80f3ac9e8982e0a8bb42256295a5e34b70e781172983b1b6a
SHA512759377365e5e8a18900b296ce70781264ceb2945735688e023738eb70c74668ebe442621c9c3740e573dce97d3d23324336f7c50815c9b8d07dfd4e3e9c05ab7
-
Filesize
525KB
MD56e1262bcb015b056e16f0a8374a56174
SHA18b1bda24bed0a7e6d450a1ab37e3c0c83c85cf20
SHA2569ee6516ee147bc8f0fe7de2be4b86434f483a8c22ee1fb18abdb29a07e20015f
SHA512a5a387190b3b7b6d25a261c6bbb71251f2b7a5ea57bd20faaf052ac971e0fb9137412ca65c4a3e822676841214104f7081e16ab4d27c11ff5190705cddae1210