Analysis
-
max time kernel
25s -
max time network
35s -
platform
android_x86 -
resource
android-x86-arm-20240624-en -
resource tags
-
submitted
26-01-2025 01:58
General
-
Target
f081db526aa37f891fde022b80bc6cff8a29d4611cd3353065b6805c8568ec61.apk
-
Size
7.2MB
-
MD5
f2b62d9ca5265e0231c4967d2f954cc9
-
SHA1
0dccad4a8cee57b1c02705339f5508cda33939f9
-
SHA256
f081db526aa37f891fde022b80bc6cff8a29d4611cd3353065b6805c8568ec61
-
SHA512
4d1c73cb4d3f8b84c82b8a58fad55c3172bb5427ea0488bae213effa31149b3f01f8e6995cd703b88a60dd8221671653f3e24afce0a77ece58ffb4afc667188b
-
SSDEEP
98304:L7YaZA3XlRshOM5iSRGeWVK3C6j+e7mnffQq7ujC:L7C3XlR1MreUX7mffujC
Malware Config
Extracted
octo
Signatures
-
Octo
Octo is a banking malware with remote access capabilities first seen in April 2022.
-
Octo family
-
Octo payload 1 IoCs
-
Removes its main activity from the application launcher 1 TTPs 1 IoCs
-
Checks Android system properties for emulator presence. 1 TTPs 1 IoCs
-
Loads dropped Dex/Jar 1 TTPs 3 IoCs
Runs executable file dropped to the device during analysis.
-
Makes use of the framework's Accessibility service 4 TTPs 2 IoCs
Retrieves information displayed on the phone screen using AccessibilityService.
-
Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
-
Queries the phone number (MSISDN for GSM devices) 1 TTPs
-
Acquires the wake lock 1 IoCs
-
Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs
Application may abuse the framework's foreground service to continue running in the foreground.
-
Queries the mobile country code (MCC) 1 TTPs 1 IoCs
-
Queries the unique device ID (IMEI, MEID, IMSI) 1 TTPs
-
Requests disabling of battery optimizations (often used to enable hiding in the background). 1 TTPs 1 IoCs
-
Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs
-
Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs
-
Checks CPU information 2 TTPs 1 IoCs
-
Checks memory information 2 TTPs 1 IoCs
Processes
-
com.ndbookmarks8privselector1⤵
- Removes its main activity from the application launcher
- Checks Android system properties for emulator presence.
- Loads dropped Dex/Jar
- Makes use of the framework's Accessibility service
- Acquires the wake lock
- Makes use of the framework's foreground persistence service
- Queries the mobile country code (MCC)
- Requests disabling of battery optimizations (often used to enable hiding in the background).
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Uses Crypto APIs (Might try to encrypt user data)
- Checks CPU information
- Checks memory information
-
/system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.ndbookmarks8privselector/app_civil/jgslOYQ.json --output-vdex-fd=41 --oat-fd=42 --oat-location=/data/user/0/com.ndbookmarks8privselector/app_civil/oat/x86/jgslOYQ.odex --compiler-filter=quicken --class-loader-context=&2⤵
- Loads dropped Dex/Jar
-
Network
MITRE ATT&CK Mobile v15
Persistence
Event Triggered Execution
1Broadcast Receivers
1Foreground Persistence
1Defense Evasion
Download New Code at Runtime
1Foreground Persistence
1Hide Artifacts
2Suppress Application Icon
1User Evasion
1Input Injection
1Virtualization/Sandbox Evasion
3System Checks
3Discovery
Software Discovery
1Security Software Discovery
1System Information Discovery
2System Network Configuration Discovery
3Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
48B
MD5046a414913add6f5bb60072c7db819b6
SHA1451ee4f6809260aec622d772fd329c7d0297a842
SHA256b66c1320cb063a1d391c94273572ea6edae76c8c8b0a07f8d75c88686f0df72a
SHA5124e6355f3051ed5e811ab030abde1f5be7f5e1cf33be99cd08477e9b6c015deb1d8bd75a09fb9c7176b8511c5ad0a67abc0902a3531e97564ccb6afc57496a47c
-
Filesize
1018B
MD52d50ccba45aaf0ea23251b829b2b63da
SHA1830e66da718b0218153dbcff1479b117791a300e
SHA256849734c320de2d0756e1160da008df0234ef22c4e49ce1abbd33e352fb619d1a
SHA51217e34c38dbbb881ac51bcae12072931fadcec762ab7bb68017347a8dc02a1e5d1b5fbeed077d6795188eeda499eaff285596208ddf8defb6e6d0a5371acd0d67
-
Filesize
1018B
MD57d1aa73da3266d3ab52c9e6400eb09a6
SHA1984578d1f9fa62a144bd3facde192d04b67192da
SHA256ed678bc4815f10de9681318237d5d39ee6f3ee84cce63cecc949f92f383df6c4
SHA5123b5d0267de8cde80258a4b54e066f79d25527dafb1f7317fbd1710e13b21a02bd028954c191c1456bd54c85b37d4636d8fece80dd7eb7fd1e8ca9e0b994871ed
-
Filesize
307KB
MD54e73947cabb5db3f92ca85004981b754
SHA16d9667fdb0280ed2dcb782b4683e422a51bdc601
SHA2566db94232e756b90ed437f1bc87dc38cf20fb2e7c7a19a5e40c6c17254b7e234c
SHA512be8b500a7070af1dfb53b0cf1a7b327dadc4e163a6dad905496ac228c58cd1ed87b054533917924455d35e9b300683ae33e1bcdd91935a5dbae1d693c3e13d69
-
Filesize
1KB
MD53b382ee3d88f095a01e491f3fe4f979e
SHA13282b03e9f856164c073548d181ef4e53e7a6d9d
SHA2560fda800f4414ca2a526a01ad57849e5edb8492042643cddba09518e55eabffe5
SHA512dfc54a6280d6cf2d95613ff160ec146e44f236550f3bef3ecb968b621ecae1c5d076ace7134c0db03028752269b53f8826374a3e6c850187e10e0bb5087771b7
-
Filesize
1KB
MD561d2c3f2cb81bf35e095282858bc6e21
SHA162700e72befbea1dcb63e77ecaf6c0c9e8ec632c
SHA25691a26c060c80de094375766eb68ac93c47d37e429439ae66cb8d3c87a3e71560
SHA5128b733bea6ae49fda710b1130436356100385419372638b167b0928631b61d46459d6f83949e6f24edbc539697cd95a1d2eafe0d76c282f31a466dc9dd83f97fd
-
Filesize
529KB
MD53b22ac613ea01cb1b98124f3be27ca2a
SHA152990c55346343bf2eb58970cf4abb517846016d
SHA2562fa75fbe10eb37f89b137181ea521ac6df75b78f1ec547e6192e267b06aaf5ec
SHA5124697cb43b3b6b6321ba290fb7de5ee93673da8505f41e9e0b8fd887913230f04be4dd78c9647682fb5334f59c1fc691c1cba949f6748d68f6623a6715e795719