Analysis
-
max time kernel
19s -
max time network
30s -
platform
android-13_x64 -
resource
android-33-x64-arm64-20240910-en -
resource tags
-
submitted
21/03/2025, 18:51
General
-
Target
base.apk
-
Size
7.1MB
-
MD5
ef9ca4ebd1e4f8c345a8ef2c9cbcb756
-
SHA1
cc378fa2d6b2af6dcf65f8c8608fa5e0306f0f45
-
SHA256
0ed5e46d9da10084baa9cad664f2f54b15ace995208e171d5c49c56466a64146
-
SHA512
f9a0abd1d8be2ab13d6cc2c70ef946075bc18f0b0400b0814e0855c617c6506701c8b4f7341d643b52f75049d11ff8ec3bf6b65a3bfaa329b3591700d161980e
-
SSDEEP
98304:R5iSRG9jujVKjJsDSj76Rs4J3z8pPcoAABKPbfUfmNB6Ae0OR5Y:RrBU1s2j76RH8yoAC+NV
Malware Config
Extracted
octo
Signatures
-
Octo
Octo is a banking malware with remote access capabilities first seen in April 2022.
-
Octo family
-
Octo payload 1 IoCs
-
Loads dropped Dex/Jar 1 TTPs 2 IoCs
Runs executable file dropped to the device during analysis.
-
Makes use of the framework's Accessibility service 4 TTPs 2 IoCs
Retrieves information displayed on the phone screen using AccessibilityService.
-
Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
-
Queries the phone number (MSISDN for GSM devices) 1 TTPs
-
Acquires the wake lock 1 IoCs
-
Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs
Application may abuse the framework's foreground service to continue running in the foreground.
-
Queries the mobile country code (MCC) 1 TTPs 1 IoCs
-
Reads information about phone network operator. 1 TTPs
-
Requests enabling of the accessibility settings. 1 IoCs
-
Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs
Processes
-
com.handed_wlantestc741⤵
- Loads dropped Dex/Jar
- Makes use of the framework's Accessibility service
- Acquires the wake lock
- Makes use of the framework's foreground persistence service
- Queries the mobile country code (MCC)
- Requests enabling of the accessibility settings.
- Uses Crypto APIs (Might try to encrypt user data)
Network
MITRE ATT&CK Mobile v15
Defense Evasion
Download New Code at Runtime
1Foreground Persistence
1Input Injection
1Discovery
Software Discovery
1Security Software Discovery
1System Network Configuration Discovery
3Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
48B
MD5046a414913add6f5bb60072c7db819b6
SHA1451ee4f6809260aec622d772fd329c7d0297a842
SHA256b66c1320cb063a1d391c94273572ea6edae76c8c8b0a07f8d75c88686f0df72a
SHA5124e6355f3051ed5e811ab030abde1f5be7f5e1cf33be99cd08477e9b6c015deb1d8bd75a09fb9c7176b8511c5ad0a67abc0902a3531e97564ccb6afc57496a47c
-
Filesize
1005B
MD59b419dacb611e17f57642e96bc85d879
SHA1a707e337dfa8c69dfad994557e2f266a1f68edfa
SHA2564e8aa5cc88340ece3bcbe3b947a8de8717c12778511500db3529f4bb5ceaae56
SHA51268a35399dfeab4ed7f17ed46ac422d790533c1d5fb359a992b365e15bfc17eebe005b828f0a3de043d615f51dce16bf3395aa6201c7001b2247442ca94661be9
-
Filesize
1005B
MD5bf5fd9cbc0ee1f213b37e25eb899776e
SHA10a8700c6b743a04709b857e91a73b94e17563fe8
SHA2563ea0dec6b7ec4309e93430e9c9cc4cd54243d7112b84be7ad4be9dc8dcb36a1c
SHA5124dd166536690e5637e888265f935d33ed556a9023614e5acdcc7a8a71a03b8fba95785736c02eae6305edfcef16f5c6a332018139101de827470eb6dd78c8158
-
Filesize
322KB
MD577dc50489b9323274732d27dc8a4e803
SHA10e02a3595b62489d0739d771881da8604d117c65
SHA256c5684e792d1ebefea6aac09fed45911703fd58c899f8a08133d49dd91429a820
SHA5120684a92f3e9c525384cfa53f531afba61e5930e1c27032a7e27e3315f72761b62e122dc34768d8162ba08f9bed53d148aa8dc034b46456bdd211f230637eba58
-
Filesize
13KB
MD521ddc80b6c04ebe1af72c672b687e804
SHA10fb119e8cfdf968f1a7819e54e939c4613410cb6
SHA2561c1d38e40382f25058589ff6f4de344f0440e8bd50bfc870bc73b9d01f5b8e3f
SHA51210863deb71e0efc3927ae0b4623da42bb669611ee2fdfab9c3f2e7cc67a52ac70f71071a0a6c75cbb4a7b0d3f85d369a1721a8018a48834e94749cbb09248271
-
Filesize
528KB
MD560ef4ab7b1d3a3617e723e4a8bc260b7
SHA18e46dff699126d1c34cc3dd695e72d5ede849c34
SHA25660059ed5fe314648e53ee945ce653f1ec720b7077717476e89ad2b9e2380e89f
SHA51272fdb7e913f32a4734fcee4ec9ec2dc53fdeb8260ffce2efc606e4473316810945cfde17d5d77446550ccb2bf8687075cc9ec0b23ea975cd929630be57a388c0
-
Filesize
1KB
MD5fd7cf01706c59263c15f2ce3ad438453
SHA15b0ac9b2c9fbbaf64bab92df3c1e192169d3da5a
SHA2566f8088e81d70caf4f4e3a0fcbf7bfa96e9be9f6eee327e3ecef212c7eacaf684
SHA51288562848d97db96a0cc2fd350ce5ea4fa57b221271d7d249c730084d2fd173c99511206e3625c8d328100ffa9c6bc1785430c8c422251fc8c14b00599a762b87