Malware Analysis Report

2024-07-28 11:39

Sample ID 240624-1wn9fatfrd
Target a1a7346dd8143987d27234d37f514db05b6b64735cdb1d230a55758aecd763dc.bin
SHA256 a1a7346dd8143987d27234d37f514db05b6b64735cdb1d230a55758aecd763dc
Tags
octo banker collection credential_access discovery evasion impact infostealer persistence rat trojan stealth
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK Matrix

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

a1a7346dd8143987d27234d37f514db05b6b64735cdb1d230a55758aecd763dc

Threat Level: Known bad

The file a1a7346dd8143987d27234d37f514db05b6b64735cdb1d230a55758aecd763dc.bin was found to be: Known bad.

Malicious Activity Summary

octo banker collection credential_access discovery evasion impact infostealer persistence rat trojan stealth

Octo

Octo payload

Removes its main activity from the application launcher

Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps)

Loads dropped Dex/Jar

Queries the phone number (MSISDN for GSM devices)

Makes use of the framework's Accessibility service

Queries the unique device ID (IMEI, MEID, IMSI)

Requests dangerous framework permissions

Requests accessing notifications (often used to intercept notifications before users become aware).

Acquires the wake lock

Requests disabling of battery optimizations (often used to enable hiding in the background).

Declares services with permission to bind to the system

Makes use of the framework's foreground persistence service

Queries the mobile country code (MCC)

Performs UI accessibility actions on behalf of the user

Requests modifying system settings.

Reads information about phone network operator.

Declares broadcast receivers with permission to handle system events

Registers a broadcast receiver at runtime (usually for listening for system events)

Uses Crypto APIs (Might try to encrypt user data)

MITRE ATT&CK Matrix

N/A

Analysis: static1

Detonation Overview

Reported

2024-06-24 22:00

Signatures

Declares broadcast receivers with permission to handle system events

Description Indicator Process Target
Required by device admin receivers to bind with the system. Allows apps to manage device administration features. android.permission.BIND_DEVICE_ADMIN N/A N/A

Declares services with permission to bind to the system

Description Indicator Process Target
Required by accessibility services to bind with the system. Allows apps to access accessibility features. android.permission.BIND_ACCESSIBILITY_SERVICE N/A N/A
Required by notification listener services to bind with the system. Allows apps to listen to and interact with notifications on the device. android.permission.BIND_NOTIFICATION_LISTENER_SERVICE N/A N/A

Requests dangerous framework permissions

Description Indicator Process Target
Allows an application to write to external storage. android.permission.WRITE_EXTERNAL_STORAGE N/A N/A
Allows an application to receive SMS messages. android.permission.RECEIVE_SMS N/A N/A
Allows an application to read SMS messages. android.permission.READ_SMS N/A N/A
Allows an application to send SMS messages. android.permission.SEND_SMS N/A N/A
Allows an application to initiate a phone call without going through the Dialer user interface for the user to confirm the call. android.permission.CALL_PHONE N/A N/A
Allows an application to read or write the system settings. android.permission.WRITE_SETTINGS N/A N/A
Allows read only access to phone state, including the current cellular network information, the status of any ongoing calls, and a list of any PhoneAccounts registered on the device. android.permission.READ_PHONE_STATE N/A N/A

Analysis: behavioral2

Detonation Overview

Submitted

2024-06-24 22:00

Reported

2024-06-24 22:03

Platform

android-33-x64-arm64-20240624-en

Max time kernel

179s

Max time network

186s

Command Line

com.twolike56

Signatures

Octo

banker trojan infostealer rat octo

Octo payload

Description Indicator Process Target
N/A N/A N/A N/A

Loads dropped Dex/Jar

evasion
Description Indicator Process Target
N/A /data/user/0/com.twolike56/cache/qbachlfcpp N/A N/A

Makes use of the framework's Accessibility service

collection evasion credential_access
Description Indicator Process Target
Framework service call android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId N/A N/A
Framework service call android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByViewId N/A N/A

Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps)

banker discovery

Queries the phone number (MSISDN for GSM devices)

discovery

Acquires the wake lock

Description Indicator Process Target
Framework service call android.os.IPowerManager.acquireWakeLock N/A N/A

Makes use of the framework's foreground persistence service

evasion persistence
Description Indicator Process Target
Framework service call android.app.IActivityManager.setServiceForeground N/A N/A

Performs UI accessibility actions on behalf of the user

evasion
Description Indicator Process Target
N/A android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction N/A N/A
N/A android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction N/A N/A

Queries the mobile country code (MCC)

discovery
Description Indicator Process Target
Framework service call com.android.internal.telephony.ITelephony.getNetworkCountryIsoForPhone N/A N/A

Reads information about phone network operator.

discovery

Requests accessing notifications (often used to intercept notifications before users become aware).

collection credential_access
Description Indicator Process Target
Intent action android.settings.ACTION_NOTIFICATION_LISTENER_SETTINGS N/A N/A

Requests disabling of battery optimizations (often used to enable hiding in the background).

evasion
Description Indicator Process Target
Intent action android.settings.REQUEST_IGNORE_BATTERY_OPTIMIZATIONS N/A N/A

Requests modifying system settings.

evasion
Description Indicator Process Target
Intent action android.settings.action.MANAGE_WRITE_SETTINGS N/A N/A

Uses Crypto APIs (Might try to encrypt user data)

impact
Description Indicator Process Target
Framework API call javax.crypto.Cipher.doFinal N/A N/A

Processes

com.twolike56

Network

Country Destination Domain Proto
GB 216.58.201.100:443 udp
GB 216.58.201.100:443 tcp
GB 216.58.201.100:443 tcp
GB 142.250.200.42:443 udp
GB 142.250.200.42:443 tcp
N/A 224.0.0.251:5353 udp
US 1.1.1.1:53 sigaracokhojdur1.com udp
US 1.1.1.1:53 dertlikaygisiz04.com udp
US 1.1.1.1:53 kaygisizamamutlu04.com udp
US 1.1.1.1:53 mamudoilekeyfyap.com udp
US 1.1.1.1:53 mamudoiledostadogru.com udp
RU 193.143.1.9:443 mamudoiledostadogru.com tcp
RU 193.143.1.9:443 mamudoiledostadogru.com tcp
GB 216.58.201.100:443 udp
US 172.64.41.3:443 udp
US 172.64.41.3:443 tcp
US 172.64.41.3:443 tcp
GB 216.58.204.67:443 tcp
GB 216.58.204.67:443 udp
RU 193.143.1.9:443 mamudoiledostadogru.com tcp
RU 193.143.1.9:443 mamudoiledostadogru.com tcp
RU 193.143.1.9:443 mamudoiledostadogru.com tcp
RU 193.143.1.9:443 mamudoiledostadogru.com tcp
RU 193.143.1.9:443 mamudoiledostadogru.com tcp
US 1.1.1.1:53 www.google.com udp
GB 142.250.200.36:443 www.google.com tcp
RU 193.143.1.9:443 mamudoiledostadogru.com tcp
GB 142.250.200.36:443 www.google.com tcp
RU 193.143.1.9:443 mamudoiledostadogru.com tcp
RU 193.143.1.9:443 mamudoiledostadogru.com tcp
RU 193.143.1.9:443 mamudoiledostadogru.com tcp
RU 193.143.1.9:443 mamudoiledostadogru.com tcp
RU 193.143.1.9:443 mamudoiledostadogru.com tcp
RU 193.143.1.9:443 mamudoiledostadogru.com tcp
RU 193.143.1.9:443 mamudoiledostadogru.com tcp
GB 142.250.200.36:443 www.google.com tcp
RU 193.143.1.9:443 mamudoiledostadogru.com tcp
RU 193.143.1.9:443 mamudoiledostadogru.com tcp
RU 193.143.1.9:443 mamudoiledostadogru.com tcp

Files

/data/data/com.twolike56/cache/qbachlfcpp

MD5 e99a4afb7839e0b468fb788607bdde2e
SHA1 c7d2a6c763a520d80c4d73756d26c6d1f4db5dca
SHA256 fb71d06fd02fc96c2c2b4934883754553a2102eba857a023d19cbaff4620d61e
SHA512 d48d2eaaa655838c79ce68d0bc85c2f5d49d321c4d0a627eaf595b9ddc1948eae471cbc14c69d5b09538f50f4f2e1236904dabce802da7ff0f9e5a21eb679b20

/data/data/com.twolike56/cache/oat/qbachlfcpp.cur.prof

MD5 465c24210579d3777c1a97439ad3e90b
SHA1 7d6cf786b9a16a9b5da8fe12a85c638824750151
SHA256 6ac8319de1c124d8b604d7b1828fa89eee844c516e9702970f7f32bf83202ce7
SHA512 fa85227d19a2412d6b8bbbb4133ca95f6beb18ceb2b96c24f8aff5ac3d01ae68bfd75d0b78fc15a70fb48b3d8a6d938d5a59e552d46a2f8a59a2c8dac8c157bf

Analysis: behavioral1

Detonation Overview

Submitted

2024-06-24 22:00

Reported

2024-06-24 22:03

Platform

android-x86-arm-20240624-en

Max time kernel

179s

Max time network

186s

Command Line

com.twolike56

Signatures

Octo

banker trojan infostealer rat octo

Octo payload

Description Indicator Process Target
N/A N/A N/A N/A

Removes its main activity from the application launcher

stealth trojan evasion
Description Indicator Process Target
N/A N/A N/A N/A

Loads dropped Dex/Jar

evasion
Description Indicator Process Target
N/A /data/user/0/com.twolike56/cache/qbachlfcpp N/A N/A
N/A /data/user/0/com.twolike56/cache/qbachlfcpp N/A N/A

Makes use of the framework's Accessibility service

collection evasion credential_access
Description Indicator Process Target
Framework service call android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId N/A N/A
Framework service call android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByViewId N/A N/A

Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps)

banker discovery

Queries the phone number (MSISDN for GSM devices)

discovery

Acquires the wake lock

Description Indicator Process Target
Framework service call android.os.IPowerManager.acquireWakeLock N/A N/A

Makes use of the framework's foreground persistence service

evasion persistence
Description Indicator Process Target
Framework service call android.app.IActivityManager.setServiceForeground N/A N/A

Performs UI accessibility actions on behalf of the user

evasion
Description Indicator Process Target
N/A android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction N/A N/A
N/A android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction N/A N/A
N/A android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction N/A N/A
N/A android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction N/A N/A

Queries the mobile country code (MCC)

discovery
Description Indicator Process Target
Framework service call com.android.internal.telephony.ITelephony.getNetworkCountryIsoForPhone N/A N/A

Queries the unique device ID (IMEI, MEID, IMSI)

discovery

Reads information about phone network operator.

discovery

Requests accessing notifications (often used to intercept notifications before users become aware).

collection credential_access
Description Indicator Process Target
Intent action android.settings.ACTION_NOTIFICATION_LISTENER_SETTINGS N/A N/A

Requests disabling of battery optimizations (often used to enable hiding in the background).

evasion
Description Indicator Process Target
Intent action android.settings.REQUEST_IGNORE_BATTERY_OPTIMIZATIONS N/A N/A

Requests modifying system settings.

evasion
Description Indicator Process Target
Intent action android.settings.action.MANAGE_WRITE_SETTINGS N/A N/A

Registers a broadcast receiver at runtime (usually for listening for system events)

persistence
Description Indicator Process Target
Framework service call android.app.IActivityManager.registerReceiver N/A N/A

Uses Crypto APIs (Might try to encrypt user data)

impact
Description Indicator Process Target
Framework API call javax.crypto.Cipher.doFinal N/A N/A

Processes

com.twolike56

Network

Country Destination Domain Proto
N/A 224.0.0.251:5353 udp
GB 216.58.204.74:443 tcp
US 1.1.1.1:53 semanticlocation-pa.googleapis.com udp
US 1.1.1.1:53 kaygisizamamutlu04.com udp
US 1.1.1.1:53 dertlikaygisiz04.com udp
US 1.1.1.1:53 mamudoiledostadogru.com udp
US 1.1.1.1:53 mamudoilekeyfyap.com udp
RU 193.143.1.9:443 mamudoiledostadogru.com tcp
RU 193.143.1.9:443 mamudoiledostadogru.com tcp
GB 142.250.187.206:443 tcp
US 1.1.1.1:53 android.apis.google.com udp
GB 142.250.179.238:443 android.apis.google.com tcp
RU 193.143.1.9:443 mamudoiledostadogru.com tcp
US 1.1.1.1:53 sigaracokhojdur1.com udp
RU 193.143.1.9:443 mamudoiledostadogru.com tcp
RU 193.143.1.9:443 mamudoiledostadogru.com tcp
RU 193.143.1.9:443 mamudoiledostadogru.com tcp
RU 193.143.1.9:443 mamudoiledostadogru.com tcp
RU 193.143.1.9:443 mamudoiledostadogru.com tcp
RU 193.143.1.9:443 mamudoiledostadogru.com tcp

Files

/data/data/com.twolike56/cache/qbachlfcpp

MD5 e99a4afb7839e0b468fb788607bdde2e
SHA1 c7d2a6c763a520d80c4d73756d26c6d1f4db5dca
SHA256 fb71d06fd02fc96c2c2b4934883754553a2102eba857a023d19cbaff4620d61e
SHA512 d48d2eaaa655838c79ce68d0bc85c2f5d49d321c4d0a627eaf595b9ddc1948eae471cbc14c69d5b09538f50f4f2e1236904dabce802da7ff0f9e5a21eb679b20

/data/data/com.twolike56/cache/oat/qbachlfcpp.cur.prof

MD5 ff7af9cbb3368a68cc08b43250f7c104
SHA1 af280a444e40cb8d4c35f6a11053b1a970fdbd5f
SHA256 61fb7bb5b1f525a59a090c8e46a1366a9124f3662a3891e493efafc285ea1641
SHA512 eeebebbd1a940e78db7036ad959fc42831cb91fe8d6082374807918425f614bb943f3051d89e2ca86ee8a0fb9474c08b2cf7016f24708e52bde29351ac03adfa