Analysis
-
max time kernel
23s -
max time network
25s -
platform
android-13_x64 -
resource
android-33-x64-arm64-20240910-en -
resource tags
-
submitted
21/03/2025, 18:58
General
-
Target
base.apk
-
Size
9.9MB
-
MD5
c63a7341b83657975615109f144e926a
-
SHA1
c486503ec21bf61620fd5749b9b9456e13e4b53d
-
SHA256
d838927c91197c21b1ecd43ef97590d63ad2351e23f90fd96483aa10eba93f1c
-
SHA512
9ee55b5c21e91f1e773c08b81e665691ced17c17bf879d53f6962cc9fce13fe7a3f8aa7c6b57aad39a9a3521b0d60596e8ea7c724431f765950d00698fbb4c50
-
SSDEEP
98304:TwdpTASe2WrSj7kVKdn5iSRG5CPVql6jgYt6+U93sx1DUUXTEPQRXG7zRsUq:cdidOj7kUNrTPVAVeDUAAoRXG7zRY
Malware Config
Extracted
octo
Signatures
-
Octo
Octo is a banking malware with remote access capabilities first seen in April 2022.
-
Octo family
-
Octo payload 1 IoCs
-
Loads dropped Dex/Jar 1 TTPs 2 IoCs
Runs executable file dropped to the device during analysis.
-
Makes use of the framework's Accessibility service 4 TTPs 1 IoCs
Retrieves information displayed on the phone screen using AccessibilityService.
-
Obtains sensitive information copied to the device clipboard 2 TTPs 1 IoCs
Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.
-
Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
-
Queries the phone number (MSISDN for GSM devices) 1 TTPs
-
Acquires the wake lock 1 IoCs
-
Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs
Application may abuse the framework's foreground service to continue running in the foreground.
-
Queries the mobile country code (MCC) 1 TTPs 1 IoCs
-
Reads information about phone network operator. 1 TTPs
-
Requests disabling of battery optimizations (often used to enable hiding in the background). 1 TTPs 1 IoCs
-
Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs
-
Checks CPU information 2 TTPs 1 IoCs
-
Checks memory information 2 TTPs 1 IoCs
Processes
-
com.uunfw31secgestural1⤵
- Loads dropped Dex/Jar
- Makes use of the framework's Accessibility service
- Obtains sensitive information copied to the device clipboard
- Acquires the wake lock
- Makes use of the framework's foreground persistence service
- Queries the mobile country code (MCC)
- Requests disabling of battery optimizations (often used to enable hiding in the background).
- Uses Crypto APIs (Might try to encrypt user data)
- Checks CPU information
- Checks memory information
Network
MITRE ATT&CK Mobile v15
Defense Evasion
Download New Code at Runtime
1Foreground Persistence
1Hide Artifacts
1User Evasion
1Input Injection
1Virtualization/Sandbox Evasion
2System Checks
2Credential Access
Clipboard Data
1Input Capture
2GUI Input Capture
1Keylogging
1Discovery
Software Discovery
1Security Software Discovery
1System Information Discovery
2System Network Configuration Discovery
3Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
48B
MD5046a414913add6f5bb60072c7db819b6
SHA1451ee4f6809260aec622d772fd329c7d0297a842
SHA256b66c1320cb063a1d391c94273572ea6edae76c8c8b0a07f8d75c88686f0df72a
SHA5124e6355f3051ed5e811ab030abde1f5be7f5e1cf33be99cd08477e9b6c015deb1d8bd75a09fb9c7176b8511c5ad0a67abc0902a3531e97564ccb6afc57496a47c
-
Filesize
1019B
MD52de53243f527a9ab45530b5dc31e0264
SHA182c32c6abc3950c0af67cd695c14973c45b5e1f1
SHA2560cdacbb4ecf4657acde53193871c69be8fcf70642ce4507e5605988d74646406
SHA512085958566b86b700c95efc17bcf928103f53393711f940ba1261b25bf7c1d05e134de0073a0ea3970aaaff967111dc93d63022cddaac15382bb072ee2fcba3b4
-
Filesize
1019B
MD5448e8a9f3ea84e5f357e307affe868d2
SHA1aeeea7258d1dd9fe346543a9858fb026a6168f00
SHA25648308b01f7f400bbed758fc544921b0f21f1033d9434db73e8dd9b4fe2ab434b
SHA5127dab66a6b306d3ce1d3969d43016995b540e4d307c879b027c30db480451ab6ac63390f684f7fdc158589b97118b564a5c280e4df0631f443dc8e1b4ec70b238
-
Filesize
322KB
MD577dc50489b9323274732d27dc8a4e803
SHA10e02a3595b62489d0739d771881da8604d117c65
SHA256c5684e792d1ebefea6aac09fed45911703fd58c899f8a08133d49dd91429a820
SHA5120684a92f3e9c525384cfa53f531afba61e5930e1c27032a7e27e3315f72761b62e122dc34768d8162ba08f9bed53d148aa8dc034b46456bdd211f230637eba58
-
Filesize
13KB
MD5f2f9ca3881376066d41bd8ea366b266b
SHA1df150021c3090ece8801b1bb543015aaa311008c
SHA256653a1df73396b8ba6cd4467f0c68ec4a928df3582bcf50d2862447fc586fc044
SHA512b5b8e00011fcadf45347147a4631582fce3dfe0099c7e3c6bcb7551f6a22587a75e67f8b2d6d9cf3c5ffde6e413a5de27aac30670006cf04cf403776e5ca3846
-
Filesize
528KB
MD5dc054dcc95b3efb2d2d4f043167ba712
SHA1fd0b011a4091a79a8d2f27fd46ee1d0f1ef0547f
SHA2564199ceaefeb3865fcee456010f01afd1f3e253318b840a19ff2add09f5c8e0b0
SHA5122dd7a629c5185a9325f075281bcc598e16e50137a3a1b847693cc60913b08abadce93f7faaf20e10dd10a7cd38f66fe7e02b518947886a058001da5a4e63dbc3
-
Filesize
1KB
MD5484ef4858067e65ddc78d790da8c0e38
SHA15ddc1e95483a76a1d9fc1eae0996a24749302d19
SHA2563cef5587d1d1ec586f369abde3c5e00a3c07107095b50b98d2b2af8b08c4afed
SHA5120038fcc42615cc2214bffba571a9f5026bdbf123f8bf5c568bd67fb6419455114a29cf881d0eefda4a4de5eabe27682d8a85d0a9cb556da511ac02158d8d159b