octo | 1068c7efb604e989a325befb199c8d68352d2b93b0afc09baae75a91985b75b2

Analysis

max time kernel
148s
max time network
154s
platform
android_x64
resource
android-x64-20240624-en
resource tags

androidarch:x64arch:x86image:android-x64-20240624-enlocale:en-usos:android-10-x64system
submitted
23-10-2024 12:36

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

1068c7efb604e989a325befb199c8d68352d2b93b0afc09baae75a91985b75b2.apk
Size

1.7MB
MD5

149005fa43eb993b024ac56307511276
SHA1

2e8cf2467233eab22cf3e9db3a24874f8c358651
SHA256

1068c7efb604e989a325befb199c8d68352d2b93b0afc09baae75a91985b75b2
SHA512

f97ef62461469e01fc1d174f4aa5345ebee1e42312d4ae0f18922b65d7c3c2e7da99ee94b64890f951ca02fd5cd0e668adf745a1a49d0266c6d2d697493c3af6
SSDEEP

49152:1Zmcl1Jvm0wSD63sDuPfPauoWOjXxVWfIaQwjbExxZWQRI:1sclTOTSD63sDuXiu6jXjWfIahPE0Qq

Score

10^/10

octo banker collection credential_access discovery evasion impact infostealer persistence rat trojan

Malware Config

Extracted

Family

octo

https://teknolojideyeniliklervesontrendler.xyz/YjdkMWRjNTllNzZi/

https://dogalyasamvetatilonerileriniz.xyz/YjdkMWRjNTllNzZi/

https://sanatkulturvesosyalyasantavsiyeleri.xyz/YjdkMWRjNTllNzZi/

https://gezginlerinyenikesifvedeneyimleri.xyz/YjdkMWRjNTllNzZi/

https://oyunvedijitaldunyayakesfet.xyz/YjdkMWRjNTllNzZi/

https://yemektariflerivedogalbeslenme.xyz/YjdkMWRjNTllNzZi/

https://bilimveteknolojiprojelerehberi.xyz/YjdkMWRjNTllNzZi/

https://fotografvesanatcilaryolculugu.xyz/YjdkMWRjNTllNzZi/

https://modavesanatdunyasindakiyenilikler.xyz/YjdkMWRjNTllNzZi/

https://egitimvesosyalgelisimklavuzu.xyz/YjdkMWRjNTllNzZi/

https://yogavesporkocluguprogramlari.xyz/YjdkMWRjNTllNzZi/

https://bilgisayarveoyunseverlertavsiyeleri.xyz/YjdkMWRjNTllNzZi/

https://fotografvegezisoylesileriplatformu.xyz/YjdkMWRjNTllNzZi/

https://yarisvedigitalgelisimprojeleri.xyz/YjdkMWRjNTllNzZi/

https://yenifikirlervegirisimcilikplatformu.xyz/YjdkMWRjNTllNzZi/

https://sosyalmedyayonetimivegirisim.xyz/YjdkMWRjNTllNzZi/

https://sanatvetasarimdunyasiyenilikler.xyz/YjdkMWRjNTllNzZi/

https://bilimvegirisimcilikrotasinda.xyz/YjdkMWRjNTllNzZi/

https://dogadoganlaricinyasamtavsiyeleri.xyz/YjdkMWRjNTllNzZi/

https://gencgirisimcilericevirimdunyasi.xyz/YjdkMWRjNTllNzZi/

rc4.plain

Extracted

Family

octo

https://teknolojideyeniliklervesontrendler.xyz/YjdkMWRjNTllNzZi/

https://dogalyasamvetatilonerileriniz.xyz/YjdkMWRjNTllNzZi/

https://sanatkulturvesosyalyasantavsiyeleri.xyz/YjdkMWRjNTllNzZi/

https://gezginlerinyenikesifvedeneyimleri.xyz/YjdkMWRjNTllNzZi/

https://oyunvedijitaldunyayakesfet.xyz/YjdkMWRjNTllNzZi/

https://yemektariflerivedogalbeslenme.xyz/YjdkMWRjNTllNzZi/

https://bilimveteknolojiprojelerehberi.xyz/YjdkMWRjNTllNzZi/

https://fotografvesanatcilaryolculugu.xyz/YjdkMWRjNTllNzZi/

https://modavesanatdunyasindakiyenilikler.xyz/YjdkMWRjNTllNzZi/

https://egitimvesosyalgelisimklavuzu.xyz/YjdkMWRjNTllNzZi/

https://yogavesporkocluguprogramlari.xyz/YjdkMWRjNTllNzZi/

https://bilgisayarveoyunseverlertavsiyeleri.xyz/YjdkMWRjNTllNzZi/

https://fotografvegezisoylesileriplatformu.xyz/YjdkMWRjNTllNzZi/

https://yarisvedigitalgelisimprojeleri.xyz/YjdkMWRjNTllNzZi/

https://yenifikirlervegirisimcilikplatformu.xyz/YjdkMWRjNTllNzZi/

https://sosyalmedyayonetimivegirisim.xyz/YjdkMWRjNTllNzZi/

https://sanatvetasarimdunyasiyenilikler.xyz/YjdkMWRjNTllNzZi/

https://bilimvegirisimcilikrotasinda.xyz/YjdkMWRjNTllNzZi/

https://dogadoganlaricinyasamtavsiyeleri.xyz/YjdkMWRjNTllNzZi/

https://gencgirisimcilericevirimdunyasi.xyz/YjdkMWRjNTllNzZi/

AES_key

Signatures

Octo
Octo is a banking malware with remote access capabilities first seen in April 2022.
banker trojan infostealer rat octo

Octo payload 1 IoCs

resource	yara_rule
behavioral2/memory/4998-0.dex	family_octo

Loads dropped Dex/Jar 1 TTPs 1 IoCs

Runs executable file dropped to the device during analysis.

evasion

Download New Code at Runtime

T1407

ioc	pid	Process
/data/user/0/com.collect.off/app_couple/qj.json	4998	com.collect.off

Makes use of the framework's Accessibility service 4 TTPs 2 IoCs

Retrieves information displayed on the phone screen using AccessibilityService.

collection evasion credential_access

Input Injection

T1516

Screen Capture

T1513

Keylogging

T1417.001

GUI Input Capture

T1417.002

description	ioc	Process
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId	com.collect.off
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByViewId	com.collect.off

Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
banker discovery

Security Software Discovery
T1418.001
Queries the phone number (MSISDN for GSM devices) 1 TTPs
discovery

System Network Configuration Discovery
T1422

Acquires the wake lock 1 IoCs

description	ioc	Process
Framework service call	android.os.IPowerManager.acquireWakeLock	com.collect.off

Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs

Application may abuse the framework's foreground service to continue running in the foreground.

evasion persistence

Foreground Persistence

T1541

description	ioc	Process
Framework service call	android.app.IActivityManager.setServiceForeground	com.collect.off

Performs UI accessibility actions on behalf of the user 1 TTPs 4 IoCs

Application may abuse the accessibility service to prevent their removal.

evasion

Prevent Application Removal

T1629.001

ioc	Process
android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction	com.collect.off
android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction	com.collect.off
android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction	com.collect.off
android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction	com.collect.off

Queries the mobile country code (MCC) 1 TTPs 1 IoCs

discovery

System Network Configuration Discovery

T1422

description	ioc	Process
Framework service call	com.android.internal.telephony.ITelephony.getNetworkCountryIsoForPhone	com.collect.off

Reads information about phone network operator. 1 TTPs
discovery

System Network Configuration Discovery
T1422

Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs

persistence

Broadcast Receivers

T1624.001

description	ioc	Process
Framework service call	android.app.IActivityManager.registerReceiver	com.collect.off

Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs

impact

Data Encrypted for Impact

T1471

description	ioc	Process
Framework API call	javax.crypto.Cipher.doFinal	com.collect.off

com.collect.off
1⤵
- Loads dropped Dex/Jar
- Makes use of the framework's Accessibility service
- Acquires the wake lock
- Makes use of the framework's foreground persistence service
- Performs UI accessibility actions on behalf of the user
- Queries the mobile country code (MCC)
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Uses Crypto APIs (Might try to encrypt user data)
PID:4998

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Event Triggered Execution

T1624

Broadcast Receivers

T1624.001

Foreground Persistence

T1541

Privilege Escalation

Defense Evasion

Download New Code at Runtime

T1407

Foreground Persistence

T1541

Impair Defenses

T1629

Prevent Application Removal

T1629.001

Input Injection

T1516

Credential Access

Input Capture

T1417

GUI Input Capture

T1417.002

Keylogging

T1417.001

Discovery

Software Discovery

T1418

Security Software Discovery

T1418.001

System Network Configuration Discovery

T1422

Lateral Movement

Collection

Input Capture

T1417

GUI Input Capture

T1417.002

Keylogging

T1417.001

Screen Capture

T1513

Command and Control

Exfiltration

Impact

Data Encrypted for Impact

T1471

Input Injection

T1516

Replay Monitor

Loading Replay Monitor...

Downloads

/data/data/com.collect.off/app_couple/qj.json

Filesize
153KB

MD5
dd56e341d168704f0d2ea4e8de259fde

SHA1
d2e1f0735ac9c0aaf02422b9f77dc63998cc2057

SHA256
75c03fdb64da7fe9548ca1fe33917c8821ff5ceb90de5e6165832ae3de7e7ba6

SHA512
9940cd1c2d84ac23b9e9b63bdb36623312e8244c151cbfeb92ea359b94d71c770fa661b3d8c62a9950b8dbef277f341deedc19c15ebc9fc65452e331f491223f

Download Submit
/data/data/com.collect.off/app_couple/qj.json

Filesize
153KB

MD5
8ad3cdf2a2b9cedf03af63ff5f903a92

SHA1
76338a36ec135c0188d5dfd2b0888ab28ee59205

SHA256
2671296d881d45528bfec5ce590bdb08a11d8435c899d5f1141fbb0f6e9ae8c4

SHA512
eabf55f357f8ea5aff2ed17ebb79dc393a8449b57272eb1b45384b2ead28f291fcf4c3ffad34d0629b5a8d72531f09b9e7f04219571d775b0af11bd637f88b86

Download Submit
/data/user/0/com.collect.off/app_couple/qj.json

Filesize
451KB

MD5
0752e9a551c1119e5e45ec40465220d5

SHA1
46608a3e846f02bf0043c400ba35d1a0e9152bde

SHA256
a58ea1bc6273a2dedc67308f7c1c1a29a2a14411684856324bc21f599151fbcc

SHA512
b8409d7e613c95f245dced4b8fd0f4c8e25a6a61ed319b8fa9121598600833dbb4e04a3025722353c32f34fb6fc9e2a980118b6640fe25a60cd517a653ece340

Download Submit

Analysis

Sharing

General

Malware Config

Extracted

Extracted

Signatures

Processes

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads