octo | 3a61853e2de7bf657cbd080b4a83e1e0e7c77f02c5a7a4762fe96510592e69de

Analysis

max time kernel
19s
max time network
40s
platform
android-9_x86
resource
android-x86-arm-20240910-en
resource tags

arch:armarch:x86image:android-x86-arm-20240910-enlocale:en-usos:android-9-x86system
submitted
11-11-2024 09:47

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

3a61853e2de7bf657cbd080b4a83e1e0e7c77f02c5a7a4762fe96510592e69de.apk
Size

9.9MB
MD5

5506094b6d46b5779dc9a2b4524550ad
SHA1

829bde64905b0048e715b2a65248930aee15cf01
SHA256

3a61853e2de7bf657cbd080b4a83e1e0e7c77f02c5a7a4762fe96510592e69de
SHA512

e9a9c309b04a883b43767c97a048e91a03ad9c7ff6a360efba52ee3406dd1e5023dfb993a5af2b950636d477559b9113abdcf345159e6b57957ce6fe3c8bccaa
SSDEEP

98304:YBqqKyqDIkp9BRhM3XFRs1d5iSRGAIVKF70cgSoAqNTAJTsj+dXpKodYcUZ3RQRA:YkJlm3XFR8rSUCMqNkVrRu3R

Score

10^/10

octo banker collection credential_access discovery evasion impact infostealer persistence rat trojan

Malware Config

Extracted

Family

octo

AES_key

Signatures

Octo
Octo is a banking malware with remote access capabilities first seen in April 2022.
banker trojan infostealer rat octo
Octo family
octo

Octo payload 1 IoCs

resource	yara_rule
behavioral1/memory/4330-1.dex	family_octo

Loads dropped Dex/Jar 1 TTPs 3 IoCs

Runs executable file dropped to the device during analysis.

evasion

Download New Code at Runtime

T1407

ioc	pid	Process
/data/user/0/com.dknarrow0_phone/app_reopen/Pums.json	4354	/system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.dknarrow0_phone/app_reopen/Pums.json --output-vdex-fd=41 --oat-fd=42 --oat-location=/data/user/0/com.dknarrow0_phone/app_reopen/oat/x86/Pums.odex --compiler-filter=quicken --class-loader-context=&
/data/user/0/com.dknarrow0_phone/app_reopen/Pums.json	4330	com.dknarrow0_phone
Anonymous-DexFile@0xc9789000-0xc980c6c8	4330	com.dknarrow0_phone

Makes use of the framework's Accessibility service 4 TTPs 2 IoCs

Retrieves information displayed on the phone screen using AccessibilityService.

collection evasion credential_access

Input Injection

T1516

Screen Capture

T1513

Keylogging

T1417.001

GUI Input Capture

T1417.002

description	ioc	Process
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId	com.dknarrow0_phone
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByViewId	com.dknarrow0_phone

Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
banker discovery

Security Software Discovery
T1418.001
Queries the phone number (MSISDN for GSM devices) 1 TTPs
discovery

System Network Configuration Discovery
T1422

Acquires the wake lock 1 IoCs

description	ioc	Process
Framework service call	android.os.IPowerManager.acquireWakeLock	com.dknarrow0_phone

Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs

Application may abuse the framework's foreground service to continue running in the foreground.

evasion persistence

Foreground Persistence

T1541

description	ioc	Process
Framework service call	android.app.IActivityManager.setServiceForeground	com.dknarrow0_phone

Queries the mobile country code (MCC) 1 TTPs 1 IoCs

discovery

System Network Configuration Discovery

T1422

description	ioc	Process
Framework service call	com.android.internal.telephony.ITelephony.getNetworkCountryIsoForPhone	com.dknarrow0_phone

Queries the unique device ID (IMEI, MEID, IMSI) 1 TTPs
discovery

System Network Configuration Discovery
T1422

Requests disabling of battery optimizations (often used to enable hiding in the background). 1 TTPs 1 IoCs

evasion

User Evasion

T1628.002

description	ioc	Process
Intent action	android.settings.REQUEST_IGNORE_BATTERY_OPTIMIZATIONS	com.dknarrow0_phone

Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs

persistence

Broadcast Receivers

T1624.001

description	ioc	Process
Framework service call	android.app.IActivityManager.registerReceiver	com.dknarrow0_phone

Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs

impact

Data Encrypted for Impact

T1471

description	ioc	Process
Framework API call	javax.crypto.Cipher.doFinal	com.dknarrow0_phone

Checks CPU information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/cpuinfo	com.dknarrow0_phone

Checks memory information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/meminfo	com.dknarrow0_phone

com.dknarrow0_phone
1⤵
- Loads dropped Dex/Jar
- Makes use of the framework's Accessibility service
- Acquires the wake lock
- Makes use of the framework's foreground persistence service
- Queries the mobile country code (MCC)
- Requests disabling of battery optimizations (often used to enable hiding in the background).
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Uses Crypto APIs (Might try to encrypt user data)
- Checks CPU information
- Checks memory information
PID:4330
- /system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.dknarrow0_phone/app_reopen/Pums.json --output-vdex-fd=41 --oat-fd=42 --oat-location=/data/user/0/com.dknarrow0_phone/app_reopen/oat/x86/Pums.odex --compiler-filter=quicken --class-loader-context=&
  2⤵
  - Loads dropped Dex/Jar
  PID:4354

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Event Triggered Execution

T1624

Broadcast Receivers

T1624.001

Foreground Persistence

T1541

Privilege Escalation

Defense Evasion

Download New Code at Runtime

T1407

Foreground Persistence

T1541

Hide Artifacts

T1628

User Evasion

T1628.002

Input Injection

T1516

Virtualization/Sandbox Evasion

T1633

System Checks

T1633.001

Credential Access

Input Capture

T1417

GUI Input Capture

T1417.002

Keylogging

T1417.001

Discovery

Software Discovery

T1418

Security Software Discovery

T1418.001

System Information Discovery

T1426

System Network Configuration Discovery

T1422

Lateral Movement

Collection

Input Capture

T1417

GUI Input Capture

T1417.002

Keylogging

T1417.001

Screen Capture

T1513

Command and Control

Exfiltration

Impact

Data Encrypted for Impact

T1471

Input Injection

T1516

Replay Monitor

Loading Replay Monitor...

Downloads

/data/data/com.dknarrow0_phone/.global.com.dknarrow0_phone

Filesize
48B

MD5
046a414913add6f5bb60072c7db819b6

SHA1
451ee4f6809260aec622d772fd329c7d0297a842

SHA256
b66c1320cb063a1d391c94273572ea6edae76c8c8b0a07f8d75c88686f0df72a

SHA512
4e6355f3051ed5e811ab030abde1f5be7f5e1cf33be99cd08477e9b6c015deb1d8bd75a09fb9c7176b8511c5ad0a67abc0902a3531e97564ccb6afc57496a47c

Download Submit
/data/data/com.dknarrow0_phone/app_reopen/Pums.json

Filesize
1004B

MD5
3d4283348d8f991ea8d9cbb8819a4517

SHA1
511a614c5e09973ed13a47bb827d59ce99dcb5e3

SHA256
3f931b2e6e9f4000a6b103680632a59c211080be512dc905b014a314086571bb

SHA512
a82cca87015a5035ee29d64aaaa62ff307e2d173542d64726db349bd6bf5708accf7d555b49d2e4b0e229ede83b2f7e3410dcdefeb346a76a979b4904059f13e

Download Submit
/data/data/com.dknarrow0_phone/app_reopen/Pums.json

Filesize
1004B

MD5
46baecc25a9322d367237f2ef33c239a

SHA1
bae3280ad18654130c0e2ad784a5f65965a3e3ff

SHA256
e012a53ddeaec13e19b6923ae6521401427266ad5caa5a35c49c7cea2cbc801e

SHA512
4141d2714ed62c4aa6847a9db0fac1467f216bfea32106935d786e96789e5bf315c98a414a9476b03c08ce8f112c37818c93a4b25b53c2bb30b39bdc0b17077e

Download Submit
/data/data/com.dknarrow0_phone/files/.s

Filesize
307KB

MD5
4e73947cabb5db3f92ca85004981b754

SHA1
6d9667fdb0280ed2dcb782b4683e422a51bdc601

SHA256
6db94232e756b90ed437f1bc87dc38cf20fb2e7c7a19a5e40c6c17254b7e234c

SHA512
be8b500a7070af1dfb53b0cf1a7b327dadc4e163a6dad905496ac228c58cd1ed87b054533917924455d35e9b300683ae33e1bcdd91935a5dbae1d693c3e13d69

Download Submit
/data/user/0/com.dknarrow0_phone/app_reopen/Pums.json

Filesize
1KB

MD5
8ad412a26a25145a1714ba254f283a6e

SHA1
12a2adeafd769b9a16d9ec83151597752b31c048

SHA256
f3d6eea469c333b3fc86dafb9f55a55fb24354908bffec1555a195e09052c624

SHA512
11f59f5162c896287dc5d92a6b434faff6eb6b19834c275dc08e1b099d70e995dea2e64436d86ce9e01d02cf47956a25765a5e5dea839d9acca81317c3057fc0

Download Submit
/data/user/0/com.dknarrow0_phone/app_reopen/Pums.json

Filesize
1KB

MD5
edbd92587630b7a8ba7e63aed9093a50

SHA1
932ff5531ff07eb4fe4622c153b455bcd81bc1c7

SHA256
7d3ecac281d2c8d24fa27e67fc71a8fdf3ef14c8e214d86a04c760a8ede02b5b

SHA512
ee1ab295fae467fda3bc2fc208722f03eceb5d5e89d4a68d5e4a11f7212040528c6d5869edf0eb60ca534ebcd5b8e2836ca99114c6f0d3dd193506069ed60a82

Download Submit
Anonymous-DexFile@0xc9789000-0xc980c6c8

Filesize
525KB

MD5
dee06b66f3962ab32d9a6f6018d17cf0

SHA1
7ac50b04e27f72db697b223c693479fd50759272

SHA256
7d5044eb816d4b4e11f456496023dd1f2f27cca344b5fc45e46830b818316e3e

SHA512
29de86d297350e9e27bfbc6ca52303bdf410b71a4c8ebaee5067dc8a98ce12dc9799243bd1f6fa2282be5777a61544e12c6092497a25c4a92ec807eb47ff3fb2

Download Submit

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads