Malware Analysis Report

2024-07-28 11:39

Sample ID 240624-wpj9paydqp
Target db28ccb47b99aaecc23d55e99b1a79ecaac1bd1ea41a506d6fc19a715e034f7a.bin
SHA256 db28ccb47b99aaecc23d55e99b1a79ecaac1bd1ea41a506d6fc19a715e034f7a
Tags
octo banker collection credential_access discovery evasion impact infostealer persistence rat stealth trojan
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK Matrix

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

db28ccb47b99aaecc23d55e99b1a79ecaac1bd1ea41a506d6fc19a715e034f7a

Threat Level: Known bad

The file db28ccb47b99aaecc23d55e99b1a79ecaac1bd1ea41a506d6fc19a715e034f7a.bin was found to be: Known bad.

Malicious Activity Summary

octo banker collection credential_access discovery evasion impact infostealer persistence rat stealth trojan

Octo

Octo payload

Removes its main activity from the application launcher

Loads dropped Dex/Jar

Makes use of the framework's Accessibility service

Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps)

Queries the phone number (MSISDN for GSM devices)

Requests accessing notifications (often used to intercept notifications before users become aware).

Performs UI accessibility actions on behalf of the user

Makes use of the framework's foreground persistence service

Acquires the wake lock

Declares services with permission to bind to the system

Queries the unique device ID (IMEI, MEID, IMSI)

Requests modifying system settings.

Declares broadcast receivers with permission to handle system events

Queries the mobile country code (MCC)

Reads information about phone network operator.

Requests disabling of battery optimizations (often used to enable hiding in the background).

Requests dangerous framework permissions

Uses Crypto APIs (Might try to encrypt user data)

Registers a broadcast receiver at runtime (usually for listening for system events)

MITRE ATT&CK Matrix

N/A

Analysis: static1

Detonation Overview

Reported

2024-06-24 18:05

Signatures

Declares broadcast receivers with permission to handle system events

Description Indicator Process Target
Required by device admin receivers to bind with the system. Allows apps to manage device administration features. android.permission.BIND_DEVICE_ADMIN N/A N/A

Declares services with permission to bind to the system

Description Indicator Process Target
Required by accessibility services to bind with the system. Allows apps to access accessibility features. android.permission.BIND_ACCESSIBILITY_SERVICE N/A N/A
Required by notification listener services to bind with the system. Allows apps to listen to and interact with notifications on the device. android.permission.BIND_NOTIFICATION_LISTENER_SERVICE N/A N/A

Requests dangerous framework permissions

Description Indicator Process Target
Allows an application to write to external storage. android.permission.WRITE_EXTERNAL_STORAGE N/A N/A
Allows an application to receive SMS messages. android.permission.RECEIVE_SMS N/A N/A
Allows an application to read SMS messages. android.permission.READ_SMS N/A N/A
Allows an application to send SMS messages. android.permission.SEND_SMS N/A N/A
Allows an application to initiate a phone call without going through the Dialer user interface for the user to confirm the call. android.permission.CALL_PHONE N/A N/A
Allows an application to read or write the system settings. android.permission.WRITE_SETTINGS N/A N/A
Allows read only access to phone state, including the current cellular network information, the status of any ongoing calls, and a list of any PhoneAccounts registered on the device. android.permission.READ_PHONE_STATE N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-06-24 18:05

Reported

2024-06-24 18:19

Platform

android-x86-arm-20240624-en

Max time kernel

178s

Max time network

185s

Command Line

com.goremember1

Signatures

Octo

banker trojan infostealer rat octo

Octo payload

Description Indicator Process Target
N/A N/A N/A N/A

Removes its main activity from the application launcher

stealth trojan evasion
Description Indicator Process Target
N/A N/A N/A N/A

Loads dropped Dex/Jar

evasion
Description Indicator Process Target
N/A /data/user/0/com.goremember1/cache/ezejzto N/A N/A
N/A /data/user/0/com.goremember1/cache/ezejzto N/A N/A

Makes use of the framework's Accessibility service

collection evasion credential_access
Description Indicator Process Target
Framework service call android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId N/A N/A
Framework service call android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByViewId N/A N/A

Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps)

banker discovery

Queries the phone number (MSISDN for GSM devices)

discovery

Acquires the wake lock

Description Indicator Process Target
Framework service call android.os.IPowerManager.acquireWakeLock N/A N/A

Makes use of the framework's foreground persistence service

evasion persistence
Description Indicator Process Target
Framework service call android.app.IActivityManager.setServiceForeground N/A N/A

Performs UI accessibility actions on behalf of the user

evasion
Description Indicator Process Target
N/A android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction N/A N/A
N/A android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction N/A N/A
N/A android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction N/A N/A
N/A android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction N/A N/A

Queries the mobile country code (MCC)

discovery
Description Indicator Process Target
Framework service call com.android.internal.telephony.ITelephony.getNetworkCountryIsoForPhone N/A N/A

Queries the unique device ID (IMEI, MEID, IMSI)

discovery

Reads information about phone network operator.

discovery

Requests accessing notifications (often used to intercept notifications before users become aware).

collection credential_access
Description Indicator Process Target
Intent action android.settings.ACTION_NOTIFICATION_LISTENER_SETTINGS N/A N/A

Requests disabling of battery optimizations (often used to enable hiding in the background).

evasion
Description Indicator Process Target
Intent action android.settings.REQUEST_IGNORE_BATTERY_OPTIMIZATIONS N/A N/A

Requests modifying system settings.

evasion
Description Indicator Process Target
Intent action android.settings.action.MANAGE_WRITE_SETTINGS N/A N/A

Registers a broadcast receiver at runtime (usually for listening for system events)

persistence
Description Indicator Process Target
Framework service call android.app.IActivityManager.registerReceiver N/A N/A

Uses Crypto APIs (Might try to encrypt user data)

impact
Description Indicator Process Target
Framework API call javax.crypto.Cipher.doFinal N/A N/A

Processes

com.goremember1

Network

Country Destination Domain Proto
N/A 224.0.0.251:5353 udp
GB 216.58.213.10:443 tcp
US 1.1.1.1:53 semanticlocation-pa.googleapis.com udp
US 1.1.1.1:53 mamudoilekeyfyap.com udp
US 1.1.1.1:53 mamudoiledostadogru.com udp
RU 193.143.1.9:443 mamudoiledostadogru.com tcp
US 1.1.1.1:53 sigaracokhojdur1.com udp
US 1.1.1.1:53 kaygisizamamutlu04.com udp
RU 193.143.1.9:443 mamudoiledostadogru.com tcp
GB 142.250.200.46:443 tcp
US 1.1.1.1:53 android.apis.google.com udp
GB 142.250.179.238:443 android.apis.google.com tcp
RU 193.143.1.9:443 mamudoiledostadogru.com tcp
US 1.1.1.1:53 dertlikaygisiz04.com udp
RU 193.143.1.9:443 mamudoiledostadogru.com tcp
RU 193.143.1.9:443 mamudoiledostadogru.com tcp
RU 193.143.1.9:443 mamudoiledostadogru.com tcp
RU 193.143.1.9:443 mamudoiledostadogru.com tcp
RU 193.143.1.9:443 mamudoiledostadogru.com tcp
RU 193.143.1.9:443 mamudoiledostadogru.com tcp

Files

/data/data/com.goremember1/cache/ezejzto

MD5 88f1f724916f241ae684b801a8dbbe4a
SHA1 298e25864e5ee0027ca99c048c6b67bfe46a57f0
SHA256 3812f58fd30635f80d7697b06a1bd1826faf30fecbf639b097632fabb03d9aa3
SHA512 f673896f4f2660ac25455a80a919d1ec0fa7acb75b0d28fa3ed8fc464ef99b4f0a642b9c950a467972cfb211f027ac4be5a0921606aeddf768fbe979764abce9

/data/data/com.goremember1/cache/oat/ezejzto.cur.prof

MD5 e2b4c5956033c67030d830ebe2317464
SHA1 3965880b4991ab50ad0dc88e7d92b9d2461a3375
SHA256 f5e0bfb82177ec4989e92d9741368f5583e1e6cca58470ee585278c491a52cd2
SHA512 3743609a2ffa5ce258fcbafd26f7d35c889f991dfdd2f644a71d1b39be3837bee723e5a8ec1642f568e756dc0901e742799636bfb8a99e7e80a872ebaef3f943

Analysis: behavioral2

Detonation Overview

Submitted

2024-06-24 18:05

Reported

2024-06-24 18:19

Platform

android-x64-arm64-20240624-en

Max time kernel

179s

Max time network

185s

Command Line

com.goremember1

Signatures

Octo

banker trojan infostealer rat octo

Octo payload

Description Indicator Process Target
N/A N/A N/A N/A

Loads dropped Dex/Jar

evasion
Description Indicator Process Target
N/A /data/user/0/com.goremember1/cache/ezejzto N/A N/A
N/A /data/user/0/com.goremember1/cache/ezejzto N/A N/A

Makes use of the framework's Accessibility service

collection evasion credential_access
Description Indicator Process Target
Framework service call android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId N/A N/A
Framework service call android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByViewId N/A N/A

Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps)

banker discovery

Queries the phone number (MSISDN for GSM devices)

discovery

Acquires the wake lock

Description Indicator Process Target
Framework service call android.os.IPowerManager.acquireWakeLock N/A N/A

Makes use of the framework's foreground persistence service

evasion persistence
Description Indicator Process Target
Framework service call android.app.IActivityManager.setServiceForeground N/A N/A

Performs UI accessibility actions on behalf of the user

evasion
Description Indicator Process Target
N/A android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction N/A N/A
N/A android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction N/A N/A
N/A android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction N/A N/A
N/A android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction N/A N/A

Queries the mobile country code (MCC)

discovery
Description Indicator Process Target
Framework service call com.android.internal.telephony.ITelephony.getNetworkCountryIsoForPhone N/A N/A

Reads information about phone network operator.

discovery

Requests accessing notifications (often used to intercept notifications before users become aware).

collection credential_access
Description Indicator Process Target
Intent action android.settings.ACTION_NOTIFICATION_LISTENER_SETTINGS N/A N/A

Requests disabling of battery optimizations (often used to enable hiding in the background).

evasion
Description Indicator Process Target
Intent action android.settings.REQUEST_IGNORE_BATTERY_OPTIMIZATIONS N/A N/A

Requests modifying system settings.

evasion
Description Indicator Process Target
Intent action android.settings.action.MANAGE_WRITE_SETTINGS N/A N/A

Uses Crypto APIs (Might try to encrypt user data)

impact
Description Indicator Process Target
Framework API call javax.crypto.Cipher.doFinal N/A N/A

Processes

com.goremember1

Network

Country Destination Domain Proto
GB 216.58.212.238:443 tcp
GB 216.58.212.238:443 tcp
US 1.1.1.1:53 android.apis.google.com udp
GB 142.250.187.206:443 android.apis.google.com tcp
N/A 224.0.0.251:5353 udp
US 1.1.1.1:53 dertlikaygisiz04.com udp
US 1.1.1.1:53 mamudoiledostadogru.com udp
RU 193.143.1.9:443 mamudoiledostadogru.com tcp
US 1.1.1.1:53 kaygisizamamutlu04.com udp
US 1.1.1.1:53 sigaracokhojdur1.com udp
US 1.1.1.1:53 mamudoilekeyfyap.com udp
US 1.1.1.1:53 ssl.google-analytics.com udp
RU 193.143.1.9:443 mamudoiledostadogru.com tcp
GB 216.58.213.8:443 ssl.google-analytics.com tcp
GB 142.250.187.228:443 tcp
GB 142.250.187.228:443 tcp
RU 193.143.1.9:443 mamudoiledostadogru.com tcp
RU 193.143.1.9:443 mamudoiledostadogru.com tcp
RU 193.143.1.9:443 mamudoiledostadogru.com tcp
GB 142.250.200.35:443 tcp
RU 193.143.1.9:443 mamudoiledostadogru.com tcp
RU 193.143.1.9:443 mamudoiledostadogru.com tcp
US 1.1.1.1:53 www.google.com udp
GB 142.250.187.228:443 www.google.com tcp
RU 193.143.1.9:443 mamudoiledostadogru.com tcp
RU 193.143.1.9:443 mamudoiledostadogru.com tcp
RU 193.143.1.9:443 mamudoiledostadogru.com tcp
RU 193.143.1.9:443 mamudoiledostadogru.com tcp
RU 193.143.1.9:443 mamudoiledostadogru.com tcp
RU 193.143.1.9:443 mamudoiledostadogru.com tcp
RU 193.143.1.9:443 mamudoiledostadogru.com tcp
GB 142.250.187.228:443 www.google.com tcp
RU 193.143.1.9:443 mamudoiledostadogru.com tcp
RU 193.143.1.9:443 mamudoiledostadogru.com tcp

Files

/data/data/com.goremember1/cache/ezejzto

MD5 88f1f724916f241ae684b801a8dbbe4a
SHA1 298e25864e5ee0027ca99c048c6b67bfe46a57f0
SHA256 3812f58fd30635f80d7697b06a1bd1826faf30fecbf639b097632fabb03d9aa3
SHA512 f673896f4f2660ac25455a80a919d1ec0fa7acb75b0d28fa3ed8fc464ef99b4f0a642b9c950a467972cfb211f027ac4be5a0921606aeddf768fbe979764abce9

/data/data/com.goremember1/cache/oat/ezejzto.cur.prof

MD5 047ad555eec59d1aac106b17f144d6cd
SHA1 86fcaca87e0f70e4db34f3565bc48247e36201bf
SHA256 aac6fd9a505a7c83c0a65fc1538a8c5030f4389067d402b8866c1f90bd4cc762
SHA512 cca2c11b08da9e8cafb265c104b9f8c3664bbef985eb90848fe554a6caf0029054025960bb1dc11bdb3c6db4a5afa4fcb163578371954cbd3b81a3332792998f