Malware Analysis Report

2024-07-28 11:40

Sample ID 240624-swee8ssflk
Target 6597f606ee49ac3d26ce5370f8944bf238aa56c368b82dab99f080abb6832fc1.bin
SHA256 6597f606ee49ac3d26ce5370f8944bf238aa56c368b82dab99f080abb6832fc1
Tags
octo banker collection credential_access discovery evasion impact infostealer persistence rat stealth trojan
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK Matrix

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

6597f606ee49ac3d26ce5370f8944bf238aa56c368b82dab99f080abb6832fc1

Threat Level: Known bad

The file 6597f606ee49ac3d26ce5370f8944bf238aa56c368b82dab99f080abb6832fc1.bin was found to be: Known bad.

Malicious Activity Summary

octo banker collection credential_access discovery evasion impact infostealer persistence rat stealth trojan

Octo payload

Octo

Removes its main activity from the application launcher

Loads dropped Dex/Jar

Makes use of the framework's Accessibility service

Queries the phone number (MSISDN for GSM devices)

Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps)

Requests disabling of battery optimizations (often used to enable hiding in the background).

Reads information about phone network operator.

Requests accessing notifications (often used to intercept notifications before users become aware).

Performs UI accessibility actions on behalf of the user

Makes use of the framework's foreground persistence service

Acquires the wake lock

Declares broadcast receivers with permission to handle system events

Requests dangerous framework permissions

Requests modifying system settings.

Queries the unique device ID (IMEI, MEID, IMSI)

Queries the mobile country code (MCC)

Declares services with permission to bind to the system

Uses Crypto APIs (Might try to encrypt user data)

Registers a broadcast receiver at runtime (usually for listening for system events)

MITRE ATT&CK Matrix

N/A

Analysis: static1

Detonation Overview

Reported

2024-06-24 15:28

Signatures

Declares broadcast receivers with permission to handle system events

Description Indicator Process Target
Required by device admin receivers to bind with the system. Allows apps to manage device administration features. android.permission.BIND_DEVICE_ADMIN N/A N/A

Declares services with permission to bind to the system

Description Indicator Process Target
Required by accessibility services to bind with the system. Allows apps to access accessibility features. android.permission.BIND_ACCESSIBILITY_SERVICE N/A N/A
Required by notification listener services to bind with the system. Allows apps to listen to and interact with notifications on the device. android.permission.BIND_NOTIFICATION_LISTENER_SERVICE N/A N/A

Requests dangerous framework permissions

Description Indicator Process Target
Allows an application to receive SMS messages. android.permission.RECEIVE_SMS N/A N/A
Allows an application to read SMS messages. android.permission.READ_SMS N/A N/A
Allows an application to send SMS messages. android.permission.SEND_SMS N/A N/A
Allows an application to initiate a phone call without going through the Dialer user interface for the user to confirm the call. android.permission.CALL_PHONE N/A N/A
Allows an application to read or write the system settings. android.permission.WRITE_SETTINGS N/A N/A
Allows read only access to phone state, including the current cellular network information, the status of any ongoing calls, and a list of any PhoneAccounts registered on the device. android.permission.READ_PHONE_STATE N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-06-24 15:28

Reported

2024-06-24 15:31

Platform

android-x86-arm-20240624-en

Max time kernel

178s

Max time network

135s

Command Line

com.townrest62

Signatures

Octo

banker trojan infostealer rat octo

Octo payload

Description Indicator Process Target
N/A N/A N/A N/A

Removes its main activity from the application launcher

stealth trojan evasion
Description Indicator Process Target
N/A N/A N/A N/A

Loads dropped Dex/Jar

evasion
Description Indicator Process Target
N/A /data/user/0/com.townrest62/cache/siaokec N/A N/A
N/A /data/user/0/com.townrest62/cache/siaokec N/A N/A

Makes use of the framework's Accessibility service

collection evasion credential_access
Description Indicator Process Target
Framework service call android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId N/A N/A
Framework service call android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByViewId N/A N/A

Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps)

banker discovery

Queries the phone number (MSISDN for GSM devices)

discovery

Acquires the wake lock

Description Indicator Process Target
Framework service call android.os.IPowerManager.acquireWakeLock N/A N/A

Makes use of the framework's foreground persistence service

evasion persistence
Description Indicator Process Target
Framework service call android.app.IActivityManager.setServiceForeground N/A N/A

Performs UI accessibility actions on behalf of the user

evasion
Description Indicator Process Target
N/A android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction N/A N/A
N/A android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction N/A N/A
N/A android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction N/A N/A
N/A android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction N/A N/A

