octo | b38019f9e80c2166a4e09eed0cd15bad651263f0ff3ea26199a08896ffd8e1fc

Resubmissions

05-08-2024 12:08

240805-pa55aavhjp 10

02-08-2024 15:48

03-01-2024 17:25

24-12-2023 19:17

14-12-2023 08:27

03-11-2023 03:07

01-11-2023 22:00

Analysis

max time kernel
3495884s
max time network
145s
platform
android_x86
resource
android-x86-arm-20231215-en
resource tags

androidarch:armarch:x86image:android-x86-arm-20231215-enlocale:en-usos:android-9-x86system
submitted
03-01-2024 17:25

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

b38019f9e80c2166a4e09eed0cd15bad651263f0ff3ea26199a08896ffd8e1fc.apk
Size

509KB
MD5

60609814e43a1c814b30435f15d361ed
SHA1

61431ed485c98b8a291e289a7e17e8d3e6db3660
SHA256

b38019f9e80c2166a4e09eed0cd15bad651263f0ff3ea26199a08896ffd8e1fc
SHA512

8efba5603fd4217b9c9c96e28a69f9f262568f76d43fd959d6914694808488f089f01fa92e2d04f44d5aa0859efcfb34fb080dc7b3a49502469598ab90a662fe
SSDEEP

12288:KwGWfjEhy4pNodk6TZFo9nheT5BQ4YvnAu:KnWf0y4GNIsmRvnAu

Score

10^/10

octo banker evasion infostealer rat stealth trojan

Malware Config

Extracted

Family

octo

https://84.54.50.100/Njk4Zjk4YjdjODY3/

https://pakuxxxnatationclass.net/Njk4Zjk4YjdjODY3/

https://pakuxxxnatationclass2.net/Njk4Zjk4YjdjODY3/

https://pakuxxxnatationclass3.net/Njk4Zjk4YjdjODY3/

https://pakuxxxnatationclass4.net/Njk4Zjk4YjdjODY3/

https://pakuxxxnatationclass5.net/Njk4Zjk4YjdjODY3/

https://pakuxxxnatationclass6.net/Njk4Zjk4YjdjODY3/

AES_key

Signatures

Octo
Octo is a banking malware with remote access capabilities first seen in April 2022.
banker trojan infostealer rat octo

Octo payload 1 IoCs

resource	yara_rule
behavioral1/files/fstream-1.dat	family_octo

Makes use of the framework's Accessibility service 2 IoCs

Retrieves information displayed on the phone screen using AccessibilityService.

description	ioc	Process
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId	com.broughtbluea
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByViewId	com.broughtbluea

Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 IoCs

banker

description	ioc	Process
Framework service call	android.content.pm.IPackageManager.getInstalledApplications	com.broughtbluea

Removes its main activity from the application launcher 1 IoCs

stealth trojan

pid	Process
4253	com.broughtbluea

Loads dropped Dex/Jar 2 IoCs

Runs executable file dropped to the device during analysis.

ioc	pid	Process
/data/user/0/com.broughtbluea/cache/pxcpq	4253	com.broughtbluea
/data/user/0/com.broughtbluea/cache/pxcpq	4253	com.broughtbluea

Acquires the wake lock 1 IoCs

description	ioc	Process
Framework service call	android.os.IPowerManager.acquireWakeLock	com.broughtbluea

Reads information about phone network operator.

Requests disabling of battery optimizations (often used to enable hiding in the background). 1 IoCs

evasion

description	ioc	Process
Intent action	android.settings.REQUEST_IGNORE_BATTERY_OPTIMIZATIONS	com.broughtbluea

Uses Crypto APIs (Might try to encrypt user data) 1 IoCs

description	ioc	Process
Framework API call	javax.crypto.Cipher.doFinal	com.broughtbluea

com.broughtbluea
1⤵
- Makes use of the framework's Accessibility service
- Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps)
- Removes its main activity from the application launcher
- Loads dropped Dex/Jar
- Acquires the wake lock
- Requests disabling of battery optimizations (often used to enable hiding in the background).
- Uses Crypto APIs (Might try to encrypt user data)
PID:4253

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

/data/data/com.broughtbluea/cache/oat/pxcpq.cur.prof

Filesize
490B

MD5
0123bd8b34e2ccdd082858855e1626d8

SHA1
0641a2e05b134197b9ee9dba784e7394ba0fabb8

SHA256
cc093391a533ea4e02cd375c991b32c9e9106540c09d622922e3d3dbcba282b3

SHA512
1dd6b5e53937e13836d6f00ee9a28aab9bb320fdbbc5cbd67bb2f1f7461ffce0b5bfe7c4ce8c5295212b53341fc9aa714643e455af6444bccd681a412b1f8409

Download Submit
/data/data/com.broughtbluea/cache/pxcpq

Filesize
449KB

MD5
fb15ea8794c6547c5ca8f58577e433a6

SHA1
47c530ac1858cbc7584429190a07c3c4313857ac

SHA256
908588c8de2b52b69f30917583d91ac67f96c7682c017df3943d3979c9fc6095

SHA512
9cb724a385917e949052b84be546cd61a952474ee8671743034463b356de4c5bc60732b07287c326da65c4cced7f8c8247b348bbb5abb436c86fedbcb4da90c9

Download Submit
/data/data/com.broughtbluea/kl.txt

Filesize
28B

MD5
6311c3fd15588bb5c126e6c28ff5fffe

SHA1
ce81d136fce31779f4dd62e20bdaf99c91e2fc57

SHA256
8b82f6032e29a2b5c96031a3630fb6173d12ff0295bc20bb21b877d08f0812d8

SHA512
2975fe2e94b6a8adc9cfc1a865ad113772b54572883a537b02a16dd2d029c0f7d9cca3b154fd849bdfe978e18b396bcf9fa6e67e7c61f92bdc089a29a9c355c6

Download Submit
/data/data/com.broughtbluea/kl.txt

Filesize
63B

MD5
ed82ed3b786a74fa660d507d26ed743b

SHA1
af1c4780881435bee930a62a6c0290d1a20f8d3e

SHA256
ac2f9bce72236af251e4e53aba5a997d014fd3e8c983b9bce7f83fa212a3708a

SHA512
9ea07b212b0486f0eb1e6667980477ac6f7695a506fb0a826bb64f9837480e81649f0c8fa5022fecf923248c8a5e29ed3d174afff1b1a5a63826da42923d0fb0

Download Submit
/data/data/com.broughtbluea/kl.txt

Filesize
230B

MD5
63f03f7ff72481e61404b0555a80cca9

SHA1
ca21e6c3acc90094e03722afd5268693adeb7f26

SHA256
e99106dc2c276110ecac0d6c100144821139e04f39c1768d2e6c4f61bcc8b029

SHA512
bc98950bcfdbf6692b8de2fc681fc9ba148d347e1e3282d5799412cf980a2d1b89cb75622afcdf4cc9bd0e50b7280c39259ee1798aaccbec7e6f16afc54f0d14

Download Submit
/data/data/com.broughtbluea/kl.txt

Filesize
54B

MD5
edc149e85468e9598c998b1fec165f58

SHA1
296a12583cfd6a605f3759647fe3d58f591d466c

SHA256
3f5b546fc9d49edfc3282808dabbb3efb871c658f1af43ba85b4cdf2dd14fdcd

SHA512
413f561f27b7e342422d9578577517365eedca4e4398dceb6172504af864dfd2582907b4bb0a0cdb57695afe5ba3efdf94baad6c0daa05d75dbd9d43048f756d

Download Submit
/data/data/com.broughtbluea/kl.txt

Filesize
63B

MD5
c06cb168666e1b0a27570c718dfc1850

SHA1
3d54f3d9669c7ef381723bc2928e841e35b1d157

SHA256
5b17fa967315cbbbd93bdc775e7238cd37e0c7bb3777f1b2cc67ca7940c7db0d

SHA512
c43f78d0b0efdd5ca9858be5af490df034998a28d10e98d4c1f5b1c1452391851933ae21c202090044cd4f2be2841770c2b0a92c8f88816ed4e47d1064eec83d

Download Submit