octo | a6f391d7b7990e31ba4df7ca983c3e6fcaedb3bcf8bd0e0587b81bf181469c24

General

Target
a6f391d7b7990e31ba4df7ca983c3e6fcaedb3bcf8bd0e0587b81bf181469c24.apk
Size 184KB
Sample240410-1wslvsff6t
SHA256 a6f391d7b7990e31ba4df7ca983c3e6fcaedb3bcf8bd0e0587b81bf181469c24
MD5 18d8d7c981a5252c42f01289cb04c26c
SHA1 5e7aacfe2325fefbe0b95db4679b55af29da9a2d
SHA512 3866bd3f44cf6c7d30740429784d591684ec11db0c553e943bcd4586604f10e9ebf952326bfb8dd7b64bf701c3bff84373cc30ef5330298fd59516d96b3212ed
SSDEEP 3072:R5lhQehqu5d5kbdS65S/ecC2HQiINsYNr/FwLmbRULI6JzHbjK:R5l75/ZWDIPIZBRchC
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

octo banker collection discovery evasion infostealer persistence rat trojan

Malware Config

Extracted

Family

octo

C2

https://shoprise57899321.shop/YmQ5ZDVkMzRkZjE5/
https://emporiumwave245768.shop/YmQ5ZDVkMzRkZjE5/
https://worldfusion891056.shop/YmQ5ZDVkMzRkZjE5/
https://universevibe123459.shop/YmQ5ZDVkMzRkZjE5/
https://emporiumdelight987656.shop/YmQ5ZDVkMzRkZjE5/
https://thopris578993215.shop/YmQ5ZDVkMzRkZjE5/
https://empoiumwave245768.shop/YmQ5ZDVkMzRkZjE5/
https://worfusion891056.shop/YmQ5ZDVkMzRkZjE5/
https://unirsevibe123459.shop/YmQ5ZDVkMzRkZjE5/
https://eoriumdelight987656.shop/YmQ5ZDVkMzRkZjE5/

AES_key

Signatures

Octo
Octo is a banking malware with remote access capabilities first seen in April 2022.
banker trojan infostealer rat octo

Makes use of the framework's Accessibility service 2 TTPs 2 IoCs

Retrieves information displayed on the phone screen using AccessibilityService.

collection evasion

Input Injection

T1516

Screen Capture

T1513

description	ioc	Process
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId	com.beginhigh19
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByViewId	com.beginhigh19

Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs 1 IoCs

banker discovery

Security Software Discovery

T1418.001

description	ioc	Process
Framework service call	android.content.pm.IPackageManager.getInstalledApplications	com.beginhigh19

Checks CPU information 2 TTPs 1 IoCs

Checks CPU information which indicate if the system is an emulator.

evasion discovery

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/cpuinfo	com.beginhigh19

Checks memory information 2 TTPs 1 IoCs

Checks memory information which indicate if the system is an emulator.

evasion discovery

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/meminfo	com.beginhigh19

Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs

Application may abuse the framework's foreground service to continue running in the foreground.

evasion persistence

Foreground Persistence

T1541

description	ioc	Process
Framework service call	android.app.IActivityManager.setServiceForeground	com.beginhigh19

Queries the phone number (MSISDN for GSM devices) 1 TTPs
discovery

System Network Configuration Discovery
T1422

Acquires the wake lock 1 IoCs

description	ioc	Process
Framework service call	android.os.IPowerManager.acquireWakeLock	com.beginhigh19

Uses Crypto APIs (Might try to encrypt user data) 1 IoCs

description	ioc	Process
Framework API call	javax.crypto.Cipher.doFinal	com.beginhigh19

com.beginhigh19
1⤵
- Makes use of the framework's Accessibility service
- Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps)
- Checks CPU information
- Checks memory information
- Makes use of the framework's foreground persistence service
- Acquires the wake lock
- Uses Crypto APIs (Might try to encrypt user data)
PID:5033

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Foreground Persistence

1

T1541

Privilege Escalation

Defense Evasion

Foreground Persistence

Input Injection

Virtualization/Sandbox Evasion

2

T1633

System Checks

2

T1633.001

Credential Access

Discovery

Software Discovery

1

T1418

Security Software Discovery

1

T1418.001

System Information Discovery

2

T1426

System Network Configuration Discovery

1

T1422

Lateral Movement

Collection

Screen Capture

1

T1513

Command and Control

Exfiltration

Impact

Input Injection

1

T1516

Replay Monitor

Loading Replay Monitor...

Downloads

kl.txt

Path /data/data/com.beginhigh19/kl.txt
Size 28B
SHA256 8b82f6032e29a2b5c96031a3630fb6173d12ff0295bc20bb21b877d08f0812d8
MD5 6311c3fd15588bb5c126e6c28ff5fffe
SHA1 ce81d136fce31779f4dd62e20bdaf99c91e2fc57
SHA512 2975fe2e94b6a8adc9cfc1a865ad113772b54572883a537b02a16dd2d029c0f7d9cca3b154fd849bdfe978e18b396bcf9fa6e67e7c61f92bdc089a29a9c355c6
MD5 SHA1 SHA512

Submit Download

kl.txt

Path /data/data/com.beginhigh19/kl.txt
Size 230B
SHA256 8db0af3a2198dffe69128c75dd7568c83c942336966416e9c84c8eff789f68ed
MD5 f54c1ff90a02168ebb67877ee86d615f
SHA1 47e7ebc08269558414f3ad43582fd5c786451e05
SHA512 f546dc42a76eef466f3c9059f39388f5be70e762d6f64d666b7a0d3a089e9433100f9a05a50a51b4414767b788b530076c1338ec21d42a0d7da94a711456301d
MD5 SHA1 SHA512

Submit Download

kl.txt

Path /data/data/com.beginhigh19/kl.txt
Size 45B
SHA256 a6fbd7a72f2c54d3b761adcaca59b09716a83e0fbb5153636438506123304400
MD5 1ebbf37ed6c16a8d9ed06fa3fd6ca1ae
SHA1 dbe1235e4e522517e71b6d427327f2b6a80934f5
SHA512 c63d6a369fd48396302e6811be9123deda47cb1c64db0653f64e9d8f708a2afc5748c0e1cab922f65e932f938366dabe1f03372d1f680869c9b178c095aa971d
MD5 SHA1 SHA512

Submit Download

kl.txt

Path /data/data/com.beginhigh19/kl.txt
Size 63B
SHA256 331c1619dc1748ee955064494d731aaf8b8677553a109d445c3cefd0fbb51b94
MD5 cf36047d4bd016888445d5263bb32447
SHA1 4d84562d693264f37dad5e646fa68546daa811f7
SHA512 13adeff9d2ede1cda867dc8ede20ca8eda9dfeb5c9b644783225363a45c17bc0c7def3e58327f8f2abf8887bdea08d6e86646d06efd32605e4157dd7a8aae707
MD5 SHA1 SHA512

Submit Download

kl.txt

Path /data/data/com.beginhigh19/kl.txt
Size 423B
SHA256 280fc0efbf1a3b449f19dc20d7b9aae1e16d4586d2105bd1e71eb08dad03372e
MD5 c8261a2ac7920dbc1d8cff070b472c46
SHA1 1a2fd647b15373fa135cdb174a051df1ded9d77d
SHA512 edd12ad9539f01481357e1fa95ad837ba1d5f6686b2ac0fb8137313da05d4a940593bd1e714874a24d82297b43b0f055c036d21ed548351bd106177e62f13d7e
MD5 SHA1 SHA512

Submit Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads