octo | 625454da048e6a1a75c0b14a2e79759dc7fe54b5ff96835d94785ca0539a3196

Analysis

max time kernel
297s
max time network
299s
platform
android-13_x64
resource
android-33-x64-arm64-20240910-en
resource tags

arch:arm64arch:x64arch:x86image:android-33-x64-arm64-20240910-enlocale:en-usos:android-13-x64system
submitted
08-10-2024 05:57

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

625454da048e6a1a75c0b14a2e79759dc7fe54b5ff96835d94785ca0539a3196.apk
Size

8.9MB
MD5

d6e9efcf051b1109cca25c34813b5b81
SHA1

6c34352260badd9a8802ed4cabaf7310a8960ed9
SHA256

625454da048e6a1a75c0b14a2e79759dc7fe54b5ff96835d94785ca0539a3196
SHA512

c23fb07876012f9620e49ddfaaf7ffd66ae020e63118fa879d5f3dcafae77d953e83b1c4590547807877cbdeaad4b9c06abb298dac03e5fe0e5873febe48b428
SSDEEP

98304:GhYZv2qxVKKo5iSRG61TqGDE5j7DBI5K8MwJLgPevze3mWcm+xG+RspV9:N2gUbr8GDCj7u5K8MwJL3PW0U+R29

Score

10^/10

octo banker collection credential_access discovery evasion impact infostealer persistence rat trojan

Malware Config

Extracted

Family

octo

AES_key

Signatures

Octo
Octo is a banking malware with remote access capabilities first seen in April 2022.
banker trojan infostealer rat octo

Octo payload 1 IoCs

resource	yara_rule
behavioral2/memory/4499-1.dex	family_octo

Loads dropped Dex/Jar 1 TTPs 2 IoCs

Runs executable file dropped to the device during analysis.

evasion

Download New Code at Runtime

T1407

ioc	pid	Process
/data/user/0/com.ewide_messaging7/app_season/DAG.json	4499	com.ewide_messaging7
/data/user/0/com.ewide_messaging7/[email protected]	4499	com.ewide_messaging7

Makes use of the framework's Accessibility service 4 TTPs 1 IoCs

Retrieves information displayed on the phone screen using AccessibilityService.

collection evasion credential_access

Input Injection

T1516

Screen Capture

T1513

Keylogging

T1417.001

GUI Input Capture

T1417.002

description	ioc	Process
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId	com.ewide_messaging7

Obtains sensitive information copied to the device clipboard 2 TTPs 1 IoCs

Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.

collection credential_access impact

Clipboard Data

T1414

Transmitted Data Manipulation

T1641.001

description	ioc	Process
Framework service call	android.content.IClipboard.addPrimaryClipChangedListener	com.ewide_messaging7

Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
banker discovery

Security Software Discovery
T1418.001
Queries the phone number (MSISDN for GSM devices) 1 TTPs
discovery

System Network Configuration Discovery
T1422

Acquires the wake lock 1 IoCs

description	ioc	Process
Framework service call	android.os.IPowerManager.acquireWakeLock	com.ewide_messaging7

Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs

Application may abuse the framework's foreground service to continue running in the foreground.

evasion persistence

Foreground Persistence

T1541

description	ioc	Process
Framework service call	android.app.IActivityManager.setServiceForeground	com.ewide_messaging7

Queries the mobile country code (MCC) 1 TTPs 1 IoCs

discovery

System Network Configuration Discovery

T1422

description	ioc	Process
Framework service call	com.android.internal.telephony.ITelephony.getNetworkCountryIsoForPhone	com.ewide_messaging7

Reads information about phone network operator. 1 TTPs
discovery

System Network Configuration Discovery
T1422

Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs

impact

Data Encrypted for Impact

T1471

description	ioc	Process
Framework API call	javax.crypto.Cipher.doFinal	com.ewide_messaging7

Checks CPU information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/cpuinfo	com.ewide_messaging7

Checks memory information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/meminfo	com.ewide_messaging7

com.ewide_messaging7
1⤵
- Loads dropped Dex/Jar
- Makes use of the framework's Accessibility service
- Obtains sensitive information copied to the device clipboard
- Acquires the wake lock
- Makes use of the framework's foreground persistence service
- Queries the mobile country code (MCC)
- Uses Crypto APIs (Might try to encrypt user data)
- Checks CPU information
- Checks memory information
PID:4499

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Foreground Persistence

T1541

Privilege Escalation

Defense Evasion

Download New Code at Runtime

T1407

Foreground Persistence

T1541

Input Injection

T1516

Virtualization/Sandbox Evasion

T1633

System Checks

T1633.001

Credential Access

Clipboard Data

T1414

Input Capture

T1417

GUI Input Capture

T1417.002

Keylogging

T1417.001

Discovery

Software Discovery

T1418

Security Software Discovery

T1418.001

System Information Discovery

T1426

System Network Configuration Discovery

T1422

Lateral Movement

Collection

Clipboard Data

T1414

Input Capture

T1417

GUI Input Capture

T1417.002

Keylogging

T1417.001

Screen Capture

T1513

Command and Control

Exfiltration

Impact

Data Encrypted for Impact

T1471

Data Manipulation

T1641

Transmitted Data Manipulation

T1641.001

Input Injection

T1516

Replay Monitor

Loading Replay Monitor...

Downloads

/data/data/com.ewide_messaging7/.global.com.ewide_messaging7

Filesize
48B

MD5
046a414913add6f5bb60072c7db819b6

SHA1
451ee4f6809260aec622d772fd329c7d0297a842

SHA256
b66c1320cb063a1d391c94273572ea6edae76c8c8b0a07f8d75c88686f0df72a

SHA512
4e6355f3051ed5e811ab030abde1f5be7f5e1cf33be99cd08477e9b6c015deb1d8bd75a09fb9c7176b8511c5ad0a67abc0902a3531e97564ccb6afc57496a47c

Download Submit
/data/data/com.ewide_messaging7/app_season/DAG.json

Filesize
1007B

MD5
da20578e929c1fce5eac87103807ceb6

SHA1
e291d07b1d84c9c561ae280447d03dffed78c1bd

SHA256
3e3bfee8fb89d42bc612806c52fd496a52ebb7b4bfb51a520860757db3dad754

SHA512
b55150dc8cbee49263c1e76e9c24207ef3640debbc8057a9a8bab579215a195330bb4e10f5245b6cdce0a5a52ca3836efcec0be2a0e96a2a8b1dd45b6af82603

Download Submit
/data/data/com.ewide_messaging7/app_season/DAG.json

Filesize
1007B

MD5
018ada0e79237313ebd20f4612713df6

SHA1
c9be3a8c93a725ec9a67512e2e151edd23eaafb2

SHA256
e8c40a29f5258523d50bb78f12f91bd07d7fd62e416092f13e10effb7f22f2ec

SHA512
e76edfd1bcd57551e4df07b1674864223bde5eae4b8d1a76424739256236d7de53dda382ef5f306f0438173e74e640fdeb98adb29ebf86727064f3a0000c3d61

Download Submit
/data/data/com.ewide_messaging7/files/.r

Filesize
322KB

MD5
77dc50489b9323274732d27dc8a4e803

SHA1
0e02a3595b62489d0739d771881da8604d117c65

SHA256
c5684e792d1ebefea6aac09fed45911703fd58c899f8a08133d49dd91429a820

SHA512
0684a92f3e9c525384cfa53f531afba61e5930e1c27032a7e27e3315f72761b62e122dc34768d8162ba08f9bed53d148aa8dc034b46456bdd211f230637eba58

Download Submit
/data/data/com.ewide_messaging7/oat/x86_64/[email protected]

Filesize
13KB

MD5
c5dd34ef9fc8803d46df397fb1b16922

SHA1
1e7df3a3b827329bf0f17ce87d5e8f1de65e171a

SHA256
9947716b86e416fdd49d5b0f7f18c70c7b25bd5467e701e1cd3959bc3cb5d3fa

SHA512
7d621a91c1cda87202fb5d36c25d5ca1709a090c264b324ede289767373e81bf3b567bdaff6a024194bc43a3554110d013dda259d29ee74928dd3b46e77ea141

Download Submit
/data/user/0/com.ewide_messaging7/[email protected]

Filesize
525KB

MD5
825c8cf186c83f5fe9a15570cc2863ea

SHA1
d15180b28a84e401cf7d66cb1e3d233ddcf8efa9

SHA256
aa4c8ba38ace1924a0c6ea6e9067845754867758d9d1cfbfd431893cb8b3ef98

SHA512
5a3247c64d0fdeeb2f547bd8f69bbabf52d410a3e46657bfb25d263b32687825ce5b5ab35183df42bfb4cb9775ce94785a0b6f166555c70082976a70e6e6c7a0

Download Submit
/data/user/0/com.ewide_messaging7/app_season/DAG.json

Filesize
1KB

MD5
8c6793cdaa0e0704fb21d3232b668162

SHA1
25dc8dda032c54e7c6819e5806e7a1f8bb42dc75

SHA256
8dcd689b61433826b015461f8095cfe0cff8b9e6d2e9954323c943312e3ce128

SHA512
0856ac18ee52176a89fa804952f02af23bbe5605f2f444ef5f132e503939f42bc9990cab49b22620025944ff2db470e79e9fcd30a1c9ee6e721469b8cf40bd6a

Download Submit

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads