octo | e68ae9c252283ac2aac49fb1fe05006876ebd2165ad4dc6a608c79b78363d8f5

Analysis

max time kernel
148s
max time network
154s
platform
android_x86
resource
android-x86-arm-20240624-en
resource tags

androidarch:armarch:x86image:android-x86-arm-20240624-enlocale:en-usos:android-9-x86system
submitted
11/11/2024, 22:08

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

e68ae9c252283ac2aac49fb1fe05006876ebd2165ad4dc6a608c79b78363d8f5.apk
Size

1.7MB
MD5

4b202e7b185faa5ec50966b03849e4eb
SHA1

3a2c4e7fb948f0094d535b9526385625c9609010
SHA256

e68ae9c252283ac2aac49fb1fe05006876ebd2165ad4dc6a608c79b78363d8f5
SHA512

9f1f30e6558fd7db86338024f8db725572cc1a1c7d5587f28bf57f061bd35d6b6ac4c603967e4f1c8381a94b66e0883907e1cfb6fa31e2bd2471f2609f96a66d
SSDEEP

49152:xrc1Jy5qzLg+CRKnU071MU3YTKG2S5WmA07Kc7efuG:T4zLg+bU0GY/pVmA071ifp

Score

10^/10

octo banker collection credential_access discovery evasion impact infostealer persistence rat stealth trojan

Malware Config

Extracted

Family

octo

https://cizgifilmlervekarakterhikayeleri.xyz/MDQ2MTZjMDhlZDQy/

https://cocukanimasyonvesinemaustalari.xyz/MDQ2MTZjMDhlZDQy/

https://masalvecizgifilmkahramanlari.xyz/MDQ2MTZjMDhlZDQy/

https://sevimlikarakterlervesahneefektleri.xyz/MDQ2MTZjMDhlZDQy/

https://cizgifilmsanatvesinemaevreni.xyz/MDQ2MTZjMDhlZDQy/

https://eglencelihikayelervecizgidunyasi.xyz/MDQ2MTZjMDhlZDQy/

https://animasyonyapimcilariveoyuncular.xyz/MDQ2MTZjMDhlZDQy/

https://renklihayalguclerianimasyonlar.xyz/MDQ2MTZjMDhlZDQy/

https://cizgifilmklassikleriyenidonem.xyz/MDQ2MTZjMDhlZDQy/

https://eglencelianimasyonprojelerlistesi.xyz/MDQ2MTZjMDhlZDQy/

https://cizgianimasyonvedijitalhikayeler.xyz/MDQ2MTZjMDhlZDQy/

https://kahramanvetuhafcanlilarhikayesi.xyz/MDQ2MTZjMDhlZDQy/

https://eglencevedostcancizgifilmler.xyz/MDQ2MTZjMDhlZDQy/

https://cizgidunyasindakiyenikarakterler.xyz/MDQ2MTZjMDhlZDQy/

https://animasyonvegorselsanatgezileri.xyz/MDQ2MTZjMDhlZDQy/

https://cizgifilmvedegisimkulturler.xyz/MDQ2MTZjMDhlZDQy/

https://renklianimasyonvesanateserleri.xyz/MDQ2MTZjMDhlZDQy/

https://kulturvecizgihikayegirisimi.xyz/MDQ2MTZjMDhlZDQy/

https://cizgifilmtasarimvesanatyonetimi.xyz/MDQ2MTZjMDhlZDQy/

https://yeniyetisimlerveanimasyoncalismasi.xyz/MDQ2MTZjMDhlZDQy/

rc4.plain

Extracted

Family

octo

https://cizgifilmlervekarakterhikayeleri.xyz/MDQ2MTZjMDhlZDQy/

https://cocukanimasyonvesinemaustalari.xyz/MDQ2MTZjMDhlZDQy/

https://masalvecizgifilmkahramanlari.xyz/MDQ2MTZjMDhlZDQy/

https://sevimlikarakterlervesahneefektleri.xyz/MDQ2MTZjMDhlZDQy/

https://cizgifilmsanatvesinemaevreni.xyz/MDQ2MTZjMDhlZDQy/

https://eglencelihikayelervecizgidunyasi.xyz/MDQ2MTZjMDhlZDQy/

https://animasyonyapimcilariveoyuncular.xyz/MDQ2MTZjMDhlZDQy/

https://renklihayalguclerianimasyonlar.xyz/MDQ2MTZjMDhlZDQy/

https://cizgifilmklassikleriyenidonem.xyz/MDQ2MTZjMDhlZDQy/

https://eglencelianimasyonprojelerlistesi.xyz/MDQ2MTZjMDhlZDQy/

https://cizgianimasyonvedijitalhikayeler.xyz/MDQ2MTZjMDhlZDQy/

https://kahramanvetuhafcanlilarhikayesi.xyz/MDQ2MTZjMDhlZDQy/

https://eglencevedostcancizgifilmler.xyz/MDQ2MTZjMDhlZDQy/

https://cizgidunyasindakiyenikarakterler.xyz/MDQ2MTZjMDhlZDQy/

https://animasyonvegorselsanatgezileri.xyz/MDQ2MTZjMDhlZDQy/

https://cizgifilmvedegisimkulturler.xyz/MDQ2MTZjMDhlZDQy/

https://renklianimasyonvesanateserleri.xyz/MDQ2MTZjMDhlZDQy/

https://kulturvecizgihikayegirisimi.xyz/MDQ2MTZjMDhlZDQy/

https://cizgifilmtasarimvesanatyonetimi.xyz/MDQ2MTZjMDhlZDQy/

https://yeniyetisimlerveanimasyoncalismasi.xyz/MDQ2MTZjMDhlZDQy/

AES_key

Signatures

Octo
Octo is a banking malware with remote access capabilities first seen in April 2022.
banker trojan infostealer rat octo
Octo family
octo

Octo payload 2 IoCs

resource	yara_rule
behavioral1/memory/4285-0.dex	family_octo
behavioral1/memory/4256-0.dex	family_octo

Removes its main activity from the application launcher 1 TTPs 1 IoCs

stealth trojan evasion

Suppress Application Icon

T1628.001

pid	Process
4256	com.neglect.custom

Loads dropped Dex/Jar 1 TTPs 2 IoCs

Runs executable file dropped to the device during analysis.

evasion

Download New Code at Runtime

T1407

ioc	pid	Process
/data/user/0/com.neglect.custom/app_two/sdudx.json	4285	/system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.neglect.custom/app_two/sdudx.json --output-vdex-fd=41 --oat-fd=42 --oat-location=/data/user/0/com.neglect.custom/app_two/oat/x86/sdudx.odex --compiler-filter=quicken --class-loader-context=&
/data/user/0/com.neglect.custom/app_two/sdudx.json	4256	com.neglect.custom

Makes use of the framework's Accessibility service 4 TTPs 2 IoCs

Retrieves information displayed on the phone screen using AccessibilityService.

collection evasion credential_access

Input Injection

T1516

Screen Capture

T1513

Keylogging

T1417.001

GUI Input Capture

T1417.002

description	ioc	Process
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId	com.neglect.custom
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByViewId	com.neglect.custom

Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
banker discovery

Security Software Discovery
T1418.001
Queries the phone number (MSISDN for GSM devices) 1 TTPs
discovery

System Network Configuration Discovery
T1422

Acquires the wake lock 1 IoCs

description	ioc	Process
Framework service call	android.os.IPowerManager.acquireWakeLock	com.neglect.custom

Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs

Application may abuse the framework's foreground service to continue running in the foreground.

evasion persistence

Foreground Persistence

T1541

description	ioc	Process
Framework service call	android.app.IActivityManager.setServiceForeground	com.neglect.custom

Performs UI accessibility actions on behalf of the user 1 TTPs 4 IoCs

Application may abuse the accessibility service to prevent their removal.

evasion

Prevent Application Removal

T1629.001

ioc	Process
android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction	com.neglect.custom
android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction	com.neglect.custom
android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction	com.neglect.custom
android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction	com.neglect.custom

Queries the mobile country code (MCC) 1 TTPs 1 IoCs

discovery

System Network Configuration Discovery

T1422

description	ioc	Process
Framework service call	com.android.internal.telephony.ITelephony.getNetworkCountryIsoForPhone	com.neglect.custom

Queries the unique device ID (IMEI, MEID, IMSI) 1 TTPs
discovery

System Network Configuration Discovery
T1422

Requests accessing notifications (often used to intercept notifications before users become aware). 1 TTPs 1 IoCs

collection credential_access

Access Notifications

T1517

description	ioc	Process
Intent action	android.settings.ACTION_NOTIFICATION_LISTENER_SETTINGS	com.neglect.custom

Requests disabling of battery optimizations (often used to enable hiding in the background). 1 TTPs 1 IoCs

evasion

User Evasion

T1628.002

description	ioc	Process
Intent action	android.settings.REQUEST_IGNORE_BATTERY_OPTIMIZATIONS	com.neglect.custom

Requests modifying system settings. 1 IoCs

evasion

description	ioc	Process
Intent action	android.settings.action.MANAGE_WRITE_SETTINGS	com.neglect.custom

Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs

persistence

Broadcast Receivers

T1624.001

description	ioc	Process
Framework service call	android.app.IActivityManager.registerReceiver	com.neglect.custom

Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs

impact

Data Encrypted for Impact

T1471

description	ioc	Process
Framework API call	javax.crypto.Cipher.doFinal	com.neglect.custom

com.neglect.custom
1⤵
- Removes its main activity from the application launcher
- Loads dropped Dex/Jar
- Makes use of the framework's Accessibility service
- Acquires the wake lock
- Makes use of the framework's foreground persistence service
- Performs UI accessibility actions on behalf of the user
- Queries the mobile country code (MCC)
- Requests accessing notifications (often used to intercept notifications before users become aware).
- Requests disabling of battery optimizations (often used to enable hiding in the background).
- Requests modifying system settings.
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Uses Crypto APIs (Might try to encrypt user data)
PID:4256
- /system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.neglect.custom/app_two/sdudx.json --output-vdex-fd=41 --oat-fd=42 --oat-location=/data/user/0/com.neglect.custom/app_two/oat/x86/sdudx.odex --compiler-filter=quicken --class-loader-context=&
  2⤵
  - Loads dropped Dex/Jar
  PID:4285

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Event Triggered Execution

T1624

Broadcast Receivers

T1624.001

Foreground Persistence

T1541

Privilege Escalation

Defense Evasion

Download New Code at Runtime

T1407

Foreground Persistence

T1541

Hide Artifacts

T1628

Suppress Application Icon

T1628.001

User Evasion

T1628.002

Impair Defenses

T1629

Prevent Application Removal

T1629.001

Input Injection

T1516

Credential Access

Access Notifications

T1517

Input Capture

T1417

GUI Input Capture

T1417.002

Keylogging

T1417.001

Discovery

Software Discovery

T1418

Security Software Discovery

T1418.001

System Network Configuration Discovery

T1422

Lateral Movement

Collection

Access Notifications

T1517

Input Capture

T1417

GUI Input Capture

T1417.002

Keylogging

T1417.001

Screen Capture

T1513

Command and Control

Exfiltration

Impact

Data Encrypted for Impact

T1471

Input Injection

T1516

Replay Monitor

Loading Replay Monitor...

Downloads

/data/data/com.neglect.custom/app_two/sdudx.json

Filesize
153KB

MD5
1ecad1ecb68cf797ca24299bc25bd07c

SHA1
546a0560c58a89d45341f13fe1a370f21b378932

SHA256
8059dda04101bbc68b52dcb88ef90985401af25092248a4eda819d052a3d6d75

SHA512
e86f34a8bbb37449f58dbeefb82b816e5ff611fca53e7bcf5145fc61c5029cb749e185439b468beb4aea11b35b36c750427c888b7148fe422b5dff92eefa210a

Download Submit
/data/data/com.neglect.custom/app_two/sdudx.json

Filesize
153KB

MD5
6df882905447973753a05028fe86eb12

SHA1
c937e93f78a0fab13917adc215f46f05d42874ed

SHA256
95346f0ec80335ef15caf3460c9e884023ea26c3b1bb381a1b0d71909355ed9c

SHA512
3a513c5b083370af70b8d6af8efd3c14e00428a05fa2cddc78ab8bb5eb56140deac81511b7e268385123b1f52cfef11124b37ff3d28cd79e21a78f2e2cc7ee51

Download Submit
/data/user/0/com.neglect.custom/app_two/sdudx.json

Filesize
451KB

MD5
41f66a2c11d91f5796d7a0ade3108237

SHA1
97910c44a3b09e02cfb6e26540d2b0bdb9b546a6

SHA256
72e932ab71702abb1662efb22f2c02c32b73f883a276a8316ef4f5c5f8171762

SHA512
cba87b62d1fc7fb1e0b1a86d6404da7dab29a189ac59572c0213aa0e33e3531701e2809efcfd3ae88a32213f162f80e40120f021ee20323639b9e8d369699bc2

Download Submit
/data/user/0/com.neglect.custom/app_two/sdudx.json

Filesize
451KB

MD5
c00bf72a1472f42a5a85e6ad907f7598

SHA1
834d8c32e6d047a78dbffa62fc68191fba5a747e

SHA256
0a5c975730804182b18f8d575cab70898f3f52f550b5ac9fb22dbabc0057e4df

SHA512
aa49f2b431b76a458b47db118212cc64fa836b39f96944a866b5f6eda94a7783d305894443ee5a04a00008f6577a5bec4e30fd458748e2ada26f004777886f55

Download Submit

Analysis

Sharing

General

Malware Config

Extracted

Extracted

Signatures

Processes

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads