octo | 5188918349077a24492fb57d36fcf5f6f5d9abcf8307bb9229b8d6ffe1d28785 | Triage

Analysis

max time kernel
149s
max time network
132s
platform
android_x86
resource
android-x86-arm-20240624-en
resource tags

androidarch:armarch:x86image:android-x86-arm-20240624-enlocale:en-usos:android-9-x86system
submitted
03/10/2024, 22:18

Sharing

Report Analysis Logs

General

Target

5188918349077a24492fb57d36fcf5f6f5d9abcf8307bb9229b8d6ffe1d28785.apk
Size

2.8MB
MD5

ff99715bddf010b33d4a3eef410a3fe7
SHA1

81bf41574e1d76732e2fc9f494acfc23ea5baa98
SHA256

5188918349077a24492fb57d36fcf5f6f5d9abcf8307bb9229b8d6ffe1d28785
SHA512

df52612f45e1ccf7962317693e7ed80fdd28879b1eeb1ce0998a2b7368832c999f7eda1a3766070d2b7306443d3da1270897f5103b8b445c3876f9b1845a24e6
SSDEEP

49152:p4toCjw1yIYcdCQXHEr45tQvPBhcu5ZEpdWqusK8EM61cnXaodcqfnUK1dQ3mLiU:CtofRYcd35tMPcubEOqus53YcnXbdnfj

Score

10^/10

octo banker collection credential_access discovery evasion impact infostealer persistence rat stealth trojan

Malware Config

Extracted

Family

octo

C2

https://dijitaldunyayenifikirlervegirisim.xyz/YjdkMWRjNTllNzZi/

https://teknolojininileriyeniliklerrehberi.xyz/YjdkMWRjNTllNzZi/

https://sanatvedogaltasarimlarincografyasi.xyz/YjdkMWRjNTllNzZi/

https://kulturvesanatprojelerindogalteknikler.xyz/YjdkMWRjNTllNzZi/

https://fotografvesanatgozlemlerinesinlen.xyz/YjdkMWRjNTllNzZi/

https://yemektariflerivedogalurunlerkulubu.xyz/YjdkMWRjNTllNzZi/

https://gezginlericinyenirotalarvetavsiyeler.xyz/YjdkMWRjNTllNzZi/

https://sporseverlericinyeniharaketlerrehberi.xyz/YjdkMWRjNTllNzZi/

https://bilimveteknolojionerileridunyasi.xyz/YjdkMWRjNTllNzZi/

https://egitimvegirisimcilikdunyasindan.xyz/YjdkMWRjNTllNzZi/

https://sanatveguncelprojelerplani.xyz/YjdkMWRjNTllNzZi/

https://dijitaloyunvegirisimcilikakademisi.xyz/YjdkMWRjNTllNzZi/

https://dogalhayatvetatilrehberiniz.xyz/YjdkMWRjNTllNzZi/

https://kisiselgelisimvesosyalmedyayonetimi.xyz/YjdkMWRjNTllNzZi/

https://yasamvedogalyontemlerklavuzu.xyz/YjdkMWRjNTllNzZi/

https://kitapvedijitalokumakulubu.xyz/YjdkMWRjNTllNzZi/

https://sinemavetelevizyonprojelerigozlemi.xyz/YjdkMWRjNTllNzZi/

https://oyunvegencgirisimcilergelisim.xyz/YjdkMWRjNTllNzZi/

https://fotografvegundelikgozlemplatformu.xyz/YjdkMWRjNTllNzZi/

https://yeniseyahatvedogalgeziler.xyz/YjdkMWRjNTllNzZi/

rc4.plain

Extracted

Family

octo

C2

https://dijitaldunyayenifikirlervegirisim.xyz/YjdkMWRjNTllNzZi/

https://teknolojininileriyeniliklerrehberi.xyz/YjdkMWRjNTllNzZi/

https://sanatvedogaltasarimlarincografyasi.xyz/YjdkMWRjNTllNzZi/

https://kulturvesanatprojelerindogalteknikler.xyz/YjdkMWRjNTllNzZi/

https://fotografvesanatgozlemlerinesinlen.xyz/YjdkMWRjNTllNzZi/

https://yemektariflerivedogalurunlerkulubu.xyz/YjdkMWRjNTllNzZi/

https://gezginlericinyenirotalarvetavsiyeler.xyz/YjdkMWRjNTllNzZi/

https://sporseverlericinyeniharaketlerrehberi.xyz/YjdkMWRjNTllNzZi/

https://bilimveteknolojionerileridunyasi.xyz/YjdkMWRjNTllNzZi/

https://egitimvegirisimcilikdunyasindan.xyz/YjdkMWRjNTllNzZi/

https://sanatveguncelprojelerplani.xyz/YjdkMWRjNTllNzZi/

https://dijitaloyunvegirisimcilikakademisi.xyz/YjdkMWRjNTllNzZi/

https://dogalhayatvetatilrehberiniz.xyz/YjdkMWRjNTllNzZi/

https://kisiselgelisimvesosyalmedyayonetimi.xyz/YjdkMWRjNTllNzZi/

https://yasamvedogalyontemlerklavuzu.xyz/YjdkMWRjNTllNzZi/

https://kitapvedijitalokumakulubu.xyz/YjdkMWRjNTllNzZi/

https://sinemavetelevizyonprojelerigozlemi.xyz/YjdkMWRjNTllNzZi/

https://oyunvegencgirisimcilergelisim.xyz/YjdkMWRjNTllNzZi/

https://fotografvegundelikgozlemplatformu.xyz/YjdkMWRjNTllNzZi/

https://yeniseyahatvedogalgeziler.xyz/YjdkMWRjNTllNzZi/

AES_key

Signatures

Octo
Octo is a banking malware with remote access capabilities first seen in April 2022.
banker trojan infostealer rat octo

Octo payload 2 IoCs

resource	yara_rule
behavioral1/memory/4275-0.dex	family_octo
behavioral1/memory/4248-0.dex	family_octo

Removes its main activity from the application launcher 1 TTPs 1 IoCs

stealth trojan evasion

Suppress Application Icon

pid	Process
4248	com.tuition.record

Loads dropped Dex/Jar 1 TTPs 2 IoCs

Runs executable file dropped to the device during analysis.

Download New Code at Runtime

ioc	pid	Process
/data/user/0/com.tuition.record/app_fade/HKTFK.json	4275	/system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.tuition.record/app_fade/HKTFK.json --output-vdex-fd=41 --oat-fd=42 --oat-location=/data/user/0/com.tuition.record/app_fade/oat/x86/HKTFK.odex --compiler-filter=quicken --class-loader-context=&
/data/user/0/com.tuition.record/app_fade/HKTFK.json	4248	com.tuition.record

Makes use of the framework's Accessibility service 4 TTPs 2 IoCs

Retrieves information displayed on the phone screen using AccessibilityService.

collection evasion credential_access

Input Injection

Screen Capture

Keylogging

GUI Input Capture

description	ioc	Process
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId	com.tuition.record
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByViewId	com.tuition.record

Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
banker discovery

Security Software Discovery
T1418.001
Queries the phone number (MSISDN for GSM devices) 1 TTPs
discovery

System Network Configuration Discovery
T1422

Acquires the wake lock 1 IoCs

description	ioc	Process
Framework service call	android.os.IPowerManager.acquireWakeLock	com.tuition.record

Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs

Application may abuse the framework's foreground service to continue running in the foreground.

evasion persistence

Foreground Persistence

description	ioc	Process
Framework service call	android.app.IActivityManager.setServiceForeground	com.tuition.record

Performs UI accessibility actions on behalf of the user 1 TTPs 4 IoCs

Application may abuse the accessibility service to prevent their removal.

Prevent Application Removal

ioc	Process
android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction	com.tuition.record
android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction	com.tuition.record
android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction	com.tuition.record
android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction	com.tuition.record

Queries the mobile country code (MCC) 1 TTPs 1 IoCs

System Network Configuration Discovery

description	ioc	Process
Framework service call	com.android.internal.telephony.ITelephony.getNetworkCountryIsoForPhone	com.tuition.record

Queries the unique device ID (IMEI, MEID, IMSI) 1 TTPs
discovery

System Network Configuration Discovery
T1422
Reads information about phone network operator. 1 TTPs
discovery

System Network Configuration Discovery
T1422

Requests accessing notifications (often used to intercept notifications before users become aware). 1 TTPs 1 IoCs

collection credential_access

Access Notifications

description	ioc	Process
Intent action	android.settings.ACTION_NOTIFICATION_LISTENER_SETTINGS	com.tuition.record

Requests disabling of battery optimizations (often used to enable hiding in the background). 1 TTPs 1 IoCs

User Evasion

description	ioc	Process
Intent action	android.settings.REQUEST_IGNORE_BATTERY_OPTIMIZATIONS	com.tuition.record

Requests modifying system settings. 1 IoCs

description	ioc	Process
Intent action	android.settings.action.MANAGE_WRITE_SETTINGS	com.tuition.record

Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs

Broadcast Receivers

description	ioc	Process
Framework service call	android.app.IActivityManager.registerReceiver	com.tuition.record

Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs

Data Encrypted for Impact

description	ioc	Process
Framework API call	javax.crypto.Cipher.doFinal	com.tuition.record

com.tuition.record
1⤵
- Removes its main activity from the application launcher
- Loads dropped Dex/Jar
- Makes use of the framework's Accessibility service
- Acquires the wake lock
- Makes use of the framework's foreground persistence service
- Performs UI accessibility actions on behalf of the user
- Queries the mobile country code (MCC)
- Requests accessing notifications (often used to intercept notifications before users become aware).
- Requests disabling of battery optimizations (often used to enable hiding in the background).
- Requests modifying system settings.
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Uses Crypto APIs (Might try to encrypt user data)
PID:4248
- /system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.tuition.record/app_fade/HKTFK.json --output-vdex-fd=41 --oat-fd=42 --oat-location=/data/user/0/com.tuition.record/app_fade/oat/x86/HKTFK.odex --compiler-filter=quicken --class-loader-context=&
  2⤵
  - Loads dropped Dex/Jar
  PID:4275

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Event Triggered Execution

Broadcast Receivers

Foreground Persistence

Privilege Escalation

Defense Evasion

Download New Code at Runtime

Foreground Persistence

Hide Artifacts

Suppress Application Icon

User Evasion

Impair Defenses

Prevent Application Removal

Input Injection

Credential Access

Access Notifications

Input Capture

GUI Input Capture

Keylogging

Discovery

Software Discovery

Security Software Discovery

System Network Configuration Discovery

Lateral Movement

Collection

Access Notifications

Input Capture

GUI Input Capture

Keylogging

Screen Capture

Command and Control

Exfiltration

Impact

Data Encrypted for Impact

Input Injection

Replay Monitor

Loading Replay Monitor...

Downloads

/data/data/com.tuition.record/app_fade/HKTFK.json

Filesize
153KB

MD5
7f1aa1fb0b39920d77acfbe48f07cefe

SHA1
65af442325ad26683a5eb619065abf3715871710

SHA256
ae3c06a43c4e64d0f9d2f44b88b233174bcf4b61385738845ac9356cd08cdfce

SHA512
00df59755d31fe5820f82afe164cbdcc138772f756c675c5592a992d0fa3bdf2feb1cfbc1574b436854a749453f4bf4de89e240ade13f40ebad38cfa89a43fcc

Download Submit
/data/data/com.tuition.record/app_fade/HKTFK.json

Filesize
153KB

MD5
dbacb7d891a8c032fbc9af4a3b2635ae

SHA1
0bea9acf3f27fd76bd1fa5f2abe0907929b3f3c2

SHA256
3abfb7aabbd2fd249feb076a9ebbdd7f715d365271a7525a311cd4ec2e536091

SHA512
d8fedf437c806b45434e88f9cd805d971f154cc0cc93c2fcb8154f96b5946ecfe86e7d043c19223d35e573497e0aae4e060b4744255e86f2e8b91af8509fa782

Download Submit
/data/user/0/com.tuition.record/app_fade/HKTFK.json

Filesize
451KB

MD5
2d9a2aceb9cfd532d34334bd62f669a1

SHA1
f781bd657fa0be899e60120383a04b21c86f62e3

SHA256
c1e7f71a7b01fd1b3bd0fd80d4167ebd91d5739122904a26655402f20655cb43

SHA512
4076ee706dee5572625158ca8f47e4ee4fd928c9f5eae276863d9dbf8b294cd02737de4810b23978f13486391e30aed524d9c037ea8559c6cadcb649b73157f8

Download Submit
/data/user/0/com.tuition.record/app_fade/HKTFK.json

Filesize
451KB

MD5
4549c1ce4e57282e169d7330d5360d82

SHA1
7206a6222ee7439ffb6d09b4616ecd540ce4a2da

SHA256
94ca4d24cb6894f986da9b65bc6953035766f3fca4074366645ad770d4886a0c

SHA512
c3a276050ab5252397b179b1d2c80e03d04fdcaea7f5153128afd62fd9091a72703b698fea8042f58f2e9a434565db07680282f44eb40ca1ac117153d0f271a7

Download Submit