octo | 8b18b8a7f11a7976be5f1bf991b358a4438c78faf798073746973de520abe923

Analysis

max time kernel
2478338s
max time network
155s
platform
android_x86
resource
android-x86-arm-20231215-en
resource tags

androidarch:armarch:x86image:android-x86-arm-20231215-enlocale:en-usos:android-9-x86system
submitted
20-12-2023 06:22

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

8b18b8a7f11a7976be5f1bf991b358a4438c78faf798073746973de520abe923.apk
Size

3.3MB
MD5

ab4dfc2cc89eed6e9039f3ea0fe4cb76
SHA1

ed5b65c7c3677e590edadc4e7f1a49fc9296cd51
SHA256

8b18b8a7f11a7976be5f1bf991b358a4438c78faf798073746973de520abe923
SHA512

506142bdc14f576f9f0613aebfe2c94fca45afd1844df3670ef85c7a6b922ae0c04aafaf77b3129cc21417bf538db7bb165e6190de2480d71dc7326550c9bf75
SSDEEP

98304:jKZbAI2VY07HPiEnWgCUARPBR7AJ63RvE:GbA1PHn/bAR5R7AJ63RE

Score

10^/10

octo banker evasion infostealer rat stealth trojan

Malware Config

Extracted

Family

octo

https://checkserversippool.xyz/NmE0N2YwOWEzMTM3/

https://poolcheckipservers.xyz/NmE0N2YwOWEzMTM3/

https://poollipceckservers.xyz/NmE0N2YwOWEzMTM3/

https://poolserverisippool.xyz/NmE0N2YwOWEzMTM3/

https://serversippoolcheck.xyz/NmE0N2YwOWEzMTM3/

https://serverspoolcheckip.xyz/NmE0N2YwOWEzMTM3/

https://serverscheckippool.xyz/NmE0N2YwOWEzMTM3/

https://ipcheckserverspool.xyz/NmE0N2YwOWEzMTM3/

https://bestscanipworld.xyz/NmE0N2YwOWEzMTM3/

https://scanbestipworld.xyz/NmE0N2YwOWEzMTM3/

https://ipbestscanworld.xyz/NmE0N2YwOWEzMTM3/

https://worldipbestscan.xyz/NmE0N2YwOWEzMTM3/

AES_key

Signatures

Octo
Octo is a banking malware with remote access capabilities first seen in April 2022.
banker trojan infostealer rat octo

Octo payload 1 IoCs

resource	yara_rule
behavioral1/files/fstream-5.dat	family_octo

Makes use of the framework's Accessibility service 1 IoCs

Retrieves information displayed on the phone screen using AccessibilityService.

description	ioc	Process
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId	com.formtop27

Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 IoCs

banker

description	ioc	Process
Framework service call	android.content.pm.IPackageManager.getInstalledApplications	com.formtop27

Removes its main activity from the application launcher 1 IoCs

stealth trojan

pid	Process
4219	com.formtop27

Loads dropped Dex/Jar 5 IoCs

Runs executable file dropped to the device during analysis.

ioc	pid	Process
/data/user/0/com.formtop27/app_ded/F03sUzvbTmNDJghDXAfHFo6aSkGPUY3w.dex	4219	com.formtop27
/data/user/0/com.formtop27/app_ded/F03sUzvbTmNDJghDXAfHFo6aSkGPUY3w.dex	4244	/system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.formtop27/app_ded/F03sUzvbTmNDJghDXAfHFo6aSkGPUY3w.dex --output-vdex-fd=45 --oat-fd=46 --oat-location=/data/user/0/com.formtop27/app_ded/oat/x86/F03sUzvbTmNDJghDXAfHFo6aSkGPUY3w.odex --compiler-filter=quicken --class-loader-context=&
/data/user/0/com.formtop27/app_ded/F03sUzvbTmNDJghDXAfHFo6aSkGPUY3w.dex	4219	com.formtop27
/data/user/0/com.formtop27/cache/xbttwxwufqlf	4219	com.formtop27
/data/user/0/com.formtop27/cache/xbttwxwufqlf	4219	com.formtop27

Acquires the wake lock 1 IoCs

description	ioc	Process
Framework service call	android.os.IPowerManager.acquireWakeLock	com.formtop27

Requests disabling of battery optimizations (often used to enable hiding in the background). 1 IoCs

evasion

description	ioc	Process
Intent action	android.settings.REQUEST_IGNORE_BATTERY_OPTIMIZATIONS	com.formtop27

Uses Crypto APIs (Might try to encrypt user data) 1 IoCs

description	ioc	Process
Framework API call	javax.crypto.Cipher.doFinal	com.formtop27

com.formtop27
1⤵
- Makes use of the framework's Accessibility service
- Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps)
- Removes its main activity from the application launcher
- Loads dropped Dex/Jar
- Acquires the wake lock
- Requests disabling of battery optimizations (often used to enable hiding in the background).
- Uses Crypto APIs (Might try to encrypt user data)
PID:4219
- /system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.formtop27/app_ded/F03sUzvbTmNDJghDXAfHFo6aSkGPUY3w.dex --output-vdex-fd=45 --oat-fd=46 --oat-location=/data/user/0/com.formtop27/app_ded/oat/x86/F03sUzvbTmNDJghDXAfHFo6aSkGPUY3w.odex --compiler-filter=quicken --class-loader-context=&
  2⤵
  - Loads dropped Dex/Jar
  PID:4244
- rm -r/data/user/0/com.formtop27/app_ded/oat/x86/F03sUzvbTmNDJghDXAfHFo6aSkGPUY3w.odex
  2⤵
  PID:4268
- rm -r/data/user/0/com.formtop27/app_ded/oat/x86/F03sUzvbTmNDJghDXAfHFo6aSkGPUY3w.vdex
  2⤵
  PID:4282
- rm -r/data/user/0/com.formtop27/app_ded/F03sUzvbTmNDJghDXAfHFo6aSkGPUY3w.dex
  2⤵
  PID:4301

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

/data/data/com.formtop27/app_ded/F03sUzvbTmNDJghDXAfHFo6aSkGPUY3w.dex

Filesize
7KB

MD5
d249d541a857a625ee4c2a61c97d3312

SHA1
e00734ec72f3a7c896c2de2cac98108373c1d38d

SHA256
6b43fb517074aad79b7f45e2975dfdb25743374fe3c33bad0aae087db540152b

SHA512
e4958e013ac4b59de349e85a354ea907972b910530f0fd861254d5399eead05a226981110edb6d4c33464b1ceb33547c18aedf5abca5a1d5cd270801beb2d734

Download Submit
/data/data/com.formtop27/cache/oat/xbttwxwufqlf.cur.prof

Filesize
474B

MD5
918b8649bdb7e95fb2c57645f449eb6b

SHA1
2f6644249107185e36fc249e5aebf57a0eb4b619

SHA256
89d764b525420741b96d2d543f1c2b3fea570879fd6f71cd69b7d95b66deb9be

SHA512
75a6479b839ce782381ea129381ad59d661b443db855c8fa24951b6e207b27a095eef8788188a642c9edb50302b12bd97bd007daef658a0fd6a1e3dbd5231025

Download Submit
/data/data/com.formtop27/cache/xbttwxwufqlf

Filesize
444KB

MD5
81ad6d8a6d0f45b270e1a399da85f91d

SHA1
ec93b27f842e5c26b58373211e35b5ceb416fb97

SHA256
ff50b048a333f2c7782344db49872eeea2d1bdbea6823c24b0da69e680e18f2e

SHA512
90f9b28fb7f2612de43bb5dfb33f088ce144e1d2ac7dbe667ac11399c2a0473933a9181ba09162ff00acede638a44390811c4fce19ed2c5efc519a2a089727b2

Download Submit
/data/data/com.formtop27/kl.txt

Filesize
63B

MD5
043db74265320d6828d7ab399df54c34

SHA1
2b83aeaa162a14f42f8c6a6ecb0de3d056e739f5

SHA256
fd6643ee5bfe4583f9d3fbf69e8b3c841909a7353b532365fbfcbf3ca5b1e54c

SHA512
3f173f36f10abfdece8b3e125763a2cfbfc573a5337d142ec70031ab1c07228475bed37f07ba473410230eec4f62b54ff3feba9ddde83edf7ba2b74180f8c6e5

Download Submit
/data/data/com.formtop27/kl.txt

Filesize
54B

MD5
ae7de6258fe51ef757a7d9767baffb2f

SHA1
447b6356f3b3d629fd9b028054d1deb9bef3445b

SHA256
1aa5ae3de23b6f021d1e86e7387d82f3dcedf95fea2841e28a47fbcc5f033b6a

SHA512
5f59afecfadfad326a568c0f7dd97e845b011f8f7d8340760ae9e4f2dbc3b4afe5563b7a89b9ce1d1738084e0f333f04e8d46d529be2a5144c84a3b2474897bd

Download Submit
/data/data/com.formtop27/kl.txt

Filesize
63B

MD5
2af371cfe258ad8145fdfd38378d5790

SHA1
2005dfc32eaab855abd76587c3d2a8337ff026ca

SHA256
01ae66c41b342f10314a5106dffc3f34d1635f49876832190f1ef792daa5a466

SHA512
54a4f1e174f7d23fa39c69058fa9f23c76899204b5f05247666f6ff251b2cc0dfcd34e3c9fb64474a1c11b9986697f027b47bf80513e49066d127773615c19a4

Download Submit
/data/data/com.formtop27/kl.txt

Filesize
144B

MD5
10ade81b4f84869dec6432eac77c62d9

SHA1
36a2d48ff53ee0ed3eb7f53d4ea9032e0b665c93

SHA256
d44fda9eec9c0589aeb9e5f75672d3665826b6d4ba34ddd51ad58d617a470477

SHA512
6df6213823a2be6dd9efabe041762bfe8df15f2772d5d13e9dd2ccf9dd5e44380c700c63f27713338d4301f38980a95c971d073dc140ec0ec5621f3fd1a122c4

Download Submit
/data/data/com.formtop27/kl.txt

Filesize
28B

MD5
6311c3fd15588bb5c126e6c28ff5fffe

SHA1
ce81d136fce31779f4dd62e20bdaf99c91e2fc57

SHA256
8b82f6032e29a2b5c96031a3630fb6173d12ff0295bc20bb21b877d08f0812d8

SHA512
2975fe2e94b6a8adc9cfc1a865ad113772b54572883a537b02a16dd2d029c0f7d9cca3b154fd849bdfe978e18b396bcf9fa6e67e7c61f92bdc089a29a9c355c6

Download Submit
/data/user/0/com.formtop27/app_ded/F03sUzvbTmNDJghDXAfHFo6aSkGPUY3w.dex

Filesize
7KB

MD5
5dcaea7f3a0a5994a9b8fabecf61e779

SHA1
ef190c3b171fcecfaf66801e237fca3351c7ee61

SHA256
d0734ef15af157ffed23e60a1bdd26680d1491200cbc10640a6ebaba277c039c

SHA512
5ece5dca78172a13a0a4133b11774f2cddbf9fc5fd1da6476d9ab377b9b0a3f698ea76247b3dc19e0c956ecd9f4787c99c663b61d75bb7d793d06b1bafdb6633

Download Submit