octo | 6ae4323344c82ecce2dd06e8cca2c82e0333ea9fcbd3e3b02897cbf99c6ee416 | Triage

Analysis

max time kernel
46s
max time network
133s
platform
android_x86
resource
android-x86-arm-20240624-en
resource tags

androidarch:armarch:x86image:android-x86-arm-20240624-enlocale:en-usos:android-9-x86system
submitted
03/10/2024, 22:01

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

6ae4323344c82ecce2dd06e8cca2c82e0333ea9fcbd3e3b02897cbf99c6ee416.apk
Size

2.1MB
MD5

e47e7a27b9e75dbcaee66e1dfe2fca40
SHA1

78fcce66bb94a1a23ff57320c66a20d277191a55
SHA256

6ae4323344c82ecce2dd06e8cca2c82e0333ea9fcbd3e3b02897cbf99c6ee416
SHA512

6a1245d074b067173a644b3e52cca6a65c9783390665bcd4819e982a77f0b97eea163a9fdac923338f6fda8a8af42d30aa81a630ab18f96d88705db75aa28d18
SSDEEP

49152:4OQIYcdakx6aB0uCqJoMHCB2H7cD7P5J+UsXf7HSaJDl:4cYcdakx6artJoMHYS7bXjHp5

Score

10^/10

octo banker collection credential_access discovery evasion impact infostealer persistence rat stealth trojan

Malware Config

Extracted

Family

octo

C2

https://dijitaldunyayenifikirlervegirisim.xyz/YjdkMWRjNTllNzZi/

https://teknolojininileriyeniliklerrehberi.xyz/YjdkMWRjNTllNzZi/

https://sanatvedogaltasarimlarincografyasi.xyz/YjdkMWRjNTllNzZi/

https://kulturvesanatprojelerindogalteknikler.xyz/YjdkMWRjNTllNzZi/

https://fotografvesanatgozlemlerinesinlen.xyz/YjdkMWRjNTllNzZi/

https://yemektariflerivedogalurunlerkulubu.xyz/YjdkMWRjNTllNzZi/

https://gezginlericinyenirotalarvetavsiyeler.xyz/YjdkMWRjNTllNzZi/

https://sporseverlericinyeniharaketlerrehberi.xyz/YjdkMWRjNTllNzZi/

https://bilimveteknolojionerileridunyasi.xyz/YjdkMWRjNTllNzZi/

https://egitimvegirisimcilikdunyasindan.xyz/YjdkMWRjNTllNzZi/

https://sanatveguncelprojelerplani.xyz/YjdkMWRjNTllNzZi/

https://dijitaloyunvegirisimcilikakademisi.xyz/YjdkMWRjNTllNzZi/

https://dogalhayatvetatilrehberiniz.xyz/YjdkMWRjNTllNzZi/

https://kisiselgelisimvesosyalmedyayonetimi.xyz/YjdkMWRjNTllNzZi/

https://yasamvedogalyontemlerklavuzu.xyz/YjdkMWRjNTllNzZi/

https://kitapvedijitalokumakulubu.xyz/YjdkMWRjNTllNzZi/

https://sinemavetelevizyonprojelerigozlemi.xyz/YjdkMWRjNTllNzZi/

https://oyunvegencgirisimcilergelisim.xyz/YjdkMWRjNTllNzZi/

https://fotografvegundelikgozlemplatformu.xyz/YjdkMWRjNTllNzZi/

https://yeniseyahatvedogalgeziler.xyz/YjdkMWRjNTllNzZi/

rc4.plain

Extracted

Family

octo

C2

https://dijitaldunyayenifikirlervegirisim.xyz/YjdkMWRjNTllNzZi/

https://teknolojininileriyeniliklerrehberi.xyz/YjdkMWRjNTllNzZi/

https://sanatvedogaltasarimlarincografyasi.xyz/YjdkMWRjNTllNzZi/

https://kulturvesanatprojelerindogalteknikler.xyz/YjdkMWRjNTllNzZi/

https://fotografvesanatgozlemlerinesinlen.xyz/YjdkMWRjNTllNzZi/

https://yemektariflerivedogalurunlerkulubu.xyz/YjdkMWRjNTllNzZi/

https://gezginlericinyenirotalarvetavsiyeler.xyz/YjdkMWRjNTllNzZi/

https://sporseverlericinyeniharaketlerrehberi.xyz/YjdkMWRjNTllNzZi/

https://bilimveteknolojionerileridunyasi.xyz/YjdkMWRjNTllNzZi/

https://egitimvegirisimcilikdunyasindan.xyz/YjdkMWRjNTllNzZi/

https://sanatveguncelprojelerplani.xyz/YjdkMWRjNTllNzZi/

https://dijitaloyunvegirisimcilikakademisi.xyz/YjdkMWRjNTllNzZi/

https://dogalhayatvetatilrehberiniz.xyz/YjdkMWRjNTllNzZi/

https://kisiselgelisimvesosyalmedyayonetimi.xyz/YjdkMWRjNTllNzZi/

https://yasamvedogalyontemlerklavuzu.xyz/YjdkMWRjNTllNzZi/

https://kitapvedijitalokumakulubu.xyz/YjdkMWRjNTllNzZi/

https://sinemavetelevizyonprojelerigozlemi.xyz/YjdkMWRjNTllNzZi/

https://oyunvegencgirisimcilergelisim.xyz/YjdkMWRjNTllNzZi/

https://fotografvegundelikgozlemplatformu.xyz/YjdkMWRjNTllNzZi/

https://yeniseyahatvedogalgeziler.xyz/YjdkMWRjNTllNzZi/

AES_key

Signatures

Octo
Octo is a banking malware with remote access capabilities first seen in April 2022.
banker trojan infostealer rat octo

Octo payload 2 IoCs

resource	yara_rule
behavioral1/memory/4276-0.dex	family_octo
behavioral1/memory/4249-0.dex	family_octo

Removes its main activity from the application launcher 1 TTPs 1 IoCs

stealth trojan evasion

Suppress Application Icon

pid	Process
4249	com.volcano.apology

Loads dropped Dex/Jar 1 TTPs 2 IoCs

Runs executable file dropped to the device during analysis.

Download New Code at Runtime

ioc	pid	Process
/data/user/0/com.volcano.apology/app_visa/JsBnEya.json	4276	/system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.volcano.apology/app_visa/JsBnEya.json --output-vdex-fd=41 --oat-fd=42 --oat-location=/data/user/0/com.volcano.apology/app_visa/oat/x86/JsBnEya.odex --compiler-filter=quicken --class-loader-context=&
/data/user/0/com.volcano.apology/app_visa/JsBnEya.json	4249	com.volcano.apology

Makes use of the framework's Accessibility service 4 TTPs 2 IoCs

Retrieves information displayed on the phone screen using AccessibilityService.

collection evasion credential_access

Input Injection

Screen Capture

Keylogging

GUI Input Capture

description	ioc	Process
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId	com.volcano.apology
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByViewId	com.volcano.apology

Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
banker discovery

Security Software Discovery
T1418.001
Queries the phone number (MSISDN for GSM devices) 1 TTPs
discovery

System Network Configuration Discovery
T1422

Acquires the wake lock 1 IoCs

description	ioc	Process
Framework service call	android.os.IPowerManager.acquireWakeLock	com.volcano.apology

Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs

Application may abuse the framework's foreground service to continue running in the foreground.

evasion persistence

Foreground Persistence

description	ioc	Process
Framework service call	android.app.IActivityManager.setServiceForeground	com.volcano.apology

Performs UI accessibility actions on behalf of the user 1 TTPs 4 IoCs

Application may abuse the accessibility service to prevent their removal.

Prevent Application Removal

ioc	Process
android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction	com.volcano.apology
android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction	com.volcano.apology
android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction	com.volcano.apology
android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction	com.volcano.apology

Queries the mobile country code (MCC) 1 TTPs 1 IoCs

System Network Configuration Discovery

description	ioc	Process
Framework service call	com.android.internal.telephony.ITelephony.getNetworkCountryIsoForPhone	com.volcano.apology

Queries the unique device ID (IMEI, MEID, IMSI) 1 TTPs
discovery

System Network Configuration Discovery
T1422

Requests accessing notifications (often used to intercept notifications before users become aware). 1 TTPs 1 IoCs

collection credential_access

Access Notifications

description	ioc	Process
Intent action	android.settings.ACTION_NOTIFICATION_LISTENER_SETTINGS	com.volcano.apology

Requests disabling of battery optimizations (often used to enable hiding in the background). 1 TTPs 1 IoCs

User Evasion

description	ioc	Process
Intent action	android.settings.REQUEST_IGNORE_BATTERY_OPTIMIZATIONS	com.volcano.apology

Requests modifying system settings. 1 IoCs

description	ioc	Process
Intent action	android.settings.action.MANAGE_WRITE_SETTINGS	com.volcano.apology

Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs

Broadcast Receivers

description	ioc	Process
Framework service call	android.app.IActivityManager.registerReceiver	com.volcano.apology

Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs

Data Encrypted for Impact

description	ioc	Process
Framework API call	javax.crypto.Cipher.doFinal	com.volcano.apology

com.volcano.apology
1⤵
- Removes its main activity from the application launcher
- Loads dropped Dex/Jar
- Makes use of the framework's Accessibility service
- Acquires the wake lock
- Makes use of the framework's foreground persistence service
- Performs UI accessibility actions on behalf of the user
- Queries the mobile country code (MCC)
- Requests accessing notifications (often used to intercept notifications before users become aware).
- Requests disabling of battery optimizations (often used to enable hiding in the background).
- Requests modifying system settings.
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Uses Crypto APIs (Might try to encrypt user data)
PID:4249
- /system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.volcano.apology/app_visa/JsBnEya.json --output-vdex-fd=41 --oat-fd=42 --oat-location=/data/user/0/com.volcano.apology/app_visa/oat/x86/JsBnEya.odex --compiler-filter=quicken --class-loader-context=&
  2⤵
  - Loads dropped Dex/Jar
  PID:4276

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Event Triggered Execution

Broadcast Receivers

Foreground Persistence

Privilege Escalation

Defense Evasion

Download New Code at Runtime

Foreground Persistence

Hide Artifacts

Suppress Application Icon

User Evasion

Impair Defenses

Prevent Application Removal

Input Injection

Credential Access

Access Notifications

Input Capture

GUI Input Capture

Keylogging

Discovery

Software Discovery

Security Software Discovery

System Network Configuration Discovery

Lateral Movement

Collection

Access Notifications

Input Capture

GUI Input Capture

Keylogging

Screen Capture

Command and Control

Exfiltration

Impact

Data Encrypted for Impact

Input Injection

Replay Monitor

Loading Replay Monitor...

Downloads

/data/data/com.volcano.apology/app_visa/JsBnEya.json

Filesize
153KB

MD5
07164a268c338301bbf0d4ec4aaaf9fa

SHA1
7dbb514310fad7f02dce45e0cbad076745b96c41

SHA256
cbcc0a92f835fbca56b230de9f454398985e4d4e36e4a6c849ecb0927f55d0eb

SHA512
93ea474c8c16222c80fa3f6a6e03f4f5e9f27384c39f682f374336c87b28c8376131a0e8646d41ec6a751a4ffc6c701f8b4d2c9f015c274c45dbaf3b5dfa1b92

Download Submit
/data/data/com.volcano.apology/app_visa/JsBnEya.json

Filesize
153KB

MD5
04e2cfdaa4749b1b960b3364b067f29d

SHA1
88620ff8c8e088a33c206dc8dcae672119ca185d

SHA256
135cbbac64310a15ae2827aa231b31a1091986a15271c455f8e50b4d3410c5c5

SHA512
c4b1bce7c0db80e614f2de78fea06b4af4fcaaa513f748fcb1e2e9cf8e1bbe941938c57afd03c209c61bd7cf945acd707a5d4b9691da13437889f679d028df1d

Download Submit
/data/user/0/com.volcano.apology/app_visa/JsBnEya.json

Filesize
451KB

MD5
17e67c62a5c6179a703b8f36df401ae3

SHA1
28a2367b02f971cee2c600c7cf081e8925c8e0f2

SHA256
d1685cb8d7a06b1eec1c211f01f6f7559b364ffdc4413f88cb5c7e84e76714af

SHA512
dca449dde8f646ec57728a02fe5c09cd668fbe7618d28b6aed7142398bc5ec806f1c6aefe07b9e316b9cf11b143e66d8b28543bc1da353bd69c5bbac26f75077

Download Submit
/data/user/0/com.volcano.apology/app_visa/JsBnEya.json

Filesize
451KB

MD5
a641e7ef914e4bd20d63f20fc61ef556

SHA1
ebb95cab21c92e4fb0ebaa832e1231d94a3f650a

SHA256
7a94230b654279f6950e538c0aadd576abbfe11af3a06ef7e0f2f9eb485a6ec5

SHA512
f64800b46e6d37a09d856257b5dcb332c85c8dd23ef20824fe97faa6f9ce54185f24163bce7eaec38097ae651c088b1b91462913065ca2c3d65d471649ae99a1

Download Submit