octo | 9fa200233ee1f6540fadbfe452f0718143794af775369dfc21ac04c174c7e3ba

Analysis

max time kernel
20s
max time network
34s
platform
android_x86
resource
android-x86-arm-20240624-en
resource tags

androidarch:armarch:x86image:android-x86-arm-20240624-enlocale:en-usos:android-9-x86system
submitted
08-10-2024 14:39

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

9fa200233ee1f6540fadbfe452f0718143794af775369dfc21ac04c174c7e3ba.apk
Size

7.7MB
MD5

f8501cf8d0b78aa207b601376b5d6bf4
SHA1

401b7c5ebf334576c03786ef415b55488424421f
SHA256

9fa200233ee1f6540fadbfe452f0718143794af775369dfc21ac04c174c7e3ba
SHA512

b3422ea6708453487c5ca1af8dbad7f6687cf310aa361b6e0f29038deb0e53431d318a46334547630274da562286ac2bdfe96e8505b80a6ac307421a75848b0a
SSDEEP

98304:0jQYx9VKGhcN65j7J5iSRGS9Rs62dvg52X2klYSOJOHEob5:0jQYHUycNcj7JrJRv6I2ZY9M1

Score

10^/10

octo banker collection credential_access discovery evasion impact infostealer persistence rat trojan

Malware Config

Extracted

Family

octo

AES_key

Signatures

Octo
Octo is a banking malware with remote access capabilities first seen in April 2022.
banker trojan infostealer rat octo

Octo payload 1 IoCs

resource	yara_rule
behavioral1/memory/4253-1.dex	family_octo

Checks Android system properties for emulator presence. 1 TTPs 1 IoCs

evasion

System Checks

T1633.001

description	ioc	Process
Accessed system property	key: ro.product.model	com.viewerform5

Loads dropped Dex/Jar 1 TTPs 3 IoCs

Runs executable file dropped to the device during analysis.

evasion

Download New Code at Runtime

T1407

ioc	pid	Process
/data/user/0/com.viewerform5/app_cool/BkyH.json	4253	com.viewerform5
/data/user/0/com.viewerform5/app_cool/BkyH.json	4278	/system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.viewerform5/app_cool/BkyH.json --output-vdex-fd=41 --oat-fd=42 --oat-location=/data/user/0/com.viewerform5/app_cool/oat/x86/BkyH.odex --compiler-filter=quicken --class-loader-context=&
Anonymous-DexFile@0xcf97c000-0xcf9ff4d0	4253	com.viewerform5

Makes use of the framework's Accessibility service 4 TTPs 2 IoCs

Retrieves information displayed on the phone screen using AccessibilityService.

collection evasion credential_access

Input Injection

T1516

Screen Capture

T1513

Keylogging

T1417.001

GUI Input Capture

T1417.002

description	ioc	Process
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId	com.viewerform5
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByViewId	com.viewerform5

Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
banker discovery

Security Software Discovery
T1418.001
Queries the phone number (MSISDN for GSM devices) 1 TTPs
discovery

System Network Configuration Discovery
T1422

Acquires the wake lock 1 IoCs

description	ioc	Process
Framework service call	android.os.IPowerManager.acquireWakeLock	com.viewerform5

Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs

Application may abuse the framework's foreground service to continue running in the foreground.

evasion persistence

Foreground Persistence

T1541

description	ioc	Process
Framework service call	android.app.IActivityManager.setServiceForeground	com.viewerform5

Queries the mobile country code (MCC) 1 TTPs 1 IoCs

discovery

System Network Configuration Discovery

T1422

description	ioc	Process
Framework service call	com.android.internal.telephony.ITelephony.getNetworkCountryIsoForPhone	com.viewerform5

Queries the unique device ID (IMEI, MEID, IMSI) 1 TTPs
discovery

System Network Configuration Discovery
T1422

Requests disabling of battery optimizations (often used to enable hiding in the background). 1 TTPs 1 IoCs

evasion

User Evasion

T1628.002

description	ioc	Process
Intent action	android.settings.REQUEST_IGNORE_BATTERY_OPTIMIZATIONS	com.viewerform5

Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs

persistence

Broadcast Receivers

T1624.001

description	ioc	Process
Framework service call	android.app.IActivityManager.registerReceiver	com.viewerform5

Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs

impact

Data Encrypted for Impact

T1471

description	ioc	Process
Framework API call	javax.crypto.Cipher.doFinal	com.viewerform5

Checks CPU information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/cpuinfo	com.viewerform5

Checks memory information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/meminfo	com.viewerform5

com.viewerform5
1⤵
- Checks Android system properties for emulator presence.
- Loads dropped Dex/Jar
- Makes use of the framework's Accessibility service
- Acquires the wake lock
- Makes use of the framework's foreground persistence service
- Queries the mobile country code (MCC)
- Requests disabling of battery optimizations (often used to enable hiding in the background).
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Uses Crypto APIs (Might try to encrypt user data)
- Checks CPU information
- Checks memory information
PID:4253
- /system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.viewerform5/app_cool/BkyH.json --output-vdex-fd=41 --oat-fd=42 --oat-location=/data/user/0/com.viewerform5/app_cool/oat/x86/BkyH.odex --compiler-filter=quicken --class-loader-context=&
  2⤵
  - Loads dropped Dex/Jar
  PID:4278

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Event Triggered Execution

T1624

Broadcast Receivers

T1624.001

Foreground Persistence

T1541

Privilege Escalation

Defense Evasion

Download New Code at Runtime

T1407

Foreground Persistence

T1541

Hide Artifacts

T1628

User Evasion

T1628.002

Input Injection

T1516

Virtualization/Sandbox Evasion

T1633

System Checks

T1633.001

Credential Access

Input Capture

T1417

GUI Input Capture

T1417.002

Keylogging

T1417.001

Discovery

Software Discovery

T1418

Security Software Discovery

T1418.001

System Information Discovery

T1426

System Network Configuration Discovery

T1422

Lateral Movement

Collection

Input Capture

T1417

GUI Input Capture

T1417.002

Keylogging

T1417.001

Screen Capture

T1513

Command and Control

Exfiltration

Impact

Data Encrypted for Impact

T1471

Input Injection

T1516

Replay Monitor

Loading Replay Monitor...

Downloads

/data/data/com.viewerform5/.global.com.viewerform5

Filesize
48B

MD5
046a414913add6f5bb60072c7db819b6

SHA1
451ee4f6809260aec622d772fd329c7d0297a842

SHA256
b66c1320cb063a1d391c94273572ea6edae76c8c8b0a07f8d75c88686f0df72a

SHA512
4e6355f3051ed5e811ab030abde1f5be7f5e1cf33be99cd08477e9b6c015deb1d8bd75a09fb9c7176b8511c5ad0a67abc0902a3531e97564ccb6afc57496a47c

Download Submit
/data/data/com.viewerform5/app_cool/BkyH.json

Filesize
1009B

MD5
11ab56a1c194f88db7e215811787c9a3

SHA1
bc12c837aacb76019bbbf41fa99cfd6a63c14222

SHA256
cc0e27f9dc10c2f633b25d7139f3b91a0a3a5b1ab6e40783ae8c0e5642b33d0e

SHA512
ea4d3288788a24681bf8160ba71b6b707598cdc2cc880a07aaacdd2b0b0b13268ed74e0c2895cc6c640cb1fde1b8fa00c35f710f87bd234835b16d3c9b833417

Download Submit
/data/data/com.viewerform5/app_cool/BkyH.json

Filesize
1009B

MD5
d519385a84ee3223f72fa546ef447e4d

SHA1
aa4afaca3f28bdf22d5542e1458286f17965ae10

SHA256
0573e9dd0d29d85c84d40ac7d825fe8487d18a3d4aef17d917209df039847dea

SHA512
2a527c66042337313ccedc42d623e06467d865d902ded1c329746578f32c97974e8bda8a23a9914c0c2e37250e264721caba8ee2bab9ce0e38c894cecde50d0c

Download Submit
/data/data/com.viewerform5/files/.f

Filesize
307KB

MD5
4e73947cabb5db3f92ca85004981b754

SHA1
6d9667fdb0280ed2dcb782b4683e422a51bdc601

SHA256
6db94232e756b90ed437f1bc87dc38cf20fb2e7c7a19a5e40c6c17254b7e234c

SHA512
be8b500a7070af1dfb53b0cf1a7b327dadc4e163a6dad905496ac228c58cd1ed87b054533917924455d35e9b300683ae33e1bcdd91935a5dbae1d693c3e13d69

Download Submit
/data/user/0/com.viewerform5/app_cool/BkyH.json

Filesize
1KB

MD5
95aa5791ccde74cae789d624a026d281

SHA1
271a21f8590e44bbe63f7422c921d849b2cc2ccc

SHA256
1f83c1f76d0075e91b6e22a31410334c13cf681b098a509b80fedda6a3611e57

SHA512
af6c98cc822671b5eacc4a5a35254c574c4c814dff5aaee192f886c23e19a59eb37ffa70a4833170df8095f6ec266fec3fd4db2926bb599df185407edcb1e415

Download Submit
/data/user/0/com.viewerform5/app_cool/BkyH.json

Filesize
1KB

MD5
9aba8e7318bd8a665d84c001e03391a3

SHA1
4de57ab481d4268af59086ad16af3800811ff2f6

SHA256
aadede467d4039fa1b551a57aa1b3e95ca0e1e882f75807f56a72cf787c0ceb6

SHA512
7bec495d64ed74ded9aa0ccb92a78a9cdeab7a9945b4249b51d0be3cdc98e7b50366283160619b8ed111a8c15a50ae7823d71c4ca062357e2caf4df7522b63b0

Download Submit
Anonymous-DexFile@0xcf97c000-0xcf9ff4d0

Filesize
525KB

MD5
e69479005732f26e642cba1268168aba

SHA1
a6828b2303cd2b3d8c231a8a07b5fe501de7f944

SHA256
1dd99a05722e050a413e2912c8444dcb9838777acfe0db8631d6e348ffa9b115

SHA512
3c34fc2d6ef99bc14f5f88ecf6adee54a353de36c764ad8540697142d97714462ce757e0d588591ee34bb9abed912b28141288aab3b4a9bc2df532735c3fefd5

Download Submit

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads