octo | f1b9e3f4b8e23f56d14ea0d6ecf91e5022a7548a28c6bb0b1db6a2c274cd9ff3

Analysis

max time kernel
149s
max time network
150s
platform
android-11_x64
resource
android-x64-arm64-20240910-en
resource tags

arch:armarch:arm64arch:x64arch:x86image:android-x64-arm64-20240910-enlocale:en-usos:android-11-x64system
submitted
22-11-2024 22:09

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

f1b9e3f4b8e23f56d14ea0d6ecf91e5022a7548a28c6bb0b1db6a2c274cd9ff3.apk
Size

605KB
MD5

83d6844871ac04108a595028c172aa85
SHA1

1e51f9ff7995dd45fcc0a70b83ed96f54cfb1cd1
SHA256

f1b9e3f4b8e23f56d14ea0d6ecf91e5022a7548a28c6bb0b1db6a2c274cd9ff3
SHA512

2c45cb676ad3848c7df2e77fe12f90637bb36a2fc5eb90f6c7c67d63140b17adeb5eb96299cc089e0b045ceea942396d29578d6903a88250ea89ffa3d78488fc
SSDEEP

12288:VvNGODutF1Gplj0L41r+/gFuYXpxshdHYhn/t5PXfNIjXs4hDLrMhdKoDr:VvcOqxGplYL2r+ArXXOH8n/t5POjXsIS

Score

10^/10

octo banker collection credential_access discovery evasion execution impact infostealer persistence rat trojan

Malware Config

Extracted

Family

octo

https://34b6413903074567453981d0595033c23.com/YmZiMzU0OTU5NGIz/

https://64b6413903074567453981d0595033c23.com/YmZiMzU0OTU5NGIz/

https://74b6413903074567453981d0595033c23.com/YmZiMzU0OTU5NGIz/

https://894b6413903074567453981d0595033c23.com/YmZiMzU0OTU5NGIz/

https://94b64139030754567453981d0595033c23.com/YmZiMzU0OTU5NGIz/

https://94b64139033074567453981d0595033c23.com/YmZiMzU0OTU5NGIz/

https://94b641553903074567453981d0595033c23.com/YmZiMzU0OTU5NGIz/

DES_key

AES_key

Signatures

Octo
Octo is a banking malware with remote access capabilities first seen in April 2022.
banker trojan infostealer rat octo
Octo family
octo

Octo payload 1 IoCs

resource	yara_rule
behavioral3/files/fstream-3.dat	family_octo

Loads dropped Dex/Jar 1 TTPs 2 IoCs

Runs executable file dropped to the device during analysis.

evasion

Download New Code at Runtime

T1407

ioc	pid	Process
/data/user/0/com.picturefar0/code_cache/secondary-dexes/1732313346605_classes.dex	4738	com.picturefar0
/data/user/0/com.picturefar0/code_cache/secondary-dexes/1732313346605_classes.dex	4738	com.picturefar0

Makes use of the framework's Accessibility service 4 TTPs 2 IoCs

Retrieves information displayed on the phone screen using AccessibilityService.

collection evasion credential_access

Input Injection

T1516

Screen Capture

T1513

Keylogging

T1417.001

GUI Input Capture

T1417.002

description	ioc	Process
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId	com.picturefar0
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByViewId	com.picturefar0

Obtains sensitive information copied to the device clipboard 2 TTPs 1 IoCs

Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.

collection credential_access impact

Clipboard Data

T1414

Transmitted Data Manipulation

T1641.001

description	ioc	Process
Framework service call	android.content.IClipboard.addPrimaryClipChangedListener	com.picturefar0

Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
banker discovery

Security Software Discovery
T1418.001
Queries the phone number (MSISDN for GSM devices) 1 TTPs
discovery

System Network Configuration Discovery
T1422

Acquires the wake lock 1 IoCs

description	ioc	Process
Framework service call	android.os.IPowerManager.acquireWakeLock	com.picturefar0

Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs

Application may abuse the framework's foreground service to continue running in the foreground.

evasion persistence

Foreground Persistence

T1541

description	ioc	Process
Framework service call	android.app.IActivityManager.setServiceForeground	com.picturefar0

Performs UI accessibility actions on behalf of the user 1 TTPs 7 IoCs

Application may abuse the accessibility service to prevent their removal.

evasion

Prevent Application Removal

T1629.001

ioc	Process
android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction	com.picturefar0
android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction	com.picturefar0
android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction	com.picturefar0
android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction	com.picturefar0
android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction	com.picturefar0
android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction	com.picturefar0
android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction	com.picturefar0

Queries the mobile country code (MCC) 1 TTPs 1 IoCs

discovery

System Network Configuration Discovery

T1422

description	ioc	Process
Framework service call	com.android.internal.telephony.ITelephony.getNetworkCountryIsoForPhone	com.picturefar0

Reads information about phone network operator. 1 TTPs
discovery

System Network Configuration Discovery
T1422

Requests accessing notifications (often used to intercept notifications before users become aware). 1 TTPs 1 IoCs

collection credential_access

Access Notifications

T1517

description	ioc	Process
Intent action	android.settings.ACTION_NOTIFICATION_LISTENER_SETTINGS	com.picturefar0

Requests disabling of battery optimizations (often used to enable hiding in the background). 1 TTPs 1 IoCs

evasion

User Evasion

T1628.002

description	ioc	Process
Intent action	android.settings.REQUEST_IGNORE_BATTERY_OPTIMIZATIONS	com.picturefar0

Requests modifying system settings. 1 IoCs

evasion

description	ioc	Process
Intent action	android.settings.action.MANAGE_WRITE_SETTINGS	com.picturefar0

Schedules tasks to execute at a specified time 1 TTPs 1 IoCs

Application may abuse the framework's APIs to perform task scheduling for initial or recurring execution of malicious code.

execution persistence

Scheduled Task/Job

T1603

description	ioc	Process
Framework service call	android.app.job.IJobScheduler.schedule	com.picturefar0

Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs

impact

Data Encrypted for Impact

T1471

description	ioc	Process
Framework API call	javax.crypto.Cipher.doFinal	com.picturefar0

Checks CPU information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/cpuinfo	com.picturefar0

Checks memory information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/meminfo	com.picturefar0

com.picturefar0
1⤵
- Loads dropped Dex/Jar
- Makes use of the framework's Accessibility service
- Obtains sensitive information copied to the device clipboard
- Acquires the wake lock
- Makes use of the framework's foreground persistence service
- Performs UI accessibility actions on behalf of the user
- Queries the mobile country code (MCC)
- Requests accessing notifications (often used to intercept notifications before users become aware).
- Requests disabling of battery optimizations (often used to enable hiding in the background).
- Requests modifying system settings.
- Schedules tasks to execute at a specified time
- Uses Crypto APIs (Might try to encrypt user data)
- Checks CPU information
- Checks memory information
PID:4738

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Scheduled Task/Job

T1603

Persistence

Foreground Persistence

T1541

Scheduled Task/Job

T1603

Privilege Escalation

Defense Evasion

Download New Code at Runtime

T1407

Foreground Persistence

T1541

Hide Artifacts

T1628

User Evasion

T1628.002

Impair Defenses

T1629

Prevent Application Removal

T1629.001

Input Injection

T1516

Virtualization/Sandbox Evasion

T1633

System Checks

T1633.001

Credential Access

Access Notifications

T1517

Clipboard Data

T1414

Input Capture

T1417

GUI Input Capture

T1417.002

Keylogging

T1417.001

Discovery

Software Discovery

T1418

Security Software Discovery

T1418.001

System Information Discovery

T1426

System Network Configuration Discovery

T1422

Lateral Movement

Collection

Access Notifications

T1517

Clipboard Data

T1414

Input Capture

T1417

GUI Input Capture

T1417.002

Keylogging

T1417.001

Screen Capture

T1513

Command and Control

Exfiltration

Impact

Data Encrypted for Impact

T1471

Data Manipulation

T1641

Transmitted Data Manipulation

T1641.001

Input Injection

T1516

Replay Monitor

Loading Replay Monitor...

Downloads

/data/data/com.picturefar0/cache/classes.dex

Filesize
448KB

MD5
5cf9d631f22561e02a179f71dff0ceb4

SHA1
e0b80130b2f9f54b950ecf20b3ec7de0649525ee

SHA256
a92ede0ec9f2196b880a00142716620cb25f5eddd64b79f410e66f40d44c0bef

SHA512
066c941846a4f9b47448f404a00f212d567cc24560820fc025c2dd033ebb8a50078ba8f631a00ad9c1c1b7bf9509517e76b10f391130384c7c63025afac4dbda

Download Submit
/data/data/com.picturefar0/code_cache/secondary-dexes/1732313346605_classes.dex

Filesize
1.1MB

MD5
ca1d5993f0a3a8478c9c751c1dcfa80b

SHA1
93297024888afd532d42a384c4e835d22230bb7c

SHA256
4da400e359bed2f4fe26735fcf56d02e66a711402d9ddf71c1dc5e681d022572

SHA512
0123f94694a2d15309c4e1f14de06a5628c7b6a14cf89bb64cc575fac2e1ee9a5f0b03f084edd43186e9f898b1b91c0722073cd941a47a0368e0e7049ed55969

Download Submit
/data/data/com.picturefar0/files/profileinstaller_profileWrittenFor_lastUpdateTime.dat

Filesize
8B

MD5
927bc504cf94b855c698dc265699aad9

SHA1
8d4225f1bc815ae53c318d8ec4621a917ec55bae

SHA256
17e9fac7cda674d89ff759a5921008a87a37b140693e6987ce880dfa15334d9b

SHA512
b02d7e76db448a40e4ad14238c85aae4539d5baffa233fbfdbebfa3d74a4d9de96a71b4e4e77182bc84a7c255029de5c917925e52d8e9b2317781eaabf1e224b

Download Submit
/data/data/com.picturefar0/kl.txt

Filesize
28B

MD5
6311c3fd15588bb5c126e6c28ff5fffe

SHA1
ce81d136fce31779f4dd62e20bdaf99c91e2fc57

SHA256
8b82f6032e29a2b5c96031a3630fb6173d12ff0295bc20bb21b877d08f0812d8

SHA512
2975fe2e94b6a8adc9cfc1a865ad113772b54572883a537b02a16dd2d029c0f7d9cca3b154fd849bdfe978e18b396bcf9fa6e67e7c61f92bdc089a29a9c355c6

Download Submit
/data/data/com.picturefar0/kl.txt

Filesize
235B

MD5
ffc4a9f0ff088a44ad4690b2d26c938d

SHA1
a2a469e270315480440a3242b1fe6a5b6d70e3b1

SHA256
d3ff7c13b3b8aebf865ba027ff3533cc3105a48dfedb5ccc23d022835fb43d23

SHA512
847eb6cf429ccde7190d31454332b95f1234eb1f819bf130f322b168cf6fc3de3eda9b312d67f4b6f68a792e1b044a4aaa30fb961357cb013a3b59e65375be32

Download Submit
/data/data/com.picturefar0/kl.txt

Filesize
63B

MD5
977b316b33d6af9f49a41797cdfdfcd9

SHA1
ca44141dede612e4073c846a29d129cc7a4404b6

SHA256
405cfe0c2f7967ad3cb48759c50b0bc8b974ab3cf46d09de569afe8da3c07f43

SHA512
9a66ebd20ac43c224c0ef501fb5508779301f94ed8d3c0a03bdcbf2b2024aa7cea0ef444dfe82a92c7ae7f062b0c06b3961bfaedc709337ec239cae7935817f1

Download Submit
/data/data/com.picturefar0/kl.txt

Filesize
45B

MD5
5a4c6ddb09d93b3a764589eecd2a8cce

SHA1
84532c124dd0cd7cf37fdf79e5bcb884ef81172c

SHA256
87571c42086e513eb6004bf71d0c158a66b9b67572a4bb6ead30eb172bd1db3e

SHA512
7a874f4fbd0b8f5ed3bf357a8c45134a23eab6df1e49b1737204c4a837187afcdaff8d00dd21d2e7a77e1f44943ef4766acba4974b4f01349595ec4059aaafe8

Download Submit
/data/data/com.picturefar0/kl.txt

Filesize
476B

MD5
8cd80e454f0393a8d9655fa736cd4bae

SHA1
b3533be49c469a7f227f06717c537573b05f8690

SHA256
d73b32734571a08bb217f7cb1d8038c9dfb28ec6612bb390242eedefe23a4150

SHA512
3381c95fd61c560f4e5c53c64d70d8eef4140cfb4ddc4521b5cc3e26714bad97062ed7e510de9c38192083291f2f75dfb62b32fea23408f9805194c05db13ccb

Download Submit
/data/data/com.picturefar0/no_backup/androidx.work.workdb

Filesize
4KB

MD5
7e858c4054eb00fcddc653a04e5cd1c6

SHA1
2e056bf31a8d78df136f02a62afeeca77f4faccf

SHA256
9010186c5c083155a45673017d1e31c2a178e63cc15a57bbffde4d1956a23dad

SHA512
d0c7a120940c8e637d5566ef179d01eff88a2c2650afda69ad2a46aad76533eaace192028bba3d60407b4e34a950e7560f95d9f9b8eebe361ef62897d88b30cb

Download Submit
/data/data/com.picturefar0/no_backup/androidx.work.workdb-journal

Filesize
512B

MD5
5ecc10e1c68b50746b6fca08ca2dd86d

SHA1
c7969d58c342a7f8d2edb01d6e74b44660c8ca06

SHA256
7b2013cbb8c250273ce020a1d1baf657f840e92f259a2a4ac41536c6d2ed5bff

SHA512
b14babec4c0f359177adec0d634be00110fcabcde5b2f7a9269c8ab765a3b6e1ab1a5ec1b809853d2a3e74608010f7463aab91cdb4c5b29732edc914727e0e8f

Download Submit
/data/data/com.picturefar0/no_backup/androidx.work.workdb-shm

Filesize
32KB

MD5
bb7df04e1b0a2570657527a7e108ae23

SHA1
5188431849b4613152fd7bdba6a3ff0a4fd6424b

SHA256
c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479

SHA512
768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012

Download Submit
/data/data/com.picturefar0/no_backup/androidx.work.workdb-wal

Filesize
169KB

MD5
62406ad4630084f64ca8f37d61bf4c88

SHA1
01b9ea391868cdca559d71e992387fd9473e3478

SHA256
8282dd69b7799203b5c221b857b4a185d237d8ebcbf895e4c8ba836d0b32a150

SHA512
2d9092d7d024cd2fa014a9db6af2b25da0e04700fc2e0b592a68a58558c6dcb70f404050078c64feec5eac7f686cf32db32cb4746e70ae0bdd01b9a06138a625

Download Submit
/data/data/com.picturefar0/no_backup/androidx.work.workdb-wal

Filesize
16KB

MD5
96ed996ccf5f5f37cd9badc4c35cc4ff

SHA1
f1f445687844523044b1a20f31580ab42297b8e4

SHA256
0700df79cfc4637197c0173522d095b66ef91cacef47d58777177ca5d600f5fd

SHA512
4e27b88ec537ea8bbe54c27844dd317303ebc8d36635baafe3f0cad0b74264a190301cd9754b69cb402555184e714fe33888bc55601f4f32d0072f5fc96f3208

Download Submit
/data/data/com.picturefar0/no_backup/androidx.work.workdb-wal

Filesize
116KB

MD5
c8dc6c000ce1fc0074641b7bd26daba8

SHA1
730442d39561eb5f0778eecc6f22218b9139fc66

SHA256
fdba9e0f6678a2b5d5244ed35098b013d1d6d96b23ab0ea037b0026a2dccf7e4

SHA512
d2c26565ccac42e4bbbf7675a6fc22f138fb1371359414996e4154a1e021031a622ec5be9e070173a2ea22d0eb0d129595e3b6d9dbe083f8d5c3c192eefae8be

Download Submit
/data/misc/profiles/cur/0/com.picturefar0/primary.prof

Filesize
110B

MD5
ea61925ce1e0d2204353d3b5e18d70d3

SHA1
e06689c665ea00a557b97fc72aab61b7fb8238f2

SHA256
edf8fb91f3eadf13fccf008c8b2e0c15d9f31caf65d60a207eafe2acde0cffa0

SHA512
14df0d1afc48fcf2ad3ade6eea1005ce40f964d89ac7c87e4d5ea6218709753164729cdd1585eba01927240769f7981b5a5babaaa888ddb49f9e61c2979755c1

Download Submit
/data/misc/profiles/cur/0/com.picturefar0/primary.prof

Filesize
25B

MD5
b9d9e0f8902d129e1aeebff0ae7b725b

SHA1
cb0d2b4c9dd60a5c1fc6261fb581bcd3416fe781

SHA256
25a822139d06016af8be1296c0242b60e35074f94c713e03323636be1162ce91

SHA512
f158a9dc753e0cb41f71a98714ff02198c576bacdd792a6153fdaf6f9a7b52d8cfb6d09099a269d0c1b0d31e2ea5a307ea1db85115bdc6797887a6de36d597f6

Download Submit

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads