Analysis
-
max time kernel
144s -
max time network
152s -
platform
android-11_x64 -
resource
android-x64-arm64-20240910-en -
resource tags
-
submitted
21/03/2025, 18:56
General
-
Target
base.apk
-
Size
7.1MB
-
MD5
ef9ca4ebd1e4f8c345a8ef2c9cbcb756
-
SHA1
cc378fa2d6b2af6dcf65f8c8608fa5e0306f0f45
-
SHA256
0ed5e46d9da10084baa9cad664f2f54b15ace995208e171d5c49c56466a64146
-
SHA512
f9a0abd1d8be2ab13d6cc2c70ef946075bc18f0b0400b0814e0855c617c6506701c8b4f7341d643b52f75049d11ff8ec3bf6b65a3bfaa329b3591700d161980e
-
SSDEEP
98304:R5iSRG9jujVKjJsDSj76Rs4J3z8pPcoAABKPbfUfmNB6Ae0OR5Y:RrBU1s2j76RH8yoAC+NV
Malware Config
Extracted
octo
Signatures
-
Octo
Octo is a banking malware with remote access capabilities first seen in April 2022.
-
Octo family
-
Octo payload 1 IoCs
-
Loads dropped Dex/Jar 1 TTPs 2 IoCs
Runs executable file dropped to the device during analysis.
-
Makes use of the framework's Accessibility service 4 TTPs 2 IoCs
Retrieves information displayed on the phone screen using AccessibilityService.
-
Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
-
Queries the phone number (MSISDN for GSM devices) 1 TTPs
-
Acquires the wake lock 1 IoCs
-
Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs
Application may abuse the framework's foreground service to continue running in the foreground.
-
Performs UI accessibility actions on behalf of the user 1 TTPs 18 IoCs
Application may abuse the accessibility service to prevent their removal.
-
Queries the mobile country code (MCC) 1 TTPs 1 IoCs
-
Reads information about phone network operator. 1 TTPs
-
Requests enabling of the accessibility settings. 1 IoCs
-
Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs
Processes
-
com.handed_wlantestc741⤵
- Loads dropped Dex/Jar
- Makes use of the framework's Accessibility service
- Acquires the wake lock
- Makes use of the framework's foreground persistence service
- Performs UI accessibility actions on behalf of the user
- Queries the mobile country code (MCC)
- Requests enabling of the accessibility settings.
- Uses Crypto APIs (Might try to encrypt user data)
Network
MITRE ATT&CK Mobile v15
Defense Evasion
Download New Code at Runtime
1Foreground Persistence
1Impair Defenses
1Prevent Application Removal
1Input Injection
1Discovery
Software Discovery
1Security Software Discovery
1System Network Configuration Discovery
3Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
48B
MD5046a414913add6f5bb60072c7db819b6
SHA1451ee4f6809260aec622d772fd329c7d0297a842
SHA256b66c1320cb063a1d391c94273572ea6edae76c8c8b0a07f8d75c88686f0df72a
SHA5124e6355f3051ed5e811ab030abde1f5be7f5e1cf33be99cd08477e9b6c015deb1d8bd75a09fb9c7176b8511c5ad0a67abc0902a3531e97564ccb6afc57496a47c
-
Filesize
1005B
MD59b419dacb611e17f57642e96bc85d879
SHA1a707e337dfa8c69dfad994557e2f266a1f68edfa
SHA2564e8aa5cc88340ece3bcbe3b947a8de8717c12778511500db3529f4bb5ceaae56
SHA51268a35399dfeab4ed7f17ed46ac422d790533c1d5fb359a992b365e15bfc17eebe005b828f0a3de043d615f51dce16bf3395aa6201c7001b2247442ca94661be9
-
Filesize
1005B
MD5bf5fd9cbc0ee1f213b37e25eb899776e
SHA10a8700c6b743a04709b857e91a73b94e17563fe8
SHA2563ea0dec6b7ec4309e93430e9c9cc4cd54243d7112b84be7ad4be9dc8dcb36a1c
SHA5124dd166536690e5637e888265f935d33ed556a9023614e5acdcc7a8a71a03b8fba95785736c02eae6305edfcef16f5c6a332018139101de827470eb6dd78c8158
-
Filesize
322KB
MD577dc50489b9323274732d27dc8a4e803
SHA10e02a3595b62489d0739d771881da8604d117c65
SHA256c5684e792d1ebefea6aac09fed45911703fd58c899f8a08133d49dd91429a820
SHA5120684a92f3e9c525384cfa53f531afba61e5930e1c27032a7e27e3315f72761b62e122dc34768d8162ba08f9bed53d148aa8dc034b46456bdd211f230637eba58
-
Filesize
420B
MD51a94cca919d3c2f0af3cb16a7536f06f
SHA17981f121e4d32a62850b447bd6fb86c260a826a3
SHA2567785514da6890d0d6c56720052b755fdea7b40dd5dcd43ec7d5372aade882abb
SHA5125bf37ba530db80bde4bc3a23e06b7bb620e9e8ad007f4d2292d016684f005101cf149b3621ed1a8dae32e2ba362d4d3b0c56be67d996ad7a0cb453d260fa516c
-
Filesize
528KB
MD560ef4ab7b1d3a3617e723e4a8bc260b7
SHA18e46dff699126d1c34cc3dd695e72d5ede849c34
SHA25660059ed5fe314648e53ee945ce653f1ec720b7077717476e89ad2b9e2380e89f
SHA51272fdb7e913f32a4734fcee4ec9ec2dc53fdeb8260ffce2efc606e4473316810945cfde17d5d77446550ccb2bf8687075cc9ec0b23ea975cd929630be57a388c0
-
Filesize
1KB
MD5fd7cf01706c59263c15f2ce3ad438453
SHA15b0ac9b2c9fbbaf64bab92df3c1e192169d3da5a
SHA2566f8088e81d70caf4f4e3a0fcbf7bfa96e9be9f6eee327e3ecef212c7eacaf684
SHA51288562848d97db96a0cc2fd350ce5ea4fa57b221271d7d249c730084d2fd173c99511206e3625c8d328100ffa9c6bc1785430c8c422251fc8c14b00599a762b87