Malware Analysis Report

2024-09-09 13:41

Sample ID 240623-1yn2fstgrg
Target 56ed5c90b67c4483b0d09ac1b068f7d74cc966b7c73cfe9456cebf7bf11af1a9.bin
SHA256 56ed5c90b67c4483b0d09ac1b068f7d74cc966b7c73cfe9456cebf7bf11af1a9
Tags
octo banker collection credential_access discovery evasion impact infostealer persistence rat stealth trojan
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK Matrix

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

56ed5c90b67c4483b0d09ac1b068f7d74cc966b7c73cfe9456cebf7bf11af1a9

Threat Level: Known bad

The file 56ed5c90b67c4483b0d09ac1b068f7d74cc966b7c73cfe9456cebf7bf11af1a9.bin was found to be: Known bad.

Malicious Activity Summary

octo banker collection credential_access discovery evasion impact infostealer persistence rat stealth trojan

Octo

Octo payload

Removes its main activity from the application launcher

Loads dropped Dex/Jar

Queries the phone number (MSISDN for GSM devices)

Makes use of the framework's Accessibility service

Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps)

Requests modifying system settings.

Requests dangerous framework permissions

Reads information about phone network operator.

Requests disabling of battery optimizations (often used to enable hiding in the background).

Requests accessing notifications (often used to intercept notifications before users become aware).

Performs UI accessibility actions on behalf of the user

Queries the mobile country code (MCC)

Acquires the wake lock

Queries the unique device ID (IMEI, MEID, IMSI)

Declares broadcast receivers with permission to handle system events

Declares services with permission to bind to the system

Makes use of the framework's foreground persistence service

Uses Crypto APIs (Might try to encrypt user data)

Registers a broadcast receiver at runtime (usually for listening for system events)

MITRE ATT&CK Matrix

N/A

Analysis: static1

Detonation Overview

Reported

2024-06-23 22:03

Signatures

Declares broadcast receivers with permission to handle system events

Description Indicator Process Target
Required by device admin receivers to bind with the system. Allows apps to manage device administration features. android.permission.BIND_DEVICE_ADMIN N/A N/A

Declares services with permission to bind to the system

Description Indicator Process Target
Required by accessibility services to bind with the system. Allows apps to access accessibility features. android.permission.BIND_ACCESSIBILITY_SERVICE N/A N/A
Required by notification listener services to bind with the system. Allows apps to listen to and interact with notifications on the device. android.permission.BIND_NOTIFICATION_LISTENER_SERVICE N/A N/A

Requests dangerous framework permissions

Description Indicator Process Target
Allows an application to write to external storage. android.permission.WRITE_EXTERNAL_STORAGE N/A N/A
Allows an application to read from external storage. android.permission.READ_EXTERNAL_STORAGE N/A N/A
Allows an application to receive SMS messages. android.permission.RECEIVE_SMS N/A N/A
Allows an application to read SMS messages. android.permission.READ_SMS N/A N/A
Allows an application to send SMS messages. android.permission.SEND_SMS N/A N/A
Allows an application to initiate a phone call without going through the Dialer user interface for the user to confirm the call. android.permission.CALL_PHONE N/A N/A
Allows an application to read or write the system settings. android.permission.WRITE_SETTINGS N/A N/A
Allows read only access to phone state, including the current cellular network information, the status of any ongoing calls, and a list of any PhoneAccounts registered on the device. android.permission.READ_PHONE_STATE N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-06-23 22:03

Reported

2024-06-23 22:06

Platform

android-x86-arm-20240611.1-en

Max time kernel

177s

Max time network

181s

Command Line

com.roomis21

Signatures

Octo

banker trojan infostealer rat octo

Octo payload

Description Indicator Process Target
N/A N/A N/A N/A

Removes its main activity from the application launcher

stealth trojan evasion
Description Indicator Process Target
N/A N/A N/A N/A

Loads dropped Dex/Jar

evasion
Description Indicator Process Target
N/A /data/user/0/com.roomis21/cache/djfwhxvfh N/A N/A
N/A /data/user/0/com.roomis21/cache/djfwhxvfh N/A N/A

Makes use of the framework's Accessibility service

collection evasion credential_access
Description Indicator Process Target
Framework service call android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId N/A N/A
Framework service call android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByViewId N/A N/A

Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps)

banker discovery

Queries the phone number (MSISDN for GSM devices)

discovery

Acquires the wake lock

Description Indicator Process Target
Framework service call android.os.IPowerManager.acquireWakeLock N/A N/A

Makes use of the framework's foreground persistence service

evasion persistence
Description Indicator Process Target
Framework service call android.app.IActivityManager.setServiceForeground N/A N/A

Performs UI accessibility actions on behalf of the user

evasion
Description Indicator Process Target
N/A android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction N/A N/A
N/A android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction N/A N/A
N/A android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction N/A N/A
N/A android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction N/A N/A

Queries the mobile country code (MCC)

discovery
Description Indicator Process Target
Framework service call com.android.internal.telephony.ITelephony.getNetworkCountryIsoForPhone N/A N/A

Queries the unique device ID (IMEI, MEID, IMSI)

discovery

Reads information about phone network operator.

discovery

Requests accessing notifications (often used to intercept notifications before users become aware).

collection credential_access
Description Indicator Process Target
Intent action android.settings.ACTION_NOTIFICATION_LISTENER_SETTINGS N/A N/A

Requests disabling of battery optimizations (often used to enable hiding in the background).

evasion
Description Indicator Process Target
Intent action android.settings.REQUEST_IGNORE_BATTERY_OPTIMIZATIONS N/A N/A

Requests modifying system settings.

evasion
Description Indicator Process Target
Intent action android.settings.action.MANAGE_WRITE_SETTINGS N/A N/A

Registers a broadcast receiver at runtime (usually for listening for system events)

persistence
Description Indicator Process Target
Framework service call android.app.IActivityManager.registerReceiver N/A N/A

Uses Crypto APIs (Might try to encrypt user data)

impact
Description Indicator Process Target
Framework API call javax.crypto.Cipher.doFinal N/A N/A

Processes

com.roomis21

Network

Country Destination Domain Proto
N/A 224.0.0.251:5353 udp
US 1.1.1.1:53 semanticlocation-pa.googleapis.com udp
US 1.1.1.1:53 dertlikaygisiz04.com udp
US 1.1.1.1:53 sigaracokhojdur1.com udp
US 1.1.1.1:53 kaygisizamamutlu04.com udp
US 1.1.1.1:53 mamudoilekeyfyap.com udp
US 1.1.1.1:53 mamudoiledostadogru.com udp
RU 193.143.1.9:443 mamudoiledostadogru.com tcp
RU 193.143.1.9:443 mamudoiledostadogru.com tcp
GB 142.250.187.206:443 tcp
US 1.1.1.1:53 android.apis.google.com udp
GB 142.250.178.14:443 android.apis.google.com tcp
RU 193.143.1.9:443 mamudoiledostadogru.com tcp
RU 193.143.1.9:443 mamudoiledostadogru.com tcp
RU 193.143.1.9:443 mamudoiledostadogru.com tcp
RU 193.143.1.9:443 mamudoiledostadogru.com tcp
RU 193.143.1.9:443 mamudoiledostadogru.com tcp
RU 193.143.1.9:443 mamudoiledostadogru.com tcp
RU 193.143.1.9:443 mamudoiledostadogru.com tcp

Files

/data/data/com.roomis21/cache/djfwhxvfh

MD5 e9ee3f61d9ecbfbbf9956f113f8efa94
SHA1 bce207405ff1e21423afcfa998ba5768f0a25dbe
SHA256 db5c8a2929042c7fd0c7d0d411bfc1e1bb50d2c9ce9c66c6cd05888ee63941c3
SHA512 50f34a60c904035fc3ec249156c252767b2db132ff73327722aaf2bf4d314e85f5d588305c06ee8fee2eeeaf6933b49e9e8dd0cc07c45d37c8048209fb3023fa

/data/data/com.roomis21/cache/oat/djfwhxvfh.cur.prof

MD5 f1b7c18d82fa624a48354d4a7ad9d1f4
SHA1 d2488d3874a76219da9460dcbe9ea92852ce8aa8
SHA256 7eec21a2e452b863ed26d29c1065d782396068b44168362e5c78ccd6b2d72722
SHA512 b1258bff21276ffe4cb06b99f28636a1f8f522cf1375bb9604f7d09564ef9812e4a1250f54c27209590ffa30a0c94dffdd4ad0900558d0ad90eedce7411c1fd4

Analysis: behavioral2

Detonation Overview

Submitted

2024-06-23 22:03

Reported

2024-06-23 22:06

Platform

android-x64-arm64-20240611.1-en

Max time kernel

177s

Max time network

186s

Command Line

com.roomis21

Signatures

Octo

banker trojan infostealer rat octo

Octo payload

Description Indicator Process Target
N/A N/A N/A N/A

Loads dropped Dex/Jar

evasion
Description Indicator Process Target
N/A /data/user/0/com.roomis21/cache/djfwhxvfh N/A N/A
N/A /data/user/0/com.roomis21/cache/djfwhxvfh N/A N/A

Makes use of the framework's Accessibility service

collection evasion credential_access
Description Indicator Process Target
Framework service call android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId N/A N/A
Framework service call android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByViewId N/A N/A

Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps)

banker discovery

Queries the phone number (MSISDN for GSM devices)

discovery

Acquires the wake lock

Description Indicator Process Target
Framework service call android.os.IPowerManager.acquireWakeLock N/A N/A

Makes use of the framework's foreground persistence service

evasion persistence
Description Indicator Process Target
Framework service call android.app.IActivityManager.setServiceForeground N/A N/A

Performs UI accessibility actions on behalf of the user

evasion
Description Indicator Process Target
N/A android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction N/A N/A
N/A android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction N/A N/A
N/A android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction N/A N/A
N/A android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction N/A N/A

Queries the mobile country code (MCC)

discovery
Description Indicator Process Target
Framework service call com.android.internal.telephony.ITelephony.getNetworkCountryIsoForPhone N/A N/A

Reads information about phone network operator.

discovery

Requests accessing notifications (often used to intercept notifications before users become aware).

collection credential_access
Description Indicator Process Target
Intent action android.settings.ACTION_NOTIFICATION_LISTENER_SETTINGS N/A N/A

Requests disabling of battery optimizations (often used to enable hiding in the background).

evasion
Description Indicator Process Target
Intent action android.settings.REQUEST_IGNORE_BATTERY_OPTIMIZATIONS N/A N/A

Requests modifying system settings.

evasion
Description Indicator Process Target
Intent action android.settings.action.MANAGE_WRITE_SETTINGS N/A N/A

Uses Crypto APIs (Might try to encrypt user data)

impact
Description Indicator Process Target
Framework API call javax.crypto.Cipher.doFinal N/A N/A

Processes

com.roomis21

Network

Country Destination Domain Proto
GB 142.250.187.206:443 tcp
GB 142.250.187.206:443 tcp
N/A 224.0.0.251:5353 udp
US 1.1.1.1:53 kaygisizamamutlu04.com udp
US 1.1.1.1:53 mamudoiledostadogru.com udp
RU 193.143.1.9:443 mamudoiledostadogru.com tcp
US 1.1.1.1:53 sigaracokhojdur1.com udp
US 1.1.1.1:53 mamudoilekeyfyap.com udp
US 1.1.1.1:53 dertlikaygisiz04.com udp
RU 193.143.1.9:443 mamudoiledostadogru.com tcp
US 1.1.1.1:53 ssl.google-analytics.com udp
GB 142.250.200.40:443 ssl.google-analytics.com tcp
GB 142.250.179.228:443 tcp
GB 142.250.179.228:443 tcp
RU 193.143.1.9:443 mamudoiledostadogru.com tcp
RU 193.143.1.9:443 mamudoiledostadogru.com tcp
RU 193.143.1.9:443 mamudoiledostadogru.com tcp
RU 193.143.1.9:443 mamudoiledostadogru.com tcp
RU 193.143.1.9:443 mamudoiledostadogru.com tcp
US 1.1.1.1:53 www.google.com udp
GB 216.58.212.196:443 www.google.com tcp
RU 193.143.1.9:443 mamudoiledostadogru.com tcp
RU 193.143.1.9:443 mamudoiledostadogru.com tcp
RU 193.143.1.9:443 mamudoiledostadogru.com tcp
RU 193.143.1.9:443 mamudoiledostadogru.com tcp
RU 193.143.1.9:443 mamudoiledostadogru.com tcp
RU 193.143.1.9:443 mamudoiledostadogru.com tcp
RU 193.143.1.9:443 mamudoiledostadogru.com tcp
GB 216.58.212.196:443 www.google.com tcp
RU 193.143.1.9:443 mamudoiledostadogru.com tcp
RU 193.143.1.9:443 mamudoiledostadogru.com tcp

Files

/data/data/com.roomis21/cache/djfwhxvfh

MD5 e9ee3f61d9ecbfbbf9956f113f8efa94
SHA1 bce207405ff1e21423afcfa998ba5768f0a25dbe
SHA256 db5c8a2929042c7fd0c7d0d411bfc1e1bb50d2c9ce9c66c6cd05888ee63941c3
SHA512 50f34a60c904035fc3ec249156c252767b2db132ff73327722aaf2bf4d314e85f5d588305c06ee8fee2eeeaf6933b49e9e8dd0cc07c45d37c8048209fb3023fa

/data/data/com.roomis21/cache/oat/djfwhxvfh.cur.prof

MD5 3c657c4ce1989a57f84cf8c7676594f5
SHA1 07f7d2d33a9c8ce899ddfe392dbc2857c41aa1fb
SHA256 9269892559d453ed0d74adbc06e9405bc0d09284e9357715270fa2d51eeede69
SHA512 7a171b48b33f692697e9927cddaab721fe0b8e6dbea1ca193b8e2acfc34a0254dfb286497a924f0caf4b1249ad2cde9525cb7e797a1d47df1ce273bb389409a1