octo | 770994c9d5bb8554afabb675989bc843e0c7da0769eddb92476c57d50d56d4dd

Analysis

max time kernel
147s
max time network
150s
platform
android-11_x64
resource
android-x64-arm64-20240910-en
resource tags

arch:armarch:arm64arch:x64arch:x86image:android-x64-arm64-20240910-enlocale:en-usos:android-11-x64system
submitted
16-11-2024 22:00

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

770994c9d5bb8554afabb675989bc843e0c7da0769eddb92476c57d50d56d4dd.apk
Size

605KB
MD5

3e9bc28c092d03381ed0ff2e5d45d989
SHA1

f33d1b2a130fd8e7986ef577e93f78d14b4ca760
SHA256

770994c9d5bb8554afabb675989bc843e0c7da0769eddb92476c57d50d56d4dd
SHA512

5b6e303d202a9f2f0f62a13fc52b0639b068e96e46f8adbaa93772f092427c2191e453c67803098c0e0ec050ad975cc862d75d292e444354efbfcce1ecffc750
SSDEEP

12288:V+ppcVe4/g7id0c+dwKLcdgJ7XGM2ymmsZfizHs4hDLrMhdJCF:UppcI4HudLNJ7XGM5sZqzHsIzgdJCF

Score

10^/10

octo banker collection credential_access discovery evasion execution impact infostealer persistence rat trojan

Malware Config

Extracted

Family

octo

https://34b6413903074567453981d0595033c23.com/YmZiMzU0OTU5NGIz/

https://64b6413903074567453981d0595033c23.com/YmZiMzU0OTU5NGIz/

https://74b6413903074567453981d0595033c23.com/YmZiMzU0OTU5NGIz/

https://894b6413903074567453981d0595033c23.com/YmZiMzU0OTU5NGIz/

https://94b64139030754567453981d0595033c23.com/YmZiMzU0OTU5NGIz/

https://94b64139033074567453981d0595033c23.com/YmZiMzU0OTU5NGIz/

https://94b641553903074567453981d0595033c23.com/YmZiMzU0OTU5NGIz/

DES_key

AES_key

Signatures

Octo
Octo is a banking malware with remote access capabilities first seen in April 2022.
banker trojan infostealer rat octo
Octo family
octo

Octo payload 1 IoCs

resource	yara_rule
behavioral3/files/fstream-3.dat	family_octo

Loads dropped Dex/Jar 1 TTPs 2 IoCs

Runs executable file dropped to the device during analysis.

evasion

Download New Code at Runtime

T1407

ioc	pid	Process
/data/user/0/com.stillshow51/code_cache/secondary-dexes/1731794425921_classes.dex	4739	com.stillshow51
/data/user/0/com.stillshow51/code_cache/secondary-dexes/1731794425921_classes.dex	4739	com.stillshow51

Makes use of the framework's Accessibility service 4 TTPs 2 IoCs

Retrieves information displayed on the phone screen using AccessibilityService.

collection evasion credential_access

Input Injection

T1516

Screen Capture

T1513

Keylogging

T1417.001

GUI Input Capture

T1417.002

description	ioc	Process
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId	com.stillshow51
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByViewId	com.stillshow51

Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
banker discovery

Security Software Discovery
T1418.001
Queries the phone number (MSISDN for GSM devices) 1 TTPs
discovery

System Network Configuration Discovery
T1422

Acquires the wake lock 1 IoCs

description	ioc	Process
Framework service call	android.os.IPowerManager.acquireWakeLock	com.stillshow51

Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs

Application may abuse the framework's foreground service to continue running in the foreground.

evasion persistence

Foreground Persistence

T1541

description	ioc	Process
Framework service call	android.app.IActivityManager.setServiceForeground	com.stillshow51

Performs UI accessibility actions on behalf of the user 1 TTPs 4 IoCs

Application may abuse the accessibility service to prevent their removal.

evasion

Prevent Application Removal

T1629.001

ioc	Process
android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction	com.stillshow51
android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction	com.stillshow51
android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction	com.stillshow51
android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction	com.stillshow51

Queries the mobile country code (MCC) 1 TTPs 1 IoCs

discovery

System Network Configuration Discovery

T1422

description	ioc	Process
Framework service call	com.android.internal.telephony.ITelephony.getNetworkCountryIsoForPhone	com.stillshow51

Reads information about phone network operator. 1 TTPs
discovery

System Network Configuration Discovery
T1422

Requests accessing notifications (often used to intercept notifications before users become aware). 1 TTPs 1 IoCs

collection credential_access

Access Notifications

T1517

description	ioc	Process
Intent action	android.settings.ACTION_NOTIFICATION_LISTENER_SETTINGS	com.stillshow51

Requests disabling of battery optimizations (often used to enable hiding in the background). 1 TTPs 1 IoCs

evasion

User Evasion

T1628.002

description	ioc	Process
Intent action	android.settings.REQUEST_IGNORE_BATTERY_OPTIMIZATIONS	com.stillshow51

Requests modifying system settings. 1 IoCs

evasion

description	ioc	Process
Intent action	android.settings.action.MANAGE_WRITE_SETTINGS	com.stillshow51

Schedules tasks to execute at a specified time 1 TTPs 1 IoCs

Application may abuse the framework's APIs to perform task scheduling for initial or recurring execution of malicious code.

execution persistence

Scheduled Task/Job

T1603

description	ioc	Process
Framework service call	android.app.job.IJobScheduler.schedule	com.stillshow51

Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs

impact

Data Encrypted for Impact

T1471

description	ioc	Process
Framework API call	javax.crypto.Cipher.doFinal	com.stillshow51

com.stillshow51
1⤵
- Loads dropped Dex/Jar
- Makes use of the framework's Accessibility service
- Acquires the wake lock
- Makes use of the framework's foreground persistence service
- Performs UI accessibility actions on behalf of the user
- Queries the mobile country code (MCC)
- Requests accessing notifications (often used to intercept notifications before users become aware).
- Requests disabling of battery optimizations (often used to enable hiding in the background).
- Requests modifying system settings.
- Schedules tasks to execute at a specified time
- Uses Crypto APIs (Might try to encrypt user data)
PID:4739

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Scheduled Task/Job

T1603

Persistence

Foreground Persistence

T1541

Scheduled Task/Job

T1603

Privilege Escalation

Defense Evasion

Download New Code at Runtime

T1407

Foreground Persistence

T1541

Hide Artifacts

T1628

User Evasion

T1628.002

Impair Defenses

T1629

Prevent Application Removal

T1629.001

Input Injection

T1516

Credential Access

Access Notifications

T1517

Input Capture

T1417

GUI Input Capture

T1417.002

Keylogging

T1417.001

Discovery

Software Discovery

T1418

Security Software Discovery

T1418.001

System Network Configuration Discovery

T1422

Lateral Movement

Collection

Access Notifications

T1517

Input Capture

T1417

GUI Input Capture

T1417.002

Keylogging

T1417.001

Screen Capture

T1513

Command and Control

Exfiltration

Impact

Data Encrypted for Impact

T1471

Input Injection

T1516

Replay Monitor

Loading Replay Monitor...

Downloads

/data/data/com.stillshow51/cache/classes.dex

Filesize
446KB

MD5
3b4319eaf6dc1eada8a52f193873c416

SHA1
96f831cc3f22e28635868f635b0958fe8af32f7f

SHA256
c75389a6c582cde210357389b4dca5c339374447a6e24abe38584f27f2937d24

SHA512
0b9607419e925b7692633468d914591e79a46d3b04fb475be05dffa45d3e063a3294f2b02b50998c8878ea29e5210f2bdd539b07ef3ecd2fdadbde6e3d366879

Download Submit
/data/data/com.stillshow51/code_cache/secondary-dexes/1731794425921_classes.dex

Filesize
1.1MB

MD5
5580eede36d9e0606b7c761a8cbc1f78

SHA1
38064c6fdddce2453f21a0ec3faa50e5f6e48172

SHA256
0c23e37d0b81250fe0212c9d9eda7e25859f84c78b5cdd48f166c028c03fb101

SHA512
26efff0ddf5611b424e686e1146634f42bac708c4573761f93c155d8964037ad3413d1a0f4e1119d14e6c1c2435c39413bdc443ff0c58b320fc1260d39cb0d8e

Download Submit
/data/data/com.stillshow51/files/profileinstaller_profileWrittenFor_lastUpdateTime.dat

Filesize
8B

MD5
1af98afd089ce4a171ca4a3f95f7e46f

SHA1
9876f0d883a0d0faf5bbf73dc97765b0ef83d865

SHA256
a411fbf3cd7316a5f3910d5b3ef777ef34df5557fed82a14ff0708fdff5a21f5

SHA512
2041bedcf2531f4c24e7cff6a9104430f8c9b098f3b7ff14cc2eae4b10dbc36dde5b77b69a192a11c7dda6a6c009faf629fcac453ccf29ba65c21dc4913b1f1e

Download Submit
/data/data/com.stillshow51/no_backup/androidx.work.workdb

Filesize
4KB

MD5
7e858c4054eb00fcddc653a04e5cd1c6

SHA1
2e056bf31a8d78df136f02a62afeeca77f4faccf

SHA256
9010186c5c083155a45673017d1e31c2a178e63cc15a57bbffde4d1956a23dad

SHA512
d0c7a120940c8e637d5566ef179d01eff88a2c2650afda69ad2a46aad76533eaace192028bba3d60407b4e34a950e7560f95d9f9b8eebe361ef62897d88b30cb

Download Submit
/data/data/com.stillshow51/no_backup/androidx.work.workdb-journal

Filesize
512B

MD5
e834c4314dd7659e0677ab68ce9d24e6

SHA1
20033303fd5031b990a4f4df92032cd80feaf341

SHA256
f005b7e201b0f3307135b740eb1cc3e683d379519826c65dcd964ad1ca882ae9

SHA512
e10df70807a746c6b11e4bdae54e57a91487673449c7ee26803621bfe3aea7696eca26f20bc79f79b30d16dca66d51faf653dad4b332e73e14911f53e79eb4e1

Download Submit
/data/data/com.stillshow51/no_backup/androidx.work.workdb-shm

Filesize
32KB

MD5
bb7df04e1b0a2570657527a7e108ae23

SHA1
5188431849b4613152fd7bdba6a3ff0a4fd6424b

SHA256
c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479

SHA512
768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012

Download Submit
/data/data/com.stillshow51/no_backup/androidx.work.workdb-wal

Filesize
169KB

MD5
086e6103fb227a64975ea74825db8b73

SHA1
2c3aa5641b19f71cd960f610b3ef3bb0ad1ba76c

SHA256
4fe7f0d9e44b5ccde79154cf41eabbc0f31a32db19aa9b503be169a33032e0db

SHA512
735c5052e23e77dc02c752c14cb2c1441162b3d7c14b924ca1213f314a2ad171bf158f685a9898ac621a870ed3114984a4a318e5b3a9809d1052b119e02f5a20

Download Submit
/data/data/com.stillshow51/no_backup/androidx.work.workdb-wal

Filesize
16KB

MD5
3afad7979be645c36fb15534d5cb92d4

SHA1
647ab8507c3f4799bda460be8b066a9a461d07c1

SHA256
6585e8e3149253f54a40fd787492462030aef21fa1c444ae47a763374a72be97

SHA512
1eb9ae508c1d3171b3329401a1dad24a7256939ac4163e9f47e0375d6fbaf3259018450a8c5ffdf5451c4cc5f1aa70c4c59d94945e4eb86a803b66d863e25a74

Download Submit
/data/data/com.stillshow51/no_backup/androidx.work.workdb-wal

Filesize
116KB

MD5
8bd784ec5bce49c0e25c737972971607

SHA1
03f9d2c509ba7469815eb8e93436df493c7f39e6

SHA256
9ae5fd21b3967df7c440fc48b08384e13b5bb799724f273ea8ac4d0b8453991c

SHA512
3d7957d6ab10e3a769bd66b7c5f10401422cbe21f5d85d8f3ccc0c8d3c11a77bdd2c4ffdcfb9c1242e4f505753017cfb610c849d9c65bccc4d4f65c8ddc2616e

Download Submit
/data/misc/profiles/cur/0/com.stillshow51/primary.prof

Filesize
108B

MD5
ebaaaf65d8be3832e6776826051713cf

SHA1
f9f4e3f409a0cc80f6ac6784a1cc60af9994b8d2

SHA256
82734afb342b0c87d81bb8483524b1c8c79e939798edadb7ee7f0df7095ea536

SHA512
82b60f3c0d53d46c65a7ec1b3d7dbc9839e48c84ad48c3aab4f735a5b89c75365c56217d6811f0aa71a092402ef7c6be7366688786454992863d606533d33bff

Download Submit
/data/misc/profiles/cur/0/com.stillshow51/primary.prof

Filesize
25B

MD5
b9d9e0f8902d129e1aeebff0ae7b725b

SHA1
cb0d2b4c9dd60a5c1fc6261fb581bcd3416fe781

SHA256
25a822139d06016af8be1296c0242b60e35074f94c713e03323636be1162ce91

SHA512
f158a9dc753e0cb41f71a98714ff02198c576bacdd792a6153fdaf6f9a7b52d8cfb6d09099a269d0c1b0d31e2ea5a307ea1db85115bdc6797887a6de36d597f6

Download Submit

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads