octo | 19605d10876e75e584278116e31b97832c6348054c2505ae9a2aa77a3135aef6

Analysis

max time kernel
149s
max time network
154s
platform
android_x86
resource
android-x86-arm-20240624-en
resource tags

androidarch:armarch:x86image:android-x86-arm-20240624-enlocale:en-usos:android-9-x86system
submitted
27-11-2024 23:23

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

base.apk
Size

7.2MB
MD5

29ee1a7d83cdc7067a78f810e7b91b2c
SHA1

b26b7f39d151fe1ef62591934f3024e326dc81e4
SHA256

d7c65afe1247656d7c75adae815b13bd0adbca536321729651ccbcdc6a3df511
SHA512

31ecc151c44c68616024c0ac029ec1f3c71a1466b637033dbc531027b29fe3abc457e83f119865806574d7297d051cb8ba08448d0b30042f57847658ccfc3acf
SSDEEP

98304:oxPK78Kj7URsLyTuIeNeBKV25iSRGsEVK37ozxhh:sS7Bj7URTTu09r6Urozx

Score

10^/10

octo banker collection credential_access discovery evasion impact infostealer persistence rat trojan

Malware Config

Extracted

Family

octo

https://156350786312d7feba2b1c9b7577097b.com

AES_key

Signatures

Octo
Octo is a banking malware with remote access capabilities first seen in April 2022.
banker trojan infostealer rat octo
Octo family
octo

Octo payload 1 IoCs

resource	yara_rule
behavioral4/memory/4215-1.dex	family_octo

Checks Android system properties for emulator presence. 1 TTPs 1 IoCs

evasion

System Checks

T1633.001

description	ioc	Process
Accessed system property	key: ro.product.model	com.zreceiver96soundcontacts

Loads dropped Dex/Jar 1 TTPs 3 IoCs

Runs executable file dropped to the device during analysis.

evasion

Download New Code at Runtime

T1407

ioc	pid	Process
/data/user/0/com.zreceiver96soundcontacts/app_latin/EJEX.json	4239	/system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.zreceiver96soundcontacts/app_latin/EJEX.json --output-vdex-fd=41 --oat-fd=42 --oat-location=/data/user/0/com.zreceiver96soundcontacts/app_latin/oat/x86/EJEX.odex --compiler-filter=quicken --class-loader-context=&
/data/user/0/com.zreceiver96soundcontacts/app_latin/EJEX.json	4215	com.zreceiver96soundcontacts
Anonymous-DexFile@0xd3cf8000-0xd3d7bae4	4215	com.zreceiver96soundcontacts

Makes use of the framework's Accessibility service 4 TTPs 2 IoCs

Retrieves information displayed on the phone screen using AccessibilityService.

collection evasion credential_access

Input Injection

T1516

Screen Capture

T1513

Keylogging

T1417.001

GUI Input Capture

T1417.002

description	ioc	Process
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId	com.zreceiver96soundcontacts
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByViewId	com.zreceiver96soundcontacts

Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
banker discovery

Security Software Discovery
T1418.001
Queries the phone number (MSISDN for GSM devices) 1 TTPs
discovery

System Network Configuration Discovery
T1422

Acquires the wake lock 1 IoCs

description	ioc	Process
Framework service call	android.os.IPowerManager.acquireWakeLock	com.zreceiver96soundcontacts

Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs

Application may abuse the framework's foreground service to continue running in the foreground.

evasion persistence

Foreground Persistence

T1541

description	ioc	Process
Framework service call	android.app.IActivityManager.setServiceForeground	com.zreceiver96soundcontacts

Queries the mobile country code (MCC) 1 TTPs 1 IoCs

discovery

System Network Configuration Discovery

T1422

description	ioc	Process
Framework service call	com.android.internal.telephony.ITelephony.getNetworkCountryIsoForPhone	com.zreceiver96soundcontacts

Queries the unique device ID (IMEI, MEID, IMSI) 1 TTPs
discovery

System Network Configuration Discovery
T1422
Reads information about phone network operator. 1 TTPs
discovery

System Network Configuration Discovery
T1422

Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs

persistence

Broadcast Receivers

T1624.001

description	ioc	Process
Framework service call	android.app.IActivityManager.registerReceiver	com.zreceiver96soundcontacts

Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs

impact

Data Encrypted for Impact

T1471

description	ioc	Process
Framework API call	javax.crypto.Cipher.doFinal	com.zreceiver96soundcontacts

Checks CPU information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/cpuinfo	com.zreceiver96soundcontacts

Checks memory information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/meminfo	com.zreceiver96soundcontacts

com.zreceiver96soundcontacts
1⤵
- Checks Android system properties for emulator presence.
- Loads dropped Dex/Jar
- Makes use of the framework's Accessibility service
- Acquires the wake lock
- Makes use of the framework's foreground persistence service
- Queries the mobile country code (MCC)
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Uses Crypto APIs (Might try to encrypt user data)
- Checks CPU information
- Checks memory information
PID:4215
- /system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.zreceiver96soundcontacts/app_latin/EJEX.json --output-vdex-fd=41 --oat-fd=42 --oat-location=/data/user/0/com.zreceiver96soundcontacts/app_latin/oat/x86/EJEX.odex --compiler-filter=quicken --class-loader-context=&
  2⤵
  - Loads dropped Dex/Jar
  PID:4239

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Event Triggered Execution

T1624

Broadcast Receivers

T1624.001

Foreground Persistence

T1541

Privilege Escalation

Defense Evasion

Download New Code at Runtime

T1407

Foreground Persistence

T1541

Input Injection

T1516

Virtualization/Sandbox Evasion

T1633

System Checks

T1633.001

Credential Access

Input Capture

T1417

GUI Input Capture

T1417.002

Keylogging

T1417.001

Discovery

Software Discovery

T1418

Security Software Discovery

T1418.001

System Information Discovery

T1426

System Network Configuration Discovery

T1422

Lateral Movement

Collection

Input Capture

T1417

GUI Input Capture

T1417.002

Keylogging

T1417.001

Screen Capture

T1513

Command and Control

Exfiltration

Impact

Data Encrypted for Impact

T1471

Input Injection

T1516

Replay Monitor

Loading Replay Monitor...

Downloads

/data/data/com.zreceiver96soundcontacts/.global.com.zreceiver96soundcontacts

Filesize
48B

MD5
046a414913add6f5bb60072c7db819b6

SHA1
451ee4f6809260aec622d772fd329c7d0297a842

SHA256
b66c1320cb063a1d391c94273572ea6edae76c8c8b0a07f8d75c88686f0df72a

SHA512
4e6355f3051ed5e811ab030abde1f5be7f5e1cf33be99cd08477e9b6c015deb1d8bd75a09fb9c7176b8511c5ad0a67abc0902a3531e97564ccb6afc57496a47c

Download Submit
/data/data/com.zreceiver96soundcontacts/app_latin/EJEX.json

Filesize
1013B

MD5
d832a074f0c18189b8ad22fc38ed9ecb

SHA1
0a2a8aadd27593ced29b5f0dca95d3b892eb077b

SHA256
9cb827430b98aa72322c7ee02360dba91c26ad89d188e11cc65af3a7b48759d8

SHA512
1e28a3656ce9c813e2e6d9412adb9d5c66168af73f4d9f0313d1db41c502998802654075a8a50083cd4b77eee5fc4a8cd99a0f3112fb6e6db75f42e11ce7105e

Download Submit
/data/data/com.zreceiver96soundcontacts/app_latin/EJEX.json

Filesize
1013B

MD5
6e5cc4086ff2dad1000d89c97b6eb58c

SHA1
f297ebba898bc0ec9ce7d4f253cda35e98e76147

SHA256
d2bf4c155beea24c0b99dc8cca14bd0eb2c3ae90bad48499e76c8787c7b4f7be

SHA512
7f182ccca5b7ffa0fc2fbfc156ab9a34aa1366b3aae66508cb531f27cec13570c61046f395f77d9164d7a7204166e59a7bfbf8b48bdb8d5dd177c6ca746147b9

Download Submit
/data/data/com.zreceiver96soundcontacts/files/.n

Filesize
307KB

MD5
4e73947cabb5db3f92ca85004981b754

SHA1
6d9667fdb0280ed2dcb782b4683e422a51bdc601

SHA256
6db94232e756b90ed437f1bc87dc38cf20fb2e7c7a19a5e40c6c17254b7e234c

SHA512
be8b500a7070af1dfb53b0cf1a7b327dadc4e163a6dad905496ac228c58cd1ed87b054533917924455d35e9b300683ae33e1bcdd91935a5dbae1d693c3e13d69

Download Submit
/data/user/0/com.zreceiver96soundcontacts/app_latin/EJEX.json

Filesize
1KB

MD5
f08d32b63129d945402caf05c1f742cb

SHA1
dc6276908e78ebe0b2780b8692fe30968f28ff6d

SHA256
931564b7fad72b8bb275610f82bdc68dc9aaf191e3e9d30e8a00cb904aece31d

SHA512
2ae993de156e0a0a8659de22383124114d79eda383e4bb043e81a0333f07db02e6192328ea3350a52314d2429bccf93d7c6b4cb93bf438925171bef0ddcc4046

Download Submit
/data/user/0/com.zreceiver96soundcontacts/app_latin/EJEX.json

Filesize
1KB

MD5
8b851ae922999f19e421de87a22b6ac9

SHA1
9198fff2b4bdd9d7844492736c1e1a7d0de4666a

SHA256
8c10e7ea546ccefb5b0bd71b8ee69ce362a528d71e7aeba809c7b05b9673bb6a

SHA512
46b7e78c28b3b991898a318a921fddf5615d5497759bf25810b7de5896d62ed0818751c390e5501000ceea2b0704ed153b347cf3ec948c4dbc03e0d52ff7193e

Download Submit
Anonymous-DexFile@0xd3cf8000-0xd3d7bae4

Filesize
526KB

MD5
f7dc9528a65c9692d9c0cd1d8495cfb1

SHA1
94b04526df4a11244a07bb7eb2e43382a099954e

SHA256
ee0e5da53f5f387eff24587225a48ab1bcfc86c05d05006fe67c0929b6391be5

SHA512
73134e0124f74850ce1a369dcb6cd88f6bcd5f4ded5ddd22a0b7e7c782e8788d5f572c4ae3dc99815045f125d50898a45c152a25a55173ba6cacda8a3687f080

Download Submit

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads