Analysis
-
max time kernel
16s -
max time network
25s -
platform
android-9_x86 -
resource
android-x86-arm-20240910-en -
resource tags
-
submitted
09/04/2025, 09:30
General
-
Target
d6dc77858e5d37cb36b5c6b088a1fde81933b2a405555c7808aae64ef4708dfa.apk
-
Size
6.5MB
-
MD5
fbd8d85760dab75c3b39a430e2ea8e5b
-
SHA1
aa4ca473c7ba07925a177b3e9839ecda59c4f0b0
-
SHA256
d6dc77858e5d37cb36b5c6b088a1fde81933b2a405555c7808aae64ef4708dfa
-
SHA512
2dbb1cee0648056e01378ba520f278131e402d1e829e050c3ab60d5cc38ef501ee08924cf8f8ce75915d268a8f2fe83b0c224c332dcbbc34535061a299bb872f
-
SSDEEP
98304:qjBXE/2g5iSRGexRso+VKrug53XZxLZiMv5KpgK3bTK:5+gr9R8Ui23XZxLZ1luK
Malware Config
Extracted
octo
Signatures
-
Octo
Octo is a banking malware with remote access capabilities first seen in April 2022.
-
Octo family
-
Octo payload 1 IoCs
-
Removes its main activity from the application launcher 1 TTPs 1 IoCs
-
Loads dropped Dex/Jar 1 TTPs 3 IoCs
Runs executable file dropped to the device during analysis.
-
Makes use of the framework's Accessibility service 4 TTPs 2 IoCs
Retrieves information displayed on the phone screen using AccessibilityService.
-
Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
-
Queries the phone number (MSISDN for GSM devices) 1 TTPs
-
Acquires the wake lock 1 IoCs
-
Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs
Application may abuse the framework's foreground service to continue running in the foreground.
-
Queries the mobile country code (MCC) 1 TTPs 1 IoCs
-
Queries the unique device ID (IMEI, MEID, IMSI) 1 TTPs
-
Reads information about phone network operator. 1 TTPs
-
Requests enabling of the accessibility settings. 1 IoCs
-
Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs
-
Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs
Processes
-
com.lwwizard_turbow1⤵
- Removes its main activity from the application launcher
- Loads dropped Dex/Jar
- Makes use of the framework's Accessibility service
- Acquires the wake lock
- Makes use of the framework's foreground persistence service
- Queries the mobile country code (MCC)
- Requests enabling of the accessibility settings.
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Uses Crypto APIs (Might try to encrypt user data)
-
/system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.lwwizard_turbow/app_struggle/NQJd.json --output-vdex-fd=41 --oat-fd=42 --oat-location=/data/user/0/com.lwwizard_turbow/app_struggle/oat/x86/NQJd.odex --compiler-filter=quicken --class-loader-context=&2⤵
- Loads dropped Dex/Jar
-
Network
MITRE ATT&CK Mobile v16
Persistence
Event Triggered Execution
1Broadcast Receivers
1Foreground Persistence
1Defense Evasion
Download New Code at Runtime
1Foreground Persistence
1Hide Artifacts
1Suppress Application Icon
1Input Injection
1Discovery
Software Discovery
1Security Software Discovery
1System Network Configuration Discovery
4Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
48B
MD5046a414913add6f5bb60072c7db819b6
SHA1451ee4f6809260aec622d772fd329c7d0297a842
SHA256b66c1320cb063a1d391c94273572ea6edae76c8c8b0a07f8d75c88686f0df72a
SHA5124e6355f3051ed5e811ab030abde1f5be7f5e1cf33be99cd08477e9b6c015deb1d8bd75a09fb9c7176b8511c5ad0a67abc0902a3531e97564ccb6afc57496a47c
-
Filesize
1015B
MD54c271a709b280ab3ce13f00ac5b1ef83
SHA10a707bd3064c19a3cebf9402f21c767118e27b0d
SHA256975564a469063266ecd6c64724292f14405beb458e7186aa87310d42e6723966
SHA5122a0fdc3317927e00d6908fcd2b63572771cf10bf1984203aa3f62bad33e7b4bf1ac4e3b13408815a8cde033b4095db275959f665641afd7863ff850ac307dd69
-
Filesize
1015B
MD5936602d96f746f22e5a16160a10990a0
SHA1f6e02db1afbfe6228a6e5e355b3c998592db91d9
SHA256f4ca2ce56377584567d2d059d12b60e49b35c38aa88a76431cc13509b152acaf
SHA512eaac4d940870f9d32ea281e4d2cc693a57011a5bcba9f718f93da28372b3dcb47937e6e4e17317acad369a00549f1e6d48b3e4ab04dc5f349f499af8b0865a61
-
Filesize
307KB
MD54e73947cabb5db3f92ca85004981b754
SHA16d9667fdb0280ed2dcb782b4683e422a51bdc601
SHA2566db94232e756b90ed437f1bc87dc38cf20fb2e7c7a19a5e40c6c17254b7e234c
SHA512be8b500a7070af1dfb53b0cf1a7b327dadc4e163a6dad905496ac228c58cd1ed87b054533917924455d35e9b300683ae33e1bcdd91935a5dbae1d693c3e13d69
-
Filesize
1KB
MD5ab9e138925de7567e446b01ef7e19866
SHA176b8954cbc6676fc63a2f316f2912a379856c147
SHA256e7cff9dfe1cd717948438860160ced29ff8ba269d4c5e5bf8c579000f1ad3c50
SHA512749916db31fe954b3cd48fdcda1c31d936e3b7a394f6bc2015158dc7a9921ac15774ee69c8179868d57b95f610410ce3a40e39bba384580bcbcb18dbf68ddb4f
-
Filesize
1KB
MD5a86fc19a645bd73c6a6c370f47f104d2
SHA1bef28cc0e31fd5f57bed53b8229cb8fc38858fe7
SHA2561f88a669f5941e34169d7668845209b0e6f87630486423a002cdb639472d22fd
SHA51287e4328c6a734fa72da9afee00a39eeb6fc69a1226c3d0b5f05409ce36b04d85fbea283f5c7addd9826860d8a1f2cc80f14655d0a3721b46b5d7baa0d84695d4
-
Filesize
528KB
MD52b88a6ef6852956782d25ea92ae9897d
SHA1d2e197b2cdce0cf184a0136d97cc6ae46fbd86f0
SHA2566c43f49a8aaf2372ae3021bb60a2dce5e4b5ad81940024229fc580fbc2dd120b
SHA5128fa3e9e2f91ca15a15e66edf8b6eb7dbc6b0fe90fa14022d087665d1cd4bce1c5d9655704cca1365d1dbdcde9b4cd61a734e56aafa403125e2275511b973ffe5