octo | 935ed9c6ef3cf2aaca2e642f01ae4a10ab05ac2977d81fa7fb883b10a68c8584

Analysis

max time kernel
141s
max time network
151s
platform
android_x64
resource
android-x64-arm64-20240624-en
resource tags

androidarch:armarch:arm64arch:x64arch:x86image:android-x64-arm64-20240624-enlocale:en-usos:android-11-x64system
submitted
16-11-2024 22:00

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

935ed9c6ef3cf2aaca2e642f01ae4a10ab05ac2977d81fa7fb883b10a68c8584.apk
Size

605KB
MD5

4aa67b670c8ec8e8e5989259c8b79a8e
SHA1

043044521057199178bacae64acdb74fa4fceafb
SHA256

935ed9c6ef3cf2aaca2e642f01ae4a10ab05ac2977d81fa7fb883b10a68c8584
SHA512

cff2d9915be5fdfc3ece57d19ff19dcb4fc27b2e03b38c090ce902cee81f6f2a37393dae29eccd61ac66b056217911e0426c69dba5f0aa3c636ca2b23e8591c1
SSDEEP

12288:f9Sd4l6LPUq3Vf9IMSl/6t3jQSnjlnK4xxdrF6dun74us4hDLrMhd1f8:Fu4l6LzIjYQSnjlrdx6dun74usIzgdt8

Score

10^/10

octo banker collection credential_access discovery evasion execution impact infostealer persistence rat trojan

Malware Config

Extracted

Family

octo

https://7bb13903074567453981d0595033c23.com/YmZiMzU0OTU5NGIz/

https://4b6413903074567453981d0595033c23.com/YmZiMzU0OTU5NGIz/

https://34b6413903074567453981d0595033c23.com/YmZiMzU0OTU5NGIz/

https://64b6413903074567453981d0595033c23.com/YmZiMzU0OTU5NGIz/

https://74b6413903074567453981d0595033c23.com/YmZiMzU0OTU5NGIz/

https://894b6413903074567453981d0595033c23.com/YmZiMzU0OTU5NGIz/

https://94b64139030754567453981d0595033c23.com/YmZiMzU0OTU5NGIz/

https://94b64139033074567453981d0595033c23.com/YmZiMzU0OTU5NGIz/

https://94b641553903074567453981d0595033c23.com/YmZiMzU0OTU5NGIz/

DES_key

AES_key

Signatures

Octo
Octo is a banking malware with remote access capabilities first seen in April 2022.
banker trojan infostealer rat octo
Octo family
octo

Octo payload 1 IoCs

resource	yara_rule
behavioral3/files/fstream-3.dat	family_octo

Loads dropped Dex/Jar 1 TTPs 2 IoCs

Runs executable file dropped to the device during analysis.

evasion

Download New Code at Runtime

T1407

ioc	pid	Process
/data/user/0/com.sawtryap/code_cache/secondary-dexes/1731794430847_classes.dex	4428	com.sawtryap
/data/user/0/com.sawtryap/code_cache/secondary-dexes/1731794430847_classes.dex	4428	com.sawtryap

Makes use of the framework's Accessibility service 4 TTPs 2 IoCs

Retrieves information displayed on the phone screen using AccessibilityService.

collection evasion credential_access

Input Injection

T1516

Screen Capture

T1513

Keylogging

T1417.001

GUI Input Capture

T1417.002

description	ioc	Process
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId	com.sawtryap
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByViewId	com.sawtryap

Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
banker discovery

Security Software Discovery
T1418.001
Queries the phone number (MSISDN for GSM devices) 1 TTPs
discovery

System Network Configuration Discovery
T1422

Acquires the wake lock 1 IoCs

description	ioc	Process
Framework service call	android.os.IPowerManager.acquireWakeLock	com.sawtryap

Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs

Application may abuse the framework's foreground service to continue running in the foreground.

evasion persistence

Foreground Persistence

T1541

description	ioc	Process
Framework service call	android.app.IActivityManager.setServiceForeground	com.sawtryap

Performs UI accessibility actions on behalf of the user 1 TTPs 4 IoCs

Application may abuse the accessibility service to prevent their removal.

evasion

Prevent Application Removal

T1629.001

ioc	Process
android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction	com.sawtryap
android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction	com.sawtryap
android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction	com.sawtryap
android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction	com.sawtryap

Queries the mobile country code (MCC) 1 TTPs 1 IoCs

discovery

System Network Configuration Discovery

T1422

description	ioc	Process
Framework service call	com.android.internal.telephony.ITelephony.getNetworkCountryIsoForPhone	com.sawtryap

Reads information about phone network operator. 1 TTPs
discovery

System Network Configuration Discovery
T1422

Requests accessing notifications (often used to intercept notifications before users become aware). 1 TTPs 1 IoCs

collection credential_access

Access Notifications

T1517

description	ioc	Process
Intent action	android.settings.ACTION_NOTIFICATION_LISTENER_SETTINGS	com.sawtryap

Requests disabling of battery optimizations (often used to enable hiding in the background). 1 TTPs 1 IoCs

evasion

User Evasion

T1628.002

description	ioc	Process
Intent action	android.settings.REQUEST_IGNORE_BATTERY_OPTIMIZATIONS	com.sawtryap

Requests modifying system settings. 1 IoCs

evasion

description	ioc	Process
Intent action	android.settings.action.MANAGE_WRITE_SETTINGS	com.sawtryap

Schedules tasks to execute at a specified time 1 TTPs 1 IoCs

Application may abuse the framework's APIs to perform task scheduling for initial or recurring execution of malicious code.

execution persistence

Scheduled Task/Job

T1603

description	ioc	Process
Framework service call	android.app.job.IJobScheduler.schedule	com.sawtryap

Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs

impact

Data Encrypted for Impact

T1471

description	ioc	Process
Framework API call	javax.crypto.Cipher.doFinal	com.sawtryap

com.sawtryap
1⤵
- Loads dropped Dex/Jar
- Makes use of the framework's Accessibility service
- Acquires the wake lock
- Makes use of the framework's foreground persistence service
- Performs UI accessibility actions on behalf of the user
- Queries the mobile country code (MCC)
- Requests accessing notifications (often used to intercept notifications before users become aware).
- Requests disabling of battery optimizations (often used to enable hiding in the background).
- Requests modifying system settings.
- Schedules tasks to execute at a specified time
- Uses Crypto APIs (Might try to encrypt user data)
PID:4428

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Scheduled Task/Job

T1603

Persistence

Foreground Persistence

T1541

Scheduled Task/Job

T1603

Privilege Escalation

Defense Evasion

Download New Code at Runtime

T1407

Foreground Persistence

T1541

Hide Artifacts

T1628

User Evasion

T1628.002

Impair Defenses

T1629

Prevent Application Removal

T1629.001

Input Injection

T1516

Credential Access

Access Notifications

T1517

Input Capture

T1417

GUI Input Capture

T1417.002

Keylogging

T1417.001

Discovery

Software Discovery

T1418

Security Software Discovery

T1418.001

System Network Configuration Discovery

T1422

Lateral Movement

Collection

Access Notifications

T1517

Input Capture

T1417

GUI Input Capture

T1417.002

Keylogging

T1417.001

Screen Capture

T1513

Command and Control

Exfiltration

Impact

Data Encrypted for Impact

T1471

Input Injection

T1516

Replay Monitor

Loading Replay Monitor...

Downloads

/data/data/com.sawtryap/cache/classes.dex

Filesize
447KB

MD5
7439dbebc89b6d5bf5d60ce9bce7f372

SHA1
bd4a9e2f8cbae2dfe565dbfde4a71860253fcd06

SHA256
d8a0befdc55799579b648fc4c49627580bc28e33f534f450bdeb33f97d534dbf

SHA512
5a16e90d5b08894de2982e2af6fa5ffba62e74af6d850770eefb1cf1cedf18185017c36a6b9889234d2999a641b68cc187d6cad6e32c646a7433f0476d8f991c

Download Submit
/data/data/com.sawtryap/code_cache/secondary-dexes/1731794430847_classes.dex

Filesize
1.1MB

MD5
4a9505711d86bf2f6825570cc2f51fda

SHA1
26324e43842737036eb17a539bd566959eabc186

SHA256
7ab60ca0a844475b5631c7ef55ee362b6ad0e5f9aafd05ccabf2a987ea155796

SHA512
ff080b20e17fcfbc3b76d1ba6c88e77dba303b1b0301b0c26694840aa69bdb37cb7768a0957c8f742846b9f6272d5fbaff6eafc1a15b4a71c521d14161d3d59b

Download Submit
/data/data/com.sawtryap/files/profileinstaller_profileWrittenFor_lastUpdateTime.dat

Filesize
8B

MD5
fff9e3a3ff555e51b31a1d7e1dfaeaac

SHA1
3b0624952cc9b54922435df7aedea09fa16cb225

SHA256
eff06b6a4860eeef1c10c84a3191db429f72e03898cf83f3f057b46a06ae1079

SHA512
fa1c543ac507ed8a8a86d9a6a1ead5ff59662ec3a66a3fa5e2ddf8f8a3602db738e2391521efaffeb854cb81fa1244f3473b894c252f9e1d4715c7c54ef1257c

Download Submit
/data/data/com.sawtryap/no_backup/androidx.work.workdb

Filesize
4KB

MD5
7e858c4054eb00fcddc653a04e5cd1c6

SHA1
2e056bf31a8d78df136f02a62afeeca77f4faccf

SHA256
9010186c5c083155a45673017d1e31c2a178e63cc15a57bbffde4d1956a23dad

SHA512
d0c7a120940c8e637d5566ef179d01eff88a2c2650afda69ad2a46aad76533eaace192028bba3d60407b4e34a950e7560f95d9f9b8eebe361ef62897d88b30cb

Download Submit
/data/data/com.sawtryap/no_backup/androidx.work.workdb-journal

Filesize
512B

MD5
c59ddf8b48c568e312d4cc6aac4a2e7f

SHA1
3962408042bfb5fb42369fc9f179769d129a4998

SHA256
d97bc215a849b0dc066f5057bada432efbed4b0029e0c9da66678a510fed46d1

SHA512
a1690dffd39b042ca1c41e7086fcacaea5beec23e69b6e368fd524d4343603aeaa299a1076ce7334925fb74dca71d59c2ccff2e2c792cd2917aa95f9cc3c634c

Download Submit
/data/data/com.sawtryap/no_backup/androidx.work.workdb-shm

Filesize
32KB

MD5
bb7df04e1b0a2570657527a7e108ae23

SHA1
5188431849b4613152fd7bdba6a3ff0a4fd6424b

SHA256
c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479

SHA512
768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012

Download Submit
/data/data/com.sawtryap/no_backup/androidx.work.workdb-wal

Filesize
169KB

MD5
052a5be31ab7eb25a14a1f8ba2a71646

SHA1
66a43d787c3795fdea2fa95897f113558e4d9f7e

SHA256
10f39de3dc0260c780a533df08edac31b1e69d83cdb6bb2494691e4a56ebda7a

SHA512
883bd1a8d2543d09c43d338dec1cc6e0c8d238eeb60c1cfbc1f48697873331c509125e50d59383f39423a80619aea94bcf9c1f3d3f4b9767bd1a9f15dedfafd4

Download Submit
/data/data/com.sawtryap/no_backup/androidx.work.workdb-wal

Filesize
16KB

MD5
805e51d9f4469c35ec940f4353cf7af0

SHA1
74110d1ed370d6a25979bfb2fc10654b16db01d9

SHA256
94d76033357c11fa3031781d783237cdd82edeeb003dc9cc005a27fdd979958b

SHA512
b7694b193798a56d2b68ef79143469f9ebee1d513f52cb1097f68ed37d2b28e8f3f75d2d6a855fdcffcb240c235c13c2483471b15f64922511f85c230c1034f2

Download Submit
/data/data/com.sawtryap/no_backup/androidx.work.workdb-wal

Filesize
116KB

MD5
334476abf572680383fc8eea9782d89c

SHA1
e3f7abd89da81e2ccb31f84b1aebe21f7156bb91

SHA256
5438a6f8e0b357e3241e79da1e04d0081ce0db7ee84c18542d6ce79f2f5b92b5

SHA512
b8fd54b0528a510fee88d9dfd986774ef9689b3723419f4bff2ad7024d94747e8e4a34777cd4f4fa290722c43a7b4eacf0b2474d1b0d8f89fdf280be4ad83038

Download Submit
/data/misc/profiles/cur/0/com.sawtryap/primary.prof

Filesize
106B

MD5
5451948bbec030966e4a15280defc4ff

SHA1
9e2ccc7266b0cf2902879e41fdce2fe00517cb85

SHA256
303cfbfbe755be507e2cb0490d3010c110d2bb23a6d935cd929a8b30fa594faa

SHA512
3fd40acac791e309f8ef366133d6d48b889d29916ade5267aefe96d57ced68cb8621d8fb304693ade07af762655bf36febcd56622bd6803d709601d4f79ef354

Download Submit
/data/misc/profiles/cur/0/com.sawtryap/primary.prof

Filesize
25B

MD5
b9d9e0f8902d129e1aeebff0ae7b725b

SHA1
cb0d2b4c9dd60a5c1fc6261fb581bcd3416fe781

SHA256
25a822139d06016af8be1296c0242b60e35074f94c713e03323636be1162ce91

SHA512
f158a9dc753e0cb41f71a98714ff02198c576bacdd792a6153fdaf6f9a7b52d8cfb6d09099a269d0c1b0d31e2ea5a307ea1db85115bdc6797887a6de36d597f6

Download Submit

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads