octo | 9b8876dc564bfc7ded0f86e3a208960d5ce54a7c4122a13c20b8cd3869e5f9b9

Analysis

max time kernel
149s
max time network
159s
platform
android_x64
resource
android-x64-arm64-20240624-en
resource tags

androidarch:armarch:arm64arch:x64arch:x86image:android-x64-arm64-20240624-enlocale:en-usos:android-11-x64system
submitted
14/11/2024, 22:00

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
9b8876dc564bfc7ded0f86e3a208960d5ce54a7c4122a13c20b8cd3869e5f9b9.apk
Size 1.9MB
Sample241114-1w4dcstfme
SHA256 9b8876dc564bfc7ded0f86e3a208960d5ce54a7c4122a13c20b8cd3869e5f9b9
MD5 85a12519445dde3b3dee2e9e9be4be3c
SHA1 4462c4b29424f50e6bc23c9f20b630fda97197f8
SHA512 b463ca15c2c0bc6fcf7a5f1815876162656e7d0498e55c9c8d36743f0345e63669ce2a7ee815d48bb10f0c252afe48d9845ad25dd9194771243e2635220e34a8
SSDEEP 49152:/Msc1Jy5WQBfKys65xbijGyIj9pMdKnU071MUe6Q1g0iVQKN:/MKwQBfP1xbijGyIbTU0Gn6Q/CN
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

octo banker collection credential_access discovery evasion impact infostealer persistence rat trojan

Malware Config

Extracted

Family

octo

https://brunchxy.top/YTZhZjliODdlYTI4/
https://sporkly.top/YTZhZjliODdlYTI4/
https://glampingaz.top/YTZhZjliODdlYTI4/
https://frenemyq.top/YTZhZjliODdlYTI4/
https://chillaxio.top/YTZhZjliODdlYTI4/
https://ginormusj.top/YTZhZjliODdlYTI4/
https://workaholkc.top/YTZhZjliODdlYTI4/
https://hangryv.top/YTZhZjliODdlYTI4/
https://spanglix.top/YTZhZjliODdlYTI4/
https://blogosphze.top/YTZhZjliODdlYTI4/
https://smoggyu.top/YTZhZjliODdlYTI4/
https://edutainmt.top/YTZhZjliODdlYTI4/
https://mockumnt.top/YTZhZjliODdlYTI4/
https://fleekyp.top/YTZhZjliODdlYTI4/
https://infoglo.top/YTZhZjliODdlYTI4/
https://staycatzu.top/YTZhZjliODdlYTI4/
https://mansplainu.top/YTZhZjliODdlYTI4/
https://spaghettom.top/YTZhZjliODdlYTI4/
https://gluttonyd.top/YTZhZjliODdlYTI4/
https://electrohu.top/YTZhZjliODdlYTI4/
https://eorldekorasyonbiz.top

rc4.plain

Extracted

Family

octo

https://brunchxy.top/YTZhZjliODdlYTI4/
https://sporkly.top/YTZhZjliODdlYTI4/
https://glampingaz.top/YTZhZjliODdlYTI4/
https://frenemyq.top/YTZhZjliODdlYTI4/
https://chillaxio.top/YTZhZjliODdlYTI4/
https://ginormusj.top/YTZhZjliODdlYTI4/
https://workaholkc.top/YTZhZjliODdlYTI4/
https://hangryv.top/YTZhZjliODdlYTI4/
https://spanglix.top/YTZhZjliODdlYTI4/
https://blogosphze.top/YTZhZjliODdlYTI4/
https://smoggyu.top/YTZhZjliODdlYTI4/
https://edutainmt.top/YTZhZjliODdlYTI4/
https://mockumnt.top/YTZhZjliODdlYTI4/
https://fleekyp.top/YTZhZjliODdlYTI4/
https://infoglo.top/YTZhZjliODdlYTI4/
https://staycatzu.top/YTZhZjliODdlYTI4/
https://mansplainu.top/YTZhZjliODdlYTI4/
https://spaghettom.top/YTZhZjliODdlYTI4/
https://gluttonyd.top/YTZhZjliODdlYTI4/
https://electrohu.top/YTZhZjliODdlYTI4/
https://eorldekorasyonbiz.top/YTZhZjliODdlYTI4/

AES_key

Signatures

Octo
Octo is a banking malware with remote access capabilities first seen in April 2022.
banker trojan infostealer rat octo
Octo family
octo

Octo payload 1 IoCs

resource	yara_rule
behavioral2/memory/4593-0.dex	family_octo

Loads dropped Dex/Jar 1 TTPs 1 IoCs

Runs executable file dropped to the device during analysis.

evasion

Download New Code at Runtime

T1407

ioc	pid	Process
/data/user/0/com.sgakagak.agakagabs/app_talent/cEnLB.json	4593	com.sgakagak.agakagabs

Makes use of the framework's Accessibility service 4 TTPs 2 IoCs

Retrieves information displayed on the phone screen using AccessibilityService.

collection evasion credential_access

Input Injection

T1516

Screen Capture

T1513

Keylogging

T1417.001

GUI Input Capture

T1417.002

description	ioc	Process
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByViewId	com.sgakagak.agakagabs
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId	com.sgakagak.agakagabs

Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
banker discovery

Security Software Discovery
T1418.001
Queries the phone number (MSISDN for GSM devices) 1 TTPs
discovery

System Network Configuration Discovery
T1422

Acquires the wake lock 1 IoCs

description	ioc	Process
Framework service call	android.os.IPowerManager.acquireWakeLock	com.sgakagak.agakagabs

Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs

Application may abuse the framework's foreground service to continue running in the foreground.

evasion persistence

Foreground Persistence

T1541

description	ioc	Process
Framework service call	android.app.IActivityManager.setServiceForeground	com.sgakagak.agakagabs

Performs UI accessibility actions on behalf of the user 1 TTPs 4 IoCs

Application may abuse the accessibility service to prevent their removal.

evasion

Prevent Application Removal

T1629.001

ioc	Process
android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction	com.sgakagak.agakagabs
android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction	com.sgakagak.agakagabs
android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction	com.sgakagak.agakagabs
android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction	com.sgakagak.agakagabs

Queries the mobile country code (MCC) 1 TTPs 1 IoCs

discovery

System Network Configuration Discovery

T1422

description	ioc	Process
Framework service call	com.android.internal.telephony.ITelephony.getNetworkCountryIsoForPhone	com.sgakagak.agakagabs

Reads information about phone network operator. 1 TTPs
discovery

System Network Configuration Discovery
T1422

Requests accessing notifications (often used to intercept notifications before users become aware). 1 TTPs 1 IoCs

collection credential_access

Access Notifications

T1517

description	ioc	Process
Intent action	android.settings.ACTION_NOTIFICATION_LISTENER_SETTINGS	com.sgakagak.agakagabs

Requests disabling of battery optimizations (often used to enable hiding in the background). 1 TTPs 1 IoCs

evasion

User Evasion

T1628.002

description	ioc	Process
Intent action	android.settings.REQUEST_IGNORE_BATTERY_OPTIMIZATIONS	com.sgakagak.agakagabs

Requests modifying system settings. 1 IoCs

evasion

description	ioc	Process
Intent action	android.settings.action.MANAGE_WRITE_SETTINGS	com.sgakagak.agakagabs

Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs

impact

Data Encrypted for Impact

T1471

description	ioc	Process
Framework API call	javax.crypto.Cipher.doFinal	com.sgakagak.agakagabs

com.sgakagak.agakagabs
1⤵
- Loads dropped Dex/Jar
- Makes use of the framework's Accessibility service
- Acquires the wake lock
- Makes use of the framework's foreground persistence service
- Performs UI accessibility actions on behalf of the user
- Queries the mobile country code (MCC)
- Requests accessing notifications (often used to intercept notifications before users become aware).
- Requests disabling of battery optimizations (often used to enable hiding in the background).
- Requests modifying system settings.
- Uses Crypto APIs (Might try to encrypt user data)
PID:4593

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Foreground Persistence

T1541

Privilege Escalation

Defense Evasion

Download New Code at Runtime

T1407

Foreground Persistence

T1541

Hide Artifacts

T1628

User Evasion

T1628.002

Impair Defenses

T1629

Prevent Application Removal

T1629.001

Input Injection

T1516

Credential Access

Access Notifications

T1517

Input Capture

T1417

GUI Input Capture

T1417.002

Keylogging

T1417.001

Discovery

Software Discovery

T1418

Security Software Discovery

T1418.001

System Network Configuration Discovery

T1422

Lateral Movement

Collection

Access Notifications

T1517

Input Capture

T1417

GUI Input Capture

T1417.002

Keylogging

T1417.001

Screen Capture

T1513

Command and Control

Exfiltration

Impact

Data Encrypted for Impact

T1471

Input Injection

T1516

Replay Monitor

Loading Replay Monitor...

Downloads

cEnLB.json

Path /data/user/0/com.sgakagak.agakagabs/app_talent/cEnLB.json
Size 152KB
SHA256 58fe1752c7ad4dde51756067c754c15f735615156c6ae368fcac0d1cd65b43b3
MD5 7da7c53763bd881a19b880b6c45c1a1f
SHA1 fb56528078f14ecc0f30b40e3a593bfa60de1590
SHA512 9bd59e277d01e22e425af2105ae8fa89ed252761c6718b55817a4755617a163499c23d7731c7479472a4a8d229c000cc7f5cc1372a6beac1606dc953cfe93e77
SSDEEP 3072:8CQTveTGflU26ImbjccrhD7aAK2f9WEqgKc4udvmnzLvU:tQTYKlGvccrVav2f9DKc4ug3U
MD5 SHA1 SHA512 SSDEEP

Submit Download

cEnLB.json

Path /data/user/0/com.sgakagak.agakagabs/app_talent/cEnLB.json
Size 152KB
SHA256 4bbaa238c436a4b72092fffc45d385ada46741bfb8f61863ff2ff6f10e108b50
MD5 e3c3ba1b92f07c070a3d14ffc996a6d3
SHA1 59794086490c9d19eced3d219e3116f385bd8284
SHA512 3b3e002f30d402ab42f34a3ba5cd62a08ff0e1a127fd959f95c26d4284311c6717ee3a7749bf75e6aa0fb8c73ed5cdb4a8820800a62ac58d254dcb0a8b8a33b4
SSDEEP 3072:Yr2D28oq4ucZ/5F8piPert7+FdkLR32I6rs3QfLghjUDVEo:Yr2EqHm/ApiPeJ7tGrs3KLghjmP
MD5 SHA1 SHA512 SSDEEP

Submit Download

cEnLB.json

Path /data/user/0/com.sgakagak.agakagabs/app_talent/cEnLB.json
Size 450KB
SHA256 b84f3cd68731dffd90b11e12532b8dad4d067e8c35ef3aed608d2a3ec043a156
MD5 d81b8de8a4d208f9deae47923f351ee1
SHA1 7dd5b90f3ee38b9527e95639bdb11244173edd0b
SHA512 42c4a425e969f5cca15a317bfe935c1486a8de4b7ae397ed5b5478d82b2fe25baffb5f77150cbf81a7d38b8873e31fea14d0f3b1ba440f9fba0d4f10884d5dd7
SSDEEP 12288:f/OBunD3++UjwuDrhL0d5Unlt9UbbS4xoPwuCAIFsATCYeg:t/UjwuDg
MD5 SHA1 SHA512 SSDEEP

Download

Analysis

Sharing

General

Malware Config

Extracted

Extracted

Signatures

Processes

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads