octo | 55cadd00be89467edd1884a41037d15c92344729860ffec517dd3140b433934e

Analysis

max time kernel
149s
max time network
152s
platform
android-11_x64
resource
android-x64-arm64-20240910-en
resource tags

arch:armarch:arm64arch:x64arch:x86image:android-x64-arm64-20240910-enlocale:en-usos:android-11-x64system
submitted
30-11-2024 22:14

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

55cadd00be89467edd1884a41037d15c92344729860ffec517dd3140b433934e.apk
Size

605KB
MD5

0a37103b7d64aded492a098309fe3347
SHA1

7c26a8fd74bf3fede75bfcde66e5bdb183c2fa70
SHA256

55cadd00be89467edd1884a41037d15c92344729860ffec517dd3140b433934e
SHA512

63f2ad8af9a7c473dc7fb84318bd04ca39e1e34e44c7b5f1e4487647359c3409824b31d539e1de584bce45a05de431163687e98bb0f5c11df94fdeda609d3668
SSDEEP

12288:F9/ILAea+b7Ym5SLL0TGe/g4aRWJb5Z1gpaIzzs4hDLrMhdOYwT:F9/ILAetbEZLHxRW2LzzsIzgdOvT

Score

10^/10

octo banker collection credential_access discovery evasion execution impact infostealer persistence rat trojan

Malware Config

Extracted

Family

octo

https://7bb13903074567453981d0595033c23.com/YmZiMzU0OTU5NGIz/

https://4b6413903074567453981d0595033c23.com/YmZiMzU0OTU5NGIz/

https://34b6413903074567453981d0595033c23.com/YmZiMzU0OTU5NGIz/

https://64b6413903074567453981d0595033c23.com/YmZiMzU0OTU5NGIz/

https://74b6413903074567453981d0595033c23.com/YmZiMzU0OTU5NGIz/

https://894b6413903074567453981d0595033c23.com/YmZiMzU0OTU5NGIz/

https://94b64139030754567453981d0595033c23.com/YmZiMzU0OTU5NGIz/

https://94b64139033074567453981d0595033c23.com/YmZiMzU0OTU5NGIz/

https://94b641553903074567453981d0595033c23.com/YmZiMzU0OTU5NGIz/

DES_key

AES_key

Signatures

Octo
Octo is a banking malware with remote access capabilities first seen in April 2022.
banker trojan infostealer rat octo
Octo family
octo

Octo payload 1 IoCs

resource	yara_rule
behavioral3/files/fstream-3.dat	family_octo

Loads dropped Dex/Jar 1 TTPs 2 IoCs

Runs executable file dropped to the device during analysis.

evasion

Download New Code at Runtime

T1407

ioc	pid	Process
/data/user/0/com.roundmaynp/code_cache/secondary-dexes/1733004867717_classes.dex	4779	com.roundmaynp
/data/user/0/com.roundmaynp/code_cache/secondary-dexes/1733004867717_classes.dex	4779	com.roundmaynp

Makes use of the framework's Accessibility service 4 TTPs 2 IoCs

Retrieves information displayed on the phone screen using AccessibilityService.

collection evasion credential_access

Input Injection

T1516

Screen Capture

T1513

Keylogging

T1417.001

GUI Input Capture

T1417.002

description	ioc	Process
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId	com.roundmaynp
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByViewId	com.roundmaynp

Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
banker discovery

Security Software Discovery
T1418.001
Queries the phone number (MSISDN for GSM devices) 1 TTPs
discovery

System Network Configuration Discovery
T1422

Acquires the wake lock 1 IoCs

description	ioc	Process
Framework service call	android.os.IPowerManager.acquireWakeLock	com.roundmaynp

Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs

Application may abuse the framework's foreground service to continue running in the foreground.

evasion persistence

Foreground Persistence

T1541

description	ioc	Process
Framework service call	android.app.IActivityManager.setServiceForeground	com.roundmaynp

Performs UI accessibility actions on behalf of the user 1 TTPs 5 IoCs

Application may abuse the accessibility service to prevent their removal.

evasion

Prevent Application Removal

T1629.001

ioc	Process
android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction	com.roundmaynp
android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction	com.roundmaynp
android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction	com.roundmaynp
android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction	com.roundmaynp
android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction	com.roundmaynp

Queries the mobile country code (MCC) 1 TTPs 1 IoCs

discovery

System Network Configuration Discovery

T1422

description	ioc	Process
Framework service call	com.android.internal.telephony.ITelephony.getNetworkCountryIsoForPhone	com.roundmaynp

Reads information about phone network operator. 1 TTPs
discovery

System Network Configuration Discovery
T1422

Requests accessing notifications (often used to intercept notifications before users become aware). 1 TTPs 1 IoCs

collection credential_access

Access Notifications

T1517

description	ioc	Process
Intent action	android.settings.ACTION_NOTIFICATION_LISTENER_SETTINGS	com.roundmaynp

Requests disabling of battery optimizations (often used to enable hiding in the background). 1 TTPs 1 IoCs

evasion

User Evasion

T1628.002

description	ioc	Process
Intent action	android.settings.REQUEST_IGNORE_BATTERY_OPTIMIZATIONS	com.roundmaynp

Requests modifying system settings. 1 IoCs

evasion

description	ioc	Process
Intent action	android.settings.action.MANAGE_WRITE_SETTINGS	com.roundmaynp

Schedules tasks to execute at a specified time 1 TTPs 1 IoCs

Application may abuse the framework's APIs to perform task scheduling for initial or recurring execution of malicious code.

execution persistence

Scheduled Task/Job

T1603

description	ioc	Process
Framework service call	android.app.job.IJobScheduler.schedule	com.roundmaynp

Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs

impact

Data Encrypted for Impact

T1471

description	ioc	Process
Framework API call	javax.crypto.Cipher.doFinal	com.roundmaynp

com.roundmaynp
1⤵
- Loads dropped Dex/Jar
- Makes use of the framework's Accessibility service
- Acquires the wake lock
- Makes use of the framework's foreground persistence service
- Performs UI accessibility actions on behalf of the user
- Queries the mobile country code (MCC)
- Requests accessing notifications (often used to intercept notifications before users become aware).
- Requests disabling of battery optimizations (often used to enable hiding in the background).
- Requests modifying system settings.
- Schedules tasks to execute at a specified time
- Uses Crypto APIs (Might try to encrypt user data)
PID:4779

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Scheduled Task/Job

T1603

Persistence

Foreground Persistence

T1541

Scheduled Task/Job

T1603

Privilege Escalation

Defense Evasion

Download New Code at Runtime

T1407

Foreground Persistence

T1541

Hide Artifacts

T1628

User Evasion

T1628.002

Impair Defenses

T1629

Prevent Application Removal

T1629.001

Input Injection

T1516

Credential Access

Access Notifications

T1517

Input Capture

T1417

GUI Input Capture

T1417.002

Keylogging

T1417.001

Discovery

Software Discovery

T1418

Security Software Discovery

T1418.001

System Network Configuration Discovery

T1422

Lateral Movement

Collection

Access Notifications

T1517

Input Capture

T1417

GUI Input Capture

T1417.002

Keylogging

T1417.001

Screen Capture

T1513

Command and Control

Exfiltration

Impact

Data Encrypted for Impact

T1471

Input Injection

T1516

Replay Monitor

Loading Replay Monitor...

Downloads

/data/data/com.roundmaynp/cache/classes.dex

Filesize
446KB

MD5
6542ca27c9860a7fcfe1a96c21bfd80a

SHA1
d5411878e345a4338163b9f8ec0f24c640bac6b2

SHA256
3162c2d32f81f903683acd41c1a52d628aa454128005621fd8330d350a292ec8

SHA512
9f33c8e9d49f67282912a9ee5ed6498c8368b2df10656367a00adec5c632d8aa9815f560966e989824e8985fdb7c2b381bb9099325b6f308f1f0be476eaad8ea

Download Submit
/data/data/com.roundmaynp/code_cache/secondary-dexes/1733004867717_classes.dex

Filesize
1.1MB

MD5
2a32f646cf5dc6f09b09bcff6c75b8c1

SHA1
4c706b935aa0112a34aae7720df4cf955cc8839a

SHA256
f1c5600149806f7c2898092a84bc5e85863fe0f52277ad84f185915c56e6475d

SHA512
71322607e2822d095eb6d0d9db8a8ec387646a0970b4514aba8a4b876c8c4a2b459262633f0e55139bdb3accf240c0388c81493b51866f41dcf93915d7ffd668

Download Submit
/data/data/com.roundmaynp/files/profileinstaller_profileWrittenFor_lastUpdateTime.dat

Filesize
8B

MD5
ceef016d63d0b268eaa1ced16fac4134

SHA1
9c1176a290c61fac33c90f23badf30b015ac5a87

SHA256
4b20a25bed5cf82344ed594ee7553eae55cfd9c607fb168b28f69fb495bdeedd

SHA512
57e5afc29e4bbed85f417d2165a0fb7008d13475c0059b449dda1b61b5c55c05c25db8854b6978d4771f88f8593a0195b70280446d7ba5692e3fb4ea576e9afc

Download Submit
/data/data/com.roundmaynp/no_backup/androidx.work.workdb

Filesize
4KB

MD5
7e858c4054eb00fcddc653a04e5cd1c6

SHA1
2e056bf31a8d78df136f02a62afeeca77f4faccf

SHA256
9010186c5c083155a45673017d1e31c2a178e63cc15a57bbffde4d1956a23dad

SHA512
d0c7a120940c8e637d5566ef179d01eff88a2c2650afda69ad2a46aad76533eaace192028bba3d60407b4e34a950e7560f95d9f9b8eebe361ef62897d88b30cb

Download Submit
/data/data/com.roundmaynp/no_backup/androidx.work.workdb-journal

Filesize
512B

MD5
ec2f479700e24e0f69280293d440b665

SHA1
c7897629368f92d2e5e275f29813aba07b7512da

SHA256
ac57fc3e065d19342fd0ce13ba6245dd3647fc83bcae8746a5b0b51aea326551

SHA512
5f4ca2b338c3ae5541ac276ed3ce3d039bbce58bf06e15d3355a2be3fba79d4bd5be3801f7ca45d6900507a40c8ee6390df5b6b9b947814ac13b0dece3fc455a

Download Submit
/data/data/com.roundmaynp/no_backup/androidx.work.workdb-shm

Filesize
32KB

MD5
bb7df04e1b0a2570657527a7e108ae23

SHA1
5188431849b4613152fd7bdba6a3ff0a4fd6424b

SHA256
c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479

SHA512
768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012

Download Submit
/data/data/com.roundmaynp/no_backup/androidx.work.workdb-wal

Filesize
169KB

MD5
7f2c860905348fd2bf2d1ee22a841d91

SHA1
bb16ef18a4ebedd5a6f825f51071c235f7726171

SHA256
ea299d7b4bdf5ea31ce7f5d44e513871f08a69fb317ae90470d6b3207cde679e

SHA512
21bd6d85be4c9623ef306c1b18f7f278c5f6fb7345b1debd9c9abcf5efcb33641e870f0432fd988434dbf2c5fd872eb4fb52b92c87dbd4dd7a7c2b3d68621eb5

Download Submit
/data/data/com.roundmaynp/no_backup/androidx.work.workdb-wal

Filesize
16KB

MD5
dfdc48a02f05d4b8f81013e7fc3d7588

SHA1
536564993c074e3678d3ad693eeeef4eb0431063

SHA256
a4fe9f7bdfd705c0440754e4ef59f2110ab8a10cff55cdcf2763f07181c8c27a

SHA512
32ba0f45cd278a45417c1e374c3187df8548e92b9a8a95e5f7c11aab05ea04f00a10aa6104bd4d454d0b480f5917fc4ba167e83664ad68216564be2aa1f364fe

Download Submit
/data/data/com.roundmaynp/no_backup/androidx.work.workdb-wal

Filesize
116KB

MD5
585c7617256e6b870307cf31ca020386

SHA1
b9ed664e7a12c530c1c065113f5a76cad44c2052

SHA256
395ebd3a38ee52d6f71e20a646e7893a292bebe8ccf549f48a4c2bc78a3647bd

SHA512
202fc7999f52fb3bd012e476d67f35e51a29efaa691fa6e4c63b49c8e695e53a59052aff937878b8add20825d40e2511a45e73c25c4c3a57542ff4c4c581587d

Download Submit
/data/misc/profiles/cur/0/com.roundmaynp/primary.prof

Filesize
110B

MD5
4a4f3e4b0244288a74abe4311db2a5f8

SHA1
0dc8ca89f1effdb1f6f2bd88a00355e2224da1ec

SHA256
0f1da147dfbb35619d73a457a2e13415120b5360f2462aa208764dbe1451f72c

SHA512
381be26454a77481d832a3da5f005c20da2445b93e7deff310147e49bab421996be310c6bb453c31f92b4289d7f120d3ca507cb77b7860f5600a7562118179c3

Download Submit
/data/misc/profiles/cur/0/com.roundmaynp/primary.prof

Filesize
25B

MD5
b9d9e0f8902d129e1aeebff0ae7b725b

SHA1
cb0d2b4c9dd60a5c1fc6261fb581bcd3416fe781

SHA256
25a822139d06016af8be1296c0242b60e35074f94c713e03323636be1162ce91

SHA512
f158a9dc753e0cb41f71a98714ff02198c576bacdd792a6153fdaf6f9a7b52d8cfb6d09099a269d0c1b0d31e2ea5a307ea1db85115bdc6797887a6de36d597f6

Download Submit

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads