Analysis
- max time kernel
149s - max time network
153s - platform
android-11_x64 - resource
android-x64-arm64-20260325-en - resource tags
- submitted
14/08/2026, 17:08
General
- Target 655d0dba5fdefb9ec8ffb9e4bee15d9ff9289b2907280f38b0777d8dd944c031.apk
- Size 6.3MB
- Sample260814-vnnp2seq2w
- SHA256 655d0dba5fdefb9ec8ffb9e4bee15d9ff9289b2907280f38b0777d8dd944c031
Score
10/10
Malware Config
Extracted
Family
-
octo
C2
-
45.153.127.249
rc4.plain
Signatures
- Family: Octo
Octo is a banking malware with remote access capabilities first seen in April 2022.
- Loads dropped Dex/Jar 1 TTPs 2 IoCs
Runs executable file dropped to the device during analysis.
- Makes use of the framework's Accessibility service 4 TTPs 2 IoCs
Retrieves information displayed on the phone screen using AccessibilityService.
- Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
- Acquires the wake lock 1 IoCs
- Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs
Application may abuse the framework's foreground service to continue running in the foreground.
- Queries information about active data network 1 TTPs 1 IoCs
- Requests accessing notifications (often used to intercept notifications before users become aware). 1 TTPs 1 IoCs
- Requests disabling of battery optimizations (often used to enable hiding in the background). 1 TTPs 1 IoCs
- Requests modifying system settings. 1 IoCs
Processes
-
com.timeherefwuj1⤵
- Loads dropped Dex/Jar
- Makes use of the framework's Accessibility service
- Acquires the wake lock
- Makes use of the framework's foreground persistence service
- Queries information about active data network
- Requests accessing notifications (often used to intercept notifications before users become aware).
- Requests disabling of battery optimizations (often used to enable hiding in the background).
- Requests modifying system settings.
Network
MITRE ATT&CK Mobile v16
Defense Evasion
Download New Code at Runtime
1Foreground Persistence
1Hide Artifacts
1User Evasion
1Input Injection
1Credential Access
Access Notifications
1Input Capture
2GUI Input Capture
1Keylogging
1Discovery
Software Discovery
1Security Software Discovery
1System Network Connections Discovery
1Replay Monitor
Loading Replay Monitor...
Downloads
mgoukjkcvzly
mgoukjkcvzly.cur.prof