Malware Analysis Report

2024-07-28 11:39

Sample ID 240630-1wqr9szfnq
Target 6955d484c50c56c043a9d6466baa7c44ef57aad6997813bad7dd267c37ae3190.bin
SHA256 6955d484c50c56c043a9d6466baa7c44ef57aad6997813bad7dd267c37ae3190
Tags
octo banker collection credential_access discovery evasion impact infostealer persistence rat stealth trojan
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK Matrix

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

6955d484c50c56c043a9d6466baa7c44ef57aad6997813bad7dd267c37ae3190

Threat Level: Known bad

The file 6955d484c50c56c043a9d6466baa7c44ef57aad6997813bad7dd267c37ae3190.bin was found to be: Known bad.

Malicious Activity Summary

octo banker collection credential_access discovery evasion impact infostealer persistence rat stealth trojan

Octo

Octo payload

Removes its main activity from the application launcher

Makes use of the framework's Accessibility service

Queries the phone number (MSISDN for GSM devices)

Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps)

Loads dropped Dex/Jar

Reads information about phone network operator.

Declares broadcast receivers with permission to handle system events

Acquires the wake lock

Requests disabling of battery optimizations (often used to enable hiding in the background).

Requests dangerous framework permissions

Requests accessing notifications (often used to intercept notifications before users become aware).

Queries the mobile country code (MCC)

Requests modifying system settings.

Declares services with permission to bind to the system

Queries the unique device ID (IMEI, MEID, IMSI)

Performs UI accessibility actions on behalf of the user

Makes use of the framework's foreground persistence service

Uses Crypto APIs (Might try to encrypt user data)

Registers a broadcast receiver at runtime (usually for listening for system events)

MITRE ATT&CK Matrix

N/A

Analysis: static1

Detonation Overview

Reported

2024-06-30 22:00

Signatures

Declares broadcast receivers with permission to handle system events

Description Indicator Process Target
Required by device admin receivers to bind with the system. Allows apps to manage device administration features. android.permission.BIND_DEVICE_ADMIN N/A N/A

Declares services with permission to bind to the system

Description Indicator Process Target
Required by accessibility services to bind with the system. Allows apps to access accessibility features. android.permission.BIND_ACCESSIBILITY_SERVICE N/A N/A
Required by notification listener services to bind with the system. Allows apps to listen to and interact with notifications on the device. android.permission.BIND_NOTIFICATION_LISTENER_SERVICE N/A N/A

Requests dangerous framework permissions

Description Indicator Process Target
Allows an application to read from external storage. android.permission.READ_EXTERNAL_STORAGE N/A N/A
Allows an application to receive SMS messages. android.permission.RECEIVE_SMS N/A N/A
Allows an application to read SMS messages. android.permission.READ_SMS N/A N/A
Allows an application to send SMS messages. android.permission.SEND_SMS N/A N/A
Allows an application to initiate a phone call without going through the Dialer user interface for the user to confirm the call. android.permission.CALL_PHONE N/A N/A
Allows an application to read or write the system settings. android.permission.WRITE_SETTINGS N/A N/A
Allows read only access to phone state, including the current cellular network information, the status of any ongoing calls, and a list of any PhoneAccounts registered on the device. android.permission.READ_PHONE_STATE N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-06-30 22:00

Reported

2024-06-30 22:03

Platform

android-x86-arm-20240624-en

Max time kernel

47s

Max time network

140s

Command Line

com.broughtyes1

Signatures

Octo

banker trojan infostealer rat octo

Octo payload

Description Indicator Process Target
N/A N/A N/A N/A

Removes its main activity from the application launcher

stealth trojan evasion
Description Indicator Process Target
N/A N/A N/A N/A

Loads dropped Dex/Jar

evasion
Description Indicator Process Target
N/A /data/user/0/com.broughtyes1/cache/iqproznpkcgygqp N/A N/A
N/A /data/user/0/com.broughtyes1/cache/iqproznpkcgygqp N/A N/A

Makes use of the framework's Accessibility service

collection evasion credential_access
Description Indicator Process Target
Framework service call android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId N/A N/A
Framework service call android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByViewId N/A N/A

Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps)

banker discovery

Queries the phone number (MSISDN for GSM devices)

discovery

Acquires the wake lock

Description Indicator Process Target
Framework service call android.os.IPowerManager.acquireWakeLock N/A N/A

Makes use of the framework's foreground persistence service

evasion persistence
Description Indicator Process Target
Framework service call android.app.IActivityManager.setServiceForeground N/A N/A

Performs UI accessibility actions on behalf of the user

evasion
Description Indicator Process Target
N/A android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction N/A N/A
N/A android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction N/A N/A
N/A android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction N/A N/A
N/A android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction N/A N/A

Queries the mobile country code (MCC)

discovery
Description Indicator Process Target
Framework service call com.android.internal.telephony.ITelephony.getNetworkCountryIsoForPhone N/A N/A

Queries the unique device ID (IMEI, MEID, IMSI)

discovery

Reads information about phone network operator.

discovery

Requests accessing notifications (often used to intercept notifications before users become aware).

collection credential_access
Description Indicator Process Target
Intent action android.settings.ACTION_NOTIFICATION_LISTENER_SETTINGS N/A N/A

Requests disabling of battery optimizations (often used to enable hiding in the background).

evasion
Description Indicator Process Target
Intent action android.settings.REQUEST_IGNORE_BATTERY_OPTIMIZATIONS N/A N/A

Requests modifying system settings.

evasion
Description Indicator Process Target
Intent action android.settings.action.MANAGE_WRITE_SETTINGS N/A N/A

Registers a broadcast receiver at runtime (usually for listening for system events)

persistence
Description Indicator Process Target
Framework service call android.app.IActivityManager.registerReceiver N/A N/A

Uses Crypto APIs (Might try to encrypt user data)

impact
Description Indicator Process Target
Framework API call javax.crypto.Cipher.doFinal N/A N/A

Processes

com.broughtyes1

Network

Country Destination Domain Proto
N/A 224.0.0.251:5353 udp
GB 142.250.180.10:443 tcp
US 1.1.1.1:53 semanticlocation-pa.googleapis.com udp
US 1.1.1.1:53 adisback.com udp
RU 193.143.1.24:443 adisback.com tcp
RU 193.143.1.24:443 adisback.com tcp
GB 142.250.187.206:443 tcp
US 1.1.1.1:53 android.apis.google.com udp
GB 142.250.187.206:443 android.apis.google.com tcp
RU 193.143.1.24:443 adisback.com tcp
RU 193.143.1.24:443 adisback.com tcp
RU 193.143.1.24:443 adisback.com tcp

Files

/data/data/com.broughtyes1/cache/iqproznpkcgygqp

MD5 3805a611b3c5106274c117fd7fd17c06
SHA1 80b38ad07adea4cebc968c5660c421a57970b4c7
SHA256 989ce519fc41b71d59f585614a84221215a0d57ad4030ba34b4defa3807e273c
SHA512 6cccf01798f182851bb37b963523638cf148296c11a1aaeb3c9c622bb99689d4725a5edfcf297bdb9fae569d19d084fe0f35f4263b7623fbdef5d02046a3ac02

/data/data/com.broughtyes1/kl.txt

MD5 6518762c0d76eb3f442b376d26d7b2a7
SHA1 042774e71dfca11db34b178eb49823f86faf6035
SHA256 3659025655a5e6c6a08fb1603a19c7466d835d7b8ef01f7c88718ab25f9d6c80
SHA512 cb1d9897eb2b86a43a33cf90945f22e9a3659a674aa9cf0a2f8e04345bc5e07cb8227daab0455841613e6c6add02dd7229ea064b7e39cf8782d3a10d028d3662

/data/data/com.broughtyes1/kl.txt

MD5 01e4c39819b297faf80692d1d12b17ef
SHA1 b016e3a106af64e34bddb6aff7301247e7df1a4d
SHA256 f593673f067414179debe953cca935ff31307d60c30939bda070984e7e4449e2
SHA512 db4db8f77442383d3c3aca291c49fa5a2941cb31a40bdde7517c77b32729deddec5d61d3d3abe6f92d36601a66b947f6b5c2d2f9eb839fd3d1955d2c3957e5dc

Analysis: behavioral2

Detonation Overview

Submitted

2024-06-30 22:00

Reported

2024-06-30 22:04

Platform

android-33-x64-arm64-20240624-en

Max time kernel

178s

Max time network

146s

Command Line

com.broughtyes1

Signatures

Octo

banker trojan infostealer rat octo

Octo payload

Description Indicator Process Target
N/A N/A N/A N/A

Loads dropped Dex/Jar

evasion
Description Indicator Process Target
N/A /data/user/0/com.broughtyes1/cache/iqproznpkcgygqp N/A N/A

Makes use of the framework's Accessibility service

collection evasion credential_access
Description Indicator Process Target
Framework service call android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId N/A N/A
Framework service call android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByViewId N/A N/A

Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps)

banker discovery

Queries the phone number (MSISDN for GSM devices)

discovery

Acquires the wake lock

Description Indicator Process Target
Framework service call android.os.IPowerManager.acquireWakeLock N/A N/A

Makes use of the framework's foreground persistence service

evasion persistence
Description Indicator Process Target
Framework service call android.app.IActivityManager.setServiceForeground N/A N/A

Performs UI accessibility actions on behalf of the user

evasion
Description Indicator Process Target
N/A android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction N/A N/A
N/A android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction N/A N/A
N/A android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction N/A N/A

Queries the mobile country code (MCC)

discovery
Description Indicator Process Target
Framework service call com.android.internal.telephony.ITelephony.getNetworkCountryIsoForPhone N/A N/A

Reads information about phone network operator.

discovery

Requests accessing notifications (often used to intercept notifications before users become aware).

collection credential_access
Description Indicator Process Target
Intent action android.settings.ACTION_NOTIFICATION_LISTENER_SETTINGS N/A N/A

Requests disabling of battery optimizations (often used to enable hiding in the background).

evasion
Description Indicator Process Target
Intent action android.settings.REQUEST_IGNORE_BATTERY_OPTIMIZATIONS N/A N/A

Requests modifying system settings.

evasion
Description Indicator Process Target
Intent action android.settings.action.MANAGE_WRITE_SETTINGS N/A N/A

Uses Crypto APIs (Might try to encrypt user data)

impact
Description Indicator Process Target
Framework API call javax.crypto.Cipher.doFinal N/A N/A

Processes

com.broughtyes1

Network

Country Destination Domain Proto
N/A 224.0.0.251:5353 udp
GB 142.250.187.196:443 udp
GB 142.250.187.196:443 tcp
US 1.1.1.1:53 cocacolaiciyorumm.com udp
US 1.1.1.1:53 usomusikiyorumlaan.com udp
US 1.1.1.1:53 colaicmutluol34.com udp
US 1.1.1.1:53 hastagapkamdanuzakdur.com udp
US 1.1.1.1:53 adisback.com udp
US 1.1.1.1:53 apkmikimseellemesinn2.com udp
RU 193.143.1.24:443 adisback.com tcp
US 1.1.1.1:53 apkmiacmayinlen.com udp
RU 193.143.1.24:443 adisback.com tcp
GB 142.250.187.196:443 udp
GB 172.217.169.68:443 udp
GB 172.217.169.68:443 tcp
RU 193.143.1.24:443 adisback.com tcp
US 172.64.41.3:443 tcp
US 172.64.41.3:443 tcp
GB 142.250.200.3:443 tcp
US 172.64.41.3:443 udp
GB 142.250.200.3:443 udp
RU 193.143.1.24:443 adisback.com tcp
RU 193.143.1.24:443 adisback.com tcp

Files

/data/data/com.broughtyes1/cache/iqproznpkcgygqp

MD5 3805a611b3c5106274c117fd7fd17c06
SHA1 80b38ad07adea4cebc968c5660c421a57970b4c7
SHA256 989ce519fc41b71d59f585614a84221215a0d57ad4030ba34b4defa3807e273c
SHA512 6cccf01798f182851bb37b963523638cf148296c11a1aaeb3c9c622bb99689d4725a5edfcf297bdb9fae569d19d084fe0f35f4263b7623fbdef5d02046a3ac02

