Analysis
-
max time kernel
29s -
max time network
30s -
platform
android-9_x86 -
resource
android-x86-arm-20240910-en -
resource tags
-
submitted
21/03/2025, 18:58
General
-
Target
base.apk
-
Size
9.9MB
-
MD5
c63a7341b83657975615109f144e926a
-
SHA1
c486503ec21bf61620fd5749b9b9456e13e4b53d
-
SHA256
d838927c91197c21b1ecd43ef97590d63ad2351e23f90fd96483aa10eba93f1c
-
SHA512
9ee55b5c21e91f1e773c08b81e665691ced17c17bf879d53f6962cc9fce13fe7a3f8aa7c6b57aad39a9a3521b0d60596e8ea7c724431f765950d00698fbb4c50
-
SSDEEP
98304:TwdpTASe2WrSj7kVKdn5iSRG5CPVql6jgYt6+U93sx1DUUXTEPQRXG7zRsUq:cdidOj7kUNrTPVAVeDUAAoRXG7zRY
Malware Config
Extracted
octo
Signatures
-
Octo
Octo is a banking malware with remote access capabilities first seen in April 2022.
-
Octo family
-
Octo payload 1 IoCs
-
Removes its main activity from the application launcher 1 TTPs 1 IoCs
-
Loads dropped Dex/Jar 1 TTPs 3 IoCs
Runs executable file dropped to the device during analysis.
-
Makes use of the framework's Accessibility service 4 TTPs 2 IoCs
Retrieves information displayed on the phone screen using AccessibilityService.
-
Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
-
Queries the phone number (MSISDN for GSM devices) 1 TTPs
-
Acquires the wake lock 1 IoCs
-
Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs
Application may abuse the framework's foreground service to continue running in the foreground.
-
Queries the mobile country code (MCC) 1 TTPs 1 IoCs
-
Queries the unique device ID (IMEI, MEID, IMSI) 1 TTPs
-
Requests disabling of battery optimizations (often used to enable hiding in the background). 1 TTPs 1 IoCs
-
Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs
-
Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs
-
Checks CPU information 2 TTPs 1 IoCs
-
Checks memory information 2 TTPs 1 IoCs
Processes
-
com.uunfw31secgestural1⤵
- Removes its main activity from the application launcher
- Loads dropped Dex/Jar
- Makes use of the framework's Accessibility service
- Acquires the wake lock
- Makes use of the framework's foreground persistence service
- Queries the mobile country code (MCC)
- Requests disabling of battery optimizations (often used to enable hiding in the background).
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Uses Crypto APIs (Might try to encrypt user data)
- Checks CPU information
- Checks memory information
-
/system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.uunfw31secgestural/app_rival/YSIecoy.json --output-vdex-fd=41 --oat-fd=42 --oat-location=/data/user/0/com.uunfw31secgestural/app_rival/oat/x86/YSIecoy.odex --compiler-filter=quicken --class-loader-context=&2⤵
- Loads dropped Dex/Jar
-
Network
MITRE ATT&CK Mobile v15
Persistence
Event Triggered Execution
1Broadcast Receivers
1Foreground Persistence
1Defense Evasion
Download New Code at Runtime
1Foreground Persistence
1Hide Artifacts
2Suppress Application Icon
1User Evasion
1Input Injection
1Virtualization/Sandbox Evasion
2System Checks
2Discovery
Software Discovery
1Security Software Discovery
1System Information Discovery
2System Network Configuration Discovery
3Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
48B
MD5046a414913add6f5bb60072c7db819b6
SHA1451ee4f6809260aec622d772fd329c7d0297a842
SHA256b66c1320cb063a1d391c94273572ea6edae76c8c8b0a07f8d75c88686f0df72a
SHA5124e6355f3051ed5e811ab030abde1f5be7f5e1cf33be99cd08477e9b6c015deb1d8bd75a09fb9c7176b8511c5ad0a67abc0902a3531e97564ccb6afc57496a47c
-
Filesize
1019B
MD52de53243f527a9ab45530b5dc31e0264
SHA182c32c6abc3950c0af67cd695c14973c45b5e1f1
SHA2560cdacbb4ecf4657acde53193871c69be8fcf70642ce4507e5605988d74646406
SHA512085958566b86b700c95efc17bcf928103f53393711f940ba1261b25bf7c1d05e134de0073a0ea3970aaaff967111dc93d63022cddaac15382bb072ee2fcba3b4
-
Filesize
1019B
MD5448e8a9f3ea84e5f357e307affe868d2
SHA1aeeea7258d1dd9fe346543a9858fb026a6168f00
SHA25648308b01f7f400bbed758fc544921b0f21f1033d9434db73e8dd9b4fe2ab434b
SHA5127dab66a6b306d3ce1d3969d43016995b540e4d307c879b027c30db480451ab6ac63390f684f7fdc158589b97118b564a5c280e4df0631f443dc8e1b4ec70b238
-
Filesize
307KB
MD54e73947cabb5db3f92ca85004981b754
SHA16d9667fdb0280ed2dcb782b4683e422a51bdc601
SHA2566db94232e756b90ed437f1bc87dc38cf20fb2e7c7a19a5e40c6c17254b7e234c
SHA512be8b500a7070af1dfb53b0cf1a7b327dadc4e163a6dad905496ac228c58cd1ed87b054533917924455d35e9b300683ae33e1bcdd91935a5dbae1d693c3e13d69
-
Filesize
1KB
MD5662face10d0a9dc8710efdd4ccf62fc8
SHA151b836e0f7d6bf48b7d7c2f8b3a72bb0df8d0c29
SHA256325cec7e89b8014c27492edd4c8a7598b01baa47349e9645d3920e9591b1a5a2
SHA512c811deafec244ef3517a5abc76e7bbb7e517b806593310ba50f7ede7ef673560599ddc97c03a6e0c13689c3fff5d5ff932eadb5cb1c4f79385f0c17cf8ef075f
-
Filesize
1KB
MD5484ef4858067e65ddc78d790da8c0e38
SHA15ddc1e95483a76a1d9fc1eae0996a24749302d19
SHA2563cef5587d1d1ec586f369abde3c5e00a3c07107095b50b98d2b2af8b08c4afed
SHA5120038fcc42615cc2214bffba571a9f5026bdbf123f8bf5c568bd67fb6419455114a29cf881d0eefda4a4de5eabe27682d8a85d0a9cb556da511ac02158d8d159b
-
Filesize
528KB
MD5dc054dcc95b3efb2d2d4f043167ba712
SHA1fd0b011a4091a79a8d2f27fd46ee1d0f1ef0547f
SHA2564199ceaefeb3865fcee456010f01afd1f3e253318b840a19ff2add09f5c8e0b0
SHA5122dd7a629c5185a9325f075281bcc598e16e50137a3a1b847693cc60913b08abadce93f7faaf20e10dd10a7cd38f66fe7e02b518947886a058001da5a4e63dbc3