octo | dd2a5a043f234d30b485fdc6d4a297d07c640f4f7e2bd6b31707b7cee1f3825f

Analysis

max time kernel
179s
max time network
132s
platform
android_x64
resource
android-x64-arm64-20240514-en
resource tags

androidarch:armarch:arm64arch:x64arch:x86image:android-x64-arm64-20240514-enlocale:en-usos:android-11-x64system
submitted
29-05-2024 21:14

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

dd2a5a043f234d30b485fdc6d4a297d07c640f4f7e2bd6b31707b7cee1f3825f.apk
Size

541KB
MD5

69bbaa343457f36b54e0381ad1cec22f
SHA1

f2cd9031baf7f18db90ef2415f433dc4ed833bac
SHA256

dd2a5a043f234d30b485fdc6d4a297d07c640f4f7e2bd6b31707b7cee1f3825f
SHA512

1f8f360c37e2d1302f1df134427f052f4e7007ac4f8e88235176d3b738c2ca5c3da9a8bc70edfaf928f040c4b30f9313425c91e78be940d908086467d3a96cb3
SSDEEP

12288:7vCNEGRqYMECw5ha5H+HyYUFoUhCrlJNbf6gby16B1M:G7LMECUhpHDUCDJN7TQ6s

Score

10^/10

octo banker collection credential_access discovery evasion impact infostealer persistence rat trojan

Malware Config

Extracted

Family

octo

https://adile56tasarim.com/ZDQ5M2JhM2ZkZTkx/

https://6adiletasarim.com/ZDQ5M2JhM2ZkZTkx/

https://7adiletasarim.com/ZDQ5M2JhM2ZkZTkx/

https://8adiletasarim.com/ZDQ5M2JhM2ZkZTkx/

https://9adiletasarim.com/ZDQ5M2JhM2ZkZTkx/

AES_key

Signatures

Octo
Octo is a banking malware with remote access capabilities first seen in April 2022.
banker trojan infostealer rat octo

Octo payload 1 IoCs

Processes:

resource	yara_rule
/data/user/0/com.hadrightbqaj/cache/jpwuwyc	family_octo

Makes use of the framework's Accessibility service 4 TTPs 2 IoCs

Retrieves information displayed on the phone screen using AccessibilityService.

collection evasion credential_access

Input Injection

T1516

Screen Capture

T1513

Keylogging

T1417.001

GUI Input Capture

T1417.002

Processes:

com.hadrightbqaj

description	ioc	process
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId	com.hadrightbqaj
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByViewId	com.hadrightbqaj

Prevents application removal 1 TTPs 1 IoCs
Application may abuse the framework's APIs to prevent removal.
evasion

Prevent Application Removal
T1629.001

Processes:

com.hadrightbqaj

description ioc process

Framework service call android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction com.hadrightbqaj
Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
banker discovery

Security Software Discovery
T1418.001
Requests accessing notifications (often used to intercept notifications before users become aware). 1 TTPs 1 IoCs
collection credential_access

Access Notifications
T1517

Processes:

com.hadrightbqaj

description ioc process

Intent action android.settings.ACTION_NOTIFICATION_LISTENER_SETTINGS com.hadrightbqaj
Requests modifying system settings. 1 IoCs
evasion

Processes:

com.hadrightbqaj

description ioc process

Intent action android.settings.action.MANAGE_WRITE_SETTINGS com.hadrightbqaj
Checks CPU information 2 TTPs 1 IoCs
Checks CPU information which indicate if the system is an emulator.
evasion discovery

System Checks
T1633.001

System Information Discovery
T1426

Processes:

com.hadrightbqaj

description ioc process

File opened for read /proc/cpuinfo com.hadrightbqaj
Checks memory information 2 TTPs 1 IoCs
Checks memory information which indicate if the system is an emulator.
evasion discovery

System Checks
T1633.001

System Information Discovery
T1426

Processes:

com.hadrightbqaj

description ioc process

File opened for read /proc/meminfo com.hadrightbqaj
Loads dropped Dex/Jar 1 TTPs 2 IoCs
Runs executable file dropped to the device during analysis.
evasion

Download New Code at Runtime
T1407

Processes:

com.hadrightbqaj

ioc pid process

/data/user/0/com.hadrightbqaj/cache/jpwuwyc 4619 com.hadrightbqaj
/data/user/0/com.hadrightbqaj/cache/jpwuwyc 4619 com.hadrightbqaj
Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs
Application may abuse the framework's foreground service to continue running in the foreground.
evasion persistence

Foreground Persistence
T1541

Processes:

com.hadrightbqaj

description ioc process

Framework service call android.app.IActivityManager.setServiceForeground com.hadrightbqaj
Obtains sensitive information copied to the device clipboard 2 TTPs 1 IoCs
Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.
collection credential_access impact

Clipboard Data
T1414

Transmitted Data Manipulation
T1641.001

Processes:

com.hadrightbqaj

description ioc process

Framework service call android.content.IClipboard.addPrimaryClipChangedListener com.hadrightbqaj
Queries the mobile country code (MCC) 1 TTPs 1 IoCs
discovery

System Network Configuration Discovery
T1422

Processes:

com.hadrightbqaj

description ioc process

Framework service call com.android.internal.telephony.ITelephony.getNetworkCountryIsoForPhone com.hadrightbqaj
Queries the phone number (MSISDN for GSM devices) 1 TTPs
discovery

System Network Configuration Discovery
T1422
Acquires the wake lock 1 IoCs

Processes:

com.hadrightbqaj

description ioc process

Framework service call android.os.IPowerManager.acquireWakeLock com.hadrightbqaj
Reads information about phone network operator. 1 TTPs
discovery

System Network Configuration Discovery
T1422
Requests disabling of battery optimizations (often used to enable hiding in the background). 1 TTPs 1 IoCs
evasion

User Evasion
T1628.002

Processes:

com.hadrightbqaj

description ioc process

Intent action android.settings.REQUEST_IGNORE_BATTERY_OPTIMIZATIONS com.hadrightbqaj
Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs
impact

Data Encrypted for Impact
T1471

Processes:

com.hadrightbqaj

description ioc process

Framework API call javax.crypto.Cipher.doFinal com.hadrightbqaj

description	ioc	process
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction	com.hadrightbqaj

description	ioc	process
Intent action	android.settings.ACTION_NOTIFICATION_LISTENER_SETTINGS	com.hadrightbqaj

description	ioc	process
Intent action	android.settings.action.MANAGE_WRITE_SETTINGS	com.hadrightbqaj

description	ioc	process
File opened for read	/proc/cpuinfo	com.hadrightbqaj

description	ioc	process
File opened for read	/proc/meminfo	com.hadrightbqaj

ioc	pid	process
/data/user/0/com.hadrightbqaj/cache/jpwuwyc	4619	com.hadrightbqaj
/data/user/0/com.hadrightbqaj/cache/jpwuwyc	4619	com.hadrightbqaj

description	ioc	process
Framework service call	android.app.IActivityManager.setServiceForeground	com.hadrightbqaj

description	ioc	process
Framework service call	android.content.IClipboard.addPrimaryClipChangedListener	com.hadrightbqaj

description	ioc	process
Framework service call	com.android.internal.telephony.ITelephony.getNetworkCountryIsoForPhone	com.hadrightbqaj

description	ioc	process
Framework service call	android.os.IPowerManager.acquireWakeLock	com.hadrightbqaj

description	ioc	process
Intent action	android.settings.REQUEST_IGNORE_BATTERY_OPTIMIZATIONS	com.hadrightbqaj

description	ioc	process
Framework API call	javax.crypto.Cipher.doFinal	com.hadrightbqaj

com.hadrightbqaj
1⤵
- Makes use of the framework's Accessibility service
- Prevents application removal
- Requests accessing notifications (often used to intercept notifications before users become aware).
- Requests modifying system settings.
- Checks CPU information
- Checks memory information
- Loads dropped Dex/Jar
- Makes use of the framework's foreground persistence service
- Obtains sensitive information copied to the device clipboard
- Queries the mobile country code (MCC)
- Acquires the wake lock
- Requests disabling of battery optimizations (often used to enable hiding in the background).
- Uses Crypto APIs (Might try to encrypt user data)
PID:4619

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Foreground Persistence

T1541

Privilege Escalation

Defense Evasion

Download New Code at Runtime

T1407

Foreground Persistence

T1541

Hide Artifacts

T1628

User Evasion

T1628.002

Impair Defenses

T1629

Prevent Application Removal

T1629.001

Input Injection

T1516

Virtualization/Sandbox Evasion

T1633

System Checks

T1633.001

Credential Access

Access Notifications

T1517

Clipboard Data

T1414

Input Capture

T1417

GUI Input Capture

T1417.002

Keylogging

T1417.001

Discovery

Software Discovery

T1418

Security Software Discovery

T1418.001

System Information Discovery

T1426

System Network Configuration Discovery

T1422

Lateral Movement

Collection

Access Notifications

T1517

Clipboard Data

T1414

Input Capture

T1417

GUI Input Capture

T1417.002

Keylogging

T1417.001

Screen Capture

T1513

Command and Control

Exfiltration

Impact

Data Encrypted for Impact

T1471

Data Manipulation

T1641

Transmitted Data Manipulation

T1641.001

Input Injection

T1516

Replay Monitor

Loading Replay Monitor...

