Malware Analysis Report

2024-07-28 11:40

Sample ID 240618-3tfwdszamh
Target 551d67c97f39de191973cae82750e2709383dac87c020f23e5265b2bd4805413.bin
SHA256 551d67c97f39de191973cae82750e2709383dac87c020f23e5265b2bd4805413
Tags
octo banker collection credential_access discovery evasion impact infostealer persistence rat stealth trojan
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK Matrix

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

551d67c97f39de191973cae82750e2709383dac87c020f23e5265b2bd4805413

Threat Level: Known bad

The file 551d67c97f39de191973cae82750e2709383dac87c020f23e5265b2bd4805413.bin was found to be: Known bad.

Malicious Activity Summary

octo banker collection credential_access discovery evasion impact infostealer persistence rat stealth trojan

Octo

Octo payload

Removes its main activity from the application launcher

Queries the phone number (MSISDN for GSM devices)

Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps)

Makes use of the framework's Accessibility service

Loads dropped Dex/Jar

Queries the unique device ID (IMEI, MEID, IMSI)

Declares broadcast receivers with permission to handle system events

Requests disabling of battery optimizations (often used to enable hiding in the background).

Declares services with permission to bind to the system

Reads information about phone network operator.

Requests accessing notifications (often used to intercept notifications before users become aware).

Requests dangerous framework permissions

Acquires the wake lock

Makes use of the framework's foreground persistence service

Performs UI accessibility actions on behalf of the user

Queries the mobile country code (MCC)

Uses Crypto APIs (Might try to encrypt user data)

Registers a broadcast receiver at runtime (usually for listening for system events)

MITRE ATT&CK Matrix

N/A

Analysis: static1

Detonation Overview

Reported

2024-06-18 23:48

Signatures

Declares broadcast receivers with permission to handle system events

Description Indicator Process Target
Required by device admin receivers to bind with the system. Allows apps to manage device administration features. android.permission.BIND_DEVICE_ADMIN N/A N/A

Declares services with permission to bind to the system

Description Indicator Process Target
Required by accessibility services to bind with the system. Allows apps to access accessibility features. android.permission.BIND_ACCESSIBILITY_SERVICE N/A N/A
Required by notification listener services to bind with the system. Allows apps to listen to and interact with notifications on the device. android.permission.BIND_NOTIFICATION_LISTENER_SERVICE N/A N/A

Requests dangerous framework permissions

Description Indicator Process Target
Allows an application to write to external storage. android.permission.WRITE_EXTERNAL_STORAGE N/A N/A
Allows an application to read from external storage. android.permission.READ_EXTERNAL_STORAGE N/A N/A
Allows an application to receive SMS messages. android.permission.RECEIVE_SMS N/A N/A
Allows an application to read SMS messages. android.permission.READ_SMS N/A N/A
Allows an application to send SMS messages. android.permission.SEND_SMS N/A N/A
Allows an application to initiate a phone call without going through the Dialer user interface for the user to confirm the call. android.permission.CALL_PHONE N/A N/A
Allows an application to read or write the system settings. android.permission.WRITE_SETTINGS N/A N/A
Allows read only access to phone state, including the current cellular network information, the status of any ongoing calls, and a list of any PhoneAccounts registered on the device. android.permission.READ_PHONE_STATE N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-06-18 23:48

Reported

2024-06-18 23:51

Platform

android-x86-arm-20240611.1-en

Max time kernel

178s

Max time network

147s

Command Line

com.whiletable82

Signatures

Octo

banker trojan infostealer rat octo

Octo payload

Description Indicator Process Target
N/A N/A N/A N/A

Removes its main activity from the application launcher

stealth trojan evasion
Description Indicator Process Target
N/A N/A N/A N/A

Loads dropped Dex/Jar

evasion
Description Indicator Process Target
N/A /data/user/0/com.whiletable82/cache/enumcmbe N/A N/A
N/A /data/user/0/com.whiletable82/cache/enumcmbe N/A N/A

Makes use of the framework's Accessibility service

collection evasion credential_access
Description Indicator Process Target
Framework service call android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId N/A N/A
Framework service call android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByViewId N/A N/A

Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps)

banker discovery

Queries the phone number (MSISDN for GSM devices)

discovery

Acquires the wake lock

Description Indicator Process Target
Framework service call android.os.IPowerManager.acquireWakeLock N/A N/A

Makes use of the framework's foreground persistence service

evasion persistence
Description Indicator Process Target
Framework service call android.app.IActivityManager.setServiceForeground N/A N/A

Performs UI accessibility actions on behalf of the user

evasion
Description Indicator Process Target
N/A android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction N/A N/A
N/A android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction N/A N/A

Queries the mobile country code (MCC)

discovery
Description Indicator Process Target
Framework service call com.android.internal.telephony.ITelephony.getNetworkCountryIsoForPhone N/A N/A

Queries the unique device ID (IMEI, MEID, IMSI)

discovery

Reads information about phone network operator.

discovery

Requests accessing notifications (often used to intercept notifications before users become aware).

collection credential_access
Description Indicator Process Target
Intent action android.settings.ACTION_NOTIFICATION_LISTENER_SETTINGS N/A N/A

Requests disabling of battery optimizations (often used to enable hiding in the background).

evasion
Description Indicator Process Target
Intent action android.settings.REQUEST_IGNORE_BATTERY_OPTIMIZATIONS N/A N/A

Registers a broadcast receiver at runtime (usually for listening for system events)

persistence
Description Indicator Process Target
Framework service call android.app.IActivityManager.registerReceiver N/A N/A

Uses Crypto APIs (Might try to encrypt user data)

impact
Description Indicator Process Target
Framework API call javax.crypto.Cipher.doFinal N/A N/A

Processes

com.whiletable82

Network

Country Destination Domain Proto
N/A 224.0.0.251:5353 udp
US 1.1.1.1:53 giydirbilirfren.xyz udp
US 1.1.1.1:53 chennemburasialmnya.xyz udp
US 1.1.1.1:53 verelmsnieldenele.xyz udp
US 1.1.1.1:53 dardidardomama.top udp
US 1.1.1.1:53 senanlamazsndili.xyz udp
BG 194.59.30.2:443 verelmsnieldenele.xyz tcp
US 1.1.1.1:53 avmevsimibsladikk.top udp
US 1.1.1.1:53 zatenacikmisttm.xyz udp
US 1.1.1.1:53 gozlermkankrmizisi.xyz udp
US 1.1.1.1:53 ustuneyagdimrmi.xyz udp
US 1.1.1.1:53 sokakdaldiregibas.xyz udp
US 1.1.1.1:53 keskinbaltadndu.top udp
US 1.1.1.1:53 tlefondingalokimo.xyz udp
US 1.1.1.1:53 birdnbireoluvrdihrsy.xyz udp
US 1.1.1.1:53 gldigimyerchennmindibi.top udp
BG 194.59.30.2:443 verelmsnieldenele.xyz tcp
GB 216.58.212.238:443 tcp
US 1.1.1.1:53 android.apis.google.com udp
GB 142.250.200.46:443 android.apis.google.com tcp
US 1.1.1.1:53 semanticlocation-pa.googleapis.com udp
GB 142.250.180.10:443 semanticlocation-pa.googleapis.com tcp
BG 194.59.30.2:443 verelmsnieldenele.xyz tcp
GB 216.58.204.74:443 semanticlocation-pa.googleapis.com tcp
BG 194.59.30.2:443 verelmsnieldenele.xyz tcp
BG 194.59.30.2:443 verelmsnieldenele.xyz tcp
BG 194.59.30.2:443 verelmsnieldenele.xyz tcp

Files

/data/data/com.whiletable82/cache/enumcmbe

MD5 163a1af175dcc6e79465a14948f0d2af
SHA1 160806021edf038e47f8db0bce96fe6b6cf4135f
SHA256 14e8289b6f8fcbe293a1a645ee5bbcf566543b06310aae5b6875686e997995b7
SHA512 7259335aab5bf353e8722a793d1e20c3f847b20355acf77a0c076c0eafe88d494d9878a027f29481a16f60eae11f0609732dd258c0e2b2d07bffd8b694fe5a57

/data/data/com.whiletable82/kl.txt

MD5 a457f9630e730c0dc5eacb6a7b6f568b
SHA1 64af1fcd8d536f60fb1ab819b0b22c861a9866cb
SHA256 c63fd629acb3b798418d04d12c61c5b9f33348303f1aa5d173faf75c6994e40f
SHA512 c8fb754df326a318abf024a7b73625f711031d3b24eb50df5517df6ab9a5978c2bb7dd639954620b037a483637dc1df14ffd5aa1fdccefae27d853ae9bf8f55b

/data/data/com.whiletable82/kl.txt

MD5 c4e729de173b64cfdf97a9306a645617
SHA1 1e22401ef89e7a2334c52ccb40300533eda82317
SHA256 7ec14ab7e46e2d1dc20ca16561effdcb6f5c26ea67d4cbc8085c5b0c28f85ae1
SHA512 522ce865c9afafad7e00807392e0c070c15a36071472028821812b0c77df70c53c0e808a8aa1e1ed2b5784920cf4c36faa8f4ceaa468bbf249f6584bc6d1a17f

/data/data/com.whiletable82/kl.txt

MD5 1d80deac2aa6dcf369f39d45f59f5bf9
SHA1 553a825ddcecb0517f37bf4dadddd5606e5b76cd
SHA256 088f52a085776d3af061b0f74ab1e8babefcbf811c25b73349ce870c659f1e29
SHA512 e14b441fc234866e80ed44c846c445b57a15029fd0ccad1eabcfbf24dde89c5084859f0bfea2f8f8ff392496ffaa9490ddefc20148d60414780a50e8214a795a

/data/data/com.whiletable82/kl.txt

MD5 4f3aabca11a780eb0d576e73df6ad1e4
SHA1 0ef2530d0a770f99121abc5bf72c422e381cf409
SHA256 7202206946fe65f20dd4a00072adc1a7cae219dc40e3f6826125f8d2086fb4b7
SHA512 abc6035544aa869ad67ad637f118cd7eb14cc84036663f8c8bbfb7b21dcca775edd309e1b618e90f5e053d6a1d7785018134c7683cefdf78dc9a588e8df45b23

/data/data/com.whiletable82/kl.txt

MD5 810a7483fc535764389477cbe3dfbd35
SHA1 349ea541fd52c987dd6bd5107786320bf7d48259
SHA256 86eb93f8f9cbdf53d38ccc29e08a2277431d8ea1f41087ae3568a307a4999241
SHA512 a7c7e663e89155fe2676db6274dc2515f55472da78c55d87686a4f702891c33e1a3ca06fb5f8d78c941f9f9a78e580fbc1316875d53217370bad57d403b5197f

/data/data/com.whiletable82/cache/oat/enumcmbe.cur.prof

MD5 935687180bc6347cdcee797aa6369f24
SHA1 af02a40867f0ed63811ab879b7f30acfd9cb5e95
SHA256 1e4eeb6dfa38c45a419d5944aa49079819e3ee12f055f3884a34ff7a4b7fde46
SHA512 334c2e900d63a01a08e16d006260e21a44049ada37e66653e5c4c75f274145be9d6a7752276aa719b0fa3061805c8721a53501f0dbf4e2da706ebb27a504a61d

/data/data/com.whiletable82/.qcom.whiletable82

MD5 046a414913add6f5bb60072c7db819b6
SHA1 451ee4f6809260aec622d772fd329c7d0297a842
SHA256 b66c1320cb063a1d391c94273572ea6edae76c8c8b0a07f8d75c88686f0df72a
SHA512 4e6355f3051ed5e811ab030abde1f5be7f5e1cf33be99cd08477e9b6c015deb1d8bd75a09fb9c7176b8511c5ad0a67abc0902a3531e97564ccb6afc57496a47c

Analysis: behavioral2

Detonation Overview

Submitted

2024-06-18 23:48

Reported

2024-06-18 23:51

Platform

android-x64-arm64-20240611.1-en

Max time kernel

178s

Max time network

186s

Command Line

com.whiletable82

Signatures

Octo

banker trojan infostealer rat octo

Octo payload

Description Indicator Process Target
N/A N/A N/A N/A

Loads dropped Dex/Jar

evasion
Description Indicator Process Target
N/A /data/user/0/com.whiletable82/cache/enumcmbe N/A N/A
N/A /data/user/0/com.whiletable82/cache/enumcmbe N/A N/A

Makes use of the framework's Accessibility service

collection evasion credential_access
Description Indicator Process Target
Framework service call android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId N/A N/A
Framework service call android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByViewId N/A N/A

Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps)

banker discovery

Queries the phone number (MSISDN for GSM devices)

discovery

Acquires the wake lock

Description Indicator Process Target
Framework service call android.os.IPowerManager.acquireWakeLock N/A N/A

Makes use of the framework's foreground persistence service

evasion persistence
Description Indicator Process Target
Framework service call android.app.IActivityManager.setServiceForeground N/A N/A

Performs UI accessibility actions on behalf of the user

evasion
Description Indicator Process Target
N/A android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction N/A N/A
N/A android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction N/A N/A

Queries the mobile country code (MCC)

discovery
Description Indicator Process Target
Framework service call com.android.internal.telephony.ITelephony.getNetworkCountryIsoForPhone N/A N/A

Reads information about phone network operator.

discovery

Requests accessing notifications (often used to intercept notifications before users become aware).

collection credential_access
Description Indicator Process Target
Intent action android.settings.ACTION_NOTIFICATION_LISTENER_SETTINGS N/A N/A

Requests disabling of battery optimizations (often used to enable hiding in the background).

evasion
Description Indicator Process Target
Intent action android.settings.REQUEST_IGNORE_BATTERY_OPTIMIZATIONS N/A N/A

Uses Crypto APIs (Might try to encrypt user data)

impact
Description Indicator Process Target
Framework API call javax.crypto.Cipher.doFinal N/A N/A

Processes

com.whiletable82

Network

Country Destination Domain Proto
GB 172.217.16.238:443 tcp
GB 172.217.16.238:443 tcp
N/A 224.0.0.251:5353 udp
GB 216.58.201.106:443 tcp
GB 216.58.201.106:443 tcp
US 1.1.1.1:53 uzanrmigokyuzuneumutlarm.xyz udp
US 1.1.1.1:53 chennemburasialmnya.xyz udp
US 1.1.1.1:53 senanlamazsndili.xyz udp
US 1.1.1.1:53 ssl.google-analytics.com udp
US 1.1.1.1:53 dardidardomama.top udp
US 1.1.1.1:53 bedelniodedkicmzynayna.top udp
US 1.1.1.1:53 gozlermkankrmizisi.xyz udp
US 1.1.1.1:53 kraltacikralmisinhaci.xyz udp
US 1.1.1.1:53 verelmsnieldenele.xyz udp
US 1.1.1.1:53 zatenacikmisttm.xyz udp
US 1.1.1.1:53 amagibikertenkeellee.top udp
BG 194.59.30.2:443 amagibikertenkeellee.top tcp
BG 194.59.30.2:443 amagibikertenkeellee.top tcp
BG 194.59.30.2:443 amagibikertenkeellee.top tcp
GB 172.217.169.68:443 tcp
GB 172.217.169.68:443 tcp
BG 194.59.30.2:443 amagibikertenkeellee.top tcp
BG 194.59.30.2:443 amagibikertenkeellee.top tcp
BG 194.59.30.2:443 amagibikertenkeellee.top tcp
BG 194.59.30.2:443 amagibikertenkeellee.top tcp
BG 194.59.30.2:443 amagibikertenkeellee.top tcp
BG 194.59.30.2:443 amagibikertenkeellee.top tcp
BG 194.59.30.2:443 amagibikertenkeellee.top tcp
BG 194.59.30.2:443 amagibikertenkeellee.top tcp
BG 194.59.30.2:443 amagibikertenkeellee.top tcp
BG 194.59.30.2:443 amagibikertenkeellee.top tcp
BG 194.59.30.2:443 amagibikertenkeellee.top tcp
BG 194.59.30.2:443 amagibikertenkeellee.top tcp
BG 194.59.30.2:443 amagibikertenkeellee.top tcp

Files

/data/data/com.whiletable82/cache/enumcmbe

MD5 163a1af175dcc6e79465a14948f0d2af
SHA1 160806021edf038e47f8db0bce96fe6b6cf4135f
SHA256 14e8289b6f8fcbe293a1a645ee5bbcf566543b06310aae5b6875686e997995b7
SHA512 7259335aab5bf353e8722a793d1e20c3f847b20355acf77a0c076c0eafe88d494d9878a027f29481a16f60eae11f0609732dd258c0e2b2d07bffd8b694fe5a57

/data/data/com.whiletable82/kl.txt

MD5 26b37089ec42c4bd877a8cf91a79fceb
SHA1 7f42e6c6fbffaf5b3bd62e148577bafdf99a79aa
SHA256 8488dc8081646851e0ddc7a9036bd4685fc49ca40e13e4adfc466fa022ece3c0
SHA512 d493e9c44c525aad0a68e7c65720e66b8b7614033c8a5fb6239d44166a8c114995141039c97617a9bdfd8a259bf64f8a922e4bb6a235996573159887b2e99890

/data/data/com.whiletable82/kl.txt

MD5 d48267e1c8581c1f229e8e65a8dc1007
SHA1 3023bb86fa27d798c996d30fe20ad3224b19b324
SHA256 1d3c7d1ca7f43fe8097ae784616437d6150b97c8be564866109dde6bb48c6254
SHA512 3e4c616e71717f0bfadf03bed08c3e34f66e724ad0f95f4ed3d2dfa90bc4240ec8476bcfd11d4e7eddac056ea46082b14d6735cf6443fe132c2d7500697db070

/data/data/com.whiletable82/kl.txt

MD5 e186e94f963cf8e6045ed5949d1f85bb
SHA1 ae269f1a365bc6f4c0bfa275efa96992baa9db66
SHA256 e120877ce1ede6f8c7ad9725378a6a9334a5e86447b3e9b56c9f69ecf71f3759
SHA512 3adddb3d0a02643b5dc678900921feebbe08c6e9035b9c431f3a1ab03d52a5c6326212869a1bc705d472314f587eac66356dc3c06cf513e04f7d4b940e1bbd5c

/data/data/com.whiletable82/kl.txt

MD5 ee09c48226896b205b53fa9d6a95925c
SHA1 40a65ebe45dcc107347ee5c68312d0d074a90c2c
SHA256 c8bd73cda285a2eeb81779aabc48899c2443571d0ecc93ec5c92f373f2ad1656
SHA512 acc181308cbaa430977f4b2fa771c762f3caff649fbf218a144bae083cfa546323677ea26cd86ea8814eab9badd60930cc333fbbf8706b69536871f22ffd5100

/data/data/com.whiletable82/kl.txt

MD5 e7a2bc85dbaca6beb486865d90854198
SHA1 ad90becf75f8d09775655c5ba9ec3317252dc5d5
SHA256 03e54bc8f4bd9a2312aa7e3f6ece3e9bb39bb5091e7e3a6c7e2fb97dfecc449c
SHA512 c0ecfab1e6394c2a8221c97aa573096c1879de28fce67dc32d0f050b647b77b50a67f112a3606c56a908a6c04fd8993b62dc82c3e2b12464c90fce0b5068139a

/data/data/com.whiletable82/cache/oat/enumcmbe.cur.prof

MD5 ed0ae907d79abc09117d7abaffabda27
SHA1 88f884f230e115d76f27952a0174b686ebaabce0
SHA256 5dbe16deb05fcb3382e0d339098529c62af935b6b0b2c8b80ce46f0bf3b79afb
SHA512 9d3adad83724509e5dde977d8e856fc0403c68be777712dd534f63c181da255cd49064eaa8c2918972437eee83e17168738b27457a84a6b18b28ffa89ffbe1f2

/data/data/com.whiletable82/.qcom.whiletable82

MD5 046a414913add6f5bb60072c7db819b6
SHA1 451ee4f6809260aec622d772fd329c7d0297a842
SHA256 b66c1320cb063a1d391c94273572ea6edae76c8c8b0a07f8d75c88686f0df72a
SHA512 4e6355f3051ed5e811ab030abde1f5be7f5e1cf33be99cd08477e9b6c015deb1d8bd75a09fb9c7176b8511c5ad0a67abc0902a3531e97564ccb6afc57496a47c