Analysis
- max time kernel
149s - max time network
154s - platform
android-11_x64 - resource
android-x64-arm64-20260325-en - resource tags
- submitted
05/08/2026, 15:27
General
- Target bot_wrapped.apk
- Size 6.3MB
- Sample260805-svsapszdrd
- SHA256 655d0dba5fdefb9ec8ffb9e4bee15d9ff9289b2907280f38b0777d8dd944c031
Malware Config
Signatures
- Family: Octo
Octo is a banking malware with remote access capabilities first seen in April 2022.
- Loads dropped Dex/Jar 1 TTPs 2 IoCs
Runs executable file dropped to the device during analysis.
- Makes use of the framework's Accessibility service 4 TTPs 2 IoCs
Retrieves information displayed on the phone screen using AccessibilityService.
- Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
- Queries the phone number (MSISDN for GSM devices) 1 TTPs
- Acquires the wake lock 1 IoCs
- Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs
Application may abuse the framework's foreground service to continue running in the foreground.
- Queries information about active data network 1 TTPs 1 IoCs
- Queries the mobile country code (MCC) 1 TTPs 1 IoCs
- Reads information about phone network operator. 1 TTPs
- Requests accessing notifications (often used to intercept notifications before users become aware). 1 TTPs 1 IoCs
- Requests disabling of battery optimizations (often used to enable hiding in the background). 1 TTPs 1 IoCs
- Requests modifying system settings. 1 IoCs
- Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs
Processes
-
com.timeherefwuj1⤵
- Loads dropped Dex/Jar
- Makes use of the framework's Accessibility service
- Acquires the wake lock
- Makes use of the framework's foreground persistence service
- Queries information about active data network
- Queries the mobile country code (MCC)
- Requests accessing notifications (often used to intercept notifications before users become aware).
- Requests disabling of battery optimizations (often used to enable hiding in the background).
- Requests modifying system settings.
- Uses Crypto APIs (Might try to encrypt user data)
Network
MITRE ATT&CK Mobile v16
Defense Evasion
Download New Code at Runtime
1Foreground Persistence
1Hide Artifacts
1User Evasion
1Input Injection
1Credential Access
Access Notifications
1Input Capture
2GUI Input Capture
1Keylogging
1Discovery
Software Discovery
1Security Software Discovery
1System Network Configuration Discovery
3System Network Connections Discovery
1Replay Monitor
Loading Replay Monitor...
Downloads
mgoukjkcvzly
mgoukjkcvzly.cur.prof
mqttAndroidService.db
mqttAndroidService.db-journal
mqttAndroidService.db-journal
mqttAndroidService.db-journal