Analysis
-
max time kernel
144s -
max time network
150s -
platform
android-11_x64 -
resource
android-x64-arm64-20240910-en -
resource tags
-
submitted
21/03/2025, 18:49
General
-
Target
base.apk
-
Size
9.9MB
-
MD5
19317ed93302a06ecaf0502adfbaa639
-
SHA1
b4811105d5e15055ade059025421dbe85c36d185
-
SHA256
3016cb465e8a6fdf61b0f2f49e12ffe6f67f501b195611d1b28ba21687f9bbd0
-
SHA512
ef5bd4e7201af843cc8359f36dd31d60b6567a843ce1ae4f3ec67315cc44f2e827fe40a74fa4e1e64f447d0c6581297248dbf81449b3da832d74511633f124be
-
SSDEEP
196608:QwUTrj7ZRkprdC3cYBJaxS9TNJ9jUZtyp+x87:Qw5rgsgJasJNJ94Zto
Malware Config
Extracted
octo
Signatures
-
Octo
Octo is a banking malware with remote access capabilities first seen in April 2022.
-
Octo family
-
Octo payload 1 IoCs
-
Loads dropped Dex/Jar 1 TTPs 2 IoCs
Runs executable file dropped to the device during analysis.
-
Makes use of the framework's Accessibility service 4 TTPs 2 IoCs
Retrieves information displayed on the phone screen using AccessibilityService.
-
Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
-
Queries the phone number (MSISDN for GSM devices) 1 TTPs
-
Acquires the wake lock 1 IoCs
-
Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs
Application may abuse the framework's foreground service to continue running in the foreground.
-
Performs UI accessibility actions on behalf of the user 1 TTPs 15 IoCs
Application may abuse the accessibility service to prevent their removal.
-
Queries the mobile country code (MCC) 1 TTPs 1 IoCs
-
Reads information about phone network operator. 1 TTPs
-
Requests enabling of the accessibility settings. 1 IoCs
-
Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs
Processes
-
com.vjinformation5_emulation1⤵
- Loads dropped Dex/Jar
- Makes use of the framework's Accessibility service
- Acquires the wake lock
- Makes use of the framework's foreground persistence service
- Performs UI accessibility actions on behalf of the user
- Queries the mobile country code (MCC)
- Requests enabling of the accessibility settings.
- Uses Crypto APIs (Might try to encrypt user data)
Network
MITRE ATT&CK Mobile v15
Defense Evasion
Download New Code at Runtime
1Foreground Persistence
1Impair Defenses
1Prevent Application Removal
1Input Injection
1Discovery
Software Discovery
1Security Software Discovery
1System Network Configuration Discovery
3Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
48B
MD5046a414913add6f5bb60072c7db819b6
SHA1451ee4f6809260aec622d772fd329c7d0297a842
SHA256b66c1320cb063a1d391c94273572ea6edae76c8c8b0a07f8d75c88686f0df72a
SHA5124e6355f3051ed5e811ab030abde1f5be7f5e1cf33be99cd08477e9b6c015deb1d8bd75a09fb9c7176b8511c5ad0a67abc0902a3531e97564ccb6afc57496a47c
-
Filesize
1004B
MD55934b695340b6cd39bd9756cd2a44da0
SHA1ac9c0c7861ca438dbaffcdf6351eb5a9c1f1a23c
SHA256f192d2c2a58619295b6caac502c5253e5a5199149792c1d090e1d62c7a97bb8f
SHA512515ff1ed1d37fb5ccc4925f8db38224b3a3ce5c3ccaeb7fe80104ff9889d31a0c3f658aa7da70382f64b87c1f95efc354c8bec20087bf1aa383d8321990642e4
-
Filesize
1004B
MD50b0cdd053b868bcedbeda32a34b8b54f
SHA11c69d9144f918039c379a22b576bc6db6f6c3062
SHA256d84951ff73a247fe494f05b871e8492cc1829ade69e54731be674ba05d1dfb8d
SHA5121945218a0eed50b8d04d71cab0775c9b210bbb8d38c5300abf6ba22aeda13ef356dce4fc7d49aa535db9f1241e163d5b121e0d486093df11b135b0ffa7d724d0
-
Filesize
322KB
MD577dc50489b9323274732d27dc8a4e803
SHA10e02a3595b62489d0739d771881da8604d117c65
SHA256c5684e792d1ebefea6aac09fed45911703fd58c899f8a08133d49dd91429a820
SHA5120684a92f3e9c525384cfa53f531afba61e5930e1c27032a7e27e3315f72761b62e122dc34768d8162ba08f9bed53d148aa8dc034b46456bdd211f230637eba58
-
Filesize
431B
MD506a05007c22d1fe17b139995f9d1d7d9
SHA1b2542194f840a583763bc4d5044198cea75a3de7
SHA256c0c16df6c92508e93ee99537f43a0e5b681e8c15f786bb6aba464fb1abfda734
SHA512841194bd48046494471c4e543427c924b3b8aed93e188df4e6bc3415089513ac3532475540baae85743ed01f5c2394e7e6ffa8057768e9e03424de73b401903b
-
Filesize
529KB
MD5b53b58ff027dcc140a26133818b5a3c4
SHA17934873feb242f7cc21369eeda353437a4b201df
SHA2569d6a64e69dfcdac53d4b1229d2d839fcfeef10221c2cca6ff6d92178d241d612
SHA512a45222c3899e36d6e2161d4ad8625922fda82a1c7b77ea0c33209c9998842bb5a1ef1922a75389ebf294f21a64b0661f2fb8bea01421d09171bb0b09999d3138
-
Filesize
1KB
MD5814f8d19b92475b1e02edb939c4f08b2
SHA18c7f860746857931f32bc626032e3e053d640b65
SHA25698340d58543177b7b9c95c5ad4befa169525e3ba7e8746055c8deb2dda0b46bb
SHA512e7591650ae9f8153aa8902ab108df998536c3cb1f6a16282042c0779babc7fd7004354666702f7d0f5b25a6bcab93b1137886ff591ddce8e0bb899c8eb6b8338