Analysis
-
max time kernel
16s -
max time network
19s -
platform
android-9_x86 -
resource
android-x86-arm-20240910-en -
resource tags
-
submitted
21/03/2025, 18:24
General
-
Target
base.apk
-
Size
6.6MB
-
MD5
352555b379fa5312415fdf0839ab7aa1
-
SHA1
aaa42c72790e109d604530643e5bcbfe85328e28
-
SHA256
504cf0b50a59ea8f247491e3d176dfb665e39bd1dbc60a4eefbc330d6a4cf0af
-
SHA512
ff3f3b8fe62d493aa2ce5f3a539a7d8b037995896516604b50a8b52436158a7c6c3554fc1f74819cd3513f39e35121808a2ab39872d1c55caefa12ac269d9a0d
-
SSDEEP
98304:g5iSRGyqRsk1642+c3XRVKpHINjEYCXJdlbWvxaNff+:griRqR3XRUm/Gyvww
Malware Config
Extracted
octo
Signatures
-
Octo
Octo is a banking malware with remote access capabilities first seen in April 2022.
-
Octo family
-
Octo payload 1 IoCs
-
Removes its main activity from the application launcher 1 TTPs 1 IoCs
-
Loads dropped Dex/Jar 1 TTPs 3 IoCs
Runs executable file dropped to the device during analysis.
-
Makes use of the framework's Accessibility service 4 TTPs 2 IoCs
Retrieves information displayed on the phone screen using AccessibilityService.
-
Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
-
Queries the phone number (MSISDN for GSM devices) 1 TTPs
-
Acquires the wake lock 1 IoCs
-
Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs
Application may abuse the framework's foreground service to continue running in the foreground.
-
Queries the mobile country code (MCC) 1 TTPs 1 IoCs
-
Queries the unique device ID (IMEI, MEID, IMSI) 1 TTPs
-
Reads information about phone network operator. 1 TTPs
-
Requests enabling of the accessibility settings. 1 IoCs
-
Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs
-
Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs
Processes
-
com.lwcalculator_resourcesg1⤵
- Removes its main activity from the application launcher
- Loads dropped Dex/Jar
- Makes use of the framework's Accessibility service
- Acquires the wake lock
- Makes use of the framework's foreground persistence service
- Queries the mobile country code (MCC)
- Requests enabling of the accessibility settings.
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Uses Crypto APIs (Might try to encrypt user data)
-
/system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.lwcalculator_resourcesg/app_reflect/gDBbCtA.json --output-vdex-fd=41 --oat-fd=42 --oat-location=/data/user/0/com.lwcalculator_resourcesg/app_reflect/oat/x86/gDBbCtA.odex --compiler-filter=quicken --class-loader-context=&2⤵
- Loads dropped Dex/Jar
-
Network
MITRE ATT&CK Mobile v15
Persistence
Event Triggered Execution
1Broadcast Receivers
1Foreground Persistence
1Defense Evasion
Download New Code at Runtime
1Foreground Persistence
1Hide Artifacts
1Suppress Application Icon
1Input Injection
1Discovery
Software Discovery
1Security Software Discovery
1System Network Configuration Discovery
4Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
48B
MD5046a414913add6f5bb60072c7db819b6
SHA1451ee4f6809260aec622d772fd329c7d0297a842
SHA256b66c1320cb063a1d391c94273572ea6edae76c8c8b0a07f8d75c88686f0df72a
SHA5124e6355f3051ed5e811ab030abde1f5be7f5e1cf33be99cd08477e9b6c015deb1d8bd75a09fb9c7176b8511c5ad0a67abc0902a3531e97564ccb6afc57496a47c
-
Filesize
1014B
MD56f08bc1b89e0b184c7955f2880a04e1b
SHA1b5536c19311cdd90bfe2014dc68ed78b62ea5e75
SHA25608ba0118619b4edcd475c97d6304ed3fb59c932959dff820cf8a56118638d0cf
SHA51232175674b639c95d0482e8871cba99c4f84e3d241ba6c94b50a3182805785dee6815154e7ecc63bee2eb36b7dd1f9629ead9b03854780a7d1369fdb2c01995eb
-
Filesize
1014B
MD5694986f600c0afc5cbfab00373e17e45
SHA121e694ed17911f4002cdcfcefa5c1d761459db24
SHA2563fe9448393e82c3a40f4804e9e795c3eeab3f328112628d8f43eaf5a85e1ed8f
SHA51236f4cf873ee8f6cca022937b46e68114e8695d22a9e3477a9dc5238c7b622b9960e58d69c6ebc887dadf8111881a67060950328cf13a227d76382d9edaae41df
-
Filesize
307KB
MD54e73947cabb5db3f92ca85004981b754
SHA16d9667fdb0280ed2dcb782b4683e422a51bdc601
SHA2566db94232e756b90ed437f1bc87dc38cf20fb2e7c7a19a5e40c6c17254b7e234c
SHA512be8b500a7070af1dfb53b0cf1a7b327dadc4e163a6dad905496ac228c58cd1ed87b054533917924455d35e9b300683ae33e1bcdd91935a5dbae1d693c3e13d69
-
Filesize
1KB
MD549be9292d72d0fc9eeeb255bc7859bf1
SHA193a1c06473d72af67d199e923febfd3e140d038d
SHA256b8fdf4a5c9d514e8031fb3a456ac740e6ef21335751559e9df911377c1fc647f
SHA5120e12e8d757b200b4c4bfa424d9412cf6c2073c66fa2fff54a55ab1362933df079bf9ace6857b94b0b032be9b7053790470dbd585d82768481d8916af167f62d4
-
Filesize
1KB
MD50529705d2dbdfab76c8052b753efe4d6
SHA1e76b70533510fb47012387c1a768eb672f8d53a9
SHA256377fb206dd03df8d45f6bbc2f23971f324ddea112adce921de539a403c97089e
SHA5126cf58fda0695a4bbef4d5fd34b38b523018547671266174080aaed81938020278753b6053b3c42aaac19be23ff2bda4088efe178fabb670491947f0ccb0ad593
-
Filesize
529KB
MD54b2fb671c44aaac4fb6f4205d0962317
SHA1f19848a8676a50a37a16daa70b0621c3d5448a95
SHA256abf5a1f0cad1c786bb55a3371d140e04b0e2ddd43304ac611daa21e3f8f62225
SHA5124bf832fd1e839431b6efb265bef7cc672a6be552c6f54688a1c8f551fc0769b4190df70a1d3cd6929e9debca8143322c3104dd9027e65b87348d16e59c674d15