octo | b35d0e986be46ef9965a7b05480caa4a70f696a187f56abde79509d7e7d5d616

Analysis

max time kernel
149s
max time network
130s
platform
android_x86
resource
android-x86-arm-20240624-en
resource tags

androidarch:armarch:x86image:android-x86-arm-20240624-enlocale:en-usos:android-9-x86system
submitted
04-12-2024 22:03

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

b35d0e986be46ef9965a7b05480caa4a70f696a187f56abde79509d7e7d5d616.apk
Size

537KB
MD5

27fa6c80389845fcc4b1fd4e49b41e6b
SHA1

76a2ff1fb35522dd13da0b221b1516c011992633
SHA256

b35d0e986be46ef9965a7b05480caa4a70f696a187f56abde79509d7e7d5d616
SHA512

8d770ae2e1a284fd10c06363f1067d213fd0b02e729eae1a76360b90285d8cb9556ee9cbfebdd5b548691f7172dabaddc1346b6362e4953f4fab8cdf6d2156cc
SSDEEP

12288:P2gBi2LExgmhgGaZjf7JaRdmXyVgqQpmYwZ1W6AvOH2LaMPG:P2gBiPzpa5tJiqmyFRLm

Score

10^/10

octo banker collection credential_access discovery evasion impact infostealer persistence rat stealth trojan

Malware Config

Extracted

Family

octo

https://24fdghhoo1.top/doc/

https://25fdghhoo1.top/doc/

https://26fdghhoo1.top/doc/

https://27fdghhoo1.top/doc/

https://28fdghhoo1.top/doc/

https://29fdghhoo1.top/doc/

https://210fdghhoo1.top/doc/

https://211fdghhoo1.top/doc/

https://122fdghhoo1.top/doc/

https://123fdghhoo1.top/doc/

https://124fdghhoo1.top/doc/

https://125fdghhoo1.top/doc/

https://126fdghhoo1.top/doc/

https://127fdghhoo1.top/doc/

https://128fdghhoo1.top/doc/

https://129fdghhoo1.top/doc/

https://220fdghhoo1.top/doc/

https://234fdghhoo1.top/doc/

https://235fdghhoo1.top/doc/

https://236fdghhoo1.top/doc/

rc4.plain

Extracted

Family

octo

https://24fdghhoo1.top/doc/

https://25fdghhoo1.top/doc/

https://26fdghhoo1.top/doc/

https://27fdghhoo1.top/doc/

https://28fdghhoo1.top/doc/

https://29fdghhoo1.top/doc/

https://210fdghhoo1.top/doc/

https://211fdghhoo1.top/doc/

https://122fdghhoo1.top/doc/

https://123fdghhoo1.top/doc/

https://124fdghhoo1.top/doc/

https://125fdghhoo1.top/doc/

https://126fdghhoo1.top/doc/

https://127fdghhoo1.top/doc/

https://128fdghhoo1.top/doc/

https://129fdghhoo1.top/doc/

https://220fdghhoo1.top/doc/

https://234fdghhoo1.top/doc/

https://235fdghhoo1.top/doc/

https://236fdghhoo1.top/doc/

AES_key

Signatures

Octo
Octo is a banking malware with remote access capabilities first seen in April 2022.
banker trojan infostealer rat octo
Octo family
octo

Octo payload 1 IoCs

resource	yara_rule
behavioral1/files/fstream-1.dat	family_octo

Removes its main activity from the application launcher 1 TTPs 1 IoCs

stealth trojan evasion

Suppress Application Icon

T1628.001

pid	Process
4232	com.watchandlr

Loads dropped Dex/Jar 1 TTPs 2 IoCs

Runs executable file dropped to the device during analysis.

evasion

Download New Code at Runtime

T1407

ioc	pid	Process
/data/user/0/com.watchandlr/cache/vsuprmqfiebpsd	4232	com.watchandlr
/data/user/0/com.watchandlr/cache/vsuprmqfiebpsd	4232	com.watchandlr

Makes use of the framework's Accessibility service 4 TTPs 1 IoCs

Retrieves information displayed on the phone screen using AccessibilityService.

collection evasion credential_access

Input Injection

T1516

Screen Capture

T1513

Keylogging

T1417.001

GUI Input Capture

T1417.002

description	ioc	Process
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId	com.watchandlr

Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
banker discovery

Security Software Discovery
T1418.001
Queries the phone number (MSISDN for GSM devices) 1 TTPs
discovery

System Network Configuration Discovery
T1422

Acquires the wake lock 1 IoCs

description	ioc	Process
Framework service call	android.os.IPowerManager.acquireWakeLock	com.watchandlr

Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs

Application may abuse the framework's foreground service to continue running in the foreground.

evasion persistence

Foreground Persistence

T1541

description	ioc	Process
Framework service call	android.app.IActivityManager.setServiceForeground	com.watchandlr

Performs UI accessibility actions on behalf of the user 1 TTPs 3 IoCs

Application may abuse the accessibility service to prevent their removal.

evasion

Prevent Application Removal

T1629.001

ioc	Process
android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction	com.watchandlr
android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction	com.watchandlr
android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction	com.watchandlr

Queries the mobile country code (MCC) 1 TTPs 1 IoCs

discovery

System Network Configuration Discovery

T1422

description	ioc	Process
Framework service call	com.android.internal.telephony.ITelephony.getNetworkCountryIsoForPhone	com.watchandlr

Queries the unique device ID (IMEI, MEID, IMSI) 1 TTPs
discovery

System Network Configuration Discovery
T1422
Reads information about phone network operator. 1 TTPs
discovery

System Network Configuration Discovery
T1422

Requests accessing notifications (often used to intercept notifications before users become aware). 1 TTPs 1 IoCs

collection credential_access

Access Notifications

T1517

description	ioc	Process
Intent action	android.settings.ACTION_NOTIFICATION_LISTENER_SETTINGS	com.watchandlr

Requests disabling of battery optimizations (often used to enable hiding in the background). 1 TTPs 1 IoCs

evasion

User Evasion

T1628.002

description	ioc	Process
Intent action	android.settings.REQUEST_IGNORE_BATTERY_OPTIMIZATIONS	com.watchandlr

Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs

persistence

Broadcast Receivers

T1624.001

description	ioc	Process
Framework service call	android.app.IActivityManager.registerReceiver	com.watchandlr

Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs

impact

Data Encrypted for Impact

T1471

description	ioc	Process
Framework API call	javax.crypto.Cipher.doFinal	com.watchandlr

Checks CPU information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/cpuinfo	com.watchandlr

Checks memory information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/meminfo	com.watchandlr

com.watchandlr
1⤵
- Removes its main activity from the application launcher
- Loads dropped Dex/Jar
- Makes use of the framework's Accessibility service
- Acquires the wake lock
- Makes use of the framework's foreground persistence service
- Performs UI accessibility actions on behalf of the user
- Queries the mobile country code (MCC)
- Requests accessing notifications (often used to intercept notifications before users become aware).
- Requests disabling of battery optimizations (often used to enable hiding in the background).
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Uses Crypto APIs (Might try to encrypt user data)
- Checks CPU information
- Checks memory information
PID:4232

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Event Triggered Execution

T1624

Broadcast Receivers

T1624.001

Foreground Persistence

T1541

Privilege Escalation

Defense Evasion

Download New Code at Runtime

T1407

Foreground Persistence

T1541

Hide Artifacts

T1628

Suppress Application Icon

T1628.001

User Evasion

T1628.002

Impair Defenses

T1629

Prevent Application Removal

T1629.001

Input Injection

T1516

Virtualization/Sandbox Evasion

T1633

System Checks

T1633.001

Credential Access

Access Notifications

T1517

Input Capture

T1417

GUI Input Capture

T1417.002

Keylogging

T1417.001

Discovery

Software Discovery

T1418

Security Software Discovery

T1418.001

System Information Discovery

T1426

System Network Configuration Discovery

T1422

Lateral Movement

Collection

Access Notifications

T1517

Input Capture

T1417

GUI Input Capture

T1417.002

Keylogging

T1417.001

Screen Capture

T1513

Command and Control

Exfiltration

Impact

Data Encrypted for Impact

T1471

Input Injection

T1516

Replay Monitor

Loading Replay Monitor...

Downloads

/data/data/com.watchandlr/cache/oat/vsuprmqfiebpsd.cur.prof

Filesize
476B

MD5
58e94168d484639e46478798d37b691e

SHA1
47743af1dae8c3451960bf084d1c65e13dd3d9c9

SHA256
5aa768efa0de8bacfb848b2561c536c1c80ef43a9420df758244aef4bff09610

SHA512
b10a9c1e761c54e5a114a4bf0c7a990da8937886de305ce5464bb79cc6c2a452c750915ae083a124a8da265b302b65ab8a4c081f4b01caf9f2065adbabccde89

Download Submit
/data/data/com.watchandlr/cache/vsuprmqfiebpsd

Filesize
446KB

MD5
ca588cd5d574d50a6beed1da7a37deb3

SHA1
b0d2a36248289e2377b41f0f5d0a9fe72ac207b7

SHA256
8d9176615356427e8b71def85af48e8cc59a7c15045060b3f8a182ab85cfd739

SHA512
cab4985b534c8cf06b39035723ceacd8ead995ec4c133c4dbabc6b4b813f317d4470cc90778b30e4668e7eda67f52a3f37ac3d605dc62cd14ce3de3186b493d4

Download Submit
/data/data/com.watchandlr/kl.txt

Filesize
28B

MD5
6311c3fd15588bb5c126e6c28ff5fffe

SHA1
ce81d136fce31779f4dd62e20bdaf99c91e2fc57

SHA256
8b82f6032e29a2b5c96031a3630fb6173d12ff0295bc20bb21b877d08f0812d8

SHA512
2975fe2e94b6a8adc9cfc1a865ad113772b54572883a537b02a16dd2d029c0f7d9cca3b154fd849bdfe978e18b396bcf9fa6e67e7c61f92bdc089a29a9c355c6

Download Submit
/data/data/com.watchandlr/kl.txt

Filesize
242B

MD5
32736b6f0f779be2a27bd980dfa5c566

SHA1
eee1632a45380cefe30611df93014c17c4c47c8a

SHA256
e8bdfde4100e54245fb828d63129dd27d9bea1ab5393d047133740c993c1f540

SHA512
aa5fcd81a89aa7afcd4b13b7ba0cc58b317b33a76a866867e8ce733a7e7b54cfaaa89a08f99a031bf5b77c4a84a5e32f58c95ac03a09ba5776aca4c6c0ac7002

Download Submit
/data/data/com.watchandlr/kl.txt

Filesize
63B

MD5
7480bd2bbeebe6499ac8fbc79288b816

SHA1
a035da4982bba92175af44c9ccb869db10bde1c8

SHA256
6136fb547ec8965f02343dcee2ac45fb34c39fd391db590b3136a3809d60a533

SHA512
77b8a695bcb4a45cd9990adaab7118a8de9626a564a7dc5a74aaedc603a857bb68721f225c4003c96b6a77b849e7a4bca404112c3fd6757b4499a7c53a72e80f

Download Submit
/data/data/com.watchandlr/kl.txt

Filesize
54B

MD5
f57029f6d49c0a6786af28efb72601fb

SHA1
7067f516a7882ded97ab65c213785e3d1142bce7

SHA256
6d3136a33ef2a2bc7c89c542d5f868d5a968066dba38ee4b83fe6ad22779de06

SHA512
81ae757505c4b382b9d85fe4c32073696136799825f4b5652c5b14f216d0383fdf715fc7935c1402cab8fb9c5ab68e342c3f7fca053f6b52857c0f19ed4fd7d5

Download Submit
/data/data/com.watchandlr/kl.txt

Filesize
447B

MD5
ea45238415114a09ecef81da415f0938

SHA1
d8cddefeacbdb5f6921195c72045142da42f0cd8

SHA256
2a3d80d2ad9ed66363f56418f478617daeb7897aa7a166c7449796af129b253a

SHA512
5c13109ad4c057b8f416ca68f56c18e123af600c6bbf1ee814d9feec9c27f499bc32b270c4121739ca84b7cc759c59159c5ab84523b8a92553ae2fd3d99d841b

Download Submit

Analysis

Sharing

General

Malware Config

Extracted

Extracted

Signatures

Processes

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads