octo | 0ecd18051f04148f72b10daa7b0e49245ba0bf3f0bd81d0b3ee5214933ed382c | Triage

Analysis

max time kernel
149s
max time network
132s
platform
android_x64
resource
android-33-x64-arm64-20240624-en
resource tags

androidarch:arm64arch:x64image:android-33-x64-arm64-20240624-enlocale:en-usos:android-13-x64system
submitted
03-10-2024 22:18

Sharing

Report Analysis Logs

General

Target

0ecd18051f04148f72b10daa7b0e49245ba0bf3f0bd81d0b3ee5214933ed382c.apk
Size

2.2MB
MD5

49f128ea083d8e63c75db7d4517d985b
SHA1

e65e0dd9c71730ffa7271e363f86b81cefcca68c
SHA256

0ecd18051f04148f72b10daa7b0e49245ba0bf3f0bd81d0b3ee5214933ed382c
SHA512

1610346d918993b196737a3bfc5d6a3c703dc1397dc03f120a3b3df45a7c5bdcf5cfb86ab8a2c6926c32b883fd4e3a1303b9f19fa8bdcfd6749836d8e1f77988
SSDEEP

49152:f/zH7ldmAM2nZeIqn5qhMvdw+6v6x95G1/Yip2FIHlx8gSU5WU:fjpdMGZeyGw6o1dIA3x5v

Score

10^/10

octo banker collection credential_access discovery evasion impact infostealer persistence rat trojan

Malware Config

Extracted

Family

octo

C2

https://dijitaldunyayenifikirlervegirisim.xyz/YjdkMWRjNTllNzZi/

https://teknolojininileriyeniliklerrehberi.xyz/YjdkMWRjNTllNzZi/

https://sanatvedogaltasarimlarincografyasi.xyz/YjdkMWRjNTllNzZi/

https://kulturvesanatprojelerindogalteknikler.xyz/YjdkMWRjNTllNzZi/

https://fotografvesanatgozlemlerinesinlen.xyz/YjdkMWRjNTllNzZi/

https://yemektariflerivedogalurunlerkulubu.xyz/YjdkMWRjNTllNzZi/

https://gezginlericinyenirotalarvetavsiyeler.xyz/YjdkMWRjNTllNzZi/

https://sporseverlericinyeniharaketlerrehberi.xyz/YjdkMWRjNTllNzZi/

https://bilimveteknolojionerileridunyasi.xyz/YjdkMWRjNTllNzZi/

https://egitimvegirisimcilikdunyasindan.xyz/YjdkMWRjNTllNzZi/

https://sanatveguncelprojelerplani.xyz/YjdkMWRjNTllNzZi/

https://dijitaloyunvegirisimcilikakademisi.xyz/YjdkMWRjNTllNzZi/

https://dogalhayatvetatilrehberiniz.xyz/YjdkMWRjNTllNzZi/

https://kisiselgelisimvesosyalmedyayonetimi.xyz/YjdkMWRjNTllNzZi/

https://yasamvedogalyontemlerklavuzu.xyz/YjdkMWRjNTllNzZi/

https://kitapvedijitalokumakulubu.xyz/YjdkMWRjNTllNzZi/

https://sinemavetelevizyonprojelerigozlemi.xyz/YjdkMWRjNTllNzZi/

https://oyunvegencgirisimcilergelisim.xyz/YjdkMWRjNTllNzZi/

https://fotografvegundelikgozlemplatformu.xyz/YjdkMWRjNTllNzZi/

https://yeniseyahatvedogalgeziler.xyz/YjdkMWRjNTllNzZi/

rc4.plain

Extracted

Family

octo

C2

https://dijitaldunyayenifikirlervegirisim.xyz/YjdkMWRjNTllNzZi/

https://teknolojininileriyeniliklerrehberi.xyz/YjdkMWRjNTllNzZi/

https://sanatvedogaltasarimlarincografyasi.xyz/YjdkMWRjNTllNzZi/

https://kulturvesanatprojelerindogalteknikler.xyz/YjdkMWRjNTllNzZi/

https://fotografvesanatgozlemlerinesinlen.xyz/YjdkMWRjNTllNzZi/

https://yemektariflerivedogalurunlerkulubu.xyz/YjdkMWRjNTllNzZi/

https://gezginlericinyenirotalarvetavsiyeler.xyz/YjdkMWRjNTllNzZi/

https://sporseverlericinyeniharaketlerrehberi.xyz/YjdkMWRjNTllNzZi/

https://bilimveteknolojionerileridunyasi.xyz/YjdkMWRjNTllNzZi/

https://egitimvegirisimcilikdunyasindan.xyz/YjdkMWRjNTllNzZi/

https://sanatveguncelprojelerplani.xyz/YjdkMWRjNTllNzZi/

https://dijitaloyunvegirisimcilikakademisi.xyz/YjdkMWRjNTllNzZi/

https://dogalhayatvetatilrehberiniz.xyz/YjdkMWRjNTllNzZi/

https://kisiselgelisimvesosyalmedyayonetimi.xyz/YjdkMWRjNTllNzZi/

https://yasamvedogalyontemlerklavuzu.xyz/YjdkMWRjNTllNzZi/

https://kitapvedijitalokumakulubu.xyz/YjdkMWRjNTllNzZi/

https://sinemavetelevizyonprojelerigozlemi.xyz/YjdkMWRjNTllNzZi/

https://oyunvegencgirisimcilergelisim.xyz/YjdkMWRjNTllNzZi/

https://fotografvegundelikgozlemplatformu.xyz/YjdkMWRjNTllNzZi/

https://yeniseyahatvedogalgeziler.xyz/YjdkMWRjNTllNzZi/

AES_key

Signatures

Octo
Octo is a banking malware with remote access capabilities first seen in April 2022.
banker trojan infostealer rat octo

Octo payload 1 IoCs

resource	yara_rule
behavioral2/memory/4342-0.dex	family_octo

Loads dropped Dex/Jar 1 TTPs 1 IoCs

Runs executable file dropped to the device during analysis.

Download New Code at Runtime

ioc	pid	Process
/data/user/0/com.pretty.together/app_before/jgh.json	4342	com.pretty.together

Makes use of the framework's Accessibility service 4 TTPs 2 IoCs

Retrieves information displayed on the phone screen using AccessibilityService.

collection evasion credential_access

Input Injection

Screen Capture

Keylogging

GUI Input Capture

description	ioc	Process
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId	com.pretty.together
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByViewId	com.pretty.together

Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
banker discovery

Security Software Discovery
T1418.001
Queries the phone number (MSISDN for GSM devices) 1 TTPs
discovery

System Network Configuration Discovery
T1422

Acquires the wake lock 1 IoCs

description	ioc	Process
Framework service call	android.os.IPowerManager.acquireWakeLock	com.pretty.together

Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs

Application may abuse the framework's foreground service to continue running in the foreground.

evasion persistence

Foreground Persistence

description	ioc	Process
Framework service call	android.app.IActivityManager.setServiceForeground	com.pretty.together

Performs UI accessibility actions on behalf of the user 1 TTPs 4 IoCs

Application may abuse the accessibility service to prevent their removal.

Prevent Application Removal

ioc	Process
android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction	com.pretty.together
android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction	com.pretty.together
android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction	com.pretty.together
android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction	com.pretty.together

Queries the mobile country code (MCC) 1 TTPs 1 IoCs

System Network Configuration Discovery

description	ioc	Process
Framework service call	com.android.internal.telephony.ITelephony.getNetworkCountryIsoForPhone	com.pretty.together

Reads information about phone network operator. 1 TTPs
discovery

System Network Configuration Discovery
T1422

Requests accessing notifications (often used to intercept notifications before users become aware). 1 TTPs 1 IoCs

collection credential_access

Access Notifications

description	ioc	Process
Intent action	android.settings.ACTION_NOTIFICATION_LISTENER_SETTINGS	com.pretty.together

Requests disabling of battery optimizations (often used to enable hiding in the background). 1 TTPs 1 IoCs

User Evasion

description	ioc	Process
Intent action	android.settings.REQUEST_IGNORE_BATTERY_OPTIMIZATIONS	com.pretty.together

Requests modifying system settings. 1 IoCs

description	ioc	Process
Intent action	android.settings.action.MANAGE_WRITE_SETTINGS	com.pretty.together

Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs

Data Encrypted for Impact

description	ioc	Process
Framework API call	javax.crypto.Cipher.doFinal	com.pretty.together

com.pretty.together
1⤵
- Loads dropped Dex/Jar
- Makes use of the framework's Accessibility service
- Acquires the wake lock
- Makes use of the framework's foreground persistence service
- Performs UI accessibility actions on behalf of the user
- Queries the mobile country code (MCC)
- Requests accessing notifications (often used to intercept notifications before users become aware).
- Requests disabling of battery optimizations (often used to enable hiding in the background).
- Requests modifying system settings.
- Uses Crypto APIs (Might try to encrypt user data)
PID:4342

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Foreground Persistence

Privilege Escalation

Defense Evasion

Download New Code at Runtime

Foreground Persistence

Hide Artifacts

User Evasion

Impair Defenses

Prevent Application Removal

Input Injection

Credential Access

Access Notifications

Input Capture

GUI Input Capture

Keylogging

Discovery

Software Discovery

Security Software Discovery

System Network Configuration Discovery

Lateral Movement

Collection

Access Notifications

Input Capture

GUI Input Capture

Keylogging

Screen Capture

Command and Control

Exfiltration

Impact

Data Encrypted for Impact

Input Injection

Replay Monitor

Loading Replay Monitor...

Downloads

/data/data/com.pretty.together/app_before/jgh.json

Filesize
153KB

MD5
01d84daad852326340d92b51888c4cea

SHA1
a658e5c2ecbb9eef365ef8f215312916e7bf061c

SHA256
9a48bae004ba536d621be978ca5349b3bfce3eaf1008beabe5ce034c39ed9054

SHA512
d39ef623a140f4020d4012d9efa57c4385a89b224f975838d15876e31d8c4c17d0275c4b89158bb4c35ebd2184870bec03e19dcfd8c5f6a3fee9f1b998322803

Download Submit
/data/data/com.pretty.together/app_before/jgh.json

Filesize
153KB

MD5
41fcb65ea567918317c1514fb4986502

SHA1
6c0c58f5169ed93a1f6fbb0b6d17e1260a9b1ba3

SHA256
9f942c8e9494e75cd8dc7afd09e597ca81191b4c208ebfa4a57594e2731683eb

SHA512
1acf7ee844045d66d6371c1ff17b99c496c5197caceb1ebf2606f7b902476bd31a26c29104a22147416d40d3055bee9ec3b1c8cce1a7d9ef0f820574f11eb5e3

Download Submit
/data/user/0/com.pretty.together/app_before/jgh.json

Filesize
451KB

MD5
31a27211b4d07c1d3941949807e162ba

SHA1
35235dfb7a707371cb647e6617ebc777d7bad135

SHA256
a486698ebcd8aacbd40439ed9c4a8c6288f8dfae4a11bd8523c4b740d6bc2460

SHA512
d4069ae249bd4372f1ddfb0223f5bf0047aa8ccc045314ad0b85b405eb2f4d54c00b64ce6069e6f539a60e8d2b9246a69d4506553f1219d6fdf09cfdf53bcd45

Download Submit