Overview

overview

10

Static

static

6

ec16babbd2...35.apk

android-9-x86

10

ec16babbd2...35.apk

android-10-x64

10

Analysis

  • max time kernel
    20s
  • max time network
    35s
  • platform
    android_x86
  • resource
    android-x86-arm-20240624-en
  • resource tags

    androidarch:armarch:x86image:android-x86-arm-20240624-enlocale:en-usos:android-9-x86system
  • submitted
    21-01-2025 14:05

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    ec16babbd2cf2623c1f827cbfef706750332d12dbec7def7d981e6c4be195a35.apk

  • Size

    7.8MB

  • MD5

    69b4cbbe879a159a0db4eeaf3aa64857

  • SHA1

    56f6e28a54c86900a7136215df10dcdf29b7c5d4

  • SHA256

    ec16babbd2cf2623c1f827cbfef706750332d12dbec7def7d981e6c4be195a35

  • SHA512

    999dc6b7c3b6ff1d0ed30aa06169350b3c578d77546598c42a1cd7ad8c934b548e009ded25e4cf7073a50c6fa230046bc9f169260d619c5b1dcc96d1a3f55c89

  • SSDEEP

    98304:PJpJhEVKQOahsj765iSRGcmE3m5yrRsw+SgcSTATD+oJ0hJg:BpPEUfaCj76r84rRZPSTATp

Score
10/10
octobankercollectioncredential_accessdefense_evasiondiscoveryevasionimpactinfostealerpersistencerattrojan

Malware Config

Extracted

Family

octo

AES_key
AES_key

Signatures

  • Octo

    Octo is a banking malware with remote access capabilities first seen in April 2022.

    bankertrojaninfostealerratocto
  • Octo family
    octo
  • Octo payload 1 IoCs
  • Checks Android system properties for emulator presence. 1 TTPs 1 IoCs
    defense_evasion
  • Loads dropped Dex/Jar 1 TTPs 3 IoCs

    Runs executable file dropped to the device during analysis.

    evasion
  • Makes use of the framework's Accessibility service 4 TTPs 2 IoCs

    Retrieves information displayed on the phone screen using AccessibilityService.

    collectiondefense_evasioncredential_access
  • Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
    bankerdiscovery
  • Queries the phone number (MSISDN for GSM devices) 1 TTPs
    discovery
  • Acquires the wake lock 1 IoCs
  • Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs

    Application may abuse the framework's foreground service to continue running in the foreground.

    defense_evasionpersistence
  • Queries the mobile country code (MCC) 1 TTPs 1 IoCs
    discovery
  • Queries the unique device ID (IMEI, MEID, IMSI) 1 TTPs
    discovery
  • Reads information about phone network operator. 1 TTPs
    discovery
  • Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs
    persistence
  • Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs
    impact
  • Checks CPU information 2 TTPs 1 IoCs
  • Checks memory information 2 TTPs 1 IoCs

Processes

  • com.artrash6_machine
    1⤵
    • Checks Android system properties for emulator presence.
    • Loads dropped Dex/Jar
    • Makes use of the framework's Accessibility service
    • Acquires the wake lock
    • Makes use of the framework's foreground persistence service
    • Queries the mobile country code (MCC)
    • Registers a broadcast receiver at runtime (usually for listening for system events)
    • Uses Crypto APIs (Might try to encrypt user data)
    • Checks CPU information
    • Checks memory information
    PID:4258
    • /system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.artrash6_machine/app_bleak/tORSh.json --output-vdex-fd=41 --oat-fd=42 --oat-location=/data/user/0/com.artrash6_machine/app_bleak/oat/x86/tORSh.odex --compiler-filter=quicken --class-loader-context=&
      2⤵
      • Loads dropped Dex/Jar
      PID:4282

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • /data/data/com.artrash6_machine/.global.com.artrash6_machine
    Filesize

    48B

    MD5

    046a414913add6f5bb60072c7db819b6

    SHA1

    451ee4f6809260aec622d772fd329c7d0297a842

    SHA256

    b66c1320cb063a1d391c94273572ea6edae76c8c8b0a07f8d75c88686f0df72a

    SHA512

    4e6355f3051ed5e811ab030abde1f5be7f5e1cf33be99cd08477e9b6c015deb1d8bd75a09fb9c7176b8511c5ad0a67abc0902a3531e97564ccb6afc57496a47c

    Download Submit

  • /data/data/com.artrash6_machine/app_bleak/tORSh.json
    Filesize

    999B

    MD5

    354c6411e98fbaa6c296db52198305f5

    SHA1

    7e95504fc1a8c4d5f8177fe9d5722fcaee5eaf85

    SHA256

    aae0a8a981d4b84d5640adb74747d1e62b3f5ab6b17cb071850eeafb2c204f99

    SHA512

    67aa09e63c0363b8a9ab92868864772677701e9c87ffbaf368b95a8c74b5bf803c93aa22ab2df2b9b0ad3842ffd998b12158b4a2fecfe66c53881d3398288045

    Download Submit

  • /data/data/com.artrash6_machine/app_bleak/tORSh.json
    Filesize

    999B

    MD5

    444bbe0c01ce17d1bf0ea90489070cdc

    SHA1

    c4467bd3b667c4274298196f7c4947ad0a5c5eec

    SHA256

    a441ace6cfcea7eb7ee7ca8e2233da6826280b696c2446bfac43eeeba782d80c

    SHA512

    f3f0fc4e20d232b2a8622f34d9974f765df8b1c6599c303135dc804f63dcf1d12d336377a2712ab53552e51b28de24040c55db3c74ec48ccaabf6f78df3e0b29

    Download Submit

  • /data/data/com.artrash6_machine/files/.e
    Filesize

    307KB

    MD5

    4e73947cabb5db3f92ca85004981b754

    SHA1

    6d9667fdb0280ed2dcb782b4683e422a51bdc601

    SHA256

    6db94232e756b90ed437f1bc87dc38cf20fb2e7c7a19a5e40c6c17254b7e234c

    SHA512

    be8b500a7070af1dfb53b0cf1a7b327dadc4e163a6dad905496ac228c58cd1ed87b054533917924455d35e9b300683ae33e1bcdd91935a5dbae1d693c3e13d69

    Download Submit

  • /data/user/0/com.artrash6_machine/app_bleak/tORSh.json
    Filesize

    1KB

    MD5

    584a1ea4f3357a3bdefdf4a2e3a40b99

    SHA1

    e3b428b8960366f42df137650994313f783a231a

    SHA256

    2240ebe3e7555cf7106856df85006a9d5ca77416105debee8838c8dd9f4a5362

    SHA512

    3242a03d5800fffda4e2b679963e1b6389c54e38e57c1357fa86ec8990a357f3151271ad25a22e7239eefe52c09de48d772d0562c748a95b69ba331a1f47971e

    Download Submit

  • /data/user/0/com.artrash6_machine/app_bleak/tORSh.json
    Filesize

    1KB

    MD5

    64c50bd4dfc7a5f0e12c7149fbf230ba

    SHA1

    f3b23fa7663db953d36186e15e24365a74b9c1b7

    SHA256

    66276e1933be406a63f8f7178f1b4a2d16a977b8c27c1655b2eba90ae2010ae9

    SHA512

    199b83679739a0d38eb806c0d384e4edd32c76bc6bea873af62a3d06b8fec96f0e6f6ec8a2d2cc26720f7e7bebdc8aab5cf29e15a0797dbe53f389c018910f2c

    Download Submit

  • Anonymous-DexFile@0xcb27c000-0xcb2ff720
    Filesize

    525KB

    MD5

    f10d1c66f4aac59ac08c0142ed01d23c

    SHA1

    7daee1599f62a603ecc9fa86e974f085d6cdaffa

    SHA256

    0e033899d0fd368af7cd84f6eac4ae28e5c835432f8e823b67529d9ae3a7665d

    SHA512

    9036bf1decf51ebf681c97819c4ca272aed12094e574905ac70a6695c0eb00833ccc360c9251913b859b71c9ec8df206f4413221a54fb1615ddbae7ea3795de2

    Download Submit