Analysis
-
max time kernel
19s -
max time network
22s -
platform
android-13_x64 -
resource
android-33-x64-arm64-20240910-en -
resource tags
-
submitted
21/03/2025, 18:24
General
-
Target
base.apk
-
Size
6.6MB
-
MD5
352555b379fa5312415fdf0839ab7aa1
-
SHA1
aaa42c72790e109d604530643e5bcbfe85328e28
-
SHA256
504cf0b50a59ea8f247491e3d176dfb665e39bd1dbc60a4eefbc330d6a4cf0af
-
SHA512
ff3f3b8fe62d493aa2ce5f3a539a7d8b037995896516604b50a8b52436158a7c6c3554fc1f74819cd3513f39e35121808a2ab39872d1c55caefa12ac269d9a0d
-
SSDEEP
98304:g5iSRGyqRsk1642+c3XRVKpHINjEYCXJdlbWvxaNff+:griRqR3XRUm/Gyvww
Malware Config
Extracted
octo
Signatures
-
Octo
Octo is a banking malware with remote access capabilities first seen in April 2022.
-
Octo family
-
Octo payload 1 IoCs
-
Loads dropped Dex/Jar 1 TTPs 2 IoCs
Runs executable file dropped to the device during analysis.
-
Makes use of the framework's Accessibility service 4 TTPs 2 IoCs
Retrieves information displayed on the phone screen using AccessibilityService.
-
Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
-
Queries the phone number (MSISDN for GSM devices) 1 TTPs
-
Acquires the wake lock 1 IoCs
-
Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs
Application may abuse the framework's foreground service to continue running in the foreground.
-
Queries the mobile country code (MCC) 1 TTPs 1 IoCs
-
Reads information about phone network operator. 1 TTPs
-
Requests enabling of the accessibility settings. 1 IoCs
-
Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs
Processes
-
com.lwcalculator_resourcesg1⤵
- Loads dropped Dex/Jar
- Makes use of the framework's Accessibility service
- Acquires the wake lock
- Makes use of the framework's foreground persistence service
- Queries the mobile country code (MCC)
- Requests enabling of the accessibility settings.
- Uses Crypto APIs (Might try to encrypt user data)
Network
MITRE ATT&CK Mobile v15
Defense Evasion
Download New Code at Runtime
1Foreground Persistence
1Input Injection
1Discovery
Software Discovery
1Security Software Discovery
1System Network Configuration Discovery
3Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
48B
MD5046a414913add6f5bb60072c7db819b6
SHA1451ee4f6809260aec622d772fd329c7d0297a842
SHA256b66c1320cb063a1d391c94273572ea6edae76c8c8b0a07f8d75c88686f0df72a
SHA5124e6355f3051ed5e811ab030abde1f5be7f5e1cf33be99cd08477e9b6c015deb1d8bd75a09fb9c7176b8511c5ad0a67abc0902a3531e97564ccb6afc57496a47c
-
Filesize
1014B
MD56f08bc1b89e0b184c7955f2880a04e1b
SHA1b5536c19311cdd90bfe2014dc68ed78b62ea5e75
SHA25608ba0118619b4edcd475c97d6304ed3fb59c932959dff820cf8a56118638d0cf
SHA51232175674b639c95d0482e8871cba99c4f84e3d241ba6c94b50a3182805785dee6815154e7ecc63bee2eb36b7dd1f9629ead9b03854780a7d1369fdb2c01995eb
-
Filesize
1014B
MD5694986f600c0afc5cbfab00373e17e45
SHA121e694ed17911f4002cdcfcefa5c1d761459db24
SHA2563fe9448393e82c3a40f4804e9e795c3eeab3f328112628d8f43eaf5a85e1ed8f
SHA51236f4cf873ee8f6cca022937b46e68114e8695d22a9e3477a9dc5238c7b622b9960e58d69c6ebc887dadf8111881a67060950328cf13a227d76382d9edaae41df
-
Filesize
322KB
MD577dc50489b9323274732d27dc8a4e803
SHA10e02a3595b62489d0739d771881da8604d117c65
SHA256c5684e792d1ebefea6aac09fed45911703fd58c899f8a08133d49dd91429a820
SHA5120684a92f3e9c525384cfa53f531afba61e5930e1c27032a7e27e3315f72761b62e122dc34768d8162ba08f9bed53d148aa8dc034b46456bdd211f230637eba58
-
Filesize
13KB
MD55b5ba8f88ba2e56f8f29db19a08cc6a9
SHA16770eb411ed6ce40fafa5a87a5cc4a7c16f12707
SHA25618b3fb68fd8b89497509d70884ceccb064f71c5b7aad00501b72e2aa9e66b8a1
SHA5124134976b28d1f7d4fc7af1c00730bcd5dd93ebab17a991c87484db885120616e5c1091e0dda54b912bb66fafecebec230f8d65c1a85113fdbf90c15a47646583
-
Filesize
529KB
MD54b2fb671c44aaac4fb6f4205d0962317
SHA1f19848a8676a50a37a16daa70b0621c3d5448a95
SHA256abf5a1f0cad1c786bb55a3371d140e04b0e2ddd43304ac611daa21e3f8f62225
SHA5124bf832fd1e839431b6efb265bef7cc672a6be552c6f54688a1c8f551fc0769b4190df70a1d3cd6929e9debca8143322c3104dd9027e65b87348d16e59c674d15
-
Filesize
1KB
MD50529705d2dbdfab76c8052b753efe4d6
SHA1e76b70533510fb47012387c1a768eb672f8d53a9
SHA256377fb206dd03df8d45f6bbc2f23971f324ddea112adce921de539a403c97089e
SHA5126cf58fda0695a4bbef4d5fd34b38b523018547671266174080aaed81938020278753b6053b3c42aaac19be23ff2bda4088efe178fabb670491947f0ccb0ad593