Analysis
-
max time kernel
23s -
max time network
25s -
platform
android-13_x64 -
resource
android-33-x64-arm64-20240910-en -
resource tags
-
submitted
21/03/2025, 17:33
General
-
Target
base.apk
-
Size
8.8MB
-
MD5
5d794d2976e533d8912025497cb92c16
-
SHA1
79fed68a70624015d3a871872f64053abf548a5e
-
SHA256
61ad70416b5132932eae4d772e173260678dfe28976dd8ec4e802797904e8af3
-
SHA512
0e6d62afc61b30f71c92870c78764ede0fc8560ccdf5e1bc8548b33561869b07ec1c4b2ed7673ddeed955ae09b5b2f74cd9aedae0c52db29119aaf8b299a2fc8
-
SSDEEP
98304:wWl65iSRG0gVKzD2zj7FRs4bIRSIC2zfsqs60/z59zYHyal9PbN37JSV8Qp3Sg/:56r+UPij7FR9xzXcS8JIf
Malware Config
Extracted
octo
Signatures
-
Octo
Octo is a banking malware with remote access capabilities first seen in April 2022.
-
Octo family
-
Octo payload 1 IoCs
-
Loads dropped Dex/Jar 1 TTPs 2 IoCs
Runs executable file dropped to the device during analysis.
-
Makes use of the framework's Accessibility service 4 TTPs 2 IoCs
Retrieves information displayed on the phone screen using AccessibilityService.
-
Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
-
Queries the phone number (MSISDN for GSM devices) 1 TTPs
-
Acquires the wake lock 1 IoCs
-
Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs
Application may abuse the framework's foreground service to continue running in the foreground.
-
Queries the mobile country code (MCC) 1 TTPs 1 IoCs
-
Reads information about phone network operator. 1 TTPs
-
Requests enabling of the accessibility settings. 1 IoCs
-
Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs
Processes
-
com.xautomation7_trash1⤵
- Loads dropped Dex/Jar
- Makes use of the framework's Accessibility service
- Acquires the wake lock
- Makes use of the framework's foreground persistence service
- Queries the mobile country code (MCC)
- Requests enabling of the accessibility settings.
- Uses Crypto APIs (Might try to encrypt user data)
Network
MITRE ATT&CK Mobile v15
Defense Evasion
Download New Code at Runtime
1Foreground Persistence
1Input Injection
1Discovery
Software Discovery
1Security Software Discovery
1System Network Configuration Discovery
3Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
48B
MD5046a414913add6f5bb60072c7db819b6
SHA1451ee4f6809260aec622d772fd329c7d0297a842
SHA256b66c1320cb063a1d391c94273572ea6edae76c8c8b0a07f8d75c88686f0df72a
SHA5124e6355f3051ed5e811ab030abde1f5be7f5e1cf33be99cd08477e9b6c015deb1d8bd75a09fb9c7176b8511c5ad0a67abc0902a3531e97564ccb6afc57496a47c
-
Filesize
1006B
MD5b09d9bba5634a4299e03feb4c098bfb3
SHA19894b0800c8b01f362ad2609e43d960bce07021a
SHA25624e221bd9551848b93bc5bb9522d95e6986f5f775d60c9a5c383115861b605b0
SHA5123f1629dba7daf80ab2fbce11b496c8018a0b0219be96c58888dc0e45900ef879e7101d349e95a5866d7f90aa56309c570d7f00d7d8e6f2d300d20fae931bcb62
-
Filesize
1006B
MD59c77bc8bc755a03c9bb95d2b984e1478
SHA119505d25fb6f211c67081f96258c0215fe30b0f4
SHA256c1a78ecebbc2195dc0dfef97314a615330aae676e8de307ce028dcbc847db9b3
SHA512449b6c5bcdecce50b920d5aeaffac32ac01fc44c1900b92c72e8d67de89125517a8f0a7d638845422679328964bc462cb748ced1fb3a188897e198d013ab438e
-
Filesize
322KB
MD577dc50489b9323274732d27dc8a4e803
SHA10e02a3595b62489d0739d771881da8604d117c65
SHA256c5684e792d1ebefea6aac09fed45911703fd58c899f8a08133d49dd91429a820
SHA5120684a92f3e9c525384cfa53f531afba61e5930e1c27032a7e27e3315f72761b62e122dc34768d8162ba08f9bed53d148aa8dc034b46456bdd211f230637eba58
-
Filesize
13KB
MD5f6dc8efbc641668759fd963743e578b5
SHA18c7c84463c9bc31baa421d4e570f216a2d2bfd25
SHA256ab78389dbfa545f9b9a3af6d0a0a8cefe74f4ff592e218c1a331cd73afcddf50
SHA512cc64bbff3ab499fb38562c1c22ba88d00b8019c341fe6f81add7c85b6f6579f978b051c2d0fd16ee7aca58fea616906dfc8668161eb864e74a3916d13ccec090
-
Filesize
528KB
MD5a742eebc7b284a7642e6d9e2d27ddf7b
SHA1634947e5f587d0840ced2e210b6e86819eefa742
SHA2569f3db8e27eb6fdfc95153830ce26ac644d253a64f826df7cda613014355e5a27
SHA512b69bff1a1aa382dfd3c381446d4d57fb1d596198ba64139ef6a97357cf37b23ed5374e0c2e4ec3967a72aaaa22eeb7a4334c748c7977244bab9ec41b4a87bb5c
-
Filesize
1KB
MD572277d9c1db7cea2b8146ce98c67b725
SHA11008a0085b1295bc34266e6c32c7f04b6f81352a
SHA25690375cefde34d3277d3ed682a25466ef2accbfbdfa4690c4ca8e69517f8c61fb
SHA5123e4993dffee29581b7d55891b336a93f74b5c70bbaec3a342564395555cac13ff34f721cca61de9da1dce3f2d72b84bc57104270dabb818dd564fe1c9fab0821