octo | df096deb86121239ee8332be356cb47a3c47398cbf8bca775e009e2342cfae3a

Analysis

max time kernel
150s
max time network
152s
platform
android_x64
resource
android-33-x64-arm64-20240229-en
resource tags

androidarch:arm64arch:x64image:android-33-x64-arm64-20240229-enlocale:en-usos:android-13-x64system
submitted
23/04/2024, 22:03

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
df096deb86121239ee8332be356cb47a3c47398cbf8bca775e009e2342cfae3a.apk
Size 1.5MB
Sample240423-1ye4jscc4t
SHA256 df096deb86121239ee8332be356cb47a3c47398cbf8bca775e009e2342cfae3a
MD5 cc1274948304fda99d0e10a01e1fb671
SHA1 9b33a91f5c8b0ea17dde921bcefcbfc7d2481601
SHA512 d93375752ac21b4faaae5a34567fa0eefedec8239f08f449954dccafc5e5cea3628b271fb3918a4f1b999684df9c932e15889f8d04b46c7f43b92f25108510e2
SSDEEP 49152:KCki/x3DikWtF9Nav4cXkYUm2QAE4KoSTkX+ZGZbmq7:KCp12kW39NoCFz1X+ZQ/7
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

octo banker collection credential_access discovery evasion impact infostealer persistence rat trojan

Malware Config

Extracted

Family

octo

https://musherpicka.live/MTU2OWE0NzJjNGY5/
https://golevasi800.top/MTU2OWE0NzJjNGY5/
https://cm603lzeyxdw.site/MTU2OWE0NzJjNGY5/
https://cm603lzeyxdw1.site/MTU2OWE0NzJjNGY5/
https://arw2he7x57wp.pw/MTU2OWE0NzJjNGY5/
https://9r8i1u84t2gp.online/MTU2OWE0NzJjNGY5/
https://cm603lzeyxdw.biz/MTU2OWE0NzJjNGY5/
https://arw2he7x57wp1.pw/MTU2OWE0NzJjNGY5/
https://9r8i1u84t2gp1.online/MTU2OWE0NzJjNGY5/
https://cm603lzeyxdw.space/MTU2OWE0NzJjNGY5/
https://5a9udxg6l6gd.su/MTU2OWE0NzJjNGY5/

AES_key

Signatures

Octo
Octo is a banking malware with remote access capabilities first seen in April 2022.
banker trojan infostealer rat octo

Octo payload 1 IoCs

resource	yara_rule
behavioral2/files/fstream-3.dat	family_octo

Makes use of the framework's Accessibility service 4 TTPs 2 IoCs

Retrieves information displayed on the phone screen using AccessibilityService.

collection evasion credential_access

Input Injection

T1516

Screen Capture

T1513

Keylogging

T1417.001

GUI Input Capture

T1417.002

description	ioc	Process
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId	com.turnexample15
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByViewId	com.turnexample15

Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
banker discovery

Security Software Discovery
T1418.001

Checks CPU information 2 TTPs 1 IoCs

Checks CPU information which indicate if the system is an emulator.

evasion discovery

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/cpuinfo	com.turnexample15

Checks memory information 2 TTPs 1 IoCs

Checks memory information which indicate if the system is an emulator.

evasion discovery

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/meminfo	com.turnexample15

Loads dropped Dex/Jar 1 TTPs 2 IoCs

Runs executable file dropped to the device during analysis.

evasion

Download New Code at Runtime

T1407

ioc	pid	Process
/data/user/0/com.turnexample15/app_DynamicOptDex/KdWGMKn.json	4273	com.turnexample15
/data/user/0/com.turnexample15/cache/lvseceqyhd	4273	com.turnexample15

Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs

Application may abuse the framework's foreground service to continue running in the foreground.

evasion persistence

Foreground Persistence

T1541

description	ioc	Process
Framework service call	android.app.IActivityManager.setServiceForeground	com.turnexample15

Obtains sensitive information copied to the device clipboard 2 TTPs 1 IoCs

Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.

collection credential_access impact

Clipboard Data

T1414

Transmitted Data Manipulation

T1641.001

description	ioc	Process
Framework service call	android.content.IClipboard.addPrimaryClipChangedListener	com.turnexample15

Queries the mobile country code (MCC) 1 TTPs 1 IoCs

discovery

System Network Configuration Discovery

T1422

description	ioc	Process
Framework service call	com.android.internal.telephony.ITelephony.getNetworkCountryIsoForPhone	com.turnexample15

Queries the phone number (MSISDN for GSM devices) 1 TTPs
discovery

System Network Configuration Discovery
T1422

Acquires the wake lock 1 IoCs

description	ioc	Process
Framework service call	android.os.IPowerManager.acquireWakeLock	com.turnexample15

Reads information about phone network operator. 1 TTPs
discovery

System Network Configuration Discovery
T1422

Requests disabling of battery optimizations (often used to enable hiding in the background). 1 TTPs 1 IoCs

evasion

User Evasion

T1628.002

description	ioc	Process
Intent action	android.settings.REQUEST_IGNORE_BATTERY_OPTIMIZATIONS	com.turnexample15

Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs

impact

Data Encrypted for Impact

T1471

description	ioc	Process
Framework API call	javax.crypto.Cipher.doFinal	com.turnexample15

com.turnexample15
1⤵
- Makes use of the framework's Accessibility service
- Checks CPU information
- Checks memory information
- Loads dropped Dex/Jar
- Makes use of the framework's foreground persistence service
- Obtains sensitive information copied to the device clipboard
- Queries the mobile country code (MCC)
- Acquires the wake lock
- Requests disabling of battery optimizations (often used to enable hiding in the background).
- Uses Crypto APIs (Might try to encrypt user data)
PID:4273

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Foreground Persistence

T1541

Privilege Escalation

Defense Evasion

Download New Code at Runtime

T1407

Foreground Persistence

T1541

Hide Artifacts

T1628

User Evasion

T1628.002

Input Injection

T1516

Virtualization/Sandbox Evasion

T1633

System Checks

T1633.001

Credential Access

Clipboard Data

T1414

Input Capture

T1417

GUI Input Capture

T1417.002

Keylogging

T1417.001

Discovery

Software Discovery

T1418

Security Software Discovery

T1418.001

System Information Discovery

T1426

System Network Configuration Discovery

T1422

Lateral Movement

Collection

Clipboard Data

T1414

Input Capture

T1417

GUI Input Capture

T1417.002

Keylogging

T1417.001

Screen Capture

T1513

Command and Control

Exfiltration

Impact

Data Encrypted for Impact

T1471

Data Manipulation

T1641

Transmitted Data Manipulation

T1641.001

Input Injection

T1516

Replay Monitor

Loading Replay Monitor...

Downloads

KdWGMKn.json

Path /data/user/0/com.turnexample15/app_DynamicOptDex/KdWGMKn.json
Size 2KB
SHA256 59c46e834a5b0f4d33e4a6c84fb01fdab554c212ca7ec0c7d3acb1cc951b01a4
MD5 0650bf185606e7cc01e7c4466f25e212
SHA1 89a8ddbfac4348a67a5af895ad33d56b4d58e090
SHA512 a3c1dd5cba20190589769e55124aef28ed124a048babf5252c008c3b85b7a2781d7e0276863a7346170929edcce9b336d988b2e2588ec70c68805529b890313d
MD5 SHA1 SHA512

Submit Download

KdWGMKn.json

Path /data/user/0/com.turnexample15/app_DynamicOptDex/KdWGMKn.json
Size 2KB
SHA256 ebce94a14cae9c422c4a07ddea1bcb83895d66913d05ab29957f1c42477129a0
MD5 870bc7b6b33cc3383021cb941c9bdb0f
SHA1 8ef83733a941f70e30d3610153dee5b4e72a59b5
SHA512 c00483728fb319ece3682a03d1086c09942454a91ecd09764a164a9e1647345ca163a2c3be320d8c51c66e6ffcba548398fa73dee3f1c859e9c679c1af7ab229
MD5 SHA1 SHA512

Submit Download

KdWGMKn.json

Path /data/user/0/com.turnexample15/app_DynamicOptDex/KdWGMKn.json
Size 6KB
SHA256 eca7f673d1be3ef858c03ec4f79c07467fe4dd9f37e47c4a325ca433f09d594b
MD5 5ae419f42981cff6894434c9f79467c3
SHA1 00c55eadd6fc960a89f6d6e27f6f8b02431e0f55
SHA512 314438b93ee9bb03cf49ef2a3339a5ece79dc6bbdb7f681770e418e5349a991e9b98c4e290814959deb1d4b3979dc51e0254adcb2da9727ea2b69e3929d6f762
SSDEEP 96:I98xnBp2yPPPqrw/4WHteAI76ZGNZ+ZB4nonxvjg4HwC74AvIpctMonERCjFh8L9:ugnBp2yPPPqs/44R6AvG7ojFOLh
MD5 SHA1 SHA512 SSDEEP

Download

lvseceqyhd

Path /data/user/0/com.turnexample15/cache/lvseceqyhd
Size 271KB
SHA256 f85d16490d4a5725516476ff48bece912ae923f132f42cd88a22197929f2cfc6
MD5 6f3cf16d8a64cda396cf0e14be0dee13
SHA1 b99ff2737cdd8244e3cd7b616279b3e6a138526a
SHA512 fffbe48dbb14fec6435ca28556a1ff2e01f4e9259194fe6c85e76329c23f94e8344e2a780aa44d931b6dbf04f9d210cfed0ce5e9b9746539fe04983142b9173a
SSDEEP 6144:fl6WnIhHv5TQHsIkhQVW1PnaCQb9YxMag0KTk50Fdekq1jIF4oJ:zaHZQHFkhiW1PnaY+
MD5 SHA1 SHA512 SSDEEP

Submit Download

lvseceqyhd.cur.prof

Path /data/user/0/com.turnexample15/cache/oat/lvseceqyhd.cur.prof
Size 393B
SHA256 ac7d8162ed62c83e12848a91c29a163769ba2552f08e154853c3c253c59f10eb
MD5 c9dd9414cc9782063152e7b5a51d7fa2
SHA1 a9b5f3bff1b4f7f5b94c0a27a6a74184b92e1bdb
SHA512 572d1aa4d27696a3736118708fe080b89c185117350ed35333154af41bd4d53390581eebc75195a1bc50e6b2d435e22eb52435e79ed1627518eddac6eb0fc27a
MD5 SHA1 SHA512

Submit Download

kl.txt

Path /data/user/0/com.turnexample15/kl.txt
Size 54B
SHA256 23a163b3d9b0e03b66e00df492b998b778f1ddcce127a48ee793956e4c36297a
MD5 6b078c03b22e166f87cfeb643630c3cb
SHA1 d55245f9a6236c2db60e7d16e4d34867e37666f6
SHA512 39a24159a47789311ab7eec407ff6f3bb5809744f05242af2bdd40f73ed8c66e61726b47dc29e7b0ece89f10091469da3932ffa4d71c4f87f42f97356183b320
MD5 SHA1 SHA512

Submit Download

kl.txt

Path /data/user/0/com.turnexample15/kl.txt
Size 72B
SHA256 27f162c5e5d539ab1fc0a3003334f60c46c3b774a982ed05b1a7364e37a36107
MD5 18d86aee79abe9dcd4e43bef890338d0
SHA1 3c48781fc191395f68d064d0b80c7675842a17d5
SHA512 625d04b863c3b8a31ddae203718ff5fc96d0d8fa59b4aa8f0d86c1d7ac4c074ad7a33eeb648161fd468e70393c884ac7ebefa9f236199a3f3c77098a972881b3
MD5 SHA1 SHA512

Submit Download

kl.txt

Path /data/user/0/com.turnexample15/kl.txt
Size 28B
SHA256 8b82f6032e29a2b5c96031a3630fb6173d12ff0295bc20bb21b877d08f0812d8
MD5 6311c3fd15588bb5c126e6c28ff5fffe
SHA1 ce81d136fce31779f4dd62e20bdaf99c91e2fc57
SHA512 2975fe2e94b6a8adc9cfc1a865ad113772b54572883a537b02a16dd2d029c0f7d9cca3b154fd849bdfe978e18b396bcf9fa6e67e7c61f92bdc089a29a9c355c6
MD5 SHA1 SHA512

Submit Download

kl.txt

Path /data/user/0/com.turnexample15/kl.txt
Size 214B
SHA256 bea72571e9c653f9a7adac71cbfc11e073dbe2552a68129d530276d36a4852c5
MD5 79a65ed6d0b0984ac8d19a3fb75f0ee3
SHA1 79820992a3d8aae63a90abdb40518cf540426cae
SHA512 ea4a3064d89296268424d138194006cabcac1f183c698dc3c0116f61918316edcfbd466183beb8fb33c8a0516aff340f300a03c08e1be2c9de73441a5bed54f3
MD5 SHA1 SHA512

Submit Download

kl.txt

Path /data/user/0/com.turnexample15/kl.txt
Size 60B
SHA256 5fe7dc33ebb6f137ca708733011d5f3c93d755388bc65d1a8b084ae91ff0ab66
MD5 3ccaa95389d1098ad402ac3f63944be8
SHA1 ca2d8eb9e711ce76df5f6e9d4da5fe051061ee09
SHA512 76edc6072b3e4b299c7dd2a67332a4d61562643b025a366f030b2ca82704e8bf27b3a33bbe63644e447c7b11e4e5f789a8e34c62a50193d5f97f58ba9895c091
MD5 SHA1 SHA512

Submit Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads