Analysis
-
max time kernel
144s -
max time network
151s -
platform
android-9_x86 -
resource
android-x86-arm-20240910-en -
resource tags
-
submitted
21/03/2025, 18:49
General
-
Target
base.apk
-
Size
9.9MB
-
MD5
19317ed93302a06ecaf0502adfbaa639
-
SHA1
b4811105d5e15055ade059025421dbe85c36d185
-
SHA256
3016cb465e8a6fdf61b0f2f49e12ffe6f67f501b195611d1b28ba21687f9bbd0
-
SHA512
ef5bd4e7201af843cc8359f36dd31d60b6567a843ce1ae4f3ec67315cc44f2e827fe40a74fa4e1e64f447d0c6581297248dbf81449b3da832d74511633f124be
-
SSDEEP
196608:QwUTrj7ZRkprdC3cYBJaxS9TNJ9jUZtyp+x87:Qw5rgsgJasJNJ94Zto
Malware Config
Extracted
octo
Signatures
-
Octo
Octo is a banking malware with remote access capabilities first seen in April 2022.
-
Octo family
-
Octo payload 1 IoCs
-
Removes its main activity from the application launcher 1 TTPs 1 IoCs
-
Loads dropped Dex/Jar 1 TTPs 3 IoCs
Runs executable file dropped to the device during analysis.
-
Makes use of the framework's Accessibility service 4 TTPs 2 IoCs
Retrieves information displayed on the phone screen using AccessibilityService.
-
Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
-
Queries the phone number (MSISDN for GSM devices) 1 TTPs
-
Acquires the wake lock 1 IoCs
-
Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs
Application may abuse the framework's foreground service to continue running in the foreground.
-
Queries the mobile country code (MCC) 1 TTPs 1 IoCs
-
Queries the unique device ID (IMEI, MEID, IMSI) 1 TTPs
-
Reads information about phone network operator. 1 TTPs
-
Requests enabling of the accessibility settings. 1 IoCs
-
Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs
-
Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs
Processes
-
com.vjinformation5_emulation1⤵
- Removes its main activity from the application launcher
- Loads dropped Dex/Jar
- Makes use of the framework's Accessibility service
- Acquires the wake lock
- Makes use of the framework's foreground persistence service
- Queries the mobile country code (MCC)
- Requests enabling of the accessibility settings.
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Uses Crypto APIs (Might try to encrypt user data)
-
/system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.vjinformation5_emulation/app_face/oScOHJ.json --output-vdex-fd=41 --oat-fd=42 --oat-location=/data/user/0/com.vjinformation5_emulation/app_face/oat/x86/oScOHJ.odex --compiler-filter=quicken --class-loader-context=&2⤵
- Loads dropped Dex/Jar
-
Network
MITRE ATT&CK Mobile v15
Persistence
Event Triggered Execution
1Broadcast Receivers
1Foreground Persistence
1Defense Evasion
Download New Code at Runtime
1Foreground Persistence
1Hide Artifacts
1Suppress Application Icon
1Input Injection
1Discovery
Software Discovery
1Security Software Discovery
1System Network Configuration Discovery
4Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
48B
MD5046a414913add6f5bb60072c7db819b6
SHA1451ee4f6809260aec622d772fd329c7d0297a842
SHA256b66c1320cb063a1d391c94273572ea6edae76c8c8b0a07f8d75c88686f0df72a
SHA5124e6355f3051ed5e811ab030abde1f5be7f5e1cf33be99cd08477e9b6c015deb1d8bd75a09fb9c7176b8511c5ad0a67abc0902a3531e97564ccb6afc57496a47c
-
Filesize
1004B
MD55934b695340b6cd39bd9756cd2a44da0
SHA1ac9c0c7861ca438dbaffcdf6351eb5a9c1f1a23c
SHA256f192d2c2a58619295b6caac502c5253e5a5199149792c1d090e1d62c7a97bb8f
SHA512515ff1ed1d37fb5ccc4925f8db38224b3a3ce5c3ccaeb7fe80104ff9889d31a0c3f658aa7da70382f64b87c1f95efc354c8bec20087bf1aa383d8321990642e4
-
Filesize
1004B
MD50b0cdd053b868bcedbeda32a34b8b54f
SHA11c69d9144f918039c379a22b576bc6db6f6c3062
SHA256d84951ff73a247fe494f05b871e8492cc1829ade69e54731be674ba05d1dfb8d
SHA5121945218a0eed50b8d04d71cab0775c9b210bbb8d38c5300abf6ba22aeda13ef356dce4fc7d49aa535db9f1241e163d5b121e0d486093df11b135b0ffa7d724d0
-
Filesize
307KB
MD54e73947cabb5db3f92ca85004981b754
SHA16d9667fdb0280ed2dcb782b4683e422a51bdc601
SHA2566db94232e756b90ed437f1bc87dc38cf20fb2e7c7a19a5e40c6c17254b7e234c
SHA512be8b500a7070af1dfb53b0cf1a7b327dadc4e163a6dad905496ac228c58cd1ed87b054533917924455d35e9b300683ae33e1bcdd91935a5dbae1d693c3e13d69
-
Filesize
1KB
MD515b52dff802be13539426967b7db42a8
SHA1864a1b5d2e92e3604a2a331498dbcb0764a843e0
SHA25678e8ea550a0b0a0ccce169b1ffc0f30003aac9191181fbe6b5d32d9838b04b0b
SHA5123e9b9e2e7d917743480dc29cd377691c8bdda0f2854bd0c359af582d551ab5617b7df392b7ac22bab8e0180e16198cf50e6fb20c25c11981fa2b6132fe751ede
-
Filesize
1KB
MD5814f8d19b92475b1e02edb939c4f08b2
SHA18c7f860746857931f32bc626032e3e053d640b65
SHA25698340d58543177b7b9c95c5ad4befa169525e3ba7e8746055c8deb2dda0b46bb
SHA512e7591650ae9f8153aa8902ab108df998536c3cb1f6a16282042c0779babc7fd7004354666702f7d0f5b25a6bcab93b1137886ff591ddce8e0bb899c8eb6b8338
-
Filesize
529KB
MD5b53b58ff027dcc140a26133818b5a3c4
SHA17934873feb242f7cc21369eeda353437a4b201df
SHA2569d6a64e69dfcdac53d4b1229d2d839fcfeef10221c2cca6ff6d92178d241d612
SHA512a45222c3899e36d6e2161d4ad8625922fda82a1c7b77ea0c33209c9998842bb5a1ef1922a75389ebf294f21a64b0661f2fb8bea01421d09171bb0b09999d3138