Malware Analysis Report

2024-07-28 11:40

Sample ID 240618-2k8dlsybjb
Target 3b6fcda59424915b2da305a84afecd469016ebddf0cde2c6d81d18e89c9eb89c.bin
SHA256 3b6fcda59424915b2da305a84afecd469016ebddf0cde2c6d81d18e89c9eb89c
Tags
octo banker collection credential_access discovery evasion impact infostealer persistence rat trojan stealth
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK Matrix

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

3b6fcda59424915b2da305a84afecd469016ebddf0cde2c6d81d18e89c9eb89c

Threat Level: Known bad

The file 3b6fcda59424915b2da305a84afecd469016ebddf0cde2c6d81d18e89c9eb89c.bin was found to be: Known bad.

Malicious Activity Summary

octo banker collection credential_access discovery evasion impact infostealer persistence rat trojan stealth

Octo payload

Octo

Removes its main activity from the application launcher

Loads dropped Dex/Jar

Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps)

Queries the phone number (MSISDN for GSM devices)

Makes use of the framework's Accessibility service

Requests disabling of battery optimizations (often used to enable hiding in the background).

Declares broadcast receivers with permission to handle system events

Queries the unique device ID (IMEI, MEID, IMSI)

Queries the mobile country code (MCC)

Reads information about phone network operator.

Requests dangerous framework permissions

Requests modifying system settings.

Declares services with permission to bind to the system

Requests accessing notifications (often used to intercept notifications before users become aware).

Acquires the wake lock

Makes use of the framework's foreground persistence service

Performs UI accessibility actions on behalf of the user

Uses Crypto APIs (Might try to encrypt user data)

Registers a broadcast receiver at runtime (usually for listening for system events)

MITRE ATT&CK Matrix

N/A

Analysis: static1

Detonation Overview

Reported

2024-06-18 22:39

Signatures

Declares broadcast receivers with permission to handle system events

Description Indicator Process Target
Required by device admin receivers to bind with the system. Allows apps to manage device administration features. android.permission.BIND_DEVICE_ADMIN N/A N/A

Declares services with permission to bind to the system

Description Indicator Process Target
Required by accessibility services to bind with the system. Allows apps to access accessibility features. android.permission.BIND_ACCESSIBILITY_SERVICE N/A N/A
Required by notification listener services to bind with the system. Allows apps to listen to and interact with notifications on the device. android.permission.BIND_NOTIFICATION_LISTENER_SERVICE N/A N/A

Requests dangerous framework permissions

Description Indicator Process Target
Allows an application to write to external storage. android.permission.WRITE_EXTERNAL_STORAGE N/A N/A
Allows an application to read from external storage. android.permission.READ_EXTERNAL_STORAGE N/A N/A
Allows an application to receive SMS messages. android.permission.RECEIVE_SMS N/A N/A
Allows an application to read SMS messages. android.permission.READ_SMS N/A N/A
Allows an application to send SMS messages. android.permission.SEND_SMS N/A N/A
Allows an application to initiate a phone call without going through the Dialer user interface for the user to confirm the call. android.permission.CALL_PHONE N/A N/A
Allows an application to read or write the system settings. android.permission.WRITE_SETTINGS N/A N/A
Allows read only access to phone state, including the current cellular network information, the status of any ongoing calls, and a list of any PhoneAccounts registered on the device. android.permission.READ_PHONE_STATE N/A N/A

Analysis: behavioral2

Detonation Overview

Submitted

2024-06-18 22:39

Reported

2024-06-18 22:42

Platform

android-33-x64-arm64-20240611.1-en

Max time kernel

179s

Max time network

180s

Command Line

com.fewyear48

Signatures

Octo

banker trojan infostealer rat octo

Octo payload

Description Indicator Process Target
N/A N/A N/A N/A

Loads dropped Dex/Jar

evasion
Description Indicator Process Target
N/A /data/user/0/com.fewyear48/cache/obwsjayadc N/A N/A

Makes use of the framework's Accessibility service

collection evasion credential_access
Description Indicator Process Target
Framework service call android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId N/A N/A
Framework service call android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByViewId N/A N/A

Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps)

banker discovery

Queries the phone number (MSISDN for GSM devices)

discovery

Acquires the wake lock

Description Indicator Process Target
Framework service call android.os.IPowerManager.acquireWakeLock N/A N/A

Makes use of the framework's foreground persistence service

evasion persistence
Description Indicator Process Target
Framework service call android.app.IActivityManager.setServiceForeground N/A N/A

Performs UI accessibility actions on behalf of the user

evasion
Description Indicator Process Target
N/A android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction N/A N/A
N/A android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction N/A N/A
N/A android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction N/A N/A
N/A android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction N/A N/A

Queries the mobile country code (MCC)

discovery
Description Indicator Process Target
Framework service call com.android.internal.telephony.ITelephony.getNetworkCountryIsoForPhone N/A N/A

Reads information about phone network operator.

discovery

Requests accessing notifications (often used to intercept notifications before users become aware).

collection credential_access
Description Indicator Process Target
Intent action android.settings.ACTION_NOTIFICATION_LISTENER_SETTINGS N/A N/A

Requests disabling of battery optimizations (often used to enable hiding in the background).

evasion
Description Indicator Process Target
Intent action android.settings.REQUEST_IGNORE_BATTERY_OPTIMIZATIONS N/A N/A

Requests modifying system settings.

evasion
Description Indicator Process Target
Intent action android.settings.action.MANAGE_WRITE_SETTINGS N/A N/A

Uses Crypto APIs (Might try to encrypt user data)

impact
Description Indicator Process Target
Framework API call javax.crypto.Cipher.doFinal N/A N/A

Processes

com.fewyear48

Network

Country Destination Domain Proto
GB 172.217.16.228:443 udp
GB 172.217.16.228:443 tcp
GB 216.58.212.196:443 tcp
N/A 224.0.0.251:5353 udp
US 1.1.1.1:53 lalagkcvagurcuuuu.com udp
US 1.1.1.1:53 cruelgurcistandaaaa42.com udp
US 1.1.1.1:53 cruelveblack32.com udp
US 1.1.1.1:53 gurcistancruell33.com udp
US 1.1.1.1:53 biricruelidurdursunloo.com udp
US 1.1.1.1:53 biricruelidurdursunn.com udp
GB 142.250.187.206:443 tcp
US 1.1.1.1:53 android.apis.google.com udp
GB 142.250.187.206:443 android.apis.google.com tcp
US 1.1.1.1:53 remoteprovisioning.googleapis.com udp
GB 172.217.169.10:443 remoteprovisioning.googleapis.com tcp
GB 172.217.16.228:443 udp
GB 142.250.179.228:443 udp
GB 142.250.179.228:443 tcp
GB 142.250.179.228:443 tcp
US 162.159.61.3:443 tcp
US 162.159.61.3:443 tcp
GB 216.58.212.227:443 tcp
US 162.159.61.3:443 udp
GB 216.58.212.227:443 udp
GB 142.250.187.206:443 android.apis.google.com tcp

Files

/data/data/com.fewyear48/cache/obwsjayadc

MD5 7726936dd73fd16ed45cefe88e9c0260
SHA1 2e0a0679bece4a9ce0b8021573051303e1ea4602
SHA256 92c11ce81b987ae90e256331257e8926a8cc0bc596304f05a79c94bccd4436ba
SHA512 a055cb33b13e789b397b4ff4616d24e80f11c5241f43bdd02868777d3ed020a1467c0b30517b8b7513fad06f881074ba516e4829e232b3b23a9b88a485e151bb

/data/data/com.fewyear48/cache/oat/obwsjayadc.cur.prof

MD5 d80d66c724992c6faae77a70a9acb73d
SHA1 2e943d8cad917088ccf9595ccebe1e47303d26b0
SHA256 bf3d75ac24ad6b1d1c21670a77f26650f5fbba745d35a9b311230aa4c06ca4cc
SHA512 f925649620843336ebdd92a5b7f656abe27916591ed13a65836f786f1dc1265a4316c6864e510dfae2235937b67359b9c898bf13ca3816c3f283982fe49f794c

Analysis: behavioral1

Detonation Overview

Submitted

2024-06-18 22:39

Reported

2024-06-18 22:42

Platform

android-x86-arm-20240611.1-en

Max time kernel

178s

Max time network

157s

Command Line

com.fewyear48

Signatures

Octo

banker trojan infostealer rat octo

Octo payload

Description Indicator Process Target
N/A N/A N/A N/A

Removes its main activity from the application launcher

stealth trojan evasion
Description Indicator Process Target
N/A N/A N/A N/A

Loads dropped Dex/Jar

evasion
Description Indicator Process Target
N/A /data/user/0/com.fewyear48/cache/obwsjayadc N/A N/A
N/A /data/user/0/com.fewyear48/cache/obwsjayadc N/A N/A

Makes use of the framework's Accessibility service

collection evasion credential_access
Description Indicator Process Target
Framework service call android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId N/A N/A
Framework service call android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByViewId N/A N/A

Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps)

banker discovery

Queries the phone number (MSISDN for GSM devices)

discovery

Acquires the wake lock

Description Indicator Process Target
Framework service call android.os.IPowerManager.acquireWakeLock N/A N/A

Makes use of the framework's foreground persistence service

evasion persistence
Description Indicator Process Target
Framework service call android.app.IActivityManager.setServiceForeground N/A N/A

Performs UI accessibility actions on behalf of the user

evasion
Description Indicator Process Target
N/A android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction N/A N/A
N/A android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction N/A N/A
N/A android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction N/A N/A
N/A android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction N/A N/A

Queries the mobile country code (MCC)

discovery
Description Indicator Process Target
Framework service call com.android.internal.telephony.ITelephony.getNetworkCountryIsoForPhone N/A N/A

Queries the unique device ID (IMEI, MEID, IMSI)

discovery

Reads information about phone network operator.

discovery

Requests accessing notifications (often used to intercept notifications before users become aware).

collection credential_access
Description Indicator Process Target
Intent action android.settings.ACTION_NOTIFICATION_LISTENER_SETTINGS N/A N/A

Requests disabling of battery optimizations (often used to enable hiding in the background).

evasion
Description Indicator Process Target
Intent action android.settings.REQUEST_IGNORE_BATTERY_OPTIMIZATIONS N/A N/A

Requests modifying system settings.

evasion
Description Indicator Process Target
Intent action android.settings.action.MANAGE_WRITE_SETTINGS N/A N/A

Registers a broadcast receiver at runtime (usually for listening for system events)

persistence
Description Indicator Process Target
Framework service call android.app.IActivityManager.registerReceiver N/A N/A

Uses Crypto APIs (Might try to encrypt user data)

impact
Description Indicator Process Target
Framework API call javax.crypto.Cipher.doFinal N/A N/A

Processes

com.fewyear48

Network

Country Destination Domain Proto
N/A 224.0.0.251:5353 udp
US 1.1.1.1:53 cruelveblack32.com udp
US 1.1.1.1:53 biricruelidurdursunloo.com udp
US 1.1.1.1:53 gurcistancruell33.com udp
US 1.1.1.1:53 cruelgurcistandaaaa42.com udp
US 1.1.1.1:53 lalagkcvagurcuuuu.com udp
US 1.1.1.1:53 biricruelidurdursunn.com udp
GB 142.250.187.238:443 tcp
US 1.1.1.1:53 android.apis.google.com udp
GB 142.250.200.46:443 android.apis.google.com tcp
US 1.1.1.1:53 semanticlocation-pa.googleapis.com udp

Files

/data/data/com.fewyear48/cache/obwsjayadc

MD5 7726936dd73fd16ed45cefe88e9c0260
SHA1 2e0a0679bece4a9ce0b8021573051303e1ea4602
SHA256 92c11ce81b987ae90e256331257e8926a8cc0bc596304f05a79c94bccd4436ba
SHA512 a055cb33b13e789b397b4ff4616d24e80f11c5241f43bdd02868777d3ed020a1467c0b30517b8b7513fad06f881074ba516e4829e232b3b23a9b88a485e151bb

/data/data/com.fewyear48/cache/oat/obwsjayadc.cur.prof

MD5 c899f17d815888e0265ec26e443aeeb5
SHA1 5e20d3df50e6cd6bc7c4b51edd12d0a0e0b4cb99
SHA256 a95db72fb6caf4dfefab1e3c2a949431e63fd2aca0598895fa524af781072501
SHA512 be2fa52bd7402c041f2dddc0ffe7a0388ad04277e5c5040c31a6d013a370610853f5f5779ef152d6829ac4685b5eeebf40d3d6064d200aa46019ebadd81640eb