Overview

overview

10

Static

static

10

0f6ea55eff...1b.apk

android-13-x64

7

0f6ea55eff...1b.apk

android-9-x86

7

app.apk

android-13-x64

10

app.apk

android-9-x86

10

Analysis

  • max time kernel
    16s
  • max time network
    33s
  • platform
    android-9_x86
  • resource
    android-x86-arm-20240910-en
  • resource tags

    arch:armarch:x86image:android-x86-arm-20240910-enlocale:en-usos:android-9-x86system
  • submitted
    09/04/2025, 07:50

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    app.apk

  • Size

    10.3MB

  • MD5

    b9e885b2a478a4f2fd4b2a46adeff5c5

  • SHA1

    17a5796e1389429e2261628ed31900f51f3c6bbb

  • SHA256

    b24297c264143dfe6362716105f50ebe3ab9fd0a0dbfd23618a44b661fd0abb0

  • SHA512

    7ebc893968107dcd4028baf6c2d13253d2223be0336941aa7d641ca8265a809e6fed3fe4f06d309276858dcc9691f2218f8dd514dc74811d3c44707dde5f5802

  • SSDEEP

    196608:Yl23XFUBrXRSncNz4GN1dWf7rluT1J4PkrVnFWUF+cpxamo:Ykcr0ncN0WdWf1uTz54UF+cp8mo

Score
10/10
octobankercollectioncredential_accessdefense_evasiondiscoveryevasionimpactinfostealerpersistenceratstealthtrojan

Malware Config

Extracted

Family

octo

DES_key
AES_key
AES_key

Signatures

  • Octo

    Octo is a banking malware with remote access capabilities first seen in April 2022.

    bankertrojaninfostealerratocto
  • Octo family
    octo
  • Octo payload 1 IoCs
  • Removes its main activity from the application launcher 1 TTPs 1 IoCs
    stealthtrojanevasion
  • Loads dropped Dex/Jar 1 TTPs 4 IoCs

    Runs executable file dropped to the device during analysis.

    evasion
  • Makes use of the framework's Accessibility service 4 TTPs 2 IoCs

    Retrieves information displayed on the phone screen using AccessibilityService.

    collectiondefense_evasioncredential_access
  • Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
    bankerdiscovery
  • Queries the phone number (MSISDN for GSM devices) 1 TTPs
    discovery
  • Acquires the wake lock 1 IoCs
  • Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs

    Application may abuse the framework's foreground service to continue running in the foreground.

    defense_evasionpersistence
  • Queries the mobile country code (MCC) 1 TTPs 1 IoCs
    discovery
  • Queries the unique device ID (IMEI, MEID, IMSI) 1 TTPs
    discovery
  • Reads information about phone network operator. 1 TTPs
    discovery
  • Requests enabling of the accessibility settings. 1 IoCs
  • Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs
    persistence
  • Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs
    impact

Processes

  • com.cutoutfunction_shared2
    1⤵
    • Removes its main activity from the application launcher
    • Loads dropped Dex/Jar
    • Makes use of the framework's Accessibility service
    • Acquires the wake lock
    • Makes use of the framework's foreground persistence service
    • Queries the mobile country code (MCC)
    • Requests enabling of the accessibility settings.
    • Registers a broadcast receiver at runtime (usually for listening for system events)
    • Uses Crypto APIs (Might try to encrypt user data)
    PID:4263
    • /system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.cutoutfunction_shared2/app_dex/classes.dex --output-vdex-fd=41 --oat-fd=42 --oat-location=/data/user/0/com.cutoutfunction_shared2/app_dex/oat/x86/classes.odex --compiler-filter=quicken --class-loader-context=&
      2⤵
      • Loads dropped Dex/Jar
      PID:4288

Network

MITRE ATT&CK Mobile v16

Replay Monitor

Loading Replay Monitor...

Downloads

  • /data/data/com.cutoutfunction_shared2/.global.com.cutoutfunction_shared2
    Filesize

    48B

    MD5

    046a414913add6f5bb60072c7db819b6

    SHA1

    451ee4f6809260aec622d772fd329c7d0297a842

    SHA256

    b66c1320cb063a1d391c94273572ea6edae76c8c8b0a07f8d75c88686f0df72a

    SHA512

    4e6355f3051ed5e811ab030abde1f5be7f5e1cf33be99cd08477e9b6c015deb1d8bd75a09fb9c7176b8511c5ad0a67abc0902a3531e97564ccb6afc57496a47c

    Download Submit

  • /data/data/com.cutoutfunction_shared2/app_dex/classes.dex
    Filesize

    1KB

    MD5

    2e02cfda89912fc753ea0c1a10177113

    SHA1

    787a08583ff9b96be96af106f3eed5522048eff9

    SHA256

    52eb9a1d10c1c3c8419016157bb9c727468b41803da0786f529893fb0751a3ec

    SHA512

    c8e1b3c60535692f1e466c75cee882ea14d03185dbc396f4687ea80b1b9d0d7ca4b210c52418fa69ba6d34518c7df656a1044b9e9e8c33742ed7acbdebf4a4ba

    Download Submit

  • /data/data/com.cutoutfunction_shared2/cache/classes.dex
    Filesize

    1KB

    MD5

    c1100ec9ce815b5f4eada655202e7024

    SHA1

    b0ce37fedde3e268711dc2fa89808c301b685080

    SHA256

    1f25a187a2b52e6713be28bd135c65f0b010e67fdb347d5cd4761cf03e6a7cf4

    SHA512

    3a56828f13ed1a53552977afcc1ebc307ce48185f948818129a68bf90b32e20a1e5f7f08ea2b5f5d6585705aacda9648b0d29fb4cc21f676def3e1196a51f08b

    Download Submit

  • /data/data/com.cutoutfunction_shared2/cache/classes.zip
    Filesize

    1KB

    MD5

    c03655de3757e0ba2e4417ae02382ec8

    SHA1

    bcd12abf502fcf11a9e2d252d4727334644bc939

    SHA256

    981e21e561663e2a8ba14a5375f4245425e32770051b6eaf86dbe02c246a358c

    SHA512

    e1933e4da39a33f387b1064087a6c1d392c0f929ac022e52d9341cf0ccb8c67985b057eec076de788bfdb42bc24cdfee2f7e612491af751f439cea11ab06bffd

    Download Submit

  • /data/data/com.cutoutfunction_shared2/files/.m
    Filesize

    307KB

    MD5

    4e73947cabb5db3f92ca85004981b754

    SHA1

    6d9667fdb0280ed2dcb782b4683e422a51bdc601

    SHA256

    6db94232e756b90ed437f1bc87dc38cf20fb2e7c7a19a5e40c6c17254b7e234c

    SHA512

    be8b500a7070af1dfb53b0cf1a7b327dadc4e163a6dad905496ac228c58cd1ed87b054533917924455d35e9b300683ae33e1bcdd91935a5dbae1d693c3e13d69

    Download Submit

  • /data/user/0/com.cutoutfunction_shared2/app_dex/classes.dex
    Filesize

    1KB

    MD5

    d0f55022146f18f57d5d518bc657c08c

    SHA1

    3ed3c3a0f79359d766c1bce12bc0ce8ea6f96342

    SHA256

    8578f61e0648de46d1b89d7e25dbaa877e34d887b8a0dda0c5d9ee6dd86d8d80

    SHA512

    ba8f63f7e3bea8daba9c90dc3f4d101fb0646ff8881c948ce92386b656b380b977c46f119e8104dffa59f088b917640c04b46d5fc3b45f3d672e14c862917752

    Download Submit

  • Anonymous-DexFile@0xc8f76000-0xc8ffa4a4
    Filesize

    529KB

    MD5

    dc3f69b817e8c1c51f3ecf73bc53c59e

    SHA1

    272620ebcaf1992b07e3921d353d25d653df3d3a

    SHA256

    c8afa8b97d9573bdb28dc5ac8891506e16c7074cdc9eaad6401d4958ef434605

    SHA512

    3febfe53e157fdea78e2fb77251bbfe29b847584852082361f3c32dbe740c013bed5ea73d0090618b89577f9fb1ace7aeda7d24d9ad32962cc7fa4054a94ea05

    Download Submit