Analysis Overview

score

10^/10

SHA256

2eda5dcdb7da2eff9afb11dc79782771ed56005dbd8a6b3b118505712865ea96

Threat Level: Known bad

The file 2eda5dcdb7da2eff9afb11dc79782771ed56005dbd8a6b3b118505712865ea96.bin was found to be: Known bad.

Malicious Activity Summary

octo banker collection credential_access discovery evasion impact infostealer persistence rat stealth trojan

Octo payload

Octo

Removes its main activity from the application launcher

Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps)

Queries the phone number (MSISDN for GSM devices)

Makes use of the framework's Accessibility service

Obtains sensitive information copied to the device clipboard

Loads dropped Dex/Jar

Reads information about phone network operator.

Requests disabling of battery optimizations (often used to enable hiding in the background).

Acquires the wake lock

Makes use of the framework's foreground persistence service

Declares broadcast receivers with permission to handle system events

Performs UI accessibility actions on behalf of the user

Queries the unique device ID (IMEI, MEID, IMSI)

Declares services with permission to bind to the system

Requests modifying system settings.

Queries the mobile country code (MCC)

Requests dangerous framework permissions

Requests accessing notifications (often used to intercept notifications before users become aware).

Registers a broadcast receiver at runtime (usually for listening for system events)

Uses Crypto APIs (Might try to encrypt user data)

Checks memory information

Checks CPU information

MITRE ATT&CK Matrix

N/A

Analysis: static1

Detonation Overview

Reported

2024-06-24 18:03

Signatures

Declares broadcast receivers with permission to handle system events

Description	Indicator	Process	Target
Required by device admin receivers to bind with the system. Allows apps to manage device administration features.	android.permission.BIND_DEVICE_ADMIN	N/A	N/A

Declares services with permission to bind to the system

Description	Indicator	Process	Target
Required by accessibility services to bind with the system. Allows apps to access accessibility features.	android.permission.BIND_ACCESSIBILITY_SERVICE	N/A	N/A
Required by notification listener services to bind with the system. Allows apps to listen to and interact with notifications on the device.	android.permission.BIND_NOTIFICATION_LISTENER_SERVICE	N/A	N/A

Requests dangerous framework permissions

Description	Indicator	Process	Target
Allows an application to read from external storage.	android.permission.READ_EXTERNAL_STORAGE	N/A	N/A
Allows an application to write to external storage.	android.permission.WRITE_EXTERNAL_STORAGE	N/A	N/A
Allows an application to receive SMS messages.	android.permission.RECEIVE_SMS	N/A	N/A
Allows an application to read SMS messages.	android.permission.READ_SMS	N/A	N/A
Allows an application to send SMS messages.	android.permission.SEND_SMS	N/A	N/A
Allows an application to initiate a phone call without going through the Dialer user interface for the user to confirm the call.	android.permission.CALL_PHONE	N/A	N/A
Allows an application to read or write the system settings.	android.permission.WRITE_SETTINGS	N/A	N/A
Allows read only access to phone state, including the current cellular network information, the status of any ongoing calls, and a list of any PhoneAccounts registered on the device.	android.permission.READ_PHONE_STATE	N/A	N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-06-24 18:03

Reported

2024-06-24 18:08

Platform

android-x86-arm-20240624-en

Max time kernel

179s

Max time network

133s

Command Line

com.roadcoursec

Signatures

Octo

banker trojan infostealer rat octo

Octo payload

Description	Indicator	Process	Target
N/A	N/A	N/A	N/A

Removes its main activity from the application launcher

stealth trojan evasion

Description	Indicator	Process	Target
N/A	N/A	N/A	N/A

Loads dropped Dex/Jar

evasion

Description	Indicator	Process	Target
N/A	/data/user/0/com.roadcoursec/cache/zuqtbfhml	N/A	N/A
N/A	/data/user/0/com.roadcoursec/cache/zuqtbfhml	N/A	N/A

Makes use of the framework's Accessibility service

collection evasion credential_access

Description	Indicator	Process	Target
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId	N/A	N/A
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByViewId	N/A	N/A

Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps)

banker discovery

Queries the phone number (MSISDN for GSM devices)

discovery

Acquires the wake lock

Description	Indicator	Process	Target
Framework service call	android.os.IPowerManager.acquireWakeLock	N/A	N/A

Makes use of the framework's foreground persistence service

evasion persistence

Description	Indicator	Process	Target
Framework service call	android.app.IActivityManager.setServiceForeground	N/A	N/A

Performs UI accessibility actions on behalf of the user

evasion

Description	Indicator	Process	Target
N/A	android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction	N/A	N/A
N/A	android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction	N/A	N/A
N/A	android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction	N/A	N/A
N/A	android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction	N/A	N/A
N/A	android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction	N/A	N/A

Queries the mobile country code (MCC)

discovery

Description	Indicator	Process	Target
Framework service call	com.android.internal.telephony.ITelephony.getNetworkCountryIsoForPhone	N/A	N/A

Queries the unique device ID (IMEI, MEID, IMSI)

discovery

Reads information about phone network operator.

discovery

Requests accessing notifications (often used to intercept notifications before users become aware).

collection credential_access

Description	Indicator	Process	Target
Intent action	android.settings.ACTION_NOTIFICATION_LISTENER_SETTINGS	N/A	N/A

Requests disabling of battery optimizations (often used to enable hiding in the background).

evasion

Description	Indicator	Process	Target
Intent action	android.settings.REQUEST_IGNORE_BATTERY_OPTIMIZATIONS	N/A	N/A

Requests modifying system settings.

evasion

Description	Indicator	Process	Target
Intent action	android.settings.action.MANAGE_WRITE_SETTINGS	N/A	N/A

Registers a broadcast receiver at runtime (usually for listening for system events)

persistence

Description	Indicator	Process	Target
Framework service call	android.app.IActivityManager.registerReceiver	N/A	N/A

Uses Crypto APIs (Might try to encrypt user data)

impact

Description	Indicator	Process	Target
Framework API call	javax.crypto.Cipher.doFinal	N/A	N/A

Checks CPU information

Description	Indicator	Process	Target
File opened for read	/proc/cpuinfo	N/A	N/A

Checks memory information

Description	Indicator	Process	Target
File opened for read	/proc/meminfo	N/A	N/A

Processes

com.roadcoursec

Network

Country	Destination	Domain	Proto
N/A	224.0.0.251:5353		udp
US	1.1.1.1:53	semanticlocation-pa.googleapis.com	udp
US	1.1.1.1:53	benyemekyememihtiyar2.com	udp
US	1.1.1.1:53	aglayancivciv3.com	udp
US	1.1.1.1:53	sinirlicivciv.com	udp
BG	79.110.49.70:443	sinirlicivciv.com	tcp
US	1.1.1.1:53	benkolaicmemihtiyar51.com	udp
US	1.1.1.1:53	mutlucivciv25.com	udp
BG	79.110.49.70:443	sinirlicivciv.com	tcp
BG	79.110.49.70:443	sinirlicivciv.com	tcp
GB	216.58.204.78:443		tcp
US	1.1.1.1:53	android.apis.google.com	udp
GB	142.250.179.238:443	android.apis.google.com	tcp
BG	79.110.49.70:443	sinirlicivciv.com	tcp
GB	142.250.200.42:443	semanticlocation-pa.googleapis.com	tcp
BG	79.110.49.70:443	sinirlicivciv.com	tcp
BG	79.110.49.70:443	sinirlicivciv.com	tcp
BG	79.110.49.70:443	sinirlicivciv.com	tcp
BG	79.110.49.70:443	sinirlicivciv.com	tcp

Files

/data/data/com.roadcoursec/cache/zuqtbfhml

MD5	2f7bcdc07d2fd614a245122ab6a4e905
SHA1	af65910ff3a1f7bae639d032e500e7fefc7b3847
SHA256	6e89766ddea90e16b8cca8bf9f81a9ed70b2d5b8bb3560b9bdb708662b121474
SHA512	927cc014ef2346033cae6acd90897e9b2cc54e640b2ab3fa9847f7e413d3aca91976ac9a70a30fdadbdc845e79faac9b98b3019b46daad5913f4657ab846d05f

/data/data/com.roadcoursec/kl.txt

MD5	6311c3fd15588bb5c126e6c28ff5fffe
SHA1	ce81d136fce31779f4dd62e20bdaf99c91e2fc57
SHA256	8b82f6032e29a2b5c96031a3630fb6173d12ff0295bc20bb21b877d08f0812d8
SHA512	2975fe2e94b6a8adc9cfc1a865ad113772b54572883a537b02a16dd2d029c0f7d9cca3b154fd849bdfe978e18b396bcf9fa6e67e7c61f92bdc089a29a9c355c6

/data/data/com.roadcoursec/kl.txt

MD5	1f1aa02be802faaa972bb7336e1de763
SHA1	a3f61b67627b5c31b8ae0e32da65f80d7d07e81e
SHA256	52e507bc05317660ef8ee66c9d4ac3dd565e681af55e5c50ac20fd48604d5b49
SHA512	d5f4b1b848e4f962970577dc551d66d4a6f5fc39eaa0b9f488c098f80aa0b33b8e29ed926a73a22b1322473ef4af4b995876100ec0af3867c768dd3732763779

/data/data/com.roadcoursec/kl.txt

MD5	60ee8c465b5e6032e1c4329db6deb4b3
SHA1	fc62c6f1af5001aa3460247799501cd7c89f7deb
SHA256	6a4561f744ad27a707dce7f4a9e31c1f87c910019ef9ed6b6a03e24a74fb6ca9
SHA512	27d38507f3311882013f2c7efc04c526dfc1d029e499af481af392b8cf86463855c6a69f082b5a3f6ead84cd909b1076220ca48a10862e11f777aff82773658b

/data/data/com.roadcoursec/kl.txt

MD5	3b501a0e1bde9b772720d3e78f4b66e1
SHA1	80bf77ebde38c8a769ea976b955de3e9558440bc
SHA256	e2ae530f73a6fba0185ff84fdbc77c722f6bfacf89ed97d6c59565cb24e711b2
SHA512	d948fe86db7403c9f13e8957bb911dcb044e6eec36ceae49de42d7fe4f328fb69bc2a4f93eba58c982038497cc3c3f5c9d1572dbfb022f265f1fdfeade207193

/data/data/com.roadcoursec/kl.txt

MD5	0f2f08ae8a6fb2d06214d15fb6ccde1c
SHA1	b0c917022bffa40cf738eff8d0ca9438d0cc7fd8
SHA256	edf895f597722221f3c357ea4430a259b4a55a2eead38d9f8674a71daf686b0d
SHA512	ceb73a24c4408a534374590b275d7292019bd424577719077212583ab0490c97b32b1ce8a5701aeac8ee1568a4419cb8541fcf0210a4d4965499d33c2e4cb5fb

/data/data/com.roadcoursec/cache/oat/zuqtbfhml.cur.prof

MD5	d8cf3c051496c93728279ed00335c9f0
SHA1	5e6a643805b256beaa1fb5c762973d38fbf3fd8c
SHA256	115bc69f5dad4ef41d385e605079fef5f14798887bc8b85b3b42557a1ded863c
SHA512	9254562d5d2b98bf7ec83b0db61e5caf5d348145a2e18b3e4c05c8baaf501e87ec8e044226f77618fedacc406dda536bcf4814724f60546129f6d1c1edf68d28

/data/data/com.roadcoursec/.qcom.roadcoursec

MD5	046a414913add6f5bb60072c7db819b6
SHA1	451ee4f6809260aec622d772fd329c7d0297a842
SHA256	b66c1320cb063a1d391c94273572ea6edae76c8c8b0a07f8d75c88686f0df72a
SHA512	4e6355f3051ed5e811ab030abde1f5be7f5e1cf33be99cd08477e9b6c015deb1d8bd75a09fb9c7176b8511c5ad0a67abc0902a3531e97564ccb6afc57496a47c

Analysis: behavioral2

Detonation Overview

Submitted

2024-06-24 18:03

Reported

2024-06-24 18:08

Platform

android-x64-20240624-en

Max time kernel

178s

Max time network

160s

Command Line

com.roadcoursec

Signatures

Octo

banker trojan infostealer rat octo

Octo payload

Description	Indicator	Process	Target
N/A	N/A	N/A	N/A

Loads dropped Dex/Jar

evasion

Description	Indicator	Process	Target
N/A	/data/user/0/com.roadcoursec/cache/zuqtbfhml	N/A	N/A
N/A	/data/user/0/com.roadcoursec/cache/zuqtbfhml	N/A	N/A

Makes use of the framework's Accessibility service

collection evasion credential_access

Description	Indicator	Process	Target
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId	N/A	N/A
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByViewId	N/A	N/A

Obtains sensitive information copied to the device clipboard

collection credential_access impact

Description	Indicator	Process	Target
Framework service call	android.content.IClipboard.addPrimaryClipChangedListener	N/A	N/A

Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps)

banker discovery

Queries the phone number (MSISDN for GSM devices)

discovery

Acquires the wake lock

Description	Indicator	Process	Target
Framework service call	android.os.IPowerManager.acquireWakeLock	N/A	N/A

Makes use of the framework's foreground persistence service

evasion persistence

Description	Indicator	Process	Target
Framework service call	android.app.IActivityManager.setServiceForeground	N/A	N/A

Performs UI accessibility actions on behalf of the user

evasion

Description	Indicator	Process	Target
N/A	android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction	N/A	N/A
N/A	android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction	N/A	N/A
N/A	android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction	N/A	N/A
N/A	android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction	N/A	N/A
N/A	android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction	N/A	N/A

Queries the mobile country code (MCC)

discovery

Description	Indicator	Process	Target
Framework service call	com.android.internal.telephony.ITelephony.getNetworkCountryIsoForPhone	N/A	N/A

Reads information about phone network operator.

discovery

Registers a broadcast receiver at runtime (usually for listening for system events)

persistence

Description	Indicator	Process	Target
Framework service call	android.app.IActivityManager.registerReceiver	N/A	N/A

Uses Crypto APIs (Might try to encrypt user data)

impact

Description	Indicator	Process	Target
Framework API call	javax.crypto.Cipher.doFinal	N/A	N/A

Checks CPU information

Description	Indicator	Process	Target
File opened for read	/proc/cpuinfo	N/A	N/A

Checks memory information

Description	Indicator	Process	Target
File opened for read	/proc/meminfo	N/A	N/A

Processes

com.roadcoursec

Network

Country	Destination	Domain	Proto
N/A	224.0.0.251:5353		udp
GB	142.250.179.238:443		tcp
GB	142.250.200.34:443		tcp
US	1.1.1.1:53	ssl.google-analytics.com	udp
GB	142.250.200.40:443	ssl.google-analytics.com	tcp
US	1.1.1.1:53	mutlucivciv25.com	udp
US	1.1.1.1:53	sinirlicivciv.com	udp
BG	79.110.49.70:443	sinirlicivciv.com	tcp
US	1.1.1.1:53	benyemekyememihtiyar2.com	udp
US	1.1.1.1:53	benkolaicmemihtiyar51.com	udp
BG	79.110.49.70:443	sinirlicivciv.com	tcp
BG	79.110.49.70:443	sinirlicivciv.com	tcp
BG	79.110.49.70:443	sinirlicivciv.com	tcp
US	1.1.1.1:53	semanticlocation-pa.googleapis.com	udp
GB	142.250.180.10:443	semanticlocation-pa.googleapis.com	tcp
BG	79.110.49.70:443	sinirlicivciv.com	tcp
BG	79.110.49.70:443	sinirlicivciv.com	tcp
BG	79.110.49.70:443	sinirlicivciv.com	tcp
GB	172.217.16.228:443		tcp
GB	172.217.16.228:443		tcp
BG	79.110.49.70:443	sinirlicivciv.com	tcp
GB	142.250.180.14:443		tcp
US	1.1.1.1:53	android.apis.google.com	udp
GB	172.217.16.238:443	android.apis.google.com	tcp
GB	216.58.201.99:443		tcp
GB	216.58.201.99:443		tcp
GB	216.58.201.99:443		tcp
BG	79.110.49.70:443	sinirlicivciv.com	tcp
BG	79.110.49.70:443	sinirlicivciv.com	tcp

Files

/data/data/com.roadcoursec/cache/zuqtbfhml

MD5	2f7bcdc07d2fd614a245122ab6a4e905
SHA1	af65910ff3a1f7bae639d032e500e7fefc7b3847
SHA256	6e89766ddea90e16b8cca8bf9f81a9ed70b2d5b8bb3560b9bdb708662b121474
SHA512	927cc014ef2346033cae6acd90897e9b2cc54e640b2ab3fa9847f7e413d3aca91976ac9a70a30fdadbdc845e79faac9b98b3019b46daad5913f4657ab846d05f

/data/data/com.roadcoursec/kl.txt

MD5	6311c3fd15588bb5c126e6c28ff5fffe
SHA1	ce81d136fce31779f4dd62e20bdaf99c91e2fc57
SHA256	8b82f6032e29a2b5c96031a3630fb6173d12ff0295bc20bb21b877d08f0812d8
SHA512	2975fe2e94b6a8adc9cfc1a865ad113772b54572883a537b02a16dd2d029c0f7d9cca3b154fd849bdfe978e18b396bcf9fa6e67e7c61f92bdc089a29a9c355c6

/data/data/com.roadcoursec/kl.txt

MD5	b838930ca497cfd1d9d7452af7ce5f7f
SHA1	60ff5554a2df4c9d51ce9d133e24ea8812f0d3bf
SHA256	ba3277441b8706afeea3f95d8f08d9fae45332829a02dca36d51e9d23a85bb26
SHA512	37d054f00fa74c23b82fe33d48e97ad44809ad697ade4e7f59a5cb4649eb4d54a289e83e8fc3f2061347df53d776773270dcbb8923460dad74b8305c4433c5dc

/data/data/com.roadcoursec/kl.txt

MD5	b8fbe89763a3bb4f9c15da4b76df38bd
SHA1	5d2edbb5bc785fcbe6c06807a46e57b9fefd60a6
SHA256	fd38aed348f6d96a566add072cbc6121ee1d5419395222fd21a11f26aba8affb
SHA512	f5ea8b90da97569e3f337ff5a76cbf845ba662fe6f25d17060265e1b0a7e59702c819aefa9a292e27b2f29585053030dca8af193b8548b877d6be372b10fbd90

/data/data/com.roadcoursec/kl.txt

MD5	3d3da3df8334844621699e216cc444d6
SHA1	d2507e0790543c4b715085ab8c7e2ea13f3f8a9f
SHA256	3ea8eb648df0400b5b20c303e6f2b4f131818326d6459d11e19d51fc964ed061
SHA512	015aab90dc169410eaba5ca4f81928f9d4cb0277fdffb708ab782d593154b0b52fc65379e2efa0dd69cf5d624ddfe959cc476cff9052747e3970f599c2c5c5a0

/data/data/com.roadcoursec/kl.txt

MD5	e0fc9487d9223aae21ef6cbc76f80cfe
SHA1	1399122ae195e73025cd90856fbd814abe9108ba
SHA256	f901e941edacd532862bc4e3bbe77226e4040e770bc46996f15fcf5c4ca551b2
SHA512	2753726ffcbf7ccd873b4493fd63e706e68f8e6ab9891053f48950da457ad9f92ffb65775bada9795a569cdbe0eb2303db33b9e446fee0194f0543b4b34c38dd

/data/data/com.roadcoursec/cache/oat/zuqtbfhml.cur.prof

MD5	c1de0642dd59a5629a14c05ddedbfc74
SHA1	793b5b6fc5703c6af19b90e8490d041f73c4c411
SHA256	bf0706228877705cdd18614066c976a28f3fa38e6a9654648ce873879a33c0c2
SHA512	ba2a242b1f5d4e9e3d35c7a67a95fc66ccb0219dde4c8e088529020d2f3f5e2f57b0f7805e6ad0a27ab9b7eb0230d288c78e685e724c17c62d4a73a1b7efb27d

/data/data/com.roadcoursec/.qcom.roadcoursec

MD5	046a414913add6f5bb60072c7db819b6
SHA1	451ee4f6809260aec622d772fd329c7d0297a842
SHA256	b66c1320cb063a1d391c94273572ea6edae76c8c8b0a07f8d75c88686f0df72a
SHA512	4e6355f3051ed5e811ab030abde1f5be7f5e1cf33be99cd08477e9b6c015deb1d8bd75a09fb9c7176b8511c5ad0a67abc0902a3531e97564ccb6afc57496a47c

Sample ID	240624-wmz75avglg
Target	2eda5dcdb7da2eff9afb11dc79782771ed56005dbd8a6b3b118505712865ea96.bin
SHA256	2eda5dcdb7da2eff9afb11dc79782771ed56005dbd8a6b3b118505712865ea96
Tags	octo banker collection credential_access discovery evasion impact infostealer persistence rat stealth trojan

Malware Analysis Report

2024-07-28 11:39

Table of Contents

Analysis Overview

Threat Level: Known bad

Malicious Activity Summary

MITRE ATT&CK Matrix

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files