Malware Analysis Report

2024-07-28 11:39

Sample ID 240630-1w1mgawhpc
Target 45e0853f0eed7ad84d6f50cca6b26f41b6aa7466e259e7280b398fde3c2f381a.bin
SHA256 45e0853f0eed7ad84d6f50cca6b26f41b6aa7466e259e7280b398fde3c2f381a
Tags
octo banker collection credential_access discovery evasion impact infostealer persistence rat stealth trojan
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK Matrix

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

45e0853f0eed7ad84d6f50cca6b26f41b6aa7466e259e7280b398fde3c2f381a

Threat Level: Known bad

The file 45e0853f0eed7ad84d6f50cca6b26f41b6aa7466e259e7280b398fde3c2f381a.bin was found to be: Known bad.

Malicious Activity Summary

octo banker collection credential_access discovery evasion impact infostealer persistence rat stealth trojan

Octo payload

Octo

Removes its main activity from the application launcher

Queries the phone number (MSISDN for GSM devices)

Loads dropped Dex/Jar

Makes use of the framework's Accessibility service

Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps)

Requests disabling of battery optimizations (often used to enable hiding in the background).

Queries the unique device ID (IMEI, MEID, IMSI)

Requests accessing notifications (often used to intercept notifications before users become aware).

Queries the mobile country code (MCC)

Declares broadcast receivers with permission to handle system events

Requests dangerous framework permissions

Makes use of the framework's foreground persistence service

Reads information about phone network operator.

Requests modifying system settings.

Acquires the wake lock

Declares services with permission to bind to the system

Performs UI accessibility actions on behalf of the user

Registers a broadcast receiver at runtime (usually for listening for system events)

Uses Crypto APIs (Might try to encrypt user data)

MITRE ATT&CK Matrix

N/A

Analysis: static1

Detonation Overview

Reported

2024-06-30 22:00

Signatures

Declares broadcast receivers with permission to handle system events

Description Indicator Process Target
Required by device admin receivers to bind with the system. Allows apps to manage device administration features. android.permission.BIND_DEVICE_ADMIN N/A N/A

Declares services with permission to bind to the system

Description Indicator Process Target
Required by accessibility services to bind with the system. Allows apps to access accessibility features. android.permission.BIND_ACCESSIBILITY_SERVICE N/A N/A
Required by notification listener services to bind with the system. Allows apps to listen to and interact with notifications on the device. android.permission.BIND_NOTIFICATION_LISTENER_SERVICE N/A N/A

Requests dangerous framework permissions

Description Indicator Process Target
Allows an application to write to external storage. android.permission.WRITE_EXTERNAL_STORAGE N/A N/A
Allows an application to read from external storage. android.permission.READ_EXTERNAL_STORAGE N/A N/A
Allows an application to receive SMS messages. android.permission.RECEIVE_SMS N/A N/A
Allows an application to read SMS messages. android.permission.READ_SMS N/A N/A
Allows an application to send SMS messages. android.permission.SEND_SMS N/A N/A
Allows an application to initiate a phone call without going through the Dialer user interface for the user to confirm the call. android.permission.CALL_PHONE N/A N/A
Allows an application to read or write the system settings. android.permission.WRITE_SETTINGS N/A N/A
Allows read only access to phone state, including the current cellular network information, the status of any ongoing calls, and a list of any PhoneAccounts registered on the device. android.permission.READ_PHONE_STATE N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-06-30 22:00

Reported

2024-06-30 22:03

Platform

android-x86-arm-20240624-en

Max time kernel

46s

Max time network

146s

Command Line

com.playaskt

Signatures

Octo

banker trojan infostealer rat octo

Octo payload

Description Indicator Process Target
N/A N/A N/A N/A

Removes its main activity from the application launcher

stealth trojan evasion
Description Indicator Process Target
N/A N/A N/A N/A

Loads dropped Dex/Jar

evasion
Description Indicator Process Target
N/A /data/user/0/com.playaskt/cache/gfuorsgpfa N/A N/A
N/A /data/user/0/com.playaskt/cache/gfuorsgpfa N/A N/A

Makes use of the framework's Accessibility service

collection evasion credential_access
Description Indicator Process Target
Framework service call android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByViewId N/A N/A
Framework service call android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId N/A N/A

Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps)

banker discovery

Queries the phone number (MSISDN for GSM devices)

discovery

Acquires the wake lock

Description Indicator Process Target
Framework service call android.os.IPowerManager.acquireWakeLock N/A N/A

Makes use of the framework's foreground persistence service

evasion persistence
Description Indicator Process Target
Framework service call android.app.IActivityManager.setServiceForeground N/A N/A

Performs UI accessibility actions on behalf of the user

evasion
Description Indicator Process Target
N/A android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction N/A N/A
N/A android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction N/A N/A
N/A android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction N/A N/A
N/A android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction N/A N/A

Queries the mobile country code (MCC)

discovery
Description Indicator Process Target
Framework service call com.android.internal.telephony.ITelephony.getNetworkCountryIsoForPhone N/A N/A

Queries the unique device ID (IMEI, MEID, IMSI)

discovery

Reads information about phone network operator.

discovery

Requests accessing notifications (often used to intercept notifications before users become aware).

collection credential_access
Description Indicator Process Target
Intent action android.settings.ACTION_NOTIFICATION_LISTENER_SETTINGS N/A N/A

Requests disabling of battery optimizations (often used to enable hiding in the background).

evasion
Description Indicator Process Target
Intent action android.settings.REQUEST_IGNORE_BATTERY_OPTIMIZATIONS N/A N/A

Requests modifying system settings.

evasion
Description Indicator Process Target
Intent action android.settings.action.MANAGE_WRITE_SETTINGS N/A N/A

Registers a broadcast receiver at runtime (usually for listening for system events)

persistence
Description Indicator Process Target
Framework service call android.app.IActivityManager.registerReceiver N/A N/A

Uses Crypto APIs (Might try to encrypt user data)

impact
Description Indicator Process Target
Framework API call javax.crypto.Cipher.doFinal N/A N/A

Processes

com.playaskt

Network

Country Destination Domain Proto
N/A 224.0.0.251:5353 udp
GB 142.250.187.202:443 tcp
US 1.1.1.1:53 semanticlocation-pa.googleapis.com udp
US 1.1.1.1:53 adisback.com udp
RU 193.143.1.24:443 adisback.com tcp
US 1.1.1.1:53 hastagapkamdanuzakdur.com udp
US 1.1.1.1:53 apkmikimseellemesinn2.com udp
US 1.1.1.1:53 usomusikiyorumlaan.com udp
US 1.1.1.1:53 apkmiacmayinlen.com udp
US 1.1.1.1:53 cocacolaiciyorumm.com udp
RU 193.143.1.24:443 adisback.com tcp
GB 142.250.200.46:443 tcp
US 1.1.1.1:53 android.apis.google.com udp
GB 142.250.187.206:443 android.apis.google.com tcp
RU 193.143.1.24:443 adisback.com tcp
RU 193.143.1.24:443 adisback.com tcp
RU 193.143.1.24:443 adisback.com tcp

Files

/data/data/com.playaskt/cache/gfuorsgpfa

MD5 8c24e332ae48825be4baa97b8f6a405a
SHA1 b717c44c654f172b8ce9bc001f98c3e29072c2e6
SHA256 cf2c44ec4c20ed7cf5552117578d60ba8b9a7177274ae2aa84f60c118b446122
SHA512 1aa75b63efdc55bc471cfaf87b0e21f4df3261bc0ac3175762cb6565827bf21548cd8372a3ca0b41f11419c9bf4343965b6976a77e7db35864cb49bbe82c5f3c

/data/data/com.playaskt/kl.txt

MD5 8ecaf40a891ed2ddf94dff47992b0ba2
SHA1 2a44efe441eb2eb5a3711923c9454f24eae5c72e
SHA256 e13327e76ef036c123c006e03b2ac71f1ff0326378679d5eb09d45e04cdb1948
SHA512 df64925ab71035bb03f9b3dfd0a6fb6f52c2e20c6ad04a233b1a64ecff9f3f40d09c7142028be283164386c2a31eed9464cb9131c3c6d91cbb76969c098aa61c

/data/data/com.playaskt/kl.txt

MD5 cafe53dd71e10c53c4d10b3d1c5ea606
SHA1 554f197954c1e588182e32290376658bfe71fdde
SHA256 b27a09d170f53ea33686e19f00c572cfab14b498bd9a71fae738f3d562e65a66
SHA512 7366cfa677e1343be9451ea119c06b9ba0aa105d8c81911b53e8af7ae5161bc75a48fcb514b0961d05923e1c03d313e2def1cf32ebd38565a172584f3ded317a

/data/data/com.playaskt/kl.txt

MD5 30f811aca3a14b0c79faf7b8e93c8f09
SHA1 6c411a69e8748a736733313d10a5b2bdbeba09b3
SHA256 80951d2e62d08379aa7ee35dc879a59e085fa9174075e866093124f591a67e28
SHA512 031d2abcac0963e20384fb269df9038ad86e97f535dc4fff03acc45d2279b01dc165bc1422e3bf0ebe92140331ca914114a0fc3f703d519aa5950c2dbcaad99d

/data/data/com.playaskt/cache/oat/gfuorsgpfa.cur.prof

MD5 e62d38b9de1fbbc10cbe2d915bd34976
SHA1 41574e89bd6628635d8b99bc496822b3b50c33e1
SHA256 f90ad613f64c6d9340bd03ce6787e3d0585c128c05be85f6c4d4d33d1b64afaf
SHA512 979ef50167ecbe97ea18f0c2cf721b98c1b5fa250f7f8678c5febb8738d3f99bd2cc31d943d324a1594d1f658c22c92fe5f65216d7d941c5aa47a1216199b075

Analysis: behavioral2

Detonation Overview

Submitted

2024-06-30 22:00

Reported

2024-06-30 22:03

Platform

android-33-x64-arm64-20240624-en

Max time kernel

179s

Max time network

142s

Command Line

com.playaskt

Signatures

Octo

banker trojan infostealer rat octo

Octo payload

Description Indicator Process Target
N/A N/A N/A N/A

Loads dropped Dex/Jar

evasion
Description Indicator Process Target
N/A /data/user/0/com.playaskt/cache/gfuorsgpfa N/A N/A

Makes use of the framework's Accessibility service

collection evasion credential_access
Description Indicator Process Target
Framework service call android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId N/A N/A
Framework service call android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByViewId N/A N/A

Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps)

banker discovery

Queries the phone number (MSISDN for GSM devices)

discovery

Acquires the wake lock

Description Indicator Process Target
Framework service call android.os.IPowerManager.acquireWakeLock N/A N/A

Makes use of the framework's foreground persistence service

evasion persistence
Description Indicator Process Target
Framework service call android.app.IActivityManager.setServiceForeground N/A N/A

Performs UI accessibility actions on behalf of the user

evasion
Description Indicator Process Target
N/A android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction N/A N/A
N/A android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction N/A N/A
N/A android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction N/A N/A
N/A android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction N/A N/A

Queries the mobile country code (MCC)

discovery
Description Indicator Process Target
Framework service call com.android.internal.telephony.ITelephony.getNetworkCountryIsoForPhone N/A N/A

Reads information about phone network operator.

discovery

Requests accessing notifications (often used to intercept notifications before users become aware).

collection credential_access
Description Indicator Process Target
Intent action android.settings.ACTION_NOTIFICATION_LISTENER_SETTINGS N/A N/A

Requests disabling of battery optimizations (often used to enable hiding in the background).

evasion
Description Indicator Process Target
Intent action android.settings.REQUEST_IGNORE_BATTERY_OPTIMIZATIONS N/A N/A

Requests modifying system settings.

evasion
Description Indicator Process Target
Intent action android.settings.action.MANAGE_WRITE_SETTINGS N/A N/A

Uses Crypto APIs (Might try to encrypt user data)

impact
Description Indicator Process Target
Framework API call javax.crypto.Cipher.doFinal N/A N/A

Processes

com.playaskt

Network

Country Destination Domain Proto
GB 142.250.187.228:443 udp
GB 142.250.187.228:443 tcp
N/A 224.0.0.251:5353 udp
US 1.1.1.1:53 apkmikimseellemesinn2.com udp
US 1.1.1.1:53 apkmiacmayinlen.com udp
US 1.1.1.1:53 colaicmutluol34.com udp
US 1.1.1.1:53 usomusikiyorumlaan.com udp
US 1.1.1.1:53 cocacolaiciyorumm.com udp
US 1.1.1.1:53 hastagapkamdanuzakdur.com udp
US 1.1.1.1:53 adisback.com udp
RU 193.143.1.24:443 adisback.com tcp
RU 193.143.1.24:443 adisback.com tcp
GB 142.250.178.4:443 udp
GB 142.250.178.4:443 tcp
GB 142.250.187.228:443 udp
US 162.159.61.3:443 tcp
US 162.159.61.3:443 tcp
GB 216.58.212.227:443 tcp
US 162.159.61.3:443 udp
GB 216.58.212.227:443 udp
RU 193.143.1.24:443 adisback.com tcp
RU 193.143.1.24:443 adisback.com tcp
RU 193.143.1.24:443 adisback.com tcp
RU 193.143.1.24:443 adisback.com tcp
RU 193.143.1.24:443 adisback.com tcp
RU 193.143.1.24:443 adisback.com tcp
RU 193.143.1.24:443 adisback.com tcp

Files

/data/data/com.playaskt/cache/gfuorsgpfa

MD5 8c24e332ae48825be4baa97b8f6a405a
SHA1 b717c44c654f172b8ce9bc001f98c3e29072c2e6
SHA256 cf2c44ec4c20ed7cf5552117578d60ba8b9a7177274ae2aa84f60c118b446122
SHA512 1aa75b63efdc55bc471cfaf87b0e21f4df3261bc0ac3175762cb6565827bf21548cd8372a3ca0b41f11419c9bf4343965b6976a77e7db35864cb49bbe82c5f3c

/data/data/com.playaskt/kl.txt

MD5 2af937688c597e24e5bb8af31205771a
SHA1 9c2518aacb6517da758ab28fea8f1cefa84b95e9
SHA256 ca09b5d7ad6b04012469ab6e9a73db78ae4e891cf14a8d5d8bda035c95ab53c3
SHA512 2a87efe30ba434bf6d3b884fe6b6ec2f11767eb2a1efc8a388b07db7c1975c487dd90f644178e066e5a3129c188e6393056f63bbb5c59547dacda61b9d4ffa1e

/data/data/com.playaskt/kl.txt

MD5 5009d192c186e03c1ca2027120d45321
SHA1 c2265df6db5d6e185021fece50c2e8c710757926
SHA256 6d38ee051e6de06c388d738fbbefb7a8acbaf0eae06bb405953102d52bb73d1c
SHA512 35d134bf8a0f5914680bcc2d887fe67e876462fb0aaa8ae619528dc6d5d0c16a293bf32d8ab0fd628aaf1b2de31be97e1863404ed761dcad7565b0321a80d069

/data/data/com.playaskt/kl.txt

MD5 6c58731e1b5e403e3343ff5a206a7861
SHA1 4dc2e3ef93e1ed92f119f2fc33dfb6b42e69ed74
SHA256 9b905a38597c19f8d7ac869bb3756e3e50e555605eba72096e82433c740db300
SHA512 cf9ee0a08c40e9a6f30eaa443dc45c16a84133ca85bb2ef6fba822ff07055c28ad4105aebf74e03f43063169ddf9c3362d7a650cacf4b35379d933ae09c92969

/data/data/com.playaskt/kl.txt

MD5 43ad8198f6e450057bbc53d5642789b0
SHA1 c89a997639c987000631130305d90315011e40d3
SHA256 424ec8d68e8f9892c4e0a6c940254efb1d3726fdbce25d7af81dc9e0325ca930
SHA512 98904cd8a62db3cc90ee40f7edab8698555c24ea73b13285e3db28ccc36fa554466f17e4c10a4b493ae09fd428564ff2576322e5f4575e6ac6c0ec161f36376a

/data/data/com.playaskt/kl.txt

MD5 cdd8c7504ad66117cd96c6d8e5c7db72
SHA1 14a2b9253140567bf27173b6a6798dd003b1e1e6
SHA256 0d36bc172da82862493d52bbc7371225b64abb02c3b8987e4ee9ac31575cbdf9
SHA512 eba94e15c4d35595b1cac5ebb55a53ae01fe80c49fc6ade4d43d44d4c0f9123931ca2a6275a14f249166967c242c5a58c112fdd7a248aebe7cf7869802142047

/data/data/com.playaskt/cache/oat/gfuorsgpfa.cur.prof

MD5 dafdb8ffdfbc12dbed0dec201738efec
SHA1 fce40841b211b034ee4ae1a8ac2fb74a456f5062
SHA256 10ae3a152ea94c7af594b5f1071bc3bf4abae8c172fa38f759407171e4dbdf0e
SHA512 95c015e024d708a672d701e20e434aed2ae25e87adc21f7b6e8ae36fc0ef4491f492a2f8cabc112bf1d9967f2fb7f9c3a6a9ab558010c0e64a1ec9296ac25e1d

/data/data/com.playaskt/.qcom.playaskt

MD5 046a414913add6f5bb60072c7db819b6
SHA1 451ee4f6809260aec622d772fd329c7d0297a842
SHA256 b66c1320cb063a1d391c94273572ea6edae76c8c8b0a07f8d75c88686f0df72a
SHA512 4e6355f3051ed5e811ab030abde1f5be7f5e1cf33be99cd08477e9b6c015deb1d8bd75a09fb9c7176b8511c5ad0a67abc0902a3531e97564ccb6afc57496a47c