octo | 173aa89091bd450df5cb0af509b8ddd74ebb2097433e8f2998edcd3848647b7a

General

Target

173aa89091bd450df5cb0af509b8ddd74ebb2097433e8f2998edcd3848647b7a.apk
Size

509KB
MD5

913847e5845268f10a4a2b11024827ea
SHA1

b542051df3e58b6712c5a72361a5d1c686233ba9
SHA256

173aa89091bd450df5cb0af509b8ddd74ebb2097433e8f2998edcd3848647b7a
SHA512

c8b2804a0896b8e2b4ee58e4358f14c7780e5a2e28c01bf5ee31fdf17d3c033be728108fc775adbb2a0d6875b13b82240c8feb390fbebdffcbf4f1b6683f7391
SSDEEP

12288:tSkTYtBbHmGKNuFak1Rsg8c7kdwmlzo1wRFY4EsQWNSznw:MaCZuEp8m7WRFVqznw

Score

10^/10

octo banker collection discovery evasion infostealer persistence rat stealth trojan

Malware Config

Extracted

Family

octo

C2

https://tecbabbshop24578.shop/ZDQyN2NmOGEZOTIK/

https://karamdsadvs2.shop/ZDQyN2NmOGEZOTIK/

https://karakalandankasd5.com/ZDQyN2NmOGEZOTIK/

https://tecklardankalan.shop/ZDQyN2NmOGEZOTIK/

AES_key

Signatures

Octo
Octo is a banking malware with remote access capabilities first seen in April 2022.
banker trojan infostealer rat octo

Octo payload 1 IoCs

Processes:

resource	yara_rule
/data/data/com.nextfreele/cache/bsngvvpe	family_octo

Makes use of the framework's Accessibility service 2 TTPs 3 IoCs

Retrieves information displayed on the phone screen using AccessibilityService.

collection evasion

T1516

T1513

Processes:

com.nextfreele

description	ioc	process
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId	com.nextfreele
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByViewId	com.nextfreele
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByText	com.nextfreele

Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
banker discovery

T1418.001
Removes its main activity from the application launcher 1 TTPs 1 IoCs
stealth trojan evasion

T1628.001

Processes:

com.nextfreele

pid process

4175 com.nextfreele
Checks CPU information 2 TTPs 1 IoCs
Checks CPU information which indicate if the system is an emulator.
evasion discovery

T1633.001

T1426

Processes:

com.nextfreele

description ioc process

File opened for read /proc/cpuinfo com.nextfreele
Checks memory information 2 TTPs 1 IoCs
Checks memory information which indicate if the system is an emulator.
evasion discovery

T1633.001

T1426

Processes:

com.nextfreele

description ioc process

File opened for read /proc/meminfo com.nextfreele
Loads dropped Dex/Jar 1 TTPs 2 IoCs
Runs executable file dropped to the device during analysis.
evasion

T1407

Processes:

com.nextfreele

ioc pid process

/data/user/0/com.nextfreele/cache/bsngvvpe 4175 com.nextfreele
/data/user/0/com.nextfreele/cache/bsngvvpe 4175 com.nextfreele
Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs
Application may abuse the framework's foreground service to continue running in the foreground.
evasion persistence

T1541

Processes:

com.nextfreele

description ioc process

Framework service call android.app.IActivityManager.setServiceForeground com.nextfreele
Acquires the wake lock 1 IoCs

Processes:

com.nextfreele

description ioc process

Framework service call android.os.IPowerManager.acquireWakeLock com.nextfreele
Queries the unique device ID (IMEI, MEID, IMSI) 1 TTPs
discovery

T1422
Reads information about phone network operator. 1 TTPs
discovery

T1422
Requests disabling of battery optimizations (often used to enable hiding in the background). 1 TTPs 1 IoCs
evasion

T1628.002

Processes:

com.nextfreele

description ioc process

Intent action android.settings.REQUEST_IGNORE_BATTERY_OPTIMIZATIONS com.nextfreele
Uses Crypto APIs (Might try to encrypt user data) 1 IoCs

Processes:

com.nextfreele

description ioc process

Framework API call javax.crypto.Cipher.doFinal com.nextfreele

pid	process
4175	com.nextfreele

description	ioc	process
File opened for read	/proc/cpuinfo	com.nextfreele

description	ioc	process
File opened for read	/proc/meminfo	com.nextfreele

ioc	pid	process
/data/user/0/com.nextfreele/cache/bsngvvpe	4175	com.nextfreele
/data/user/0/com.nextfreele/cache/bsngvvpe	4175	com.nextfreele

description	ioc	process
Framework service call	android.app.IActivityManager.setServiceForeground	com.nextfreele

description	ioc	process
Framework service call	android.os.IPowerManager.acquireWakeLock	com.nextfreele

description	ioc	process
Intent action	android.settings.REQUEST_IGNORE_BATTERY_OPTIMIZATIONS	com.nextfreele

description	ioc	process
Framework API call	javax.crypto.Cipher.doFinal	com.nextfreele

com.nextfreele
1⤵
- Makes use of the framework's Accessibility service
- Removes its main activity from the application launcher
- Checks CPU information
- Checks memory information
- Loads dropped Dex/Jar
- Makes use of the framework's foreground persistence service
- Acquires the wake lock
- Requests disabling of battery optimizations (often used to enable hiding in the background).
- Uses Crypto APIs (Might try to encrypt user data)
PID:4175

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

/data/data/com.nextfreele/cache/bsngvvpe
Filesize
449KB

MD5
f25308b4f6e09ffaccc0f15b94753d6e

SHA1
b14cd1afaf222f7fc6f19d796e794b6fcd26b3d2

SHA256
cf1999bc0d3634c395a01a9959ec67c0ef20b421115247f0b191df4db859458e

SHA512
21102e789fa44b2717a63f074de6838e6f4e6150d4e251ac98ce3bd84a9a658e36bab3c2182c7a4c1d63363eb2ea8c213c3a9f19a7b84b81ae415a82bd7b31f6

Download Submit
/data/data/com.nextfreele/cache/oat/bsngvvpe.cur.prof
Filesize
471B

MD5
82dafdb73c560922773a740f351aa48b

SHA1
6489521119a9cc829964fe4ebe6c99ced64b82b8

SHA256
d53da5a8686f9754752441d1bc7562d5f125eb3170e88d06661368c6445daeb9

SHA512
36767d23ffded2b6c4bc977f5bc0a53c79bafbbf8724acbf076191e868c48e138b68ad411ecf3c703b4dad732ea7496d0a48a4ab9f3ad2ebb550bfaf22280b5d

Download Submit
/data/data/com.nextfreele/kl.txt
Filesize
28B

MD5
6311c3fd15588bb5c126e6c28ff5fffe

SHA1
ce81d136fce31779f4dd62e20bdaf99c91e2fc57

SHA256
8b82f6032e29a2b5c96031a3630fb6173d12ff0295bc20bb21b877d08f0812d8

SHA512
2975fe2e94b6a8adc9cfc1a865ad113772b54572883a537b02a16dd2d029c0f7d9cca3b154fd849bdfe978e18b396bcf9fa6e67e7c61f92bdc089a29a9c355c6

Download Submit
/data/data/com.nextfreele/kl.txt
Filesize
237B

MD5
dbd5973ed5644d91a63c7b64642576ff

SHA1
08680d99186c71c78c940682271f6ce8a19d7296

SHA256
231108e074d5083a639172aa8cc22687703aa67ead9b04d6c879c074ded5b5c5

SHA512
8b65bd5d10d9768125e2a573a8d57fc4228fd27ad01e218df3a109daabea9440aff5d04bcf23732a8250273d8a6fd2e274fba35e867d8be6907bdba0f100866c

Download Submit
/data/data/com.nextfreele/kl.txt
Filesize
63B

MD5
d6559522981917ae0519b5abcd8d4c0a

SHA1
4a1f09367eba3d4de1cfa62c14d72f1f0118dee1

SHA256
5cfb7e17edef4ef65c055f7ada56eefd464f8c2cf07612ee30f2fa4caefee74a

SHA512
9724f6e6e9609e16725c700892d2e7b53bdb2099ee8fb162960cca06b67e3f7078d225f62051aa0645a3a475a84e1d5cc182530cbc28099d4d73cb1b4b714243

Download Submit
/data/data/com.nextfreele/kl.txt
Filesize
45B

MD5
16c7dda7c653498b2db86881385cbf13

SHA1
db669123e3c43a0ce7ad3df9a6ab7727f5cb7467

SHA256
65285fab7c6cfb68f15bd8e3a28885268d5591c9877308e6b29d82c00adfd9f4

SHA512
8633f5badcfd43ea35630aea7f7f776a683610124da9746830325633bb3e6aa1388207b78ecb6cc07741b3e2c52d8a0ef09f1cd98b3c3e06b5a6bd2dfa4440a5

Download Submit
/data/data/com.nextfreele/kl.txt
Filesize
151B

MD5
46073efff23465160c2914cabe5d60b7

SHA1
5012185ce690640f8711a41bf32d13c67f2510bc

SHA256
7737a8bc3469f1ce6d52038517847cfcc1b6aa8199591876817b15a17634b614

SHA512
b05a0cf86d3a818a41e565bbfc16f76b2b42820c1505155861dc3114fd27b95b4b8dc6c361895c3f305cdc08688de2fc21a5bb4d69fcfb4f34c7107f3688d5a4

Download Submit

Analysis

Sharing