octo | 96515ec94f2bce57561174f2516246c16b73ddfc5f0aadf2aa576f65604df213

Analysis

max time kernel
149s
max time network
151s
platform
android-9_x86
resource
android-x86-arm-20240910-en
resource tags

arch:armarch:x86image:android-x86-arm-20240910-enlocale:en-usos:android-9-x86system
submitted
23-11-2024 11:00

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

43e48ed5f674dcf241ba8b9456162b97f671f7fc.apk
Size

2.3MB
MD5

03fe02d1c77afc416ea7b2cde11d0730
SHA1

43e48ed5f674dcf241ba8b9456162b97f671f7fc
SHA256

001c43293f68ebc6a914518f5ef2fce3ec8eccef274f42662a783f0b340a1509
SHA512

ff6ad234ecd2f9399c647d23a67be8b325e2ba73eb6ee7e533593c6cb33039c7e5a5fcbe717d1a3e0f97ab1d6a5f1459b6f15894f0a837a44360d8a31f0734e5
SSDEEP

49152:Vc1Jy5LpRQk7pb3HQFBUX+uwsN0H6jECVDPVpN94y+wy:vBpqkBwFBUX+lw0svhY

Score

10^/10

octo banker collection credential_access discovery evasion impact infostealer persistence rat stealth trojan

Malware Config

Extracted

Family

octo

https://populeryabancianimaserver.xyz/MDQ2MTZjMDhlZDQy/

https://eglencelikahramanlaranimas.xyz/MDQ2MTZjMDhlZDQy/

https://cizgifilmtutkunlarianim.xyz/MDQ2MTZjMDhlZDQy/

https://renklidunyavekarakterler.xyz/MDQ2MTZjMDhlZDQy/

https://animasyonvekulturhikayeleri.xyz/MDQ2MTZjMDhlZDQy/

https://yabancisanatcizgiustalari.xyz/MDQ2MTZjMDhlZDQy/

https://cocukvesinemaoyuncular.xyz/MDQ2MTZjMDhlZDQy/

https://cizgidunyasindakiyabanci.xyz/MDQ2MTZjMDhlZDQy/

https://animasyontavsiyeveyorumlar.xyz/MDQ2MTZjMDhlZDQy/

https://sevimlicanlilarhikarakat.xyz/MDQ2MTZjMDhlZDQy/

https://yabancianimasinemaustalari.xyz/MDQ2MTZjMDhlZDQy/

https://cizgianimasanatyaraticilik.xyz/MDQ2MTZjMDhlZDQy/

https://populeranimaserverkaliteleri.xyz/MDQ2MTZjMDhlZDQy/

https://kulturelanimasyonvesanat.xyz/MDQ2MTZjMDhlZDQy/

https://yabancicizgianimasanatyolu.xyz/MDQ2MTZjMDhlZDQy/

https://eglencevesanatcizgihikaye.xyz/MDQ2MTZjMDhlZDQy/

https://yabanciveklasikanimasyon.xyz/MDQ2MTZjMDhlZDQy/

https://populeranimaserverdunyasi.xyz/MDQ2MTZjMDhlZDQy/

https://cizgianimasanatkonusmasi.xyz/MDQ2MTZjMDhlZDQy/

rc4.plain

Extracted

Family

octo

https://populeryabancianimaserver.xyz/MDQ2MTZjMDhlZDQy/

https://eglencelikahramanlaranimas.xyz/MDQ2MTZjMDhlZDQy/

https://cizgifilmtutkunlarianim.xyz/MDQ2MTZjMDhlZDQy/

https://renklidunyavekarakterler.xyz/MDQ2MTZjMDhlZDQy/

https://animasyonvekulturhikayeleri.xyz/MDQ2MTZjMDhlZDQy/

https://yabancisanatcizgiustalari.xyz/MDQ2MTZjMDhlZDQy/

https://cocukvesinemaoyuncular.xyz/MDQ2MTZjMDhlZDQy/

https://cizgidunyasindakiyabanci.xyz/MDQ2MTZjMDhlZDQy/

https://animasyontavsiyeveyorumlar.xyz/MDQ2MTZjMDhlZDQy/

https://sevimlicanlilarhikarakat.xyz/MDQ2MTZjMDhlZDQy/

https://yabancianimasinemaustalari.xyz/MDQ2MTZjMDhlZDQy/

https://cizgianimasanatyaraticilik.xyz/MDQ2MTZjMDhlZDQy/

https://populeranimaserverkaliteleri.xyz/MDQ2MTZjMDhlZDQy/

https://kulturelanimasyonvesanat.xyz/MDQ2MTZjMDhlZDQy/

https://yabancicizgianimasanatyolu.xyz/MDQ2MTZjMDhlZDQy/

https://eglencevesanatcizgihikaye.xyz/MDQ2MTZjMDhlZDQy/

https://yabanciveklasikanimasyon.xyz/MDQ2MTZjMDhlZDQy/

https://populeranimaserverdunyasi.xyz/MDQ2MTZjMDhlZDQy/

https://cizgianimasanatkonusmasi.xyz/MDQ2MTZjMDhlZDQy/

AES_key

Signatures

Octo
Octo is a banking malware with remote access capabilities first seen in April 2022.
banker trojan infostealer rat octo
Octo family
octo

Octo payload 2 IoCs

Processes:

resource	yara_rule
/data/user/0/com.satoshi.foam/app_mass/knU.json	family_octo
/data/user/0/com.satoshi.foam/app_mass/knU.json	family_octo

Removes its main activity from the application launcher 1 TTPs 1 IoCs
stealth trojan evasion

Suppress Application Icon
T1628.001

Processes:

com.satoshi.foam

pid process

4212 com.satoshi.foam

pid	process
4212	com.satoshi.foam

Loads dropped Dex/Jar 1 TTPs 2 IoCs

Runs executable file dropped to the device during analysis.

evasion

Download New Code at Runtime

T1407

Processes:

/system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.satoshi.foam/app_mass/knU.json --output-vdex-fd=41 --oat-fd=42 --oat-location=/data/user/0/com.satoshi.foam/app_mass/oat/x86/knU.odex --compiler-filter=quicken --class-loader-context=&com.satoshi.foam

ioc	pid	process
/data/user/0/com.satoshi.foam/app_mass/knU.json	4238	/system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.satoshi.foam/app_mass/knU.json --output-vdex-fd=41 --oat-fd=42 --oat-location=/data/user/0/com.satoshi.foam/app_mass/oat/x86/knU.odex --compiler-filter=quicken --class-loader-context=&
/data/user/0/com.satoshi.foam/app_mass/knU.json	4212	com.satoshi.foam

Makes use of the framework's Accessibility service 4 TTPs 2 IoCs

Retrieves information displayed on the phone screen using AccessibilityService.

collection evasion credential_access

Input Injection

T1516

Screen Capture

T1513

Keylogging

T1417.001

GUI Input Capture

T1417.002

Processes:

com.satoshi.foam

description	ioc	process
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId	com.satoshi.foam
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByViewId	com.satoshi.foam

Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
banker discovery

Security Software Discovery
T1418.001
Queries the phone number (MSISDN for GSM devices) 1 TTPs
discovery

System Network Configuration Discovery
T1422
Acquires the wake lock 1 IoCs

Processes:

com.satoshi.foam

description ioc process

Framework service call android.os.IPowerManager.acquireWakeLock com.satoshi.foam
Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs
Application may abuse the framework's foreground service to continue running in the foreground.
evasion persistence

Foreground Persistence
T1541

Processes:

com.satoshi.foam

description ioc process

Framework service call android.app.IActivityManager.setServiceForeground com.satoshi.foam

description	ioc	process
Framework service call	android.os.IPowerManager.acquireWakeLock	com.satoshi.foam

description	ioc	process
Framework service call	android.app.IActivityManager.setServiceForeground	com.satoshi.foam

Performs UI accessibility actions on behalf of the user 1 TTPs 4 IoCs

Application may abuse the accessibility service to prevent their removal.

evasion

Prevent Application Removal

T1629.001

Processes:

com.satoshi.foam

ioc	process
android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction	com.satoshi.foam
android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction	com.satoshi.foam
android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction	com.satoshi.foam
android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction	com.satoshi.foam

Queries the mobile country code (MCC) 1 TTPs 1 IoCs
discovery

System Network Configuration Discovery
T1422

Processes:

com.satoshi.foam

description ioc process

Framework service call com.android.internal.telephony.ITelephony.getNetworkCountryIsoForPhone com.satoshi.foam
Queries the unique device ID (IMEI, MEID, IMSI) 1 TTPs
discovery

System Network Configuration Discovery
T1422
Reads information about phone network operator. 1 TTPs
discovery

System Network Configuration Discovery
T1422
Requests accessing notifications (often used to intercept notifications before users become aware). 1 TTPs 1 IoCs
collection credential_access

Access Notifications
T1517

Processes:

com.satoshi.foam

description ioc process

Intent action android.settings.ACTION_NOTIFICATION_LISTENER_SETTINGS com.satoshi.foam
Requests disabling of battery optimizations (often used to enable hiding in the background). 1 TTPs 1 IoCs
evasion

User Evasion
T1628.002

Processes:

com.satoshi.foam

description ioc process

Intent action android.settings.REQUEST_IGNORE_BATTERY_OPTIMIZATIONS com.satoshi.foam
Requests modifying system settings. 1 IoCs
evasion

Processes:

com.satoshi.foam

description ioc process

Intent action android.settings.action.MANAGE_WRITE_SETTINGS com.satoshi.foam
Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs
persistence

Broadcast Receivers
T1624.001

Processes:

com.satoshi.foam

description ioc process

Framework service call android.app.IActivityManager.registerReceiver com.satoshi.foam
Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs
impact

Data Encrypted for Impact
T1471

Processes:

com.satoshi.foam

description ioc process

Framework API call javax.crypto.Cipher.doFinal com.satoshi.foam

description	ioc	process
Framework service call	com.android.internal.telephony.ITelephony.getNetworkCountryIsoForPhone	com.satoshi.foam

description	ioc	process
Intent action	android.settings.ACTION_NOTIFICATION_LISTENER_SETTINGS	com.satoshi.foam

description	ioc	process
Intent action	android.settings.REQUEST_IGNORE_BATTERY_OPTIMIZATIONS	com.satoshi.foam

description	ioc	process
Intent action	android.settings.action.MANAGE_WRITE_SETTINGS	com.satoshi.foam

description	ioc	process
Framework service call	android.app.IActivityManager.registerReceiver	com.satoshi.foam

description	ioc	process
Framework API call	javax.crypto.Cipher.doFinal	com.satoshi.foam

com.satoshi.foam
1⤵
- Removes its main activity from the application launcher
- Loads dropped Dex/Jar
- Makes use of the framework's Accessibility service
- Acquires the wake lock
- Makes use of the framework's foreground persistence service
- Performs UI accessibility actions on behalf of the user
- Queries the mobile country code (MCC)
- Requests accessing notifications (often used to intercept notifications before users become aware).
- Requests disabling of battery optimizations (often used to enable hiding in the background).
- Requests modifying system settings.
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Uses Crypto APIs (Might try to encrypt user data)
PID:4212
- /system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.satoshi.foam/app_mass/knU.json --output-vdex-fd=41 --oat-fd=42 --oat-location=/data/user/0/com.satoshi.foam/app_mass/oat/x86/knU.odex --compiler-filter=quicken --class-loader-context=&
  2⤵
  - Loads dropped Dex/Jar
  PID:4238

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Event Triggered Execution

T1624

Broadcast Receivers

T1624.001

Foreground Persistence

T1541

Privilege Escalation

Defense Evasion

Download New Code at Runtime

T1407

Foreground Persistence

T1541

Hide Artifacts

T1628

Suppress Application Icon

T1628.001

User Evasion

T1628.002

Impair Defenses

T1629

Prevent Application Removal

T1629.001

Input Injection

T1516

Credential Access

Access Notifications

T1517

Input Capture

T1417

GUI Input Capture

T1417.002

Keylogging

T1417.001

Discovery

Software Discovery

T1418

Security Software Discovery

T1418.001

System Network Configuration Discovery

T1422

Lateral Movement

Collection

Access Notifications

T1517

Input Capture

T1417

GUI Input Capture

T1417.002

Keylogging

T1417.001

Screen Capture

T1513

Command and Control

Exfiltration

Impact

Data Encrypted for Impact

T1471

Input Injection

T1516

Replay Monitor

Loading Replay Monitor...

Downloads

/data/data/com.satoshi.foam/app_mass/knU.json

Filesize
153KB

MD5
53b72875d8f78e93bb46fb9f7779ed4b

SHA1
8b31704dba39af8f941a4c6c7dfceabd946ba45f

SHA256
c9db43266d862fafbb48d41f141e73195428c065c482c77f5fbdec6ceebdda81

SHA512
8caf154f5e99d556a64823c9d60692a65b75a24fd375a739d7fec9c859cb9c1747debe35a82ce95810c49b25be5dfe96c94ab4f413a4cda1598a01b942060b13

Download Submit
/data/data/com.satoshi.foam/app_mass/knU.json

Filesize
153KB

MD5
cc113036f66a1718c439c37129e1a5ea

SHA1
df0e0f78fc533ea35e42c9ec3ce892a08f8ce158

SHA256
3dccb2261a6d723574234c3e9c8108b489759bec88495df4d6dac7ea1cfa0ddd

SHA512
364e81b4530822c7bb59499957afd807e0ced93e4f1e20847b393ad4456ac36d8cb106171b5fb9d2496b7d8743dcf33765013aef28b442a62749d32758a4bda7

Download Submit
/data/user/0/com.satoshi.foam/app_mass/knU.json

Filesize
451KB

MD5
c4c69b7409d9a625a1e50e69bc5733a5

SHA1
a2f89253b85035e87d6103de3c4ef26416a8c870

SHA256
9b60456e88938110e93b0092585f07acb29c0d4d6c0f1758c74d00d69233bb7c

SHA512
2275b0e2eddae3a69f7c6e80bf213631ac0c29b2e818353932ab4a3c510974326d2c6131bfdc645870b716ca0fc5737267732371d8537ecaf7795e8a42746dba

Download Submit
/data/user/0/com.satoshi.foam/app_mass/knU.json

Filesize
451KB

MD5
87abaa3b780e74a0a40f3b89ca1e3fa7

SHA1
36c2b2a365847284845d3c2740da64f9bc8879f3

SHA256
6b29057033fea1f90cb1124b97bbcb1614d45985b27239251855787cc89120a2

SHA512
e0e3dd027bae4893f32220ee69c14d209b335e5fb537820678aa450112b3e7d52ee776f799a854dd6a7f58e9ac5cd2bd0fcc23b0824510095f4984a01f98d6a7

Download Submit