Analysis
-
max time kernel
149s -
max time network
157s -
platform
android_x86 -
resource
android-x86-arm-20240624-en -
resource tags
-
submitted
24-01-2025 21:26
General
-
Target
2_e0e674ead8.apk
-
Size
7.4MB
-
MD5
8b7c9a2f5d9f433e88078a58a88ffb7e
-
SHA1
7cfe826255012225dc3be526706aa00fe7693701
-
SHA256
89ff1e5fbfd528574d51f1b48ca3283f53694b081f858d1c08cc1bb12bc3a729
-
SHA512
98dcaaec7669a839b5e882419a469e29a9b7a8ac3ebcabd64bdf645b0b2d39740e6bb7a22ec72f7b7113b06dbebaf7d6b0754fc2ec7c26f740ab1e7cccc3e76c
-
SSDEEP
196608:oF/pCRlrF/j7HUmZmPn5X7sVmRoK9viUz:oF/p+rJ125X7ToKwUz
Malware Config
Extracted
octo
https://81a10c7ce78c2af74b5788a6a013efe3.com
-
target_apps
at.spardat.bcrmobile
at.spardat.netbanking
com.bankaustria.android.olb
com.bmo.mobile
com.cibc.android.mobi
com.rbc.mobile.android
com.scotiabank.mobile
com.td
cz.airbank.android
eu.inmite.prj.kb.mobilbank
com.bankinter.launcher
com.kutxabank.android
com.rsi
com.tecnocom.cajalaboral
es.bancopopular.nbmpopular
es.evobanco.bancamovil
es.lacaixa.mobile.android.newwapicon
com.dbs.hk.dbsmbanking
com.FubonMobileClient
com.hangseng.rbmobile
com.MobileTreeApp
com.mtel.androidbea
com.scb.breezebanking.hk
hk.com.hsbc.hsbchkmobilebanking
com.aff.otpdirekt
com.ideomobile.hapoalim
com.infrasofttech.indianBank
com.mobikwik_new
com.oxigen.oxigenwallet
jp.co.aeonbank.android.passbook
Signatures
-
Octo
Octo is a banking malware with remote access capabilities first seen in April 2022.
-
Octo family
-
Octo payload 1 IoCs
-
Removes its main activity from the application launcher 1 TTPs 1 IoCs
-
Checks Android system properties for emulator presence. 1 TTPs 1 IoCs
-
Loads dropped Dex/Jar 1 TTPs 4 IoCs
Runs executable file dropped to the device during analysis.
-
Makes use of the framework's Accessibility service 4 TTPs 2 IoCs
Retrieves information displayed on the phone screen using AccessibilityService.
-
Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
-
Queries the phone number (MSISDN for GSM devices) 1 TTPs
-
Acquires the wake lock 1 IoCs
-
Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs
Application may abuse the framework's foreground service to continue running in the foreground.
-
Queries the mobile country code (MCC) 1 TTPs 1 IoCs
-
Queries the unique device ID (IMEI, MEID, IMSI) 1 TTPs
-
Reads information about phone network operator. 1 TTPs
-
Requests disabling of battery optimizations (often used to enable hiding in the background). 1 TTPs 1 IoCs
-
Tries to add a device administrator. 2 TTPs 1 IoCs
-
Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs
-
Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs
-
Checks CPU information 2 TTPs 1 IoCs
-
Checks memory information 2 TTPs 1 IoCs
Processes
-
com.yrecommendation_intelligence191⤵
- Removes its main activity from the application launcher
- Checks Android system properties for emulator presence.
- Loads dropped Dex/Jar
- Makes use of the framework's Accessibility service
- Acquires the wake lock
- Makes use of the framework's foreground persistence service
- Queries the mobile country code (MCC)
- Requests disabling of battery optimizations (often used to enable hiding in the background).
- Tries to add a device administrator.
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Uses Crypto APIs (Might try to encrypt user data)
- Checks CPU information
- Checks memory information
-
/system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.yrecommendation_intelligence19/app_dex/classes.dex --output-vdex-fd=41 --oat-fd=42 --oat-location=/data/user/0/com.yrecommendation_intelligence19/app_dex/oat/x86/classes.odex --compiler-filter=quicken --class-loader-context=&2⤵
- Loads dropped Dex/Jar
-
Network
MITRE ATT&CK Mobile v15
Persistence
Event Triggered Execution
1Broadcast Receivers
1Foreground Persistence
1Privilege Escalation
Abuse Elevation Control Mechanism
1Device Administrator Permissions
1Defense Evasion
Download New Code at Runtime
1Foreground Persistence
1Hide Artifacts
2Suppress Application Icon
1User Evasion
1Input Injection
1Virtualization/Sandbox Evasion
3System Checks
3Discovery
Software Discovery
1Security Software Discovery
1System Information Discovery
2System Network Configuration Discovery
4Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
335B
MD58994594aec4a0cdc3e40a764d3ca3457
SHA1e821b0e735d82b33db07322e1b219dd6d72ff6df
SHA2564eddd088b1cf89fea84b14ca7ca6cbfb67d133857fbf1fe4230e597e5f385103
SHA512534483735f4dd6389b2d3ab135197c245548f319c8129b0aa98d56a13f46c26715245ff2098708712e9df5bff6426ea310fb8dd4cc493eadeec600711ab4d979
-
Filesize
265B
MD50f90b0da8101f3ee37f3340f58f7bda5
SHA1e351809bd4d3164dc154b1e74959f8bd8ae8bac3
SHA25603a8330ba44f42c2b56b2e7b5cb79c3918d72e7aef327985af85dedce0ec0541
SHA51219d230d59cc2493b9f2bcb3583affd29dda210ee33ba95b95b640fb4f727af6102f5078c0a73b4e957f211dbef44ac144b881a8a156e093db3d8eceebc149a16
-
Filesize
194B
MD502bd9744c3fdefb07f727e43f6ed3ed1
SHA1d04c7e34eb28a34b75917c7f74b591912b810583
SHA25644191dfcc2d33febd0d4cde3b1813512d5271c4c32e08e2b57acc82fd7c3f74a
SHA512b174aedaf1360ece27417f84b1ae39ca68d861af2a65719e083b81d1c36359e7260c5508fe2407682292e4c7fcdfb52369f236999df3f44b09e0ea1a93c42317
-
Filesize
48B
MD5046a414913add6f5bb60072c7db819b6
SHA1451ee4f6809260aec622d772fd329c7d0297a842
SHA256b66c1320cb063a1d391c94273572ea6edae76c8c8b0a07f8d75c88686f0df72a
SHA5124e6355f3051ed5e811ab030abde1f5be7f5e1cf33be99cd08477e9b6c015deb1d8bd75a09fb9c7176b8511c5ad0a67abc0902a3531e97564ccb6afc57496a47c
-
Filesize
1KB
MD5e79590ed9061ed84c662a766035e0f6a
SHA1f05b61669f4cad3bf19ac2164f73fa61c056f5a4
SHA256d8a3b68720bc21cf6f4bf0cfc8c1a39a8c858f63d8b4994ed2b4f28aedabf50c
SHA5126da08c49657f26318aa496873e6fa6339fbb31670c8377ddc81ec4d06830f02d742cf942beec5b6ff855bce5e382e150405af3b630b9f720e365f10ffe0689fb
-
Filesize
1KB
MD55606167d688284d134d4a1b81661f4ce
SHA1b85fe9dbc7dd6e80db14ab9a7c2c6f15491f2c14
SHA25681164f8ff11e1a35ddef6d9d07a5228fb8a78c3c8baba125a4548649f9acb9bc
SHA51272f6e75dbf89f895ab0edba6f6c8fe8233cfb1546b2ffe5055bfd8faf58acc84df01318d091243178fe96bb010f13088eaf1830d5465575ef3e4faabf35e2f10
-
Filesize
1KB
MD5c4086482f3bb5af7d088f3ed04c038c0
SHA1156a07566e71c8a7cd118ebe9909d20530320d28
SHA256bd5890895f290cc8e2930fb69d0373d6b7dafce44771de0f841bded02b9082b2
SHA512fa556f59236b4204847f0f13a02a205eddfc46bbf3845cd2b2500409cd555ccb0e51534a6ec85c39e2cc30d220879fd2bb216faad56cdbcebe5744310db9e936
-
Filesize
307KB
MD54e73947cabb5db3f92ca85004981b754
SHA16d9667fdb0280ed2dcb782b4683e422a51bdc601
SHA2566db94232e756b90ed437f1bc87dc38cf20fb2e7c7a19a5e40c6c17254b7e234c
SHA512be8b500a7070af1dfb53b0cf1a7b327dadc4e163a6dad905496ac228c58cd1ed87b054533917924455d35e9b300683ae33e1bcdd91935a5dbae1d693c3e13d69
-
Filesize
1KB
MD57726dd4a0c40a54f58d2698316613024
SHA17c92b4c1d6c8215a13d8dca8e9af14817cfb286b
SHA2563490f346836e1a568f24268eabdc7d16bb875fef7d12e3dde53c0ba282c64ea5
SHA51241ea97694d293e6c7e80de50ae3ab5f4ad56db4bee7e4a872ab58fb36f875276007376544520365dceb91f1c730889b3b8f73a057b35e3506a35c3fa68345d14
-
Filesize
530KB
MD54fdd8add1be56712fba83dac6e3f5e93
SHA1c461e004b264879ff3a5a7147afe090657abe9c9
SHA2568d29b41ce8a88f213d2389c84c2d9f22b6d5826e5b4d3d22da624672666db4c3
SHA51221d99b2930762717b286298d6516dd7044ab8b3ad4047bcfadc7f30c4626864483a745fb63994203e374d2b7e084d3b7e88233be15fc963bffbe597a4732ac55