octo | 563a4cfebe9ec8bd44fafd18e25dae97499e9a4ae7603b63c2b9bdb28226b6fe

Analysis

max time kernel
22s
max time network
35s
platform
android_x86
resource
android-x86-arm-20240624-en
resource tags

androidarch:armarch:x86image:android-x86-arm-20240624-enlocale:en-usos:android-9-x86system
submitted
01-12-2024 21:55

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

563a4cfebe9ec8bd44fafd18e25dae97499e9a4ae7603b63c2b9bdb28226b6fe.apk
Size

7.4MB
MD5

e9ccb05ac15559a80818ffcbe77ec7d4
SHA1

544dcf55b3c4e0b3e39d830df2e3f22224fa9913
SHA256

563a4cfebe9ec8bd44fafd18e25dae97499e9a4ae7603b63c2b9bdb28226b6fe
SHA512

c86c68d501aa37681b804f1ba593fee0d5b9aec9db6e799b9f053c1e46aec5c32f5b0e3bf093e57dcb1b3c25232c62b3623bc4a2da1307131e6d93e009a2fa22
SSDEEP

98304:+8Vv5iSRGOqVKouXSKs4QVBeH3XzRsvLA3Eyd:+8VvrGUpXmXBK3XzRMA3J

Score

10^/10

octo banker collection credential_access discovery evasion impact infostealer persistence rat trojan

Malware Config

Extracted

Family

octo

AES_key

Signatures

Octo
Octo is a banking malware with remote access capabilities first seen in April 2022.
banker trojan infostealer rat octo
Octo family
octo

Octo payload 1 IoCs

resource	yara_rule
behavioral1/memory/4316-1.dex	family_octo

Checks Android system properties for emulator presence. 1 TTPs 1 IoCs

evasion

System Checks

T1633.001

description	ioc	Process
Accessed system property	key: ro.product.model	com.dpaint15mapsexplorer

Loads dropped Dex/Jar 1 TTPs 3 IoCs

Runs executable file dropped to the device during analysis.

evasion

Download New Code at Runtime

T1407

ioc	pid	Process
/data/user/0/com.dpaint15mapsexplorer/app_march/edXxFO.json	4341	/system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.dpaint15mapsexplorer/app_march/edXxFO.json --output-vdex-fd=41 --oat-fd=42 --oat-location=/data/user/0/com.dpaint15mapsexplorer/app_march/oat/x86/edXxFO.odex --compiler-filter=quicken --class-loader-context=&
/data/user/0/com.dpaint15mapsexplorer/app_march/edXxFO.json	4316	com.dpaint15mapsexplorer
Anonymous-DexFile@0xc90f8000-0xc917b960	4316	com.dpaint15mapsexplorer

Makes use of the framework's Accessibility service 4 TTPs 2 IoCs

Retrieves information displayed on the phone screen using AccessibilityService.

collection evasion credential_access

Input Injection

T1516

Screen Capture

T1513

Keylogging

T1417.001

GUI Input Capture

T1417.002

description	ioc	Process
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId	com.dpaint15mapsexplorer
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByViewId	com.dpaint15mapsexplorer

Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
banker discovery

Security Software Discovery
T1418.001
Queries the phone number (MSISDN for GSM devices) 1 TTPs
discovery

System Network Configuration Discovery
T1422

Acquires the wake lock 1 IoCs

description	ioc	Process
Framework service call	android.os.IPowerManager.acquireWakeLock	com.dpaint15mapsexplorer

Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs

Application may abuse the framework's foreground service to continue running in the foreground.

evasion persistence

Foreground Persistence

T1541

description	ioc	Process
Framework service call	android.app.IActivityManager.setServiceForeground	com.dpaint15mapsexplorer

Queries the mobile country code (MCC) 1 TTPs 1 IoCs

discovery

System Network Configuration Discovery

T1422

description	ioc	Process
Framework service call	com.android.internal.telephony.ITelephony.getNetworkCountryIsoForPhone	com.dpaint15mapsexplorer

Queries the unique device ID (IMEI, MEID, IMSI) 1 TTPs
discovery

System Network Configuration Discovery
T1422
Reads information about phone network operator. 1 TTPs
discovery

System Network Configuration Discovery
T1422

Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs

persistence

Broadcast Receivers

T1624.001

description	ioc	Process
Framework service call	android.app.IActivityManager.registerReceiver	com.dpaint15mapsexplorer

Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs

impact

Data Encrypted for Impact

T1471

description	ioc	Process
Framework API call	javax.crypto.Cipher.doFinal	com.dpaint15mapsexplorer

Checks CPU information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/cpuinfo	com.dpaint15mapsexplorer

Checks memory information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/meminfo	com.dpaint15mapsexplorer

com.dpaint15mapsexplorer
1⤵
- Checks Android system properties for emulator presence.
- Loads dropped Dex/Jar
- Makes use of the framework's Accessibility service
- Acquires the wake lock
- Makes use of the framework's foreground persistence service
- Queries the mobile country code (MCC)
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Uses Crypto APIs (Might try to encrypt user data)
- Checks CPU information
- Checks memory information
PID:4316
- /system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.dpaint15mapsexplorer/app_march/edXxFO.json --output-vdex-fd=41 --oat-fd=42 --oat-location=/data/user/0/com.dpaint15mapsexplorer/app_march/oat/x86/edXxFO.odex --compiler-filter=quicken --class-loader-context=&
  2⤵
  - Loads dropped Dex/Jar
  PID:4341

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Event Triggered Execution

T1624

Broadcast Receivers

T1624.001

Foreground Persistence

T1541

Privilege Escalation

Defense Evasion

Download New Code at Runtime

T1407

Foreground Persistence

T1541

Input Injection

T1516

Virtualization/Sandbox Evasion

T1633

System Checks

T1633.001

Credential Access

Input Capture

T1417

GUI Input Capture

T1417.002

Keylogging

T1417.001

Discovery

Software Discovery

T1418

Security Software Discovery

T1418.001

System Information Discovery

T1426

System Network Configuration Discovery

T1422

Lateral Movement

Collection

Input Capture

T1417

GUI Input Capture

T1417.002

Keylogging

T1417.001

Screen Capture

T1513

Command and Control

Exfiltration

Impact

Data Encrypted for Impact

T1471

Input Injection

T1516

Replay Monitor

Loading Replay Monitor...

Downloads

/data/data/com.dpaint15mapsexplorer/.global.com.dpaint15mapsexplorer

Filesize
48B

MD5
046a414913add6f5bb60072c7db819b6

SHA1
451ee4f6809260aec622d772fd329c7d0297a842

SHA256
b66c1320cb063a1d391c94273572ea6edae76c8c8b0a07f8d75c88686f0df72a

SHA512
4e6355f3051ed5e811ab030abde1f5be7f5e1cf33be99cd08477e9b6c015deb1d8bd75a09fb9c7176b8511c5ad0a67abc0902a3531e97564ccb6afc57496a47c

Download Submit
/data/data/com.dpaint15mapsexplorer/app_march/edXxFO.json

Filesize
1019B

MD5
531010aae2e58e96e0fe283de3c412f2

SHA1
a702ff04a716d0d334f2a443c8b2f9fac988511d

SHA256
4b00ffaa335a70ecc878096bd4d6b7eff38694cc10e37a9bd860845928f383d7

SHA512
48bd9ab06a30de96748f6e1e0c4a35bf438e69dfcb27d534792f020a7c1ef60869397e1885c6297e37cd689c7574145852dcb8881de431372fafc7f2178168cb

Download Submit
/data/data/com.dpaint15mapsexplorer/app_march/edXxFO.json

Filesize
1019B

MD5
7ab6c998eadcb92c1637d336bc1b1d2a

SHA1
969dd52a99d52998dd93b038d5ce42099b335e50

SHA256
cf235fdabfca618705078b195c87ea5d389f59c6f6e4319fbcedaef52e9a6d90

SHA512
fea95f04fdeaf37d8b3d5f8c37135e9c9b665b9c794cc797c0df6589371094ccff14d40abc7d2b24047f936f5001f6cc235ef63c3f93e0b74fab97ba8e7224ec

Download Submit
/data/data/com.dpaint15mapsexplorer/files/.n

Filesize
307KB

MD5
4e73947cabb5db3f92ca85004981b754

SHA1
6d9667fdb0280ed2dcb782b4683e422a51bdc601

SHA256
6db94232e756b90ed437f1bc87dc38cf20fb2e7c7a19a5e40c6c17254b7e234c

SHA512
be8b500a7070af1dfb53b0cf1a7b327dadc4e163a6dad905496ac228c58cd1ed87b054533917924455d35e9b300683ae33e1bcdd91935a5dbae1d693c3e13d69

Download Submit
/data/user/0/com.dpaint15mapsexplorer/app_march/edXxFO.json

Filesize
1KB

MD5
a2d5656f3f73156736245699b4350d61

SHA1
db66c51c476e236371f4b005b729c2adbf62809f

SHA256
1aa8821c4de5d8f918c8bb620b8801bdbb3ff1735fe0655a78597753d43c38f9

SHA512
bc75a11e928c3381a199e864298f827b76ff40514f670d941a7efb8c4dee20252784351ea91cdb7401eb8bbd95eadf854583dfe3d28676809f5878d522dbea93

Download Submit
/data/user/0/com.dpaint15mapsexplorer/app_march/edXxFO.json

Filesize
1KB

MD5
9a873f11ab2c6bdc1bc997ed6867d385

SHA1
18861e37b97c0902c0ff3850873c919c5b5f93cb

SHA256
f5be69fd381de09be9b5c49850fe7e2dff7a7ae8406a5dafba8419c0ec91d63a

SHA512
db6e97905d4e81bbc6dba7b05f7df6d12371a31e1b43f0ec95d1db611523bc07ae546980cecbafe8e307771a164ba6cdace5c9d8a49e791a13bd9db82db55029

Download Submit
Anonymous-DexFile@0xc90f8000-0xc917b960

Filesize
526KB

MD5
19a65bda122c5e975e1d80da33cb83a0

SHA1
4c38fde6815e1c5e48bc9b3c9b87b43e3f1ae85a

SHA256
cf241ceb8b85ba4ae0923afbc98c4f371a2f9e2608ef807d7251c98786092896

SHA512
6b501420a482d099034cbe35678942ba281d78b9181032f5a58ccf7fb48672929823a37a763fc63f3d7d642e39340f5ee309d5e94b64a3defbefd0d9da752536

Download Submit

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads