octo | 1dda2398fb3c4c2aee9b2a18f0975b921cbd2809625618d7a91d174806c677b7

Resubmissions

03-05-2024 05:43

240503-genrssae99 10

03-05-2024 05:43

03-05-2024 05:42

26-04-2024 11:24

26-04-2024 09:55

26-04-2024 09:35

Analysis

max time kernel
149s
max time network
130s
platform
android_x86
resource
android-x86-arm-20240221-en
resource tags

androidarch:armarch:x86image:android-x86-arm-20240221-enlocale:en-usos:android-9-x86system
submitted
13-04-2024 22:00

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

1dda2398fb3c4c2aee9b2a18f0975b921cbd2809625618d7a91d174806c677b7.apk
Size

509KB
MD5

398d22e2d522ad3b4dec483d095ab0a0
SHA1

57864eac5ff484b9943bb30657a5b8b521a04068
SHA256

1dda2398fb3c4c2aee9b2a18f0975b921cbd2809625618d7a91d174806c677b7
SHA512

7d4c8aad0e3ea2fda730554f4fa8220567b94cf0e6a7c3d93112ea1b0b11cc972b00b3d00346976e664cdf82d672f94185f5868df9c6b9b81b2bee9748649b7b
SSDEEP

12288:+f22AykQKMrEjYTYVk5B+vdosmXw91+9VYATRWcOqZUeJnPG:+55QjYTPMvdjmXw9M31W5MJnPG

Score

10^/10

octo banker collection discovery evasion infostealer persistence rat stealth trojan

Malware Config

Extracted

Family

octo

https://tecbabbshop24578.shop/ZDQyN2NmOGEZOTIK/

https://karamdsadvs2.shop/ZDQyN2NmOGEZOTIK/

https://karakalandankasd5.com/ZDQyN2NmOGEZOTIK/

https://tecklardankalan.shop/ZDQyN2NmOGEZOTIK/

AES_key

Signatures

Octo
Octo is a banking malware with remote access capabilities first seen in April 2022.
banker trojan infostealer rat octo

Octo payload 1 IoCs

Processes:

resource	yara_rule
/data/data/com.beautyship5/cache/qhqrdtmuyib	family_octo

Makes use of the framework's Accessibility service 2 TTPs 2 IoCs

Retrieves information displayed on the phone screen using AccessibilityService.

collection evasion

Input Injection

T1516

Screen Capture

T1513

Processes:

com.beautyship5

description	ioc	process
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId	com.beautyship5
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByViewId	com.beautyship5

Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
banker discovery

Security Software Discovery
T1418.001
Removes its main activity from the application launcher 1 TTPs 1 IoCs
stealth trojan evasion

Suppress Application Icon
T1628.001

Processes:

com.beautyship5

pid process

4248 com.beautyship5
Checks CPU information 2 TTPs 1 IoCs
Checks CPU information which indicate if the system is an emulator.
evasion discovery

System Checks
T1633.001

System Information Discovery
T1426

Processes:

com.beautyship5

description ioc process

File opened for read /proc/cpuinfo com.beautyship5
Checks memory information 2 TTPs 1 IoCs
Checks memory information which indicate if the system is an emulator.
evasion discovery

System Checks
T1633.001

System Information Discovery
T1426

Processes:

com.beautyship5

description ioc process

File opened for read /proc/meminfo com.beautyship5
Loads dropped Dex/Jar 1 TTPs 2 IoCs
Runs executable file dropped to the device during analysis.
evasion

Download New Code at Runtime
T1407

Processes:

com.beautyship5

ioc pid process

/data/user/0/com.beautyship5/cache/qhqrdtmuyib 4248 com.beautyship5
/data/user/0/com.beautyship5/cache/qhqrdtmuyib 4248 com.beautyship5
Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs
Application may abuse the framework's foreground service to continue running in the foreground.
evasion persistence

Foreground Persistence
T1541

Processes:

com.beautyship5

description ioc process

Framework service call android.app.IActivityManager.setServiceForeground com.beautyship5
Acquires the wake lock 1 IoCs

Processes:

com.beautyship5

description ioc process

Framework service call android.os.IPowerManager.acquireWakeLock com.beautyship5
Queries the unique device ID (IMEI, MEID, IMSI) 1 TTPs
discovery

System Network Configuration Discovery
T1422
Reads information about phone network operator. 1 TTPs
discovery

System Network Configuration Discovery
T1422
Requests disabling of battery optimizations (often used to enable hiding in the background). 1 TTPs 1 IoCs
evasion

User Evasion
T1628.002

Processes:

com.beautyship5

description ioc process

Intent action android.settings.REQUEST_IGNORE_BATTERY_OPTIMIZATIONS com.beautyship5
Uses Crypto APIs (Might try to encrypt user data) 1 IoCs

Processes:

com.beautyship5

description ioc process

Framework API call javax.crypto.Cipher.doFinal com.beautyship5

pid	process
4248	com.beautyship5

description	ioc	process
File opened for read	/proc/cpuinfo	com.beautyship5

description	ioc	process
File opened for read	/proc/meminfo	com.beautyship5

ioc	pid	process
/data/user/0/com.beautyship5/cache/qhqrdtmuyib	4248	com.beautyship5
/data/user/0/com.beautyship5/cache/qhqrdtmuyib	4248	com.beautyship5

description	ioc	process
Framework service call	android.app.IActivityManager.setServiceForeground	com.beautyship5

description	ioc	process
Framework service call	android.os.IPowerManager.acquireWakeLock	com.beautyship5

description	ioc	process
Intent action	android.settings.REQUEST_IGNORE_BATTERY_OPTIMIZATIONS	com.beautyship5

description	ioc	process
Framework API call	javax.crypto.Cipher.doFinal	com.beautyship5

com.beautyship5
1⤵
- Makes use of the framework's Accessibility service
- Removes its main activity from the application launcher
- Checks CPU information
- Checks memory information
- Loads dropped Dex/Jar
- Makes use of the framework's foreground persistence service
- Acquires the wake lock
- Requests disabling of battery optimizations (often used to enable hiding in the background).
- Uses Crypto APIs (Might try to encrypt user data)
PID:4248

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Foreground Persistence

T1541

Privilege Escalation

Defense Evasion

Download New Code at Runtime

T1407

Foreground Persistence

T1541

Hide Artifacts

T1628

Suppress Application Icon

T1628.001

User Evasion

T1628.002

Input Injection

T1516

Virtualization/Sandbox Evasion

T1633

System Checks

T1633.001

Credential Access

Discovery

Software Discovery

T1418

Security Software Discovery

T1418.001

System Information Discovery

T1426

System Network Configuration Discovery

T1422

Lateral Movement

Collection

Screen Capture

T1513

Command and Control

Exfiltration

Impact

Input Injection

T1516

Replay Monitor

Loading Replay Monitor...

Downloads

/data/data/com.beautyship5/cache/oat/qhqrdtmuyib.cur.prof

Filesize
475B

MD5
2de6b650a5d0ff17ae1d12073379047d

SHA1
4bd28be412740dd00b9f5072eb8cf14b338cf303

SHA256
83601447cf4eb5670298976d917f168f3e13c218183d1092fda5aa5579947621

SHA512
25d6cde1e0157d36728f1eb4b18a50e5828b06564ebf3f96ed872316b7b18ef079ba433290988c9eac4416cd44fadc12ee1e2e4f30f152bae1264a8f52c62b7a

Download Submit
/data/data/com.beautyship5/cache/qhqrdtmuyib

Filesize
449KB

MD5
7cfcfcdf2f1a2e962d3975435a55b97d

SHA1
0e3b3c6e167542c580dec3a674f2fc3b4e91628d

SHA256
abe48a2b945177b37b9f59db9f4d8f92ea9dc991f0835b7df3191e937b6d8929

SHA512
eafb08deef09f5b4644c42e9bccac724dd5ba0345f43ea5cbc4ca8286b6ee34e579fa6195fbff24ceeb5e25db521e44edd99cc4d9a5691405e0e1f71b805548a

Download Submit
/data/data/com.beautyship5/kl.txt

Filesize
28B

MD5
6311c3fd15588bb5c126e6c28ff5fffe

SHA1
ce81d136fce31779f4dd62e20bdaf99c91e2fc57

SHA256
8b82f6032e29a2b5c96031a3630fb6173d12ff0295bc20bb21b877d08f0812d8

SHA512
2975fe2e94b6a8adc9cfc1a865ad113772b54572883a537b02a16dd2d029c0f7d9cca3b154fd849bdfe978e18b396bcf9fa6e67e7c61f92bdc089a29a9c355c6

Download Submit
/data/data/com.beautyship5/kl.txt

Filesize
237B

MD5
b3de2496657c83ca6df268a9bfe40185

SHA1
a08217603dd633f21c15e7fe864e8c34659f623a

SHA256
780898b8b7aed3035b29a36fa02efedfd66ccf743ee74e37911fb63faa97fa6a

SHA512
4ea8917c082ff2de1f53f006bf45bf73ed7f217120632f1da2522be31ea4c16cd9cc71be1db6ecba893a62e35d12bf20c01f8587cc7e59c343d58fcb4bd02c65

Download Submit
/data/data/com.beautyship5/kl.txt

Filesize
63B

MD5
6541ef9f16dc1fb39d019e952807e9a0

SHA1
cd3f40d3c4befea168667f71d15ab5719e4688e0

SHA256
0af45002585e57ddebc8f4d7645f211d25219c3184a3fd740de2acfc4f386b18

SHA512
9322cb8fa56e35793927535ba43d0062bf494c3556074c18986b21f7c487de5263c52f238945bf3f96729486e1387d4bbe9111de072dbd36482acb3a4a81d1fe

Download Submit
/data/data/com.beautyship5/kl.txt

Filesize
54B

MD5
68090f5510eab45582a6fa47b7c1aaba

SHA1
1755af70ca58c8d40003acd5ff3c76abae12bcf7

SHA256
5556f93cd9f132cde5217b0c143657d00cbcdee3382791bf92ccd8808e3932fe

SHA512
9355c2757f5e880c631493faefbc739f7fe9fe8ac731241b39b83bd3cdb7f0c4e735a658ebe465187453b91a2228143cc9530d0a0b06d42cf8170720168e7ca6

Download Submit
/data/data/com.beautyship5/kl.txt

Filesize
437B

MD5
e3d4c9961a35f78a6c7abff3d0716a9d

SHA1
f68dbca909b24b0e358c1da7895fe6062ef9f725

SHA256
0260fd645f6a9535acd0ad2fb1b1dce54fe30afb6a7646edd003bd33a177f472

SHA512
d114823bd72f7ee4b41e7e59acfe5610e8b8f112f355e021e71b3cca37ecff7edfd78fd8232a1249b669ade5764fca051baba962b9246980197e00a3c542cccd

Download Submit