octo | b634293a427a9ec74715e4db8a21dcfd2b831999dbc5a0bb67a3051e411dcb0f | Triage

Analysis

max time kernel
148s
max time network
151s
platform
android-11_x64
resource
android-x64-arm64-20240910-en
resource tags

arch:armarch:arm64arch:x64arch:x86image:android-x64-arm64-20240910-enlocale:en-usos:android-11-x64system
submitted
03/10/2024, 22:18

Sharing

Report Analysis Logs

General

Target

b634293a427a9ec74715e4db8a21dcfd2b831999dbc5a0bb67a3051e411dcb0f.apk
Size

2.7MB
MD5

e2a3493129dce0c25168118bb0a66eb5
SHA1

5605b7120bd11fd62644350e35099a98dbdff30e
SHA256

b634293a427a9ec74715e4db8a21dcfd2b831999dbc5a0bb67a3051e411dcb0f
SHA512

7b643c7b24a40422e2550536813e8f966011dc61b5cb12d285c353bc797e684a51207ec7deb1e813b980b0207b62ed3668d8be903ba899b4519da50025786563
SSDEEP

49152:8v+evGwZMYjZaqR+khyJdyovhvPMDXlbNhLhwVGONuczT3nJDbLMuFwEHl:8v+E2YjAqgkojvvlM7lbNhLiVVTTBbzV

Score

10^/10

octo banker collection credential_access discovery evasion impact infostealer persistence rat trojan

Malware Config

Extracted

Family

octo

C2

https://dijitaldunyayenifikirlervegirisim.xyz/YjdkMWRjNTllNzZi/

https://teknolojininileriyeniliklerrehberi.xyz/YjdkMWRjNTllNzZi/

https://sanatvedogaltasarimlarincografyasi.xyz/YjdkMWRjNTllNzZi/

https://kulturvesanatprojelerindogalteknikler.xyz/YjdkMWRjNTllNzZi/

https://fotografvesanatgozlemlerinesinlen.xyz/YjdkMWRjNTllNzZi/

https://yemektariflerivedogalurunlerkulubu.xyz/YjdkMWRjNTllNzZi/

https://gezginlericinyenirotalarvetavsiyeler.xyz/YjdkMWRjNTllNzZi/

https://sporseverlericinyeniharaketlerrehberi.xyz/YjdkMWRjNTllNzZi/

https://bilimveteknolojionerileridunyasi.xyz/YjdkMWRjNTllNzZi/

https://egitimvegirisimcilikdunyasindan.xyz/YjdkMWRjNTllNzZi/

https://sanatveguncelprojelerplani.xyz/YjdkMWRjNTllNzZi/

https://dijitaloyunvegirisimcilikakademisi.xyz/YjdkMWRjNTllNzZi/

https://dogalhayatvetatilrehberiniz.xyz/YjdkMWRjNTllNzZi/

https://kisiselgelisimvesosyalmedyayonetimi.xyz/YjdkMWRjNTllNzZi/

https://yasamvedogalyontemlerklavuzu.xyz/YjdkMWRjNTllNzZi/

https://kitapvedijitalokumakulubu.xyz/YjdkMWRjNTllNzZi/

https://sinemavetelevizyonprojelerigozlemi.xyz/YjdkMWRjNTllNzZi/

https://oyunvegencgirisimcilergelisim.xyz/YjdkMWRjNTllNzZi/

https://fotografvegundelikgozlemplatformu.xyz/YjdkMWRjNTllNzZi/

https://yeniseyahatvedogalgeziler.xyz/YjdkMWRjNTllNzZi/

rc4.plain

Extracted

Family

octo

C2

https://dijitaldunyayenifikirlervegirisim.xyz/YjdkMWRjNTllNzZi/

https://teknolojininileriyeniliklerrehberi.xyz/YjdkMWRjNTllNzZi/

https://sanatvedogaltasarimlarincografyasi.xyz/YjdkMWRjNTllNzZi/

https://kulturvesanatprojelerindogalteknikler.xyz/YjdkMWRjNTllNzZi/

https://fotografvesanatgozlemlerinesinlen.xyz/YjdkMWRjNTllNzZi/

https://yemektariflerivedogalurunlerkulubu.xyz/YjdkMWRjNTllNzZi/

https://gezginlericinyenirotalarvetavsiyeler.xyz/YjdkMWRjNTllNzZi/

https://sporseverlericinyeniharaketlerrehberi.xyz/YjdkMWRjNTllNzZi/

https://bilimveteknolojionerileridunyasi.xyz/YjdkMWRjNTllNzZi/

https://egitimvegirisimcilikdunyasindan.xyz/YjdkMWRjNTllNzZi/

https://sanatveguncelprojelerplani.xyz/YjdkMWRjNTllNzZi/

https://dijitaloyunvegirisimcilikakademisi.xyz/YjdkMWRjNTllNzZi/

https://dogalhayatvetatilrehberiniz.xyz/YjdkMWRjNTllNzZi/

https://kisiselgelisimvesosyalmedyayonetimi.xyz/YjdkMWRjNTllNzZi/

https://yasamvedogalyontemlerklavuzu.xyz/YjdkMWRjNTllNzZi/

https://kitapvedijitalokumakulubu.xyz/YjdkMWRjNTllNzZi/

https://sinemavetelevizyonprojelerigozlemi.xyz/YjdkMWRjNTllNzZi/

https://oyunvegencgirisimcilergelisim.xyz/YjdkMWRjNTllNzZi/

https://fotografvegundelikgozlemplatformu.xyz/YjdkMWRjNTllNzZi/

https://yeniseyahatvedogalgeziler.xyz/YjdkMWRjNTllNzZi/

AES_key

Signatures

Octo
Octo is a banking malware with remote access capabilities first seen in April 2022.
banker trojan infostealer rat octo

Octo payload 1 IoCs

resource	yara_rule
behavioral2/memory/4790-0.dex	family_octo

Loads dropped Dex/Jar 1 TTPs 1 IoCs

Runs executable file dropped to the device during analysis.

Download New Code at Runtime

ioc	pid	Process
/data/user/0/com.sample.ship/app_accident/NDpMC.json	4790	com.sample.ship

Makes use of the framework's Accessibility service 4 TTPs 2 IoCs

Retrieves information displayed on the phone screen using AccessibilityService.

collection evasion credential_access

Input Injection

Screen Capture

Keylogging

GUI Input Capture

description	ioc	Process
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId	com.sample.ship
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByViewId	com.sample.ship

Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
banker discovery

Security Software Discovery
T1418.001
Queries the phone number (MSISDN for GSM devices) 1 TTPs
discovery

System Network Configuration Discovery
T1422

Acquires the wake lock 1 IoCs

description	ioc	Process
Framework service call	android.os.IPowerManager.acquireWakeLock	com.sample.ship

Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs

Application may abuse the framework's foreground service to continue running in the foreground.

evasion persistence

Foreground Persistence

description	ioc	Process
Framework service call	android.app.IActivityManager.setServiceForeground	com.sample.ship

Performs UI accessibility actions on behalf of the user 1 TTPs 5 IoCs

Application may abuse the accessibility service to prevent their removal.

Prevent Application Removal

ioc	Process
android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction	com.sample.ship
android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction	com.sample.ship
android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction	com.sample.ship
android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction	com.sample.ship
android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction	com.sample.ship

Queries the mobile country code (MCC) 1 TTPs 1 IoCs

System Network Configuration Discovery

description	ioc	Process
Framework service call	com.android.internal.telephony.ITelephony.getNetworkCountryIsoForPhone	com.sample.ship

Reads information about phone network operator. 1 TTPs
discovery

System Network Configuration Discovery
T1422

Requests accessing notifications (often used to intercept notifications before users become aware). 1 TTPs 1 IoCs

collection credential_access

Access Notifications

description	ioc	Process
Intent action	android.settings.ACTION_NOTIFICATION_LISTENER_SETTINGS	com.sample.ship

Requests disabling of battery optimizations (often used to enable hiding in the background). 1 TTPs 1 IoCs

User Evasion

description	ioc	Process
Intent action	android.settings.REQUEST_IGNORE_BATTERY_OPTIMIZATIONS	com.sample.ship

Requests modifying system settings. 1 IoCs

description	ioc	Process
Intent action	android.settings.action.MANAGE_WRITE_SETTINGS	com.sample.ship

Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs

Data Encrypted for Impact

description	ioc	Process
Framework API call	javax.crypto.Cipher.doFinal	com.sample.ship

com.sample.ship
1⤵
- Loads dropped Dex/Jar
- Makes use of the framework's Accessibility service
- Acquires the wake lock
- Makes use of the framework's foreground persistence service
- Performs UI accessibility actions on behalf of the user
- Queries the mobile country code (MCC)
- Requests accessing notifications (often used to intercept notifications before users become aware).
- Requests disabling of battery optimizations (often used to enable hiding in the background).
- Requests modifying system settings.
- Uses Crypto APIs (Might try to encrypt user data)
PID:4790

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Foreground Persistence

Privilege Escalation

Defense Evasion

Download New Code at Runtime

Foreground Persistence

Hide Artifacts

User Evasion

Impair Defenses

Prevent Application Removal

Input Injection

Credential Access

Access Notifications

Input Capture

GUI Input Capture

Keylogging

Discovery

Software Discovery

Security Software Discovery

System Network Configuration Discovery

Lateral Movement

Collection

Access Notifications

Input Capture

GUI Input Capture

Keylogging

Screen Capture

Command and Control

Exfiltration

Impact

Data Encrypted for Impact

Input Injection

Replay Monitor

Loading Replay Monitor...

Downloads

/data/data/com.sample.ship/app_accident/NDpMC.json

Filesize
153KB

MD5
cd4314e23ca01d9b954702d02e70c770

SHA1
fc0c91d20656ccd632fdab9854e8c6591062e970

SHA256
eb1fb1a21abe8a5cc3fd7a6e6b4fc1fbaa20e9f6b6aa3e0bc0b833874a2a0429

SHA512
efff1c6a0f7759770f3e3bbf4ba9bc09bf8996e1fe2c4488408827a0b12ee5ac42be99b9c8b7f1320c868fb7fa54d1ea6fa10d6f1abb3d39545dc77a26bb74b8

Download Submit
/data/data/com.sample.ship/app_accident/NDpMC.json

Filesize
153KB

MD5
445c6311305a1c47cfc1b2594fea6a19

SHA1
81a00255d59076e1607358b1d1e26e1f4871d2b3

SHA256
b32aea96673e96440afba71fcfc7891817713bbe965edb227d46e4d8c99c3d33

SHA512
9a050a4dfbea73998a658a7fc15f8f38ebb67427e76388f561582bea7cb7517a6cb2e284e6cff0f66ee1f2e64bea77164566a6cd8b8e623b5623243d286657f2

Download Submit
/data/user/0/com.sample.ship/app_accident/NDpMC.json

Filesize
451KB

MD5
897be6ea023b387e36a22a1a55d1ab53

SHA1
b9a950e86c33e531ee5c71b228b1dfd9191ab5fb

SHA256
017365a870ab710a1ccb06a1e03afa18b0084b2954c8e201aca594ad526a3427

SHA512
a844aaf79e76ce8b9d4c7591c8d9a520337f3676f7b249840ae6a0a76ab4c291e317a495d2371a329c06d1a869ddccf83388548dfd5c58e0beacd154ed3bcb34

Download Submit