Queries the mobile country code (MCC)

discovery
Description Indicator Process Target
Framework service call com.android.internal.telephony.ITelephony.getNetworkCountryIsoForPhone N/A N/A

Queries the unique device ID (IMEI, MEID, IMSI)

discovery

Requests accessing notifications (often used to intercept notifications before users become aware).

collection credential_access
Description Indicator Process Target
Intent action android.settings.ACTION_NOTIFICATION_LISTENER_SETTINGS N/A N/A

Requests disabling of battery optimizations (often used to enable hiding in the background).

evasion
Description Indicator Process Target
Intent action android.settings.REQUEST_IGNORE_BATTERY_OPTIMIZATIONS N/A N/A

Requests modifying system settings.

evasion
Description Indicator Process Target
Intent action android.settings.action.MANAGE_WRITE_SETTINGS N/A N/A

Registers a broadcast receiver at runtime (usually for listening for system events)

persistence
Description Indicator Process Target
Framework service call android.app.IActivityManager.registerReceiver N/A N/A

Uses Crypto APIs (Might try to encrypt user data)

impact
Description Indicator Process Target
Framework API call javax.crypto.Cipher.doFinal N/A N/A

Processes

com.townrest62

Network

Country Destination Domain Proto
N/A 224.0.0.251:5353 udp
GB 142.250.200.42:443 tcp
US 1.1.1.1:53 semanticlocation-pa.googleapis.com udp
US 1.1.1.1:53 biricruelidurdursunloo.com udp
US 1.1.1.1:53 gurcistancruell33.com udp
US 1.1.1.1:53 cruelveblack32.com udp
TR 45.88.91.112:443 cruelveblack32.com tcp
US 1.1.1.1:53 biricruelidurdursunn.com udp
TR 45.88.91.112:443 cruelveblack32.com tcp
GB 216.58.204.78:443 tcp
US 1.1.1.1:53 android.apis.google.com udp
GB 172.217.16.238:443 android.apis.google.com tcp
GB 142.250.178.10:443 semanticlocation-pa.googleapis.com tcp
TR 45.88.91.112:443 cruelveblack32.com tcp
TR 45.88.91.112:443 cruelveblack32.com tcp
TR 45.88.91.112:443 cruelveblack32.com tcp
TR 45.88.91.112:443 cruelveblack32.com tcp

Files

/data/data/com.townrest62/cache/siaokec

MD5 ad3527eb79fb0253e0333e419af31c74
SHA1 5250abb05be29fa80e767b1a07f84e722ef84ead
SHA256 a32626932983d09d01ee7e59d196454a5388204c60d7e8b13c45819a04f262ad
SHA512 9235e8f138756f8536bc88916ec13b92c277ef0511c48d542974e1b03b0bc95d275a3c64a596ce17bda36f8a5e96c97c5721e00e21bff0e387e165ab8a0159a9

/data/data/com.townrest62/kl.txt

MD5 6578f9fbb2eff843204c948f883857b9
SHA1 76785ca6f3180bac28713d478e20c64a17dfb13f
SHA256 2dc2a7e465a86191cf0979ade4b231a6c873ed65a9ab453f8af63cc142a6e79b
SHA512 fb8d9898e8238cdc939392df763ac4d49cabca44f9dda0d09c25314e0c020e4c9eb1d2febcf63b49041f231e8ba337df94f3b9b12720becfbed6413fd75f7f53

/data/data/com.townrest62/kl.txt

MD5 2b37caaefdeee0b3c657ef838fd77ec2
SHA1 070c154fd3437879b4e12e020b1e9d1aef373726
SHA256 49c95d918e1e2a8f2d3d0d73c25f73096f675bcbd650a901a91425d5c771c0ed
SHA512 d86e1f933bfb2367603b4cd87beace0b1a4215658579bdbc9ff7c0330f75bb9aa7c63be560f8e747d5ec997e878f3b369bb342a57a26caf8faaceff334efc0ba

/data/data/com.townrest62/kl.txt

MD5 93facd7ac468b387978be32b9a701400
SHA1 9438995ac0c1071b85f53cc5efe2586dc58812a1
SHA256 510a130b584ad16f14dec27cf569bab9a641abaf2b958f1864710e23cfcdbc40
SHA512 907a141fac46efa4be3eff89717c975b2525defd3226c80116ee56a8d1f1800c2e661884747dac0387bba026f9e0bd66025e7cdaea84bff755abc6af94ee69c2

/data/data/com.townrest62/kl.txt

MD5 530b03c11a9282cf60c5ae7a961e7e4a
SHA1 de03ed23da4fd2d5b79a66ab17fea2baeeee8762
SHA256 ecd698c04bb225eccc93ffe8985c9001796cc8191d5d4de66466a46c5f791e3c
SHA512 b58a2b2704840f6117c0f390f45b94751677919bc94ad8172e9639ce2f86a0ce8ac8d4b67b9a29ab2c5d5bf3b3ebaf357c54f0eac5d5b4452ff66d5c61c69fa9

/data/data/com.townrest62/kl.txt

MD5 df98a5da8c7fcb3d64787c1069185caa
SHA1 1f4a7e21ad0cf5d5876d7a3523b2208e79245fd3
SHA256 e6bf055c6e2cad171475ff49da0bb745ac446aa056e98568d0a743a1209bb07f
SHA512 eab544db811b2af6afb6a00501fbd2d4f0929a1ca59251f3fc591d075bbb259c1aaeeb64e9c07aab085ba18e500a8e8c1bfa221d9e96a66d279977a060c61b1e

/data/data/com.townrest62/cache/oat/siaokec.cur.prof

MD5 830bce65e3703b8898cae1d3a6d22c71
SHA1 6cf34e976aebfd711393bbca140ba2d551b9f52f
SHA256 dcae732b672b797a98c17accdacaa049a674d99018082253ca9894be67284eaa
SHA512 39a259ffdc63700ef72dde6cb1e5fec2821291c92d5d5d6b20589a4a67987718b4be62b07e0a9818e71f4f726242ed2b7a9ebb6f35f5313df07ea4928e6d3df5

/data/data/com.townrest62/.qcom.townrest62

MD5 046a414913add6f5bb60072c7db819b6
SHA1 451ee4f6809260aec622d772fd329c7d0297a842
SHA256 b66c1320cb063a1d391c94273572ea6edae76c8c8b0a07f8d75c88686f0df72a
SHA512 4e6355f3051ed5e811ab030abde1f5be7f5e1cf33be99cd08477e9b6c015deb1d8bd75a09fb9c7176b8511c5ad0a67abc0902a3531e97564ccb6afc57496a47c

Analysis: behavioral2

Detonation Overview

Submitted

2024-06-24 15:28

Reported

2024-06-24 15:31

Platform

android-x64-20240624-en

Max time kernel

179s

Max time network

145s

Command Line

com.townrest62

Signatures

Octo

banker trojan infostealer rat octo

Octo payload

Description Indicator Process Target
N/A N/A N/A N/A

Loads dropped Dex/Jar

evasion
Description Indicator Process Target
N/A /data/user/0/com.townrest62/cache/siaokec N/A N/A
N/A /data/user/0/com.townrest62/cache/siaokec N/A N/A

Makes use of the framework's Accessibility service

collection evasion credential_access
Description Indicator Process Target
Framework service call android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId N/A N/A
Framework service call android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByViewId N/A N/A

Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps)

banker discovery

Queries the phone number (MSISDN for GSM devices)

discovery

Acquires the wake lock

Description Indicator Process Target
Framework service call android.os.IPowerManager.acquireWakeLock N/A N/A

Makes use of the framework's foreground persistence service

evasion persistence
Description Indicator Process Target
Framework service call android.app.IActivityManager.setServiceForeground N/A N/A

Performs UI accessibility actions on behalf of the user

evasion
Description Indicator Process Target
N/A android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction N/A N/A
N/A android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction N/A N/A
N/A android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction N/A N/A
N/A android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction N/A N/A

Queries the mobile country code (MCC)

discovery
Description Indicator Process Target
Framework service call com.android.internal.telephony.ITelephony.getNetworkCountryIsoForPhone N/A N/A

Reads information about phone network operator.

discovery

Registers a broadcast receiver at runtime (usually for listening for system events)

persistence
Description Indicator Process Target
Framework service call android.app.IActivityManager.registerReceiver N/A N/A

Uses Crypto APIs (Might try to encrypt user data)

impact
Description Indicator Process Target
Framework API call javax.crypto.Cipher.doFinal N/A N/A

Processes

com.townrest62

Network

Country Destination Domain Proto
N/A 224.0.0.251:5353 udp
US 1.1.1.1:53 cruelgurcistandaaaa42.com udp
US 1.1.1.1:53 biricruelidurdursunn.com udp
US 1.1.1.1:53 cruelveblack32.com udp
US 1.1.1.1:53 biricruelidurdursunloo.com udp
TR 45.88.91.112:443 cruelveblack32.com tcp
TR 45.88.91.112:443 cruelveblack32.com tcp
US 1.1.1.1:53 ssl.google-analytics.com udp
GB 216.58.201.104:443 ssl.google-analytics.com tcp
GB 142.250.200.46:443 tcp
US 1.1.1.1:53 android.apis.google.com udp
GB 142.250.187.206:443 android.apis.google.com tcp
TR 45.88.91.112:443 cruelveblack32.com tcp
TR 45.88.91.112:443 cruelveblack32.com tcp
GB 142.250.187.228:443 tcp
GB 142.250.187.228:443 tcp
TR 45.88.91.112:443 cruelveblack32.com tcp
TR 45.88.91.112:443 cruelveblack32.com tcp

Files

/data/data/com.townrest62/cache/siaokec

MD5 ad3527eb79fb0253e0333e419af31c74
SHA1 5250abb05be29fa80e767b1a07f84e722ef84ead
SHA256 a32626932983d09d01ee7e59d196454a5388204c60d7e8b13c45819a04f262ad
SHA512 9235e8f138756f8536bc88916ec13b92c277ef0511c48d542974e1b03b0bc95d275a3c64a596ce17bda36f8a5e96c97c5721e00e21bff0e387e165ab8a0159a9

/data/data/com.townrest62/kl.txt

MD5 eba688537b25c9238905df5423ad31bb
SHA1 4750b22453239113a2b59ef7daa6852eb665df7c
SHA256 d376529af54fabd02caaa7aae57459692daf5b9c3cd8d1bf152a2caf46abd01a
SHA512 6c2c799eea2c7637961dd230993ae494e03757cd55862663a04004c652805e06fbba5d06f778b053295d8e7677b89fc5e04f27ab2a4d60953b1fdbd486029af6

/data/data/com.townrest62/kl.txt

MD5 088c0b057c827b847518d8c3b20a122b
SHA1 49cb896cef7366003d4f8e563813c70b2018d6ed
SHA256 cb980dfcd5ea43889f4a0d047c8e37cf4945ba27766cc0322de6a4be6becea7d
SHA512 e496754085612a0132cb4d1ec7f08799005fe3af62820abcec2b23e2345eea20e67b8ba4d3686fcf4f8d7ea565f141278df69a0be897d7bc873c2de4ca0c8784

/data/data/com.townrest62/kl.txt

MD5 c7836adfa0cbf43a02581e16e80ae68b
SHA1 899b551f2e46278e5e0a517fbf3d7001841956dd
SHA256 4a24854b059df3df7c4d78096e805c045552a38c683b0b30b799e167cf8fb514
SHA512 dcfc7c7b0247696a23ccdf2df5551e088058d7a10592863cf615ed3970b8a8055ee9914a476198cbedec89f56ed69a7565302bdccee8a1e9ab651d628000eec0

/data/data/com.townrest62/kl.txt

MD5 1d1bacad137699e515cd9f593a6d3568
SHA1 a7038326a08612a029ed42727d82ef5467c9c724
SHA256 e084077309e0e8b8ffff33d12ae22482e11354400d8acc0cbf0aa9545a231d50
SHA512 e0e2a0b69b1f87405e9d9ce6c48742174cd1670492339d9c8106cbe8c2364d5f68944f1347d69b4dac14ce3484c4fbfabf677c35f5fba76c8752b01bdfaf23bf

/data/data/com.townrest62/kl.txt

MD5 bd54a0520ea0fed929891dab3fdfc6b5
SHA1 8b1adcca7b6804993264cfcbcc4bbe1f9b692bc1
SHA256 95af07efb12611625ba5432da299d8f5979b395e05dd8351729a0cc2c4b921f2
SHA512 b2a054e00784e1c7883ff83d28ae570dc90066092ed968a4acf6d45f736b93344af8ab47e4247d59582ea1084701545f8a7466173338fcaba7b07bf8ca3ce994

/data/data/com.townrest62/cache/oat/siaokec.cur.prof

MD5 de02d828792bf9e2a4e69d21667be557
SHA1 f203b35d95be343f7a67568dac8595704a6aa000
SHA256 c7c049b6df276c72253de0e2c945c7d45000fc504e5b31876229de68886e91d9
SHA512 a3aa90fac43533251148a12e586dfaa2391a76ebd64691108edcbf16a0a584bc88913ff51ecb37ccd8524356062c904e96ea90cebc6be1f8e7480b5dcd603640

/data/data/com.townrest62/.qcom.townrest62

MD5 046a414913add6f5bb60072c7db819b6
SHA1 451ee4f6809260aec622d772fd329c7d0297a842
SHA256 b66c1320cb063a1d391c94273572ea6edae76c8c8b0a07f8d75c88686f0df72a
SHA512 4e6355f3051ed5e811ab030abde1f5be7f5e1cf33be99cd08477e9b6c015deb1d8bd75a09fb9c7176b8511c5ad0a67abc0902a3531e97564ccb6afc57496a47c