octo | 1913bf56c50411c5b6c7554bc70738fded0b7d7e675018850de08cb51254c077

Analysis

max time kernel
148s
max time network
147s
platform
android_x86
resource
android-x86-arm-20240624-en
resource tags

androidarch:armarch:x86image:android-x86-arm-20240624-enlocale:en-usos:android-9-x86system
submitted
06-12-2024 22:10

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

1913bf56c50411c5b6c7554bc70738fded0b7d7e675018850de08cb51254c077.apk
Size

2.4MB
MD5

0b9d9cf6f9a9210d73db899de707f45d
SHA1

164a004d251890e07f81925947e8f9b187c5c193
SHA256

1913bf56c50411c5b6c7554bc70738fded0b7d7e675018850de08cb51254c077
SHA512

8b4d4c6bd087d5eb764ec4016e22f5dda85dc99084e33dcdfff09a309ed72b616d4e32f69a89386a18b1bc28811672a013da05ef7e421b780004c40f20ef02db
SSDEEP

49152:RGIvUw+z4dFo2sDA6YOZPfnEBL0LStBvM2MJjnIsz0geuK5Yj44gJuv6/8u8U0:F7+ze0DA6YOkBLbBf6IszNUYj44gJ3lA

Score

10^/10

octo banker collection credential_access discovery evasion impact infostealer persistence rat trojan

Malware Config

Extracted

Family

octo

https://332237453981d0595033c23.com/N2IzYzFlOTM3MWU3/

https://7237453981d0595033c23.com/N2IzYzFlOTM3MWU3/

https://62237453981d0595033c23.com/N2IzYzFlOTM3MWU3/

https://35237453981d0595033c23.com/N2IzYzFlOTM3MWU3/

https://332137453981d0595033c23.com/N2IzYzFlOTM3MWU3/

https://34437453981d0595033c23.com/N2IzYzFlOTM3MWU3/

https://3637453981d0595033c23.com/N2IzYzFlOTM3MWU3/

rc4.plain

Extracted

Family

octo

https://332237453981d0595033c23.com/N2IzYzFlOTM3MWU3/

https://7237453981d0595033c23.com/N2IzYzFlOTM3MWU3/

https://62237453981d0595033c23.com/N2IzYzFlOTM3MWU3/

https://35237453981d0595033c23.com/N2IzYzFlOTM3MWU3/

https://332137453981d0595033c23.com/N2IzYzFlOTM3MWU3/

https://34437453981d0595033c23.com/N2IzYzFlOTM3MWU3/

https://3637453981d0595033c23.com/N2IzYzFlOTM3MWU3/

AES_key

Signatures

Octo
Octo is a banking malware with remote access capabilities first seen in April 2022.
banker trojan infostealer rat octo
Octo family
octo

Octo payload 1 IoCs

resource	yara_rule
behavioral1/files/fstream-1.dat	family_octo

Loads dropped Dex/Jar 1 TTPs 2 IoCs

Runs executable file dropped to the device during analysis.

evasion

Download New Code at Runtime

T1407

ioc	pid	Process
/data/user/0/com.schoolform7/cache/eubvara	4256	com.schoolform7
/data/user/0/com.schoolform7/cache/eubvara	4256	com.schoolform7

Makes use of the framework's Accessibility service 4 TTPs 2 IoCs

Retrieves information displayed on the phone screen using AccessibilityService.

collection evasion credential_access

Input Injection

T1516

Screen Capture

T1513

Keylogging

T1417.001

GUI Input Capture

T1417.002

description	ioc	Process
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId	com.schoolform7
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByViewId	com.schoolform7

Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
banker discovery

Security Software Discovery
T1418.001
Queries the phone number (MSISDN for GSM devices) 1 TTPs
discovery

System Network Configuration Discovery
T1422

Acquires the wake lock 1 IoCs

description	ioc	Process
Framework service call	android.os.IPowerManager.acquireWakeLock	com.schoolform7

Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs

Application may abuse the framework's foreground service to continue running in the foreground.

evasion persistence

Foreground Persistence

T1541

description	ioc	Process
Framework service call	android.app.IActivityManager.setServiceForeground	com.schoolform7

Performs UI accessibility actions on behalf of the user 1 TTPs 7 IoCs

Application may abuse the accessibility service to prevent their removal.

evasion

Prevent Application Removal

T1629.001

ioc	Process
android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction	com.schoolform7
android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction	com.schoolform7
android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction	com.schoolform7
android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction	com.schoolform7
android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction	com.schoolform7
android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction	com.schoolform7
android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction	com.schoolform7

Queries the mobile country code (MCC) 1 TTPs 1 IoCs

discovery

System Network Configuration Discovery

T1422

description	ioc	Process
Framework service call	com.android.internal.telephony.ITelephony.getNetworkCountryIsoForPhone	com.schoolform7

Queries the unique device ID (IMEI, MEID, IMSI) 1 TTPs
discovery

System Network Configuration Discovery
T1422
Reads information about phone network operator. 1 TTPs
discovery

System Network Configuration Discovery
T1422

Requests accessing notifications (often used to intercept notifications before users become aware). 1 TTPs 1 IoCs

collection credential_access

Access Notifications

T1517

description	ioc	Process
Intent action	android.settings.ACTION_NOTIFICATION_LISTENER_SETTINGS	com.schoolform7

Requests disabling of battery optimizations (often used to enable hiding in the background). 1 TTPs 1 IoCs

evasion

User Evasion

T1628.002

description	ioc	Process
Intent action	android.settings.REQUEST_IGNORE_BATTERY_OPTIMIZATIONS	com.schoolform7

Requests modifying system settings. 1 IoCs

evasion

description	ioc	Process
Intent action	android.settings.action.MANAGE_WRITE_SETTINGS	com.schoolform7

Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs

persistence

Broadcast Receivers

T1624.001

description	ioc	Process
Framework service call	android.app.IActivityManager.registerReceiver	com.schoolform7

Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs

impact

Data Encrypted for Impact

T1471

description	ioc	Process
Framework API call	javax.crypto.Cipher.doFinal	com.schoolform7

Checks CPU information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/cpuinfo	com.schoolform7

Checks memory information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/meminfo	com.schoolform7

com.schoolform7
1⤵
- Loads dropped Dex/Jar
- Makes use of the framework's Accessibility service
- Acquires the wake lock
- Makes use of the framework's foreground persistence service
- Performs UI accessibility actions on behalf of the user
- Queries the mobile country code (MCC)
- Requests accessing notifications (often used to intercept notifications before users become aware).
- Requests disabling of battery optimizations (often used to enable hiding in the background).
- Requests modifying system settings.
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Uses Crypto APIs (Might try to encrypt user data)
- Checks CPU information
- Checks memory information
PID:4256

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Event Triggered Execution

T1624

Broadcast Receivers

T1624.001

Foreground Persistence

T1541

Privilege Escalation

Defense Evasion

Download New Code at Runtime

T1407

Foreground Persistence

T1541

Hide Artifacts

T1628

User Evasion

T1628.002

Impair Defenses

T1629

Prevent Application Removal

T1629.001

Input Injection

T1516

Virtualization/Sandbox Evasion

T1633

System Checks

T1633.001

Credential Access

Access Notifications

T1517

Input Capture

T1417

GUI Input Capture

T1417.002

Keylogging

T1417.001

Discovery

Software Discovery

T1418

Security Software Discovery

T1418.001

System Information Discovery

T1426

System Network Configuration Discovery

T1422

Lateral Movement

Collection

Access Notifications

T1517

Input Capture

T1417

GUI Input Capture

T1417.002

Keylogging

T1417.001

Screen Capture

T1513

Command and Control

Exfiltration

Impact

Data Encrypted for Impact

T1471

Input Injection

T1516

Replay Monitor

Loading Replay Monitor...

Downloads

/data/data/com.schoolform7/cache/eubvara

Filesize
2.3MB

MD5
e6476ff50bed591d868d975dd6415985

SHA1
7698b695def903f98f07b990ec30a76f2d1107ee

SHA256
512b9c50fdfc37ad30a72282d7eee19ea1122ab9303a96292a07251afee6b78f

SHA512
95e0aa5e4ec1e6566ae5921f7f5756e9f442222d7b89df8da73c74c53921c11b7f53f27263ee4b7ed560c51a95a7f10a0b1869685c2989faef7642c77cda5815

Download Submit
/data/data/com.schoolform7/cache/oat/eubvara.cur.prof

Filesize
544B

MD5
f36450602b77b12401d18aa6f160e5c8

SHA1
7c1381f6e12cb4abe1a97053bcd52c6514525ae2

SHA256
d933c26c38e0fd37dbf35759a9a52157583b721dad4faad6370273eefbebe98e

SHA512
3ad63507b4852f2332725a0937c88deccb444deebb7de1775f8d51a96bbd1afa712232054ac4025cb6d2ca7f07bf54dbb6bf0283262bdbe106d65516ea2e9da0

Download Submit
/data/data/com.schoolform7/kl.txt

Filesize
28B

MD5
6311c3fd15588bb5c126e6c28ff5fffe

SHA1
ce81d136fce31779f4dd62e20bdaf99c91e2fc57

SHA256
8b82f6032e29a2b5c96031a3630fb6173d12ff0295bc20bb21b877d08f0812d8

SHA512
2975fe2e94b6a8adc9cfc1a865ad113772b54572883a537b02a16dd2d029c0f7d9cca3b154fd849bdfe978e18b396bcf9fa6e67e7c61f92bdc089a29a9c355c6

Download Submit
/data/data/com.schoolform7/kl.txt

Filesize
237B

MD5
ed755463f4e7c4a30b8297e938f3aaa8

SHA1
cce9ca711102e016247f95c384ab862651207d07

SHA256
1b3d1a4426788607cb51a89ad846ad493b0cb6cfbe344f8adaad32edb2b147c7

SHA512
af67a27398de3a498cc23627ff8bd7d611efe878bcb910db4fcfc74a30d4912ae1170d4084ded35618dffbf54b11ce59813e559d2ecf3adc667d1f080095d51d

Download Submit
/data/data/com.schoolform7/kl.txt

Filesize
54B

MD5
ec90d0de5219ce29d53dccecdd8002d8

SHA1
28e24ac59067fc1aa1a2a1b3e23867d9f1cb0ffc

SHA256
a9769c9a88346783ebcaa557566357693a3c7e76f4c27e3047f8e22773a90fa9

SHA512
f173b2046335e85f905d6eed8e691a0d1b2bfa451215c88dff654a2693c2f203ff378e4c430bdff556f66f2fc2d934d1fb842d6956901fd77b7384464f13552a

Download Submit
/data/data/com.schoolform7/kl.txt

Filesize
63B

MD5
da7db60c5ee7e0b0564d8169227b23a8

SHA1
fb108c2ae6232392f0d8cbe9c847a9159a3870a3

SHA256
53edafb401d1201440c6abec1fd72dd4f1d500b5cc25aa3fecb2be56d3596a4a

SHA512
94156a7f82ea7d379d37618ad2711cfbaa9f9bc5bf30735b08f8b7f6d6d41a721f7cb5469761579ceb3c1fe3f2a312ad059b406260a2a85a8a82df6bdc181404

Download Submit
/data/data/com.schoolform7/kl.txt

Filesize
437B

MD5
c2e9b546c69fb5c8c95a07282f034f15

SHA1
6315997626a9a5ec538ebc76fa7a97e0f22a6962

SHA256
fb64e163506761ec9575224d2e3a8346a9763883e5d1084f1f8f78dc94efd4fe

SHA512
426e80db8feb2dc4152d1b1d7a9940fee8ec5a4c0943a75fbf72e8f600c30be5748034003b48abd3748317c570023b7eb434890fa9271df702e539f433557e95

Download Submit

Analysis

Sharing

General

Malware Config

Extracted

Extracted

Signatures

Processes

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads