octo | 96515ec94f2bce57561174f2516246c16b73ddfc5f0aadf2aa576f65604df213

Analysis

max time kernel
29s
max time network
40s
platform
android_x64
resource
android-33-x64-arm64-20240624-en
resource tags

androidarch:arm64arch:x64image:android-33-x64-arm64-20240624-enlocale:en-usos:android-13-x64system
submitted
23-11-2024 10:56

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

c4dccd90c3a007ce989c494caaa4b7f6e9bc2d2c.apk
Size

2.7MB
MD5

b667a069b20c4f6da3c0b2edf79608e2
SHA1

c4dccd90c3a007ce989c494caaa4b7f6e9bc2d2c
SHA256

252feff9531af45445a74b949cad2a532de2a54831e66278c142f71c7b8c3f6d
SHA512

59e3ffde0e4878c87296240e0b16f127f2d60a856860b5618167cc0154d391dc51772179f4bf269d0e778c7db24905bae75f2dd7f53b742c24e0f5070036d92d
SSDEEP

49152:bze1Vqo4Zo1Zj4WlzKWfqniw1XeupuEtkoKrn9lirWcII+oSCVh/+VYGDBID+L:bzE0o1Zj4Wt4n1X3uEtkrzm6com/sK6L

Score

10^/10

octo banker collection credential_access discovery evasion impact infostealer persistence rat trojan

Malware Config

Extracted

Family

octo

https://populeryabancianimaserver.xyz/MDQ2MTZjMDhlZDQy/

https://eglencelikahramanlaranimas.xyz/MDQ2MTZjMDhlZDQy/

https://cizgifilmtutkunlarianim.xyz/MDQ2MTZjMDhlZDQy/

https://renklidunyavekarakterler.xyz/MDQ2MTZjMDhlZDQy/

https://animasyonvekulturhikayeleri.xyz/MDQ2MTZjMDhlZDQy/

https://yabancisanatcizgiustalari.xyz/MDQ2MTZjMDhlZDQy/

https://cocukvesinemaoyuncular.xyz/MDQ2MTZjMDhlZDQy/

https://cizgidunyasindakiyabanci.xyz/MDQ2MTZjMDhlZDQy/

https://animasyontavsiyeveyorumlar.xyz/MDQ2MTZjMDhlZDQy/

https://sevimlicanlilarhikarakat.xyz/MDQ2MTZjMDhlZDQy/

https://yabancianimasinemaustalari.xyz/MDQ2MTZjMDhlZDQy/

https://cizgianimasanatyaraticilik.xyz/MDQ2MTZjMDhlZDQy/

https://populeranimaserverkaliteleri.xyz/MDQ2MTZjMDhlZDQy/

https://kulturelanimasyonvesanat.xyz/MDQ2MTZjMDhlZDQy/

https://yabancicizgianimasanatyolu.xyz/MDQ2MTZjMDhlZDQy/

https://eglencevesanatcizgihikaye.xyz/MDQ2MTZjMDhlZDQy/

https://yabanciveklasikanimasyon.xyz/MDQ2MTZjMDhlZDQy/

https://populeranimaserverdunyasi.xyz/MDQ2MTZjMDhlZDQy/

https://cizgianimasanatkonusmasi.xyz/MDQ2MTZjMDhlZDQy/

rc4.plain

Extracted

Family

octo

https://populeryabancianimaserver.xyz/MDQ2MTZjMDhlZDQy/

https://eglencelikahramanlaranimas.xyz/MDQ2MTZjMDhlZDQy/

https://cizgifilmtutkunlarianim.xyz/MDQ2MTZjMDhlZDQy/

https://renklidunyavekarakterler.xyz/MDQ2MTZjMDhlZDQy/

https://animasyonvekulturhikayeleri.xyz/MDQ2MTZjMDhlZDQy/

https://yabancisanatcizgiustalari.xyz/MDQ2MTZjMDhlZDQy/

https://cocukvesinemaoyuncular.xyz/MDQ2MTZjMDhlZDQy/

https://cizgidunyasindakiyabanci.xyz/MDQ2MTZjMDhlZDQy/

https://animasyontavsiyeveyorumlar.xyz/MDQ2MTZjMDhlZDQy/

https://sevimlicanlilarhikarakat.xyz/MDQ2MTZjMDhlZDQy/

https://yabancianimasinemaustalari.xyz/MDQ2MTZjMDhlZDQy/

https://cizgianimasanatyaraticilik.xyz/MDQ2MTZjMDhlZDQy/

https://populeranimaserverkaliteleri.xyz/MDQ2MTZjMDhlZDQy/

https://kulturelanimasyonvesanat.xyz/MDQ2MTZjMDhlZDQy/

https://yabancicizgianimasanatyolu.xyz/MDQ2MTZjMDhlZDQy/

https://eglencevesanatcizgihikaye.xyz/MDQ2MTZjMDhlZDQy/

https://yabanciveklasikanimasyon.xyz/MDQ2MTZjMDhlZDQy/

https://populeranimaserverdunyasi.xyz/MDQ2MTZjMDhlZDQy/

https://cizgianimasanatkonusmasi.xyz/MDQ2MTZjMDhlZDQy/

AES_key

Signatures

Octo
Octo is a banking malware with remote access capabilities first seen in April 2022.
banker trojan infostealer rat octo
Octo family
octo

Octo payload 1 IoCs

Processes:

resource	yara_rule
/data/user/0/com.clean.leader/app_have/gEFSAy.json	family_octo

Loads dropped Dex/Jar 1 TTPs 1 IoCs
Runs executable file dropped to the device during analysis.
evasion

Download New Code at Runtime
T1407

Processes:

com.clean.leader

ioc pid process

/data/user/0/com.clean.leader/app_have/gEFSAy.json 4371 com.clean.leader

ioc	pid	process
/data/user/0/com.clean.leader/app_have/gEFSAy.json	4371	com.clean.leader

Makes use of the framework's Accessibility service 4 TTPs 2 IoCs

Retrieves information displayed on the phone screen using AccessibilityService.

collection evasion credential_access

Input Injection

T1516

Screen Capture

T1513

Keylogging

T1417.001

GUI Input Capture

T1417.002

Processes:

com.clean.leader

description	ioc	process
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId	com.clean.leader
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByViewId	com.clean.leader

Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
banker discovery

Security Software Discovery
T1418.001
Queries the phone number (MSISDN for GSM devices) 1 TTPs
discovery

System Network Configuration Discovery
T1422
Acquires the wake lock 1 IoCs

Processes:

com.clean.leader

description ioc process

Framework service call android.os.IPowerManager.acquireWakeLock com.clean.leader
Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs
Application may abuse the framework's foreground service to continue running in the foreground.
evasion persistence

Foreground Persistence
T1541

Processes:

com.clean.leader

description ioc process

Framework service call android.app.IActivityManager.setServiceForeground com.clean.leader

description	ioc	process
Framework service call	android.os.IPowerManager.acquireWakeLock	com.clean.leader

description	ioc	process
Framework service call	android.app.IActivityManager.setServiceForeground	com.clean.leader

Performs UI accessibility actions on behalf of the user 1 TTPs 4 IoCs

Application may abuse the accessibility service to prevent their removal.

evasion

Prevent Application Removal

T1629.001

Processes:

com.clean.leader

ioc	process
android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction	com.clean.leader
android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction	com.clean.leader
android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction	com.clean.leader
android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction	com.clean.leader

Queries the mobile country code (MCC) 1 TTPs 1 IoCs
discovery

System Network Configuration Discovery
T1422

Processes:

com.clean.leader

description ioc process

Framework service call com.android.internal.telephony.ITelephony.getNetworkCountryIsoForPhone com.clean.leader
Reads information about phone network operator. 1 TTPs
discovery

System Network Configuration Discovery
T1422
Requests accessing notifications (often used to intercept notifications before users become aware). 1 TTPs 1 IoCs
collection credential_access

Access Notifications
T1517

Processes:

com.clean.leader

description ioc process

Intent action android.settings.ACTION_NOTIFICATION_LISTENER_SETTINGS com.clean.leader
Requests disabling of battery optimizations (often used to enable hiding in the background). 1 TTPs 1 IoCs
evasion

User Evasion
T1628.002

Processes:

com.clean.leader

description ioc process

Intent action android.settings.REQUEST_IGNORE_BATTERY_OPTIMIZATIONS com.clean.leader
Requests modifying system settings. 1 IoCs
evasion

Processes:

com.clean.leader

description ioc process

Intent action android.settings.action.MANAGE_WRITE_SETTINGS com.clean.leader
Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs
impact

Data Encrypted for Impact
T1471

Processes:

com.clean.leader

description ioc process

Framework API call javax.crypto.Cipher.doFinal com.clean.leader

description	ioc	process
Framework service call	com.android.internal.telephony.ITelephony.getNetworkCountryIsoForPhone	com.clean.leader

description	ioc	process
Intent action	android.settings.ACTION_NOTIFICATION_LISTENER_SETTINGS	com.clean.leader

description	ioc	process
Intent action	android.settings.REQUEST_IGNORE_BATTERY_OPTIMIZATIONS	com.clean.leader

description	ioc	process
Intent action	android.settings.action.MANAGE_WRITE_SETTINGS	com.clean.leader

description	ioc	process
Framework API call	javax.crypto.Cipher.doFinal	com.clean.leader

com.clean.leader
1⤵
- Loads dropped Dex/Jar
- Makes use of the framework's Accessibility service
- Acquires the wake lock
- Makes use of the framework's foreground persistence service
- Performs UI accessibility actions on behalf of the user
- Queries the mobile country code (MCC)
- Requests accessing notifications (often used to intercept notifications before users become aware).
- Requests disabling of battery optimizations (often used to enable hiding in the background).
- Requests modifying system settings.
- Uses Crypto APIs (Might try to encrypt user data)
PID:4371

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Foreground Persistence

T1541

Privilege Escalation

Defense Evasion

Download New Code at Runtime

T1407

Foreground Persistence

T1541

Hide Artifacts

T1628

User Evasion

T1628.002

Impair Defenses

T1629

Prevent Application Removal

T1629.001

Input Injection

T1516

Credential Access

Access Notifications

T1517

Input Capture

T1417

GUI Input Capture

T1417.002

Keylogging

T1417.001

Discovery

Software Discovery

T1418

Security Software Discovery

T1418.001

System Network Configuration Discovery

T1422

Lateral Movement

Collection

Access Notifications

T1517

Input Capture

T1417

GUI Input Capture

T1417.002

Keylogging

T1417.001

Screen Capture

T1513

Command and Control

Exfiltration

Impact

Data Encrypted for Impact

T1471

Input Injection

T1516

Replay Monitor

Loading Replay Monitor...

Downloads

/data/data/com.clean.leader/app_have/gEFSAy.json

Filesize
153KB

MD5
038163934d201e940c3c3e979c89faec

SHA1
eb50f5226550db94bb8a30bef7492ae2c8b02998

SHA256
4de9e2633e562b4e5c3fbf77566a877de4ea5e91b04f0e25c7c7391102b97a1c

SHA512
d094a75bee04baa2eb189c08a329001a7bacdbab8ff8af3c56e1ca9e62dcd1dc770dbfb97410869ab63a3fc580830232d486594e71e31f56d32ce56468c8e0f7

Download Submit
/data/data/com.clean.leader/app_have/gEFSAy.json

Filesize
153KB

MD5
77ae0be5bc2b054c8c42feab08452ee9

SHA1
bc380315d37da2475d20b983e8f65a202fda8eab

SHA256
ab412d96f1a18fdc01ae5b7cf8d678d8062c90a1adc86e3ddee6e346a52e870a

SHA512
e9cf24203fb4a91163d4403b3507d19f89e42b30e5bfe0d96fdd35432bddbca6db02286d1599810c1741e7bed0b720ab5e7b74726ded39586163d501621f6de1

Download Submit
/data/user/0/com.clean.leader/app_have/gEFSAy.json

Filesize
451KB

MD5
f5a74112f4595e45b2ef79de0c98e5d7

SHA1
5bcbaf20c5dfd61b320484c3c60fedfdc97ba4c6

SHA256
e1ef9ce8a27a48d13f4ead4941357fcee4a6e9f9ca6ab87d96db1e75dafefffe

SHA512
d1edbbc69d402d9a8882fd9fe487044e48a5ace651f3cc269a1bd3bef0339a16fd8022fc6b081baa6907d4fa6a57b3fdd11c242aae67a2680c892a928da3a8ef

Download Submit