Analysis
-
max time kernel
22s -
max time network
24s -
platform
android-13_x64 -
resource
android-33-x64-arm64-20240910-en -
resource tags
-
submitted
22/03/2025, 00:45
General
-
Target
base.apk
-
Size
7.2MB
-
MD5
4a61da22726c477f73e1c8518062cb28
-
SHA1
d489dce01704de491fa56bc694889cb5a8d22fe9
-
SHA256
04ac76ce0b7d9e2e7ee4664743e446b7a5fe9dd1b60aa69e30a38fa0088749c3
-
SHA512
6e3ff9d924039a99dca74568a9f0bd1780370c8930551c1f207671cc7478d580738f9365cd3340cd99bc166b6a8f02eed9105511d36aca4d38917f1cfcd8059e
-
SSDEEP
98304:mQ/n5iSRGj2Rs5i1yFWxBuTh2VKXXtw5j7tokkG1Fe:mQnrNRcki2Ut2j7wYs
Malware Config
Extracted
octo
Signatures
-
Octo
Octo is a banking malware with remote access capabilities first seen in April 2022.
-
Octo family
-
Octo payload 1 IoCs
-
Loads dropped Dex/Jar 1 TTPs 2 IoCs
Runs executable file dropped to the device during analysis.
-
Makes use of the framework's Accessibility service 4 TTPs 1 IoCs
Retrieves information displayed on the phone screen using AccessibilityService.
-
Obtains sensitive information copied to the device clipboard 2 TTPs 1 IoCs
Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.
-
Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
-
Queries the phone number (MSISDN for GSM devices) 1 TTPs
-
Acquires the wake lock 1 IoCs
-
Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs
Application may abuse the framework's foreground service to continue running in the foreground.
-
Queries the mobile country code (MCC) 1 TTPs 1 IoCs
-
Reads information about phone network operator. 1 TTPs
-
Requests disabling of battery optimizations (often used to enable hiding in the background). 1 TTPs 1 IoCs
-
Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs
-
Checks CPU information 2 TTPs 1 IoCs
-
Checks memory information 2 TTPs 1 IoCs
Processes
-
com.ngms07_corner1⤵
- Loads dropped Dex/Jar
- Makes use of the framework's Accessibility service
- Obtains sensitive information copied to the device clipboard
- Acquires the wake lock
- Makes use of the framework's foreground persistence service
- Queries the mobile country code (MCC)
- Requests disabling of battery optimizations (often used to enable hiding in the background).
- Uses Crypto APIs (Might try to encrypt user data)
- Checks CPU information
- Checks memory information
Network
MITRE ATT&CK Mobile v15
Defense Evasion
Download New Code at Runtime
1Foreground Persistence
1Hide Artifacts
1User Evasion
1Input Injection
1Virtualization/Sandbox Evasion
2System Checks
2Credential Access
Clipboard Data
1Input Capture
2GUI Input Capture
1Keylogging
1Discovery
Software Discovery
1Security Software Discovery
1System Information Discovery
2System Network Configuration Discovery
3Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
48B
MD5046a414913add6f5bb60072c7db819b6
SHA1451ee4f6809260aec622d772fd329c7d0297a842
SHA256b66c1320cb063a1d391c94273572ea6edae76c8c8b0a07f8d75c88686f0df72a
SHA5124e6355f3051ed5e811ab030abde1f5be7f5e1cf33be99cd08477e9b6c015deb1d8bd75a09fb9c7176b8511c5ad0a67abc0902a3531e97564ccb6afc57496a47c
-
Filesize
1010B
MD5edd40a8ed5690e304e5928c1cfb8867a
SHA18d03bdf3019c207ae2965ced621f2bf4c72d5cd8
SHA25699f486ea76f10de7988a38a320f156f4e51255fbf2dbf9e42c03edbe53b7ea85
SHA512d21d04b5162c01edda94a6f278138f3ae8bde7d997937b414ed479931607673268f3c2b93133880a47c4cfa70d82dd8e0df1e21273170ec8b07c7b4644a0a57f
-
Filesize
1010B
MD5ecfcfd5557fc9f0654ede1f92a34ec36
SHA1d4c48517f7fe24c7df33b29463a014dc37299884
SHA256452efb4be65fa2dbe3789b18f42eb4e3b569e5459f9d0f11a2a683f217a7fffe
SHA512c4bf60ca7f8e94f8b724f900e15b5e4f5d8178f37d39c618a1431e2244e54f91b7abce85480dfba113c428527d22397faeed2075f90eeacfc76933a8d9291ab7
-
Filesize
322KB
MD577dc50489b9323274732d27dc8a4e803
SHA10e02a3595b62489d0739d771881da8604d117c65
SHA256c5684e792d1ebefea6aac09fed45911703fd58c899f8a08133d49dd91429a820
SHA5120684a92f3e9c525384cfa53f531afba61e5930e1c27032a7e27e3315f72761b62e122dc34768d8162ba08f9bed53d148aa8dc034b46456bdd211f230637eba58
-
Filesize
13KB
MD56d917eabccfc1990fac130a25ddd4be8
SHA143b4807a0b47bde9c8f56bb84e9c089e839a19af
SHA256c94b16e17c28773cad6cf17be1bc1c9d3b215a4cb3f51af33b68e7956aa080c2
SHA51212a18e37649d228117de2895f85f814c343e5ce40c1b348922513a61cb4ca7b899f8948517999c428efe0b0eb59ceafbfd577f8480895d6e7d31b2f8b814c931
-
Filesize
528KB
MD5907afeb079dd414e6ba812d396de5517
SHA138c5670a09c9971b4fb2b062a5e022989d01bffc
SHA256c3ecb8c015e3424749ef6cb3552b4a9124142aa0e49293e13e82957422a42c3f
SHA51223d04ce14bb43f4d326dca695823ad2ae377709c9e2d3567e07b65c82ba4567058bf2d2db5ce88e1cc8a0e14f203c9f1260ae8404f2be7ce50ca43971c63ba38
-
Filesize
1KB
MD50940bf5f002294f4e0e5ca27d365237d
SHA149ea872886717c0262ed8ae1cea6a6c1b20fb4e5
SHA256a2f99ff69256110b5756ecc1a3f89bf77ff4af704bab48da24a4d00c846115f4
SHA5124fd42cf23ebed46de5a54ed98c38c71d6d0c5a3aba5ed0601840da2a63ea8d55aff0d9740663b5f505bd0c18f3109af8aff259c1048a45d825a07af79bc33b69