octo | 3f99aad460f24330fce28b40f83d9065c0af0b5e30a30064ff0f1e187f08b978

Analysis

max time kernel
20s
max time network
35s
platform
android_x86
resource
android-x86-arm-20240624-en
resource tags

androidarch:armarch:x86image:android-x86-arm-20240624-enlocale:en-usos:android-9-x86system
submitted
11-11-2024 09:41

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

3f99aad460f24330fce28b40f83d9065c0af0b5e30a30064ff0f1e187f08b978.apk
Size

9.3MB
MD5

9f49d1e7f508f0b8eb1c47680712369a
SHA1

d694730eb99272c3bac8e5e7671d96d41d32dc5b
SHA256

3f99aad460f24330fce28b40f83d9065c0af0b5e30a30064ff0f1e187f08b978
SHA512

5cc2e868f5757d1dde47f2647238a10b70dfafa1d9e8483a4a7f34733deaf3c3487b031a885fb8947364d48afef40df023580845c561b385063c2f79ec703199
SSDEEP

98304:SHmdGqwxVKf7v+3Xy5iSRGH+lpkRRsOjIqZKeIKKaL2bO3uRbTMD4pf57n:zGvUzm3XyrmRrINRbTMD4l57n

Score

10^/10

octo banker collection credential_access discovery evasion impact infostealer persistence rat trojan

Malware Config

Extracted

Family

octo

AES_key

Signatures

Octo
Octo is a banking malware with remote access capabilities first seen in April 2022.
banker trojan infostealer rat octo
Octo family
octo

Octo payload 1 IoCs

resource	yara_rule
behavioral1/memory/4259-1.dex	family_octo

Checks Android system properties for emulator presence. 1 TTPs 1 IoCs

evasion

System Checks

T1633.001

description	ioc	Process
Accessed system property	key: ro.product.model	com.eproduct_health6

Loads dropped Dex/Jar 1 TTPs 3 IoCs

Runs executable file dropped to the device during analysis.

evasion

Download New Code at Runtime

T1407

ioc	pid	Process
/data/user/0/com.eproduct_health6/app_west/ttYMB.json	4284	/system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.eproduct_health6/app_west/ttYMB.json --output-vdex-fd=41 --oat-fd=42 --oat-location=/data/user/0/com.eproduct_health6/app_west/oat/x86/ttYMB.odex --compiler-filter=quicken --class-loader-context=&
/data/user/0/com.eproduct_health6/app_west/ttYMB.json	4259	com.eproduct_health6
Anonymous-DexFile@0xd53f8000-0xd547b7a8	4259	com.eproduct_health6

Makes use of the framework's Accessibility service 4 TTPs 2 IoCs

Retrieves information displayed on the phone screen using AccessibilityService.

collection evasion credential_access

Input Injection

T1516

Screen Capture

T1513

Keylogging

T1417.001

GUI Input Capture

T1417.002

description	ioc	Process
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId	com.eproduct_health6
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByViewId	com.eproduct_health6

Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
banker discovery

Security Software Discovery
T1418.001
Queries the phone number (MSISDN for GSM devices) 1 TTPs
discovery

System Network Configuration Discovery
T1422

Acquires the wake lock 1 IoCs

description	ioc	Process
Framework service call	android.os.IPowerManager.acquireWakeLock	com.eproduct_health6

Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs

Application may abuse the framework's foreground service to continue running in the foreground.

evasion persistence

Foreground Persistence

T1541

description	ioc	Process
Framework service call	android.app.IActivityManager.setServiceForeground	com.eproduct_health6

Queries the mobile country code (MCC) 1 TTPs 1 IoCs

discovery

System Network Configuration Discovery

T1422

description	ioc	Process
Framework service call	com.android.internal.telephony.ITelephony.getNetworkCountryIsoForPhone	com.eproduct_health6

Queries the unique device ID (IMEI, MEID, IMSI) 1 TTPs
discovery

System Network Configuration Discovery
T1422

Requests disabling of battery optimizations (often used to enable hiding in the background). 1 TTPs 1 IoCs

evasion

User Evasion

T1628.002

description	ioc	Process
Intent action	android.settings.REQUEST_IGNORE_BATTERY_OPTIMIZATIONS	com.eproduct_health6

Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs

persistence

Broadcast Receivers

T1624.001

description	ioc	Process
Framework service call	android.app.IActivityManager.registerReceiver	com.eproduct_health6

Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs

impact

Data Encrypted for Impact

T1471

description	ioc	Process
Framework API call	javax.crypto.Cipher.doFinal	com.eproduct_health6

Checks CPU information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/cpuinfo	com.eproduct_health6

Checks memory information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/meminfo	com.eproduct_health6

com.eproduct_health6
1⤵
- Checks Android system properties for emulator presence.
- Loads dropped Dex/Jar
- Makes use of the framework's Accessibility service
- Acquires the wake lock
- Makes use of the framework's foreground persistence service
- Queries the mobile country code (MCC)
- Requests disabling of battery optimizations (often used to enable hiding in the background).
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Uses Crypto APIs (Might try to encrypt user data)
- Checks CPU information
- Checks memory information
PID:4259
- /system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.eproduct_health6/app_west/ttYMB.json --output-vdex-fd=41 --oat-fd=42 --oat-location=/data/user/0/com.eproduct_health6/app_west/oat/x86/ttYMB.odex --compiler-filter=quicken --class-loader-context=&
  2⤵
  - Loads dropped Dex/Jar
  PID:4284

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Event Triggered Execution

T1624

Broadcast Receivers

T1624.001

Foreground Persistence

T1541

Privilege Escalation

Defense Evasion

Download New Code at Runtime

T1407

Foreground Persistence

T1541

Hide Artifacts

T1628

User Evasion

T1628.002

Input Injection

T1516

Virtualization/Sandbox Evasion

T1633

System Checks

T1633.001

Credential Access

Input Capture

T1417

GUI Input Capture

T1417.002

Keylogging

T1417.001

Discovery

Software Discovery

T1418

Security Software Discovery

T1418.001

System Information Discovery

T1426

System Network Configuration Discovery

T1422

Lateral Movement

Collection

Input Capture

T1417

GUI Input Capture

T1417.002

Keylogging

T1417.001

Screen Capture

T1513

Command and Control

Exfiltration

Impact

Data Encrypted for Impact

T1471

Input Injection

T1516

Replay Monitor

Loading Replay Monitor...

Downloads

/data/data/com.eproduct_health6/.global.com.eproduct_health6

Filesize
48B

MD5
046a414913add6f5bb60072c7db819b6

SHA1
451ee4f6809260aec622d772fd329c7d0297a842

SHA256
b66c1320cb063a1d391c94273572ea6edae76c8c8b0a07f8d75c88686f0df72a

SHA512
4e6355f3051ed5e811ab030abde1f5be7f5e1cf33be99cd08477e9b6c015deb1d8bd75a09fb9c7176b8511c5ad0a67abc0902a3531e97564ccb6afc57496a47c

Download Submit
/data/data/com.eproduct_health6/app_west/ttYMB.json

Filesize
1021B

MD5
e8a2934030ea781819c00c54a2d53a9e

SHA1
5f882b5fc0ead8eb7b48d1555fd8208485131238

SHA256
03961e24b17183aeba986016453bae125c86eda2d9df6e7bfc5f5aa36f59af60

SHA512
459760691fbae94bca07eb070ba8d58fd5fec317e315953a770d94cf2dd344a86e4249e28a0d339e6eeb6d5400753968c4f0a14a1b764d18ca6b4137c4674984

Download Submit
/data/data/com.eproduct_health6/app_west/ttYMB.json

Filesize
1021B

MD5
b0c0b6d5a29f2f700705da7027f23e77

SHA1
ed7beee043c77cf25a33874e92a6f4831f459790

SHA256
af9929f59515a4a7f13cbc31ccd818956795496e6af76a1fdda047cf928ec1a4

SHA512
464422552c5475a61b04ad8086af3d9dc5895f69009f7a44402c7f20d0921e678a1f8f52237e6f3574a7c6b1adb46300d8985ba9f5e3f947fd840be6b59cf5a0

Download Submit
/data/data/com.eproduct_health6/files/.o

Filesize
307KB

MD5
4e73947cabb5db3f92ca85004981b754

SHA1
6d9667fdb0280ed2dcb782b4683e422a51bdc601

SHA256
6db94232e756b90ed437f1bc87dc38cf20fb2e7c7a19a5e40c6c17254b7e234c

SHA512
be8b500a7070af1dfb53b0cf1a7b327dadc4e163a6dad905496ac228c58cd1ed87b054533917924455d35e9b300683ae33e1bcdd91935a5dbae1d693c3e13d69

Download Submit
/data/user/0/com.eproduct_health6/app_west/ttYMB.json

Filesize
1KB

MD5
bbc1f1b42b299d42e6fea5d4a9f60799

SHA1
9536d0fef851738c20cbc875a45fd6ba43b63812

SHA256
61158045ae39df57360693d932cfc1a79623f6e37fa50bce12359881965f538c

SHA512
011bc292174f6919b38d6f5dab71772d8510b611a9dc80756b2464ce40f57d0af0d9182ce5828061ff7cff67351748ef16328b85397686d72c6b349faa42f478

Download Submit
/data/user/0/com.eproduct_health6/app_west/ttYMB.json

Filesize
1KB

MD5
0a3437f4faac62f37dc248ff2b8ce0f8

SHA1
a380c2ed2d1b9147e4691c329a9bcba2aaf13200

SHA256
1446e2422798fce725ca770ffbef3fa1d1159de33855f316460f00ade23b3a98

SHA512
3537a201bc324dd0e5f85648bd5f2556c87dae41a085bc8f03f02dfc18540ca23cbd50ab82b9972f45ad3f2be37399f26444a5f888804359e940053d50d1ad43

Download Submit
Anonymous-DexFile@0xd53f8000-0xd547b7a8

Filesize
525KB

MD5
bef7f929a1cb257dddba0ab610ce0e77

SHA1
666463544ab668f88b231853b6681520d20e8df0

SHA256
17fa7aae2679b54f18877081f845902708133ea8c196f9aa1c2a950656520932

SHA512
486efdb746cb4df40c83a0a8b7908c93928b53d42afbf1136731e5f9458ae7e8703ee9f3cd2723934c239322f86cbf90ef95ad1a6b743a1f81b66dfdc677008d

Download Submit

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads