Analysis
-
max time kernel
25s -
max time network
24s -
platform
android-13_x64 -
resource
android-33-x64-arm64-20240910-en -
resource tags
-
submitted
21/03/2025, 18:45
General
-
Target
base.apk
-
Size
9.9MB
-
MD5
19317ed93302a06ecaf0502adfbaa639
-
SHA1
b4811105d5e15055ade059025421dbe85c36d185
-
SHA256
3016cb465e8a6fdf61b0f2f49e12ffe6f67f501b195611d1b28ba21687f9bbd0
-
SHA512
ef5bd4e7201af843cc8359f36dd31d60b6567a843ce1ae4f3ec67315cc44f2e827fe40a74fa4e1e64f447d0c6581297248dbf81449b3da832d74511633f124be
-
SSDEEP
196608:QwUTrj7ZRkprdC3cYBJaxS9TNJ9jUZtyp+x87:Qw5rgsgJasJNJ94Zto
Malware Config
Extracted
octo
Signatures
-
Octo
Octo is a banking malware with remote access capabilities first seen in April 2022.
-
Octo family
-
Octo payload 1 IoCs
-
Loads dropped Dex/Jar 1 TTPs 2 IoCs
Runs executable file dropped to the device during analysis.
-
Makes use of the framework's Accessibility service 4 TTPs 2 IoCs
Retrieves information displayed on the phone screen using AccessibilityService.
-
Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
-
Queries the phone number (MSISDN for GSM devices) 1 TTPs
-
Acquires the wake lock 1 IoCs
-
Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs
Application may abuse the framework's foreground service to continue running in the foreground.
-
Queries the mobile country code (MCC) 1 TTPs 1 IoCs
-
Reads information about phone network operator. 1 TTPs
-
Requests enabling of the accessibility settings. 1 IoCs
-
Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs
Processes
-
com.vjinformation5_emulation1⤵
- Loads dropped Dex/Jar
- Makes use of the framework's Accessibility service
- Acquires the wake lock
- Makes use of the framework's foreground persistence service
- Queries the mobile country code (MCC)
- Requests enabling of the accessibility settings.
- Uses Crypto APIs (Might try to encrypt user data)
Network
MITRE ATT&CK Mobile v15
Defense Evasion
Download New Code at Runtime
1Foreground Persistence
1Input Injection
1Discovery
Software Discovery
1Security Software Discovery
1System Network Configuration Discovery
3Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
48B
MD5046a414913add6f5bb60072c7db819b6
SHA1451ee4f6809260aec622d772fd329c7d0297a842
SHA256b66c1320cb063a1d391c94273572ea6edae76c8c8b0a07f8d75c88686f0df72a
SHA5124e6355f3051ed5e811ab030abde1f5be7f5e1cf33be99cd08477e9b6c015deb1d8bd75a09fb9c7176b8511c5ad0a67abc0902a3531e97564ccb6afc57496a47c
-
Filesize
1004B
MD55934b695340b6cd39bd9756cd2a44da0
SHA1ac9c0c7861ca438dbaffcdf6351eb5a9c1f1a23c
SHA256f192d2c2a58619295b6caac502c5253e5a5199149792c1d090e1d62c7a97bb8f
SHA512515ff1ed1d37fb5ccc4925f8db38224b3a3ce5c3ccaeb7fe80104ff9889d31a0c3f658aa7da70382f64b87c1f95efc354c8bec20087bf1aa383d8321990642e4
-
Filesize
1004B
MD50b0cdd053b868bcedbeda32a34b8b54f
SHA11c69d9144f918039c379a22b576bc6db6f6c3062
SHA256d84951ff73a247fe494f05b871e8492cc1829ade69e54731be674ba05d1dfb8d
SHA5121945218a0eed50b8d04d71cab0775c9b210bbb8d38c5300abf6ba22aeda13ef356dce4fc7d49aa535db9f1241e163d5b121e0d486093df11b135b0ffa7d724d0
-
Filesize
322KB
MD577dc50489b9323274732d27dc8a4e803
SHA10e02a3595b62489d0739d771881da8604d117c65
SHA256c5684e792d1ebefea6aac09fed45911703fd58c899f8a08133d49dd91429a820
SHA5120684a92f3e9c525384cfa53f531afba61e5930e1c27032a7e27e3315f72761b62e122dc34768d8162ba08f9bed53d148aa8dc034b46456bdd211f230637eba58
-
Filesize
13KB
MD59e208c68f4f452e98fe7b564c4d9a29f
SHA148e222e7bd303453a17bf7d07d7fbe65caf859b8
SHA2562744246389463d934ff85184087e0aa78c4fc406df9160f6c21669d6a7da96a3
SHA51290c7756ae43c030dda4cb526031175c46daab8f865df2e883bddb3f83d2e61ba2e870069d39ad310225534721474c481d2b3fe05397ac58399047eb960ca3814
-
Filesize
529KB
MD5b53b58ff027dcc140a26133818b5a3c4
SHA17934873feb242f7cc21369eeda353437a4b201df
SHA2569d6a64e69dfcdac53d4b1229d2d839fcfeef10221c2cca6ff6d92178d241d612
SHA512a45222c3899e36d6e2161d4ad8625922fda82a1c7b77ea0c33209c9998842bb5a1ef1922a75389ebf294f21a64b0661f2fb8bea01421d09171bb0b09999d3138
-
Filesize
1KB
MD5814f8d19b92475b1e02edb939c4f08b2
SHA18c7f860746857931f32bc626032e3e053d640b65
SHA25698340d58543177b7b9c95c5ad4befa169525e3ba7e8746055c8deb2dda0b46bb
SHA512e7591650ae9f8153aa8902ab108df998536c3cb1f6a16282042c0779babc7fd7004354666702f7d0f5b25a6bcab93b1137886ff591ddce8e0bb899c8eb6b8338