Malware Analysis Report

2024-09-09 13:42

Sample ID 240528-1wt5paea7v
Target 9d1ce9b45a92e764359b87cfa6c882242ed6a0402a56f24832d60cbd88337459.bin
SHA256 9d1ce9b45a92e764359b87cfa6c882242ed6a0402a56f24832d60cbd88337459
Tags
octo banker collection credential_access discovery evasion impact infostealer persistence rat stealth trojan
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK Matrix

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

9d1ce9b45a92e764359b87cfa6c882242ed6a0402a56f24832d60cbd88337459

Threat Level: Known bad

The file 9d1ce9b45a92e764359b87cfa6c882242ed6a0402a56f24832d60cbd88337459.bin was found to be: Known bad.

Malicious Activity Summary

octo banker collection credential_access discovery evasion impact infostealer persistence rat stealth trojan

Octo

Octo payload

Makes use of the framework's Accessibility service

Prevents application removal

Requests accessing notifications (often used to intercept notifications before users become aware).

Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps)

Removes its main activity from the application launcher

Requests modifying system settings.

Queries the phone number (MSISDN for GSM devices)

Queries the mobile country code (MCC)

Checks memory information

Checks CPU information

Loads dropped Dex/Jar

Registers a broadcast receiver at runtime (usually for listening for system events)

Makes use of the framework's foreground persistence service

Obtains sensitive information copied to the device clipboard

Queries the unique device ID (IMEI, MEID, IMSI)

Declares broadcast receivers with permission to handle system events

Requests dangerous framework permissions

Reads information about phone network operator.

Declares services with permission to bind to the system

Requests disabling of battery optimizations (often used to enable hiding in the background).

Acquires the wake lock

Uses Crypto APIs (Might try to encrypt user data)

MITRE ATT&CK Matrix

N/A

Analysis: static1

Detonation Overview

Reported

2024-05-28 22:00

Signatures

Declares broadcast receivers with permission to handle system events

Description Indicator Process Target
Required by device admin receivers to bind with the system. Allows apps to manage device administration features. android.permission.BIND_DEVICE_ADMIN N/A N/A

Declares services with permission to bind to the system

Description Indicator Process Target
Required by accessibility services to bind with the system. Allows apps to access accessibility features. android.permission.BIND_ACCESSIBILITY_SERVICE N/A N/A
Required by notification listener services to bind with the system. Allows apps to listen to and interact with notifications on the device. android.permission.BIND_NOTIFICATION_LISTENER_SERVICE N/A N/A

Requests dangerous framework permissions

Description Indicator Process Target
Allows an application to write to external storage. android.permission.WRITE_EXTERNAL_STORAGE N/A N/A
Allows an application to receive SMS messages. android.permission.RECEIVE_SMS N/A N/A
Allows an application to read SMS messages. android.permission.READ_SMS N/A N/A
Allows an application to send SMS messages. android.permission.SEND_SMS N/A N/A
Allows read only access to phone state, including the current cellular network information, the status of any ongoing calls, and a list of any PhoneAccounts registered on the device. android.permission.READ_PHONE_STATE N/A N/A
Allows an application to initiate a phone call without going through the Dialer user interface for the user to confirm the call. android.permission.CALL_PHONE N/A N/A
Allows an application to read or write the system settings. android.permission.WRITE_SETTINGS N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-05-28 22:00

Reported

2024-05-28 22:04

Platform

android-x86-arm-20240514-en

Max time kernel

179s

Max time network

180s

Command Line

com.whateverwhatever

Signatures

Octo

banker trojan infostealer rat octo

Octo payload

Description Indicator Process Target
N/A N/A N/A N/A

Makes use of the framework's Accessibility service

collection evasion credential_access
Description Indicator Process Target
Framework service call android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId N/A N/A
Framework service call android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByViewId N/A N/A

Prevents application removal

evasion
Description Indicator Process Target
Framework service call android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction N/A N/A

Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps)

banker discovery

Removes its main activity from the application launcher

stealth trojan evasion
Description Indicator Process Target
N/A N/A N/A N/A

Requests accessing notifications (often used to intercept notifications before users become aware).

collection credential_access
Description Indicator Process Target
Intent action android.settings.ACTION_NOTIFICATION_LISTENER_SETTINGS N/A N/A

Requests modifying system settings.

evasion
Description Indicator Process Target
Intent action android.settings.action.MANAGE_WRITE_SETTINGS N/A N/A

Checks CPU information

evasion discovery
Description Indicator Process Target
File opened for read /proc/cpuinfo N/A N/A

Checks memory information

evasion discovery
Description Indicator Process Target
File opened for read /proc/meminfo N/A N/A

Loads dropped Dex/Jar

evasion
Description Indicator Process Target
N/A /data/user/0/com.whateverwhatever/cache/ntygrhadjbuptz N/A N/A
N/A /data/user/0/com.whateverwhatever/cache/ntygrhadjbuptz N/A N/A

Makes use of the framework's foreground persistence service

evasion persistence
Description Indicator Process Target
Framework service call android.app.IActivityManager.setServiceForeground N/A N/A

Queries the mobile country code (MCC)

discovery
Description Indicator Process Target
Framework service call com.android.internal.telephony.ITelephony.getNetworkCountryIsoForPhone N/A N/A

Queries the phone number (MSISDN for GSM devices)

discovery

Registers a broadcast receiver at runtime (usually for listening for system events)

persistence
Description Indicator Process Target
Framework service call android.app.IActivityManager.registerReceiver N/A N/A

Acquires the wake lock

Description Indicator Process Target
Framework service call android.os.IPowerManager.acquireWakeLock N/A N/A

Queries the unique device ID (IMEI, MEID, IMSI)

discovery

Reads information about phone network operator.

discovery

Requests disabling of battery optimizations (often used to enable hiding in the background).

evasion
Description Indicator Process Target
Intent action android.settings.REQUEST_IGNORE_BATTERY_OPTIMIZATIONS N/A N/A

Uses Crypto APIs (Might try to encrypt user data)

impact
Description Indicator Process Target
Framework API call javax.crypto.Cipher.doFinal N/A N/A

Processes

com.whateverwhatever

Network

Country Destination Domain Proto
N/A 224.0.0.251:5353 udp
US 1.1.1.1:53 semanticlocation-pa.googleapis.com udp
US 1.1.1.1:53 89divos.art udp
US 1.1.1.1:53 89divos.shop udp
US 1.1.1.1:53 89divos.tech udp
SY 94.232.249.36:443 94.232.249.36 tcp
US 1.1.1.1:53 www.ip-api.com udp
US 208.95.112.1:80 www.ip-api.com tcp
SY 94.232.249.36:443 94.232.249.36 tcp
GB 142.250.200.3:443 tcp
SY 94.232.249.36:443 94.232.249.36 tcp
SY 94.232.249.36:443 94.232.249.36 tcp
GB 142.250.180.14:443 tcp
US 1.1.1.1:53 android.apis.google.com udp
GB 142.250.187.238:443 android.apis.google.com tcp
SY 94.232.249.36:443 94.232.249.36 tcp
SY 94.232.249.36:443 94.232.249.36 tcp
SY 94.232.249.36:443 94.232.249.36 tcp
SY 94.232.249.36:443 94.232.249.36 tcp
SY 94.232.249.36:443 94.232.249.36 tcp
SY 94.232.249.36:443 94.232.249.36 tcp
SY 94.232.249.36:443 94.232.249.36 tcp
SY 94.232.249.36:443 94.232.249.36 tcp
SY 94.232.249.36:443 94.232.249.36 tcp
GB 142.250.187.206:443 tcp
SY 94.232.249.36:443 94.232.249.36 tcp
SY 94.232.249.36:443 94.232.249.36 tcp
SY 94.232.249.36:443 94.232.249.36 tcp
SY 94.232.249.36:443 94.232.249.36 tcp
SY 94.232.249.36:443 94.232.249.36 tcp
SY 94.232.249.36:443 94.232.249.36 tcp
SY 94.232.249.36:443 94.232.249.36 tcp
SY 94.232.249.36:443 94.232.249.36 tcp
SY 94.232.249.36:443 94.232.249.36 tcp
SY 94.232.249.36:443 94.232.249.36 tcp
SY 94.232.249.36:443 94.232.249.36 tcp
SY 94.232.249.36:443 94.232.249.36 tcp
SY 94.232.249.36:443 94.232.249.36 tcp
SY 94.232.249.36:443 94.232.249.36 tcp
SY 94.232.249.36:443 94.232.249.36 tcp
SY 94.232.249.36:443 94.232.249.36 tcp
SY 94.232.249.36:443 94.232.249.36 tcp
SY 94.232.249.36:443 94.232.249.36 tcp
SY 94.232.249.36:443 94.232.249.36 tcp
SY 94.232.249.36:443 94.232.249.36 tcp
SY 94.232.249.36:443 94.232.249.36 tcp
SY 94.232.249.36:443 94.232.249.36 tcp
SY 94.232.249.36:443 94.232.249.36 tcp
SY 94.232.249.36:443 94.232.249.36 tcp
SY 94.232.249.36:443 94.232.249.36 tcp
SY 94.232.249.36:443 94.232.249.36 tcp
SY 94.232.249.36:443 94.232.249.36 tcp
SY 94.232.249.36:443 94.232.249.36 tcp
SY 94.232.249.36:443 94.232.249.36 tcp
SY 94.232.249.36:443 94.232.249.36 tcp
SY 94.232.249.36:443 94.232.249.36 tcp
SY 94.232.249.36:443 94.232.249.36 tcp
SY 94.232.249.36:443 94.232.249.36 tcp
SY 94.232.249.36:443 94.232.249.36 tcp
SY 94.232.249.36:443 94.232.249.36 tcp
SY 94.232.249.36:443 94.232.249.36 tcp

Files

/data/data/com.whateverwhatever/cache/ntygrhadjbuptz

MD5 65cb593886751d7394957a9da951aaf8
SHA1 64eedc22cbde9f912d227744f9ebe6b8e6f638f8
SHA256 8a6242f184ede2ac58585af93dc550c4b7a824570bc881222afa5071fb50d4bf
SHA512 13ab53b5c34be5e6a0aa93ee6d8761d8797d1626a9005c2ede2e23547daec56a58902e8e87e13ae7e4540618abbff5857233c7bfdc0601aeeabe263fc46e3766

/data/data/com.whateverwhatever/kl.txt

MD5 6311c3fd15588bb5c126e6c28ff5fffe
SHA1 ce81d136fce31779f4dd62e20bdaf99c91e2fc57
SHA256 8b82f6032e29a2b5c96031a3630fb6173d12ff0295bc20bb21b877d08f0812d8
SHA512 2975fe2e94b6a8adc9cfc1a865ad113772b54572883a537b02a16dd2d029c0f7d9cca3b154fd849bdfe978e18b396bcf9fa6e67e7c61f92bdc089a29a9c355c6

/data/data/com.whateverwhatever/kl.txt

MD5 b07d8b410d4b6ee0c2acf8cb15d331d1
SHA1 a57dfce700325f7ea267bb3da29480af62fa979a
SHA256 2448bab6dd008eccf3fd9cf2f8af6096c8682a72bfa24524039f3e330d83732c
SHA512 21d96aed0358aa22c4c6c1cd6404746b233926057ae7eabfb00db5ae2675981927c8c3154c40f319e548156af42234c362bf8dcd20e9df10905c40a08d7b651f

/data/data/com.whateverwhatever/kl.txt

MD5 81429e00d27c15b6e97845f2e56fc9a2
SHA1 af75466276a2786bfbca7a7577872dae785e864d
SHA256 08b0a03c623b2fa2d82df097a5f8eadf7bf3a22756f5466b06f6b504c49ca04a
SHA512 4fb4571fd15dea9762f8382bd2674b9fe333d5d841924d160fd57333774f70cc50b23315888874bd2f7b996daae48cfae153377f19f4de819d592119837f5060

/data/data/com.whateverwhatever/kl.txt

MD5 5ca6ae94f9a015a712efddbd1f7e8bcd
SHA1 eac52b8a5bf0c63b974ad412815b195caf32a704
SHA256 094666a0814433775d163cb64fe3de75cd2385f27a9fbb4d14a0c2b145f2f9be
SHA512 71a5a5fb9e51be71a213d6acebb423cd9cf686faca21d97e78e1ee35e88c01267cc367adbd36c6798da925c2f3e1ad10c6804e337ac071abd49dc3402148b474

/data/data/com.whateverwhatever/kl.txt

MD5 4953703d8447725b0a9ff1d7badfca2f
SHA1 b10597fd6ccdbf0d422ab0f17c3b78433daf0535
SHA256 68bf3bfb56fc7cc7f3449b7759520d00b2ebe4338ff95f7f8b2872b463ecc9ca
SHA512 5048e350081cfe75610052767af1357b29c6693ae4c0133a87c1711250916f3ca8ed0a3f37366fdf9a25c1ec2c2bd4e80d648c8d5c5e96a63610a51fa38de9b6

/data/data/com.whateverwhatever/cache/oat/ntygrhadjbuptz.cur.prof

MD5 aca60e2d72152c7550f1f18b139d43ef
SHA1 8b6fe27ce6af0b77f90ab90720fe14466ef2ee98
SHA256 c7c60034a67b6d004bf605f59ee609dd6d830b034337c8cfce43648f5bb8279b
SHA512 63e0e32f60e367e7bb5c1468d70ec5eef639e3f36f54d4aecd024a702e62a8fd3c1c55b4cc10e19df2bcbf7a8f4e3eb307081aee3b0f028fa6acfc9ae096ae05

Analysis: behavioral2

Detonation Overview

Submitted

2024-05-28 22:00

Reported

2024-05-28 22:04

Platform

android-x64-arm64-20240514-en

Max time kernel

179s

Max time network

187s

Command Line

com.whateverwhatever

Signatures

Octo

banker trojan infostealer rat octo

Octo payload

Description Indicator Process Target
N/A N/A N/A N/A

Makes use of the framework's Accessibility service

collection evasion credential_access
Description Indicator Process Target
Framework service call android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId N/A N/A
Framework service call android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByViewId N/A N/A

Prevents application removal

evasion
Description Indicator Process Target
Framework service call android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction N/A N/A

Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps)

banker discovery

Requests accessing notifications (often used to intercept notifications before users become aware).

collection credential_access
Description Indicator Process Target
Intent action android.settings.ACTION_NOTIFICATION_LISTENER_SETTINGS N/A N/A

Requests modifying system settings.

evasion
Description Indicator Process Target
Intent action android.settings.action.MANAGE_WRITE_SETTINGS N/A N/A

Checks CPU information

evasion discovery
Description Indicator Process Target
File opened for read /proc/cpuinfo N/A N/A

Checks memory information

evasion discovery
Description Indicator Process Target
File opened for read /proc/meminfo N/A N/A

Loads dropped Dex/Jar

evasion
Description Indicator Process Target
N/A /data/user/0/com.whateverwhatever/cache/ntygrhadjbuptz N/A N/A
N/A /data/user/0/com.whateverwhatever/cache/ntygrhadjbuptz N/A N/A

Makes use of the framework's foreground persistence service

evasion persistence
Description Indicator Process Target
Framework service call android.app.IActivityManager.setServiceForeground N/A N/A

Obtains sensitive information copied to the device clipboard

collection credential_access impact
Description Indicator Process Target
Framework service call android.content.IClipboard.addPrimaryClipChangedListener N/A N/A

Queries the mobile country code (MCC)

discovery
Description Indicator Process Target
Framework service call com.android.internal.telephony.ITelephony.getNetworkCountryIsoForPhone N/A N/A

Queries the phone number (MSISDN for GSM devices)

discovery

Acquires the wake lock

Description Indicator Process Target
Framework service call android.os.IPowerManager.acquireWakeLock N/A N/A

Reads information about phone network operator.

discovery

Requests disabling of battery optimizations (often used to enable hiding in the background).

evasion
Description Indicator Process Target
Intent action android.settings.REQUEST_IGNORE_BATTERY_OPTIMIZATIONS N/A N/A

Uses Crypto APIs (Might try to encrypt user data)

impact
Description Indicator Process Target
Framework API call javax.crypto.Cipher.doFinal N/A N/A

Processes

com.whateverwhatever

Network

Country Destination Domain Proto
N/A 224.0.0.251:5353 udp
GB 142.250.178.14:443 tcp
US 1.1.1.1:53 android.apis.google.com udp
GB 142.250.178.14:443 android.apis.google.com tcp
US 1.1.1.1:53 ssl.google-analytics.com udp
GB 142.250.179.232:443 ssl.google-analytics.com tcp
SY 94.232.249.36:443 94.232.249.36 tcp
US 1.1.1.1:53 www.ip-api.com udp
US 208.95.112.1:80 www.ip-api.com tcp
US 1.1.1.1:53 89divos.tech udp
US 1.1.1.1:53 89divos.shop udp
US 1.1.1.1:53 89divos.art udp
SY 94.232.249.36:443 94.232.249.36 tcp
SY 94.232.249.36:443 94.232.249.36 tcp
SY 94.232.249.36:443 94.232.249.36 tcp
SY 94.232.249.36:443 94.232.249.36 tcp
SY 94.232.249.36:443 94.232.249.36 tcp
SY 94.232.249.36:443 94.232.249.36 tcp
SY 94.232.249.36:443 94.232.249.36 tcp
SY 94.232.249.36:443 94.232.249.36 tcp
SY 94.232.249.36:443 94.232.249.36 tcp
SY 94.232.249.36:443 94.232.249.36 tcp
GB 142.250.178.4:443 tcp
GB 142.250.178.4:443 tcp
SY 94.232.249.36:443 94.232.249.36 tcp
SY 94.232.249.36:443 94.232.249.36 tcp
SY 94.232.249.36:443 94.232.249.36 tcp
SY 94.232.249.36:443 94.232.249.36 tcp
SY 94.232.249.36:443 94.232.249.36 tcp
SY 94.232.249.36:443 94.232.249.36 tcp
SY 94.232.249.36:443 94.232.249.36 tcp
SY 94.232.249.36:443 94.232.249.36 tcp
SY 94.232.249.36:443 94.232.249.36 tcp
SY 94.232.249.36:443 94.232.249.36 tcp
SY 94.232.249.36:443 94.232.249.36 tcp
SY 94.232.249.36:443 94.232.249.36 tcp
SY 94.232.249.36:443 94.232.249.36 tcp
SY 94.232.249.36:443 94.232.249.36 tcp
SY 94.232.249.36:443 94.232.249.36 tcp
SY 94.232.249.36:443 94.232.249.36 tcp
SY 94.232.249.36:443 94.232.249.36 tcp
SY 94.232.249.36:443 94.232.249.36 tcp
SY 94.232.249.36:443 94.232.249.36 tcp
SY 94.232.249.36:443 94.232.249.36 tcp
SY 94.232.249.36:443 94.232.249.36 tcp
SY 94.232.249.36:443 94.232.249.36 tcp
SY 94.232.249.36:443 94.232.249.36 tcp
SY 94.232.249.36:443 94.232.249.36 tcp
SY 94.232.249.36:443 94.232.249.36 tcp
SY 94.232.249.36:443 94.232.249.36 tcp
SY 94.232.249.36:443 94.232.249.36 tcp
SY 94.232.249.36:443 94.232.249.36 tcp
SY 94.232.249.36:443 94.232.249.36 tcp
SY 94.232.249.36:443 94.232.249.36 tcp
SY 94.232.249.36:443 94.232.249.36 tcp
SY 94.232.249.36:443 tcp

Files

/data/user/0/com.whateverwhatever/cache/ntygrhadjbuptz

MD5 65cb593886751d7394957a9da951aaf8
SHA1 64eedc22cbde9f912d227744f9ebe6b8e6f638f8
SHA256 8a6242f184ede2ac58585af93dc550c4b7a824570bc881222afa5071fb50d4bf
SHA512 13ab53b5c34be5e6a0aa93ee6d8761d8797d1626a9005c2ede2e23547daec56a58902e8e87e13ae7e4540618abbff5857233c7bfdc0601aeeabe263fc46e3766

/data/user/0/com.whateverwhatever/kl.txt

MD5 6311c3fd15588bb5c126e6c28ff5fffe
SHA1 ce81d136fce31779f4dd62e20bdaf99c91e2fc57
SHA256 8b82f6032e29a2b5c96031a3630fb6173d12ff0295bc20bb21b877d08f0812d8
SHA512 2975fe2e94b6a8adc9cfc1a865ad113772b54572883a537b02a16dd2d029c0f7d9cca3b154fd849bdfe978e18b396bcf9fa6e67e7c61f92bdc089a29a9c355c6

/data/user/0/com.whateverwhatever/kl.txt

MD5 da88236c888f6e9b1424bfd7bd570ba8
SHA1 64329dce7024897193415517f9954ee40e09c16d
SHA256 d78029b486c91961b25143da2aa5fd464e8de1369727a9b521660db073a455f9
SHA512 22a0e4260d4badfa9765f0a5825bbc703037a5b58f43f60b57f9d71175c640d914e1e0465e1e09565b2791d9c9ef99913f4389a751461f6c65d08405eac3398f

/data/user/0/com.whateverwhatever/kl.txt

MD5 30203167a30b41318383750bf328e43d
SHA1 5cf9baa5c8aa75e41d5b93a6dbadbc652a185071
SHA256 7289a152185f214397299479c2625d6588d87aad597986ba34f6cebc22c1d816
SHA512 c3c526e9680053ff5f04108b52e021b4e0371d1d9c45e7cc5227564eb8672ece91a51103123cd87a6577ee0d947fb2c229d45fffabf035843df18c8693f66919

/data/user/0/com.whateverwhatever/kl.txt

MD5 d0ca935dbc3eb52b07a4a8a6724260aa
SHA1 c6a2d84187faf5eb400d3983adf4dbf9113aedde
SHA256 96ccc5127f78541862d18355b1c606c0b9ba36eba085a09eaea53efaf50269c2
SHA512 bc43dc134a09cd98582e34f3c35b406828cdc02982038db5d9bb54d782db405983d54291138a04beb1fbcc5432dbf55302097d875c35dc526797425cfd91f981

/data/user/0/com.whateverwhatever/kl.txt

MD5 bfe22531527ac7e3caf76d67136933d8
SHA1 75ae6b8248dff764829d1d148d0ad39dfae164eb
SHA256 d937892a87c7532934477931f63a3ea459946ba0205d3aeb270319d935e5f75e
SHA512 2c5d54be5d8d7e099610e51fbb509d784a7cd21309e9f673f6d8bbd2f232e34aa387f67fba0387380c665c82cafdf148b57ac7a4087b5f7f49527b65bae60620

/data/user/0/com.whateverwhatever/cache/oat/ntygrhadjbuptz.cur.prof

MD5 b4433dce4ad1ef58f622d67702448941
SHA1 f06abc8ed949e6732a7babd1990ed48156b6ac86
SHA256 6ecc81ecef1e1071978029d78235094c9b690c9a9bc47378ccbb8da3a5e6addf
SHA512 a696bed2c18b0ff36109b6b04f257b067e8407cffa0c87d8537253d42bb460907a9e0431412175014b6106d6211e85da52e3ffb9dc4197cc4e2dc4260d4e690e