Downloads

/data/user/0/com.hadrightbqaj/cache/jpwuwyc
Filesize
449KB

MD5
afe4ad1d723273c6a55d7357c7862184

SHA1
53636753c24d0e8a7553897b28dcbd1a766e6fac

SHA256
4be693241f3d19603717f391f36861abe86e0e4cca87aed74a9983a6048b8d75

SHA512
62a0b83b1d4da77991a3b9a4e1e43800629574f674f336b292e45e4cf42e3c97120ad6cbe16b75a5b26ab0d26d0fcb23e89e61ac137075edd9000d86581fd30f

Download Submit
/data/user/0/com.hadrightbqaj/cache/oat/jpwuwyc.cur.prof
Filesize
316B

MD5
c891a9863a0304894da8fc3398bffd6f

SHA1
ca25ed6c1213ffe5a6854a9fefc07a6d194541ca

SHA256
fa02dde732102a491a27f388364a5c614a289f86418b2eca3aa1b298548e78dc

SHA512
689c53b755150b9b8ea9ea36ad5f664cfa49b70dff546a536a46dce96c03074809fd33f292349c76a12bc6859b256160e8195a420b927c327051f0da9cd26b91

Download Submit
/data/user/0/com.hadrightbqaj/kl.txt
Filesize
28B

MD5
6311c3fd15588bb5c126e6c28ff5fffe

SHA1
ce81d136fce31779f4dd62e20bdaf99c91e2fc57

SHA256
8b82f6032e29a2b5c96031a3630fb6173d12ff0295bc20bb21b877d08f0812d8

SHA512
2975fe2e94b6a8adc9cfc1a865ad113772b54572883a537b02a16dd2d029c0f7d9cca3b154fd849bdfe978e18b396bcf9fa6e67e7c61f92bdc089a29a9c355c6

Download Submit
/data/user/0/com.hadrightbqaj/kl.txt
Filesize
235B

MD5
10b0340a899d38c085b3e1a0aa12f9e7

SHA1
4d05a78581884b35a1696d77bbdc72a885135383

SHA256
d10abe72e0dbe64065bb5d17fe6b7da9c0b063b6acda9657cabf9dc57772b73f

SHA512
2780a31584fb2ed6f1798346ba87d18f828bfc250d2445f1a7132ef08da66a3b62cf68bfb2cdc4fd9d109a8f98ecb4dc350ea744c0250d376d2d63d07038fa45

Download Submit
/data/user/0/com.hadrightbqaj/kl.txt
Filesize
70B

MD5
bd531b22885c1da31422ee480108528c

SHA1
7be340c338df17c56be53b4fa4eb718e8e3921bc

SHA256
3a67cc9282d2dfa36d3a4aa43c54c4f3fa6b8400278dc0bec456a52cefa73cba

SHA512
5002c1ae075b1502d8fe21797fb77a7e7c6062ceb64d34bb546926c07ea7d4efeeb4bcd5a7ce1d39c8f7e6ec9f0814986003867c2fb1fb30927c6df83ee7a2f2

Download Submit
/data/user/0/com.hadrightbqaj/kl.txt
Filesize
45B

MD5
1b6d7415cc11f54c81e0497b2bceaaa2

SHA1
7ceb15e40b69a5e0e7306c28f3790d0ca3ca7224

SHA256
613357785f5e5ecf3e03e4ceb8da523fe8ca159cb3f1431514142864e44154a1

SHA512
3afb97dae06871e43c5d01ee7c8fca046ce028359d8fd4dc6cbbb57056fd33ca7c3b215928c39eb32056d59f102cf7de58707555db10a1a4f6d66b8082fc373a

Download Submit
/data/user/0/com.hadrightbqaj/kl.txt
Filesize
84B

MD5
fdc67fd98356765833c4869cf568bf13

SHA1
dbd9ac2430097ba262dc0aa134848ad593b8ba8f

SHA256
e62bc698dc909430caa06292f018c661c13aa2c4818d1ede3cd20b26dc605350

SHA512
42e2e314d7a14e12a6f754a4ff66c598d7a7c7717eb5929a1b368d4adcb71a56ca237c6bebac40ea54325e611e22c27db4bf62eb15263ed2f2b7eff735162ee1

Download Submit