Overview

overview

10

Static

static

6

file.apk

android-9-x86

10

file.apk

android-10-x64

10

Analysis

  • max time kernel
    142s
  • max time network
    151s
  • platform
    android_x86
  • resource
    android-x86-arm-20240624-en
  • resource tags

    androidarch:armarch:x86image:android-x86-arm-20240624-enlocale:en-usos:android-9-x86system
  • submitted
    21/01/2025, 07:01

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target

    file.apk

  • Size

    7.0MB

  • MD5

    1f603e8cdd515bde64145eb1ff77f424

  • SHA1

    23de762898566b70016715b928f05effaa7075f3

  • SHA256

    0172a93ab3f19b968c8bcf01d43022fb662c213b473fb43e6bdf25248ee1eadd

  • SHA512

    8f18df0deca158759e79360e6e6c2dd5eba1245c89acfd20964fdc811a4fc5efadafcb4af4b2a6a3b7e61c2322f6409c95b726e08b7e40abdd4ae5faa5b14253

  • SSDEEP

    98304:2s75iSRGJeu2t+Si2M6ZRsUpDIaCj7aVKubTDlRZYcgOJ0:2s7rrt1i2MKR1yPj7aUSvlRZjJ0

Score
10/10
octobankercollectioncredential_accessdefense_evasiondiscoveryevasionimpactinfostealerpersistencerattrojan

Malware Config

Extracted

Family

octo

AES_key
AES_key

Signatures

  • Octo

    Octo is a banking malware with remote access capabilities first seen in April 2022.

    bankertrojaninfostealerratocto
  • Octo family
    octo
  • Octo payload 1 IoCs
  • Checks Android system properties for emulator presence. 1 TTPs 1 IoCs
    defense_evasion
  • Loads dropped Dex/Jar 1 TTPs 3 IoCs

    Runs executable file dropped to the device during analysis.

    evasion
  • Makes use of the framework's Accessibility service 4 TTPs 2 IoCs

    Retrieves information displayed on the phone screen using AccessibilityService.

    collectiondefense_evasioncredential_access
  • Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
    bankerdiscovery
  • Queries the phone number (MSISDN for GSM devices) 1 TTPs
    discovery
  • Acquires the wake lock 1 IoCs
  • Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs

    Application may abuse the framework's foreground service to continue running in the foreground.

    defense_evasionpersistence
  • Queries the mobile country code (MCC) 1 TTPs 1 IoCs
    discovery
  • Queries the unique device ID (IMEI, MEID, IMSI) 1 TTPs
    discovery
  • Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs
    persistence
  • Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs
    impact
  • Checks CPU information 2 TTPs 1 IoCs
  • Checks memory information 2 TTPs 1 IoCs

Processes

  • com.fcontacts_threeey
    1⤵
    • Checks Android system properties for emulator presence.
    • Loads dropped Dex/Jar
    • Makes use of the framework's Accessibility service
    • Acquires the wake lock
    • Makes use of the framework's foreground persistence service
    • Queries the mobile country code (MCC)
    • Registers a broadcast receiver at runtime (usually for listening for system events)
    • Uses Crypto APIs (Might try to encrypt user data)
    • Checks CPU information
    • Checks memory information
    PID:4244
    • /system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.fcontacts_threeey/app_false/Ue.json --output-vdex-fd=41 --oat-fd=42 --oat-location=/data/user/0/com.fcontacts_threeey/app_false/oat/x86/Ue.odex --compiler-filter=quicken --class-loader-context=&
      2⤵
      • Loads dropped Dex/Jar
      PID:4272

Network

        MITRE ATT&CK Mobile v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • /data/data/com.fcontacts_threeey/.global.com.fcontacts_threeey
          Filesize

          48B

          MD5

          046a414913add6f5bb60072c7db819b6

          SHA1

          451ee4f6809260aec622d772fd329c7d0297a842

          SHA256

          b66c1320cb063a1d391c94273572ea6edae76c8c8b0a07f8d75c88686f0df72a

          SHA512

          4e6355f3051ed5e811ab030abde1f5be7f5e1cf33be99cd08477e9b6c015deb1d8bd75a09fb9c7176b8511c5ad0a67abc0902a3531e97564ccb6afc57496a47c

          Download Submit

        • /data/data/com.fcontacts_threeey/app_false/Ue.json
          Filesize

          1009B

          MD5

          1a775b04dd41d780ef03f33c4a056646

          SHA1

          aaba70e56d9e7ce2e8443c88556a41ab83b160ab

          SHA256

          e7615420fe98ab46cab25fa737e698ca7c5aa9d657b5633f7b5c10a4fd5d5553

          SHA512

          995ba5a9f9e679757a47666b0ba227c098939176ee55cea1a5658d9e63ed0edc2e6f021b498d751ba6c67dfcdba3b0de0b163560b957a537615e619b4c59b381

          Download Submit

        • /data/data/com.fcontacts_threeey/app_false/Ue.json
          Filesize

          1009B

          MD5

          38e37940e70c3f985d7879ced9200b0a

          SHA1

          3a7771bc95b7711fc6262f062c7a42409cd2cf1a

          SHA256

          7240ee0119f7de0a97983beda5deeecad487711b96938b2a0da6cb7c24c03f3e

          SHA512

          46979e08da1b98adfe41caae8128ca9d7b8db933b18ac5f0b7c08b00a4cf2fb2b8b709fed44dca9144284007bd46a5a146fd3ebeaac98e7b38a84de486f3c5bf

          Download Submit

        • /data/data/com.fcontacts_threeey/files/.s
          Filesize

          307KB

          MD5

          4e73947cabb5db3f92ca85004981b754

          SHA1

          6d9667fdb0280ed2dcb782b4683e422a51bdc601

          SHA256

          6db94232e756b90ed437f1bc87dc38cf20fb2e7c7a19a5e40c6c17254b7e234c

          SHA512

          be8b500a7070af1dfb53b0cf1a7b327dadc4e163a6dad905496ac228c58cd1ed87b054533917924455d35e9b300683ae33e1bcdd91935a5dbae1d693c3e13d69

          Download Submit

        • /data/user/0/com.fcontacts_threeey/app_false/Ue.json
          Filesize

          1KB

          MD5

          1e058b828df014c0d56a9a560140211e

          SHA1

          5948723d3d6c675121a4963dfab5af8fc03cdf7d

          SHA256

          676080cc0c983e715e9eaa554093ff97f50d03e9ec5db42b806dd0caca17bab1

          SHA512

          6089f983feeb85b2f62b7c729809b0cfaced194ea217528d973b973fbc1ae9322bcea3fb298710ca547b24004a7fb6036ac789a1b782bb1dd26ffe533275f59f

          Download Submit

        • /data/user/0/com.fcontacts_threeey/app_false/Ue.json
          Filesize

          1KB

          MD5

          8f95870b5ac5b96f85ac633cdc50b059

          SHA1

          56c50fac0aa24dbb717fe181272992b5cb1001a0

          SHA256

          ab309d34a2f834c80f3ac9e8982e0a8bb42256295a5e34b70e781172983b1b6a

          SHA512

          759377365e5e8a18900b296ce70781264ceb2945735688e023738eb70c74668ebe442621c9c3740e573dce97d3d23324336f7c50815c9b8d07dfd4e3e9c05ab7

          Download Submit

        • Anonymous-DexFile@0xc8378000-0xc83fb758
          Filesize

          525KB

          MD5

          6e1262bcb015b056e16f0a8374a56174

          SHA1

          8b1bda24bed0a7e6d450a1ab37e3c0c83c85cf20

          SHA256

          9ee6516ee147bc8f0fe7de2be4b86434f483a8c22ee1fb18abdb29a07e20015f

          SHA512

          a5a387190b3b7b6d25a261c6bbb71251f2b7a5ea57bd20faaf052ac971e0fb9137412ca65c4a3e822676841214104f7081e16ab4d27c11ff5190705cddae1210

          Download Submit