/data/data/com.broughtyes1/kl.txt

MD5 857a3c98ef8a72558a80592d9de35a1a
SHA1 8044adf781c310194a6bde6148ddf2d10a0ccc5e
SHA256 d576c49264dbbe7236c0122a975eb32d2e7e64c38dbddc6ab106d161ed5ef3f0
SHA512 630c56167b0f11b3362d56a9841577ff137f4e3f6b8908ae0bf458b3d3463499a870d79ee36047bc25316c941a107a466b5d8d028f93fd3dc8c7ac8b6df0644a

/data/data/com.broughtyes1/kl.txt

MD5 bc4fe8099dd0b5b59da7891645bec47e
SHA1 31314f0aa9b48f813a94975fc8011e9ba16fad6b
SHA256 240c0773ca5833490c54534ddd235fd14d891acb74bd5c5a514bf9efb378932c
SHA512 b8036ac179be4620d06f05e7fbd5d621ff38da3fa90a4ce5a05bede89fd0e8da5df986c84fcf9457897e7c0edc8a8d28dda495b3566e9ac6a5df7aab8563ffb4

/data/data/com.broughtyes1/kl.txt

MD5 0e2bbed05447a6281c2adb72018a77f8
SHA1 9f53e4e26359ee82e507b8ae578714b22eb9fe2a
SHA256 6d41b88bce635c68667b4901d614cb831bac0083a61053216931036898423976
SHA512 9c099614b9365a9c0f4dee3ed13bd8ea4692a15a0619aa702e3db53c9e5090868f88aae1faf556529f9ed5ad2c2dd16861cc01ad50c95d5d5402d45c64116a0f

/data/data/com.broughtyes1/kl.txt

MD5 a45761bbe88cdb743c852405cfdbd96b
SHA1 9d92f70f6bd379cc0f0c4a3e948347fc47e49d0e
SHA256 04eaa65da826773747fd1ca61a6c575511fc1c546106f95aa03ad209ea0f270c
SHA512 3cba85397e98bfb73c10ea22f150a23d5204de4cd9071801166c0b3efc0690f8699ffc0facfba0d5c5bc27580a1b32af565469ca3b03fadf3f76160ca50a35f8

/data/data/com.broughtyes1/kl.txt

MD5 6ae5078da147a172369f4a63c14e3f03
SHA1 84419404348651c4b13749b967faf623084b9509
SHA256 9d14c69b1e5d753fe0042d3da973a07749567723576e05dfd10bee647b52265d
SHA512 40fececd87c57af7a8576a49899068bda22ef9d54f8d7dd94c46aa975ef02406e9edf6ff52a4ebad1c15598d9ce7b71ef1a9ceb69ab26202125aaae0d01e28f0

/data/data/com.broughtyes1/cache/oat/iqproznpkcgygqp.cur.prof

MD5 f4da494d3249ac5b49dbe87822016820
SHA1 55383cf7547822a21e267ee73d56414fed36b5e0
SHA256 2293b69e7d1a0a6bbd31ad393f17da6e86d5ac1d6ae5116cbe4706456b923776
SHA512 87e12149c7df63df8b1b9beccd229e6c7cd23619d06ddb9082cc9dbf4d1f53b26a51bd0c1727a3a6e1f99b205a0caa410c023ae2f1bcdc5bba59a8dfcfea1802

/data/data/com.broughtyes1/.qcom.broughtyes1

MD5 046a414913add6f5bb60072c7db819b6
SHA1 451ee4f6809260aec622d772fd329c7d0297a842
SHA256 b66c1320cb063a1d391c94273572ea6edae76c8c8b0a07f8d75c88686f0df72a
SHA512 4e6355f3051ed5e811ab030abde1f5be7f5e1cf33be99cd08477e9b6c015deb1d8bd75a09fb9c7176b8511c5ad0a67abc0902a3531e97564ccb6afc57496a47c