Analysis
-
max time kernel
22s -
max time network
30s -
platform
android-13_x64 -
resource
android-33-x64-arm64-20240910-en -
resource tags
-
submitted
09/04/2025, 07:50
General
-
Target
app.apk
-
Size
10.3MB
-
MD5
b9e885b2a478a4f2fd4b2a46adeff5c5
-
SHA1
17a5796e1389429e2261628ed31900f51f3c6bbb
-
SHA256
b24297c264143dfe6362716105f50ebe3ab9fd0a0dbfd23618a44b661fd0abb0
-
SHA512
7ebc893968107dcd4028baf6c2d13253d2223be0336941aa7d641ca8265a809e6fed3fe4f06d309276858dcc9691f2218f8dd514dc74811d3c44707dde5f5802
-
SSDEEP
196608:Yl23XFUBrXRSncNz4GN1dWf7rluT1J4PkrVnFWUF+cpxamo:Ykcr0ncN0WdWf1uTz54UF+cp8mo
Malware Config
Extracted
octo
Signatures
-
Octo
Octo is a banking malware with remote access capabilities first seen in April 2022.
-
Octo family
-
Octo payload 1 IoCs
-
Loads dropped Dex/Jar 1 TTPs 2 IoCs
Runs executable file dropped to the device during analysis.
-
Makes use of the framework's Accessibility service 4 TTPs 2 IoCs
Retrieves information displayed on the phone screen using AccessibilityService.
-
Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
-
Queries the phone number (MSISDN for GSM devices) 1 TTPs
-
Acquires the wake lock 1 IoCs
-
Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs
Application may abuse the framework's foreground service to continue running in the foreground.
-
Queries the mobile country code (MCC) 1 TTPs 1 IoCs
-
Reads information about phone network operator. 1 TTPs
-
Requests enabling of the accessibility settings. 1 IoCs
-
Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs
Processes
-
com.cutoutfunction_shared21⤵
- Loads dropped Dex/Jar
- Makes use of the framework's Accessibility service
- Acquires the wake lock
- Makes use of the framework's foreground persistence service
- Queries the mobile country code (MCC)
- Requests enabling of the accessibility settings.
- Uses Crypto APIs (Might try to encrypt user data)
Network
MITRE ATT&CK Mobile v16
Defense Evasion
Download New Code at Runtime
1Foreground Persistence
1Input Injection
1Discovery
Software Discovery
1Security Software Discovery
1System Network Configuration Discovery
3Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
48B
MD5046a414913add6f5bb60072c7db819b6
SHA1451ee4f6809260aec622d772fd329c7d0297a842
SHA256b66c1320cb063a1d391c94273572ea6edae76c8c8b0a07f8d75c88686f0df72a
SHA5124e6355f3051ed5e811ab030abde1f5be7f5e1cf33be99cd08477e9b6c015deb1d8bd75a09fb9c7176b8511c5ad0a67abc0902a3531e97564ccb6afc57496a47c
-
Filesize
1KB
MD52e02cfda89912fc753ea0c1a10177113
SHA1787a08583ff9b96be96af106f3eed5522048eff9
SHA25652eb9a1d10c1c3c8419016157bb9c727468b41803da0786f529893fb0751a3ec
SHA512c8e1b3c60535692f1e466c75cee882ea14d03185dbc396f4687ea80b1b9d0d7ca4b210c52418fa69ba6d34518c7df656a1044b9e9e8c33742ed7acbdebf4a4ba
-
Filesize
1KB
MD5c1100ec9ce815b5f4eada655202e7024
SHA1b0ce37fedde3e268711dc2fa89808c301b685080
SHA2561f25a187a2b52e6713be28bd135c65f0b010e67fdb347d5cd4761cf03e6a7cf4
SHA5123a56828f13ed1a53552977afcc1ebc307ce48185f948818129a68bf90b32e20a1e5f7f08ea2b5f5d6585705aacda9648b0d29fb4cc21f676def3e1196a51f08b
-
Filesize
1KB
MD5c03655de3757e0ba2e4417ae02382ec8
SHA1bcd12abf502fcf11a9e2d252d4727334644bc939
SHA256981e21e561663e2a8ba14a5375f4245425e32770051b6eaf86dbe02c246a358c
SHA512e1933e4da39a33f387b1064087a6c1d392c0f929ac022e52d9341cf0ccb8c67985b057eec076de788bfdb42bc24cdfee2f7e612491af751f439cea11ab06bffd
-
Filesize
322KB
MD577dc50489b9323274732d27dc8a4e803
SHA10e02a3595b62489d0739d771881da8604d117c65
SHA256c5684e792d1ebefea6aac09fed45911703fd58c899f8a08133d49dd91429a820
SHA5120684a92f3e9c525384cfa53f531afba61e5930e1c27032a7e27e3315f72761b62e122dc34768d8162ba08f9bed53d148aa8dc034b46456bdd211f230637eba58
-
Filesize
13KB
MD57bdde550dcef378f86a8f2083a1bcc1c
SHA161cda68210cebf48882c634052ad01633f8dea85
SHA25626f652ef3ea30daff6ebd05890db9b18d5480315d8bf3d9f48a4712b40a41cbf
SHA51250cf3e1034116c7e6bd6dd11735b4e6030cf88ee5bdd0440f437655f7ae5ce66bc3b6041a3e0ce2533187b735076d290c94f6dee721227edb56e6d0044f8b0df
-
Filesize
529KB
MD5dc3f69b817e8c1c51f3ecf73bc53c59e
SHA1272620ebcaf1992b07e3921d353d25d653df3d3a
SHA256c8afa8b97d9573bdb28dc5ac8891506e16c7074cdc9eaad6401d4958ef434605
SHA5123febfe53e157fdea78e2fb77251bbfe29b847584852082361f3c32dbe740c013bed5ea73d0090618b89577f9fb1ace7aeda7d24d9ad32962cc7fa4054a94ea05