2758c4220a3bb8ebf3df92ab8d27477dc354744d37c037d49e0071eccf282742

General

Target
Octagon.apk
Size 14.9MB
Sample260701-p437saew7k
SHA256 2758c4220a3bb8ebf3df92ab8d27477dc354744d37c037d49e0071eccf282742
MD5 bf436336de2ec9d9e404dfb9a4932c84
SHA1 8b544fc2432527930644cc75b69d58bdbe904835
SHA512 4e0aac86eddf0d173f71438f8ea0617ac224b6d5f376df98fc3b2abeceed28c7fef3395abfa1dae6996756b3f21e4a0814f1ba6f4a336f4251bbc6592c67504b
SSDEEP 393216:0MZ2e2dvJvuRrs6cpiqJerGXpE7XylWQVSM3vgHRYhBn:avYRh1rGXurygkL3vgHY
TLSH
T121F6120AEFC8BA3AC5F7123A55BB59184C474C048787D987ED99382C1DB76D06B1EBC8
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

Malware Config

Targets

- Target
  Octagon.apk
- Size 14.9MB
- SHA256 2758c4220a3bb8ebf3df92ab8d27477dc354744d37c037d49e0071eccf282742
- MD5 bf436336de2ec9d9e404dfb9a4932c84
- SHA1 8b544fc2432527930644cc75b69d58bdbe904835
- SHA512 4e0aac86eddf0d173f71438f8ea0617ac224b6d5f376df98fc3b2abeceed28c7fef3395abfa1dae6996756b3f21e4a0814f1ba6f4a336f4251bbc6592c67504b
- SSDEEP 393216:0MZ2e2dvJvuRrs6cpiqJerGXpE7XylWQVSM3vgHRYhBn:avYRh1rGXurygkL3vgHY
- TLSH
  T121F6120AEFC8BA3AC5F7123A55BB59184C474C048787D987ED99382C1DB76D06B1EBC8
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

defense_evasion discovery evasion persistence collection credential_access impact
- Loads dropped Dex/Jar
  Runs executable file dropped to the device during analysis.
  evasion
- Obtains sensitive information copied to the device clipboard
  Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.
  collection credential_access impact
- Attempts to obfuscate APK file format
  Applies obfuscation techniques to the APK format in order to hinder analysis
- Checks the application is allowed to request package installs through the package installer
  Checks the application is allowed to install additional applications (Might try to install applications from unknown sources).
  defense_evasion
- Declares services with permission to bind to the system
- Makes use of the framework's foreground persistence service
  Application may abuse the framework's foreground service to continue running in the foreground.
  defense_evasion persistence
- Queries the mobile country code (MCC)
  discovery
- Requests allowing to install additional applications from unknown sources.
  defense_evasion
- Requests dangerous framework permissions
behavioral1 behavioral2 behavioral3
- Target
  payload.base
- Size 8.4MB
- SHA256 ad37ababf6f3e945ec854408cdc0ffb477c7688fff37139affa60b5d635e0409
- MD5 527357387befd12e768354ff042eebcf
- SHA1 e7e1d1b9454cd205837e27f6cfadc71ea193b118
- SHA512 2e2ce097a03ed8dd7792aabb8e0a83fa880a4c410bc0a04f8c6a3cebae956750c28583695a4383b2b2369aef080871936727033c5f19c7ed41d1bc57690a11b5
- SSDEEP 196608:Dvh1HjESTcrcW+3SvAboQXVCLo7TwB/jXGQx:HLTcrl+3OAboeVlTwVjXGQx
- TLSH
  T1D396E106EFC4BA3EC9F75236557A5A184C474C448787DD83EE99382C18BB6D06B1EBC8
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

collection credential_access defense_evasion discovery evasion persistence impact
- Loads dropped Dex/Jar
  Runs executable file dropped to the device during analysis.
  evasion
- Makes use of the framework's Accessibility service
  Retrieves information displayed on the phone screen using AccessibilityService.
  collection defense_evasion credential_access
- Obtains sensitive information copied to the device clipboard
  Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.
  collection credential_access impact
- Acquires the wake lock
- Makes use of the framework's foreground persistence service
  Application may abuse the framework's foreground service to continue running in the foreground.
  defense_evasion persistence
- Queries the mobile country code (MCC)
  discovery
- Requests disabling of battery optimizations (often used to enable hiding in the background).
  defense_evasion
behavioral4 behavioral5 behavioral6