Analysis
-
max time kernel
23s -
max time network
26s -
platform
android-13_x64 -
resource
android-33-x64-arm64-20240910-en -
resource tags
-
submitted
21/03/2025, 18:16
General
-
Target
base.apk
-
Size
10.5MB
-
MD5
0ece716e05fb6df33dd029f1f9c3f880
-
SHA1
cb4c9fc65d1f1a2f4b40c94e5085421a92a02370
-
SHA256
6ebafd78eb8f8fa088dd529896ca7fd3408093201dd4a26a8ffe67c5981122bb
-
SHA512
fc90ca84051ea2d9187e71fcd21b2d339699dd39828c808f2476c44012b20aee28ff26cfc4edc7bb48de1a51f37eb0a1089998911cb17f24f145188860f00fae
-
SSDEEP
98304:iLa4thGTHVKaH25o3X2RswXOv5iSRGel+vf2zMvB2nXFJ2J//398/ZrujER2TaX:BbHUQv3X2R5evrUuzMp2nNxITa
Malware Config
Extracted
octo
Signatures
-
Octo
Octo is a banking malware with remote access capabilities first seen in April 2022.
-
Octo family
-
Octo payload 1 IoCs
-
Loads dropped Dex/Jar 1 TTPs 2 IoCs
Runs executable file dropped to the device during analysis.
-
Makes use of the framework's Accessibility service 4 TTPs 2 IoCs
Retrieves information displayed on the phone screen using AccessibilityService.
-
Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
-
Queries the phone number (MSISDN for GSM devices) 1 TTPs
-
Acquires the wake lock 1 IoCs
-
Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs
Application may abuse the framework's foreground service to continue running in the foreground.
-
Queries the mobile country code (MCC) 1 TTPs 1 IoCs
-
Reads information about phone network operator. 1 TTPs
-
Requests enabling of the accessibility settings. 1 IoCs
-
Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs
Processes
-
com.informationphotos_web651⤵
- Loads dropped Dex/Jar
- Makes use of the framework's Accessibility service
- Acquires the wake lock
- Makes use of the framework's foreground persistence service
- Queries the mobile country code (MCC)
- Requests enabling of the accessibility settings.
- Uses Crypto APIs (Might try to encrypt user data)
Network
MITRE ATT&CK Mobile v15
Defense Evasion
Download New Code at Runtime
1Foreground Persistence
1Input Injection
1Discovery
Software Discovery
1Security Software Discovery
1System Network Configuration Discovery
3Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
48B
MD5046a414913add6f5bb60072c7db819b6
SHA1451ee4f6809260aec622d772fd329c7d0297a842
SHA256b66c1320cb063a1d391c94273572ea6edae76c8c8b0a07f8d75c88686f0df72a
SHA5124e6355f3051ed5e811ab030abde1f5be7f5e1cf33be99cd08477e9b6c015deb1d8bd75a09fb9c7176b8511c5ad0a67abc0902a3531e97564ccb6afc57496a47c
-
Filesize
1014B
MD5ceb156ec03a204d81398b419487b3e21
SHA1b293b00d803916724909309e9204c769e969cc55
SHA2562eecf6705d2948037e13c7fab6764aac2102a649f4bbd05857b396175f94d0b8
SHA5121738698402939c3178c972b67e44f3cf1e463dd1be7b1c4ce1642850e9eec2cc2782dfd0c9f67aeaef35a3797feb1b6d3ebaf00649b9a05214ada42f614d34b6
-
Filesize
1014B
MD5921a96ab5bf3902aa1186a8285ce23ae
SHA1d6bb125b357cd92d28b2c132c36128374a75f9c2
SHA25690547bd97452f1ccb7cf7809134b64b368b68aada3255911da120a8ae8ec24ae
SHA5127394fb7edd774fe33edc25f5b98fe38f1135f192ade45a176202a2fe4fac64c2cd0ab7f78b88f54c959349b89696d6b43c2eb062f1a72209ed56398ebbd764aa
-
Filesize
322KB
MD577dc50489b9323274732d27dc8a4e803
SHA10e02a3595b62489d0739d771881da8604d117c65
SHA256c5684e792d1ebefea6aac09fed45911703fd58c899f8a08133d49dd91429a820
SHA5120684a92f3e9c525384cfa53f531afba61e5930e1c27032a7e27e3315f72761b62e122dc34768d8162ba08f9bed53d148aa8dc034b46456bdd211f230637eba58
-
Filesize
13KB
MD5136f5433465d678f70d735be7f0ec463
SHA1c476715faf8a2e12755b557d673e2bc141c8e555
SHA2567c98681c8e17ee31f595558b277c701107cd7b2f323d680f5c16602b0eea1459
SHA5128fee0b6cc311bd5f1aee26c4424110b90971002adbe5386abcd20ca44cceafc6e1d55b17f946ec5a06f858e5cf7173c195b4aeee522f51e39a279cd1d62bd1b4
-
Filesize
529KB
MD581b70478103ac69e7874caeff87a382e
SHA1d14654924e0f94eaa372efebe03ce4943b922aac
SHA2562f5a010901e69474cd7190379f9c28c2b7649f818b2d827afc33384ae5fbd7d3
SHA5123209142008b077bc4f1ac9ff53e098fdfe2e680508f5eba58a587fd953ec45a6bcbea1d3550b570ed75ff1732bd3c5aa291ed4c92aaea3f892ecbedddaa39037
-
Filesize
1KB
MD513daf2fdff919098d6303db9ef1b96b6
SHA139a99f5c9f4af3bb62ba93501db0cd8a91518fd8
SHA256fa0e22427bc9276839acbf6e3ec53984283698344b43509c2078e2d05714d658
SHA512e49393d1af295a9aefdc010af1b04ef95685603ab9bd694e112c3e4cc5a870e7dd7d890ddb2bd3e5dc9c91b594f5b51892ee241294f875bfa2df01bc74a19c65