octo | 1913bf56c50411c5b6c7554bc70738fded0b7d7e675018850de08cb51254c077

Analysis

max time kernel
126s
max time network
150s
platform
android_x64
resource
android-x64-20240624-en
resource tags

androidarch:x64arch:x86image:android-x64-20240624-enlocale:en-usos:android-10-x64system
submitted
06-12-2024 22:10

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

1913bf56c50411c5b6c7554bc70738fded0b7d7e675018850de08cb51254c077.apk
Size

2.4MB
MD5

0b9d9cf6f9a9210d73db899de707f45d
SHA1

164a004d251890e07f81925947e8f9b187c5c193
SHA256

1913bf56c50411c5b6c7554bc70738fded0b7d7e675018850de08cb51254c077
SHA512

8b4d4c6bd087d5eb764ec4016e22f5dda85dc99084e33dcdfff09a309ed72b616d4e32f69a89386a18b1bc28811672a013da05ef7e421b780004c40f20ef02db
SSDEEP

49152:RGIvUw+z4dFo2sDA6YOZPfnEBL0LStBvM2MJjnIsz0geuK5Yj44gJuv6/8u8U0:F7+ze0DA6YOkBLbBf6IszNUYj44gJ3lA

Score

10^/10

octo banker collection credential_access discovery evasion impact infostealer persistence rat trojan

Malware Config

Extracted

Family

octo

https://332237453981d0595033c23.com/N2IzYzFlOTM3MWU3/

https://7237453981d0595033c23.com/N2IzYzFlOTM3MWU3/

https://62237453981d0595033c23.com/N2IzYzFlOTM3MWU3/

https://35237453981d0595033c23.com/N2IzYzFlOTM3MWU3/

https://332137453981d0595033c23.com/N2IzYzFlOTM3MWU3/

https://34437453981d0595033c23.com/N2IzYzFlOTM3MWU3/

https://3637453981d0595033c23.com/N2IzYzFlOTM3MWU3/

rc4.plain

Extracted

Family

octo

https://332237453981d0595033c23.com/N2IzYzFlOTM3MWU3/

https://7237453981d0595033c23.com/N2IzYzFlOTM3MWU3/

https://62237453981d0595033c23.com/N2IzYzFlOTM3MWU3/

https://35237453981d0595033c23.com/N2IzYzFlOTM3MWU3/

https://332137453981d0595033c23.com/N2IzYzFlOTM3MWU3/

https://34437453981d0595033c23.com/N2IzYzFlOTM3MWU3/

https://3637453981d0595033c23.com/N2IzYzFlOTM3MWU3/

AES_key

Signatures

Octo
Octo is a banking malware with remote access capabilities first seen in April 2022.
banker trojan infostealer rat octo
Octo family
octo

Octo payload 1 IoCs

resource	yara_rule
behavioral2/files/fstream-1.dat	family_octo

Loads dropped Dex/Jar 1 TTPs 2 IoCs

Runs executable file dropped to the device during analysis.

evasion

Download New Code at Runtime

T1407

ioc	pid	Process
/data/user/0/com.schoolform7/cache/eubvara	4931	com.schoolform7
/data/user/0/com.schoolform7/cache/eubvara	4931	com.schoolform7

Makes use of the framework's Accessibility service 4 TTPs 2 IoCs

Retrieves information displayed on the phone screen using AccessibilityService.

collection evasion credential_access

Input Injection

T1516

Screen Capture

T1513

Keylogging

T1417.001

GUI Input Capture

T1417.002

description	ioc	Process
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId	com.schoolform7
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByViewId	com.schoolform7

Obtains sensitive information copied to the device clipboard 2 TTPs 1 IoCs

Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.

collection credential_access impact

Clipboard Data

T1414

Transmitted Data Manipulation

T1641.001

description	ioc	Process
Framework service call	android.content.IClipboard.addPrimaryClipChangedListener	com.schoolform7

Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
banker discovery

Security Software Discovery
T1418.001
Queries the phone number (MSISDN for GSM devices) 1 TTPs
discovery

System Network Configuration Discovery
T1422

Acquires the wake lock 1 IoCs

description	ioc	Process
Framework service call	android.os.IPowerManager.acquireWakeLock	com.schoolform7

Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs

Application may abuse the framework's foreground service to continue running in the foreground.

evasion persistence

Foreground Persistence

T1541

description	ioc	Process
Framework service call	android.app.IActivityManager.setServiceForeground	com.schoolform7

Performs UI accessibility actions on behalf of the user 1 TTPs 7 IoCs

Application may abuse the accessibility service to prevent their removal.

evasion

Prevent Application Removal

T1629.001

ioc	Process
android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction	com.schoolform7
android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction	com.schoolform7
android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction	com.schoolform7
android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction	com.schoolform7
android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction	com.schoolform7
android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction	com.schoolform7
android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction	com.schoolform7

Queries the mobile country code (MCC) 1 TTPs 1 IoCs

discovery

System Network Configuration Discovery

T1422

description	ioc	Process
Framework service call	com.android.internal.telephony.ITelephony.getNetworkCountryIsoForPhone	com.schoolform7

Reads information about phone network operator. 1 TTPs
discovery

System Network Configuration Discovery
T1422

Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs

persistence

Broadcast Receivers

T1624.001

description	ioc	Process
Framework service call	android.app.IActivityManager.registerReceiver	com.schoolform7

Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs

impact

Data Encrypted for Impact

T1471

description	ioc	Process
Framework API call	javax.crypto.Cipher.doFinal	com.schoolform7

Checks CPU information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/cpuinfo	com.schoolform7

Checks memory information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/meminfo	com.schoolform7

com.schoolform7
1⤵
- Loads dropped Dex/Jar
- Makes use of the framework's Accessibility service
- Obtains sensitive information copied to the device clipboard
- Acquires the wake lock
- Makes use of the framework's foreground persistence service
- Performs UI accessibility actions on behalf of the user
- Queries the mobile country code (MCC)
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Uses Crypto APIs (Might try to encrypt user data)
- Checks CPU information
- Checks memory information
PID:4931

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Event Triggered Execution

T1624

Broadcast Receivers

T1624.001

Foreground Persistence

T1541

Privilege Escalation

Defense Evasion

Download New Code at Runtime

T1407

Foreground Persistence

T1541

Impair Defenses

T1629

Prevent Application Removal

T1629.001

Input Injection

T1516

Virtualization/Sandbox Evasion

T1633

System Checks

T1633.001

Credential Access

Clipboard Data

T1414

Input Capture

T1417

GUI Input Capture

T1417.002

Keylogging

T1417.001

Discovery

Software Discovery

T1418

Security Software Discovery

T1418.001

System Information Discovery

T1426

System Network Configuration Discovery

T1422

Lateral Movement

Collection

Clipboard Data

T1414

Input Capture

T1417

GUI Input Capture

T1417.002

Keylogging

T1417.001

Screen Capture

T1513

Command and Control

Exfiltration

Impact

Data Encrypted for Impact

T1471

Data Manipulation

T1641

Transmitted Data Manipulation

T1641.001

Input Injection

T1516

Replay Monitor

Loading Replay Monitor...

Downloads

/data/data/com.schoolform7/cache/eubvara

Filesize
2.3MB

MD5
e6476ff50bed591d868d975dd6415985

SHA1
7698b695def903f98f07b990ec30a76f2d1107ee

SHA256
512b9c50fdfc37ad30a72282d7eee19ea1122ab9303a96292a07251afee6b78f

SHA512
95e0aa5e4ec1e6566ae5921f7f5756e9f442222d7b89df8da73c74c53921c11b7f53f27263ee4b7ed560c51a95a7f10a0b1869685c2989faef7642c77cda5815

Download Submit
/data/data/com.schoolform7/cache/oat/eubvara.cur.prof

Filesize
533B

MD5
e15e691bd093a22149bbc670c272f3d0

SHA1
c69c6f2787485167b6b176d338befb303ac7697c

SHA256
ac3739d41d4308249a3d3f53d82324c204afdf2ee722a311fa951d614d61cd49

SHA512
9c9867de448d10af04324935c2444df9be3cc1efd9d5dc75212ca2e2a26dd0000392c8c337b7599a06b8f84842cd6e836ab4ee5ce97e20a855d2d11b72cb33dd

Download Submit
/data/data/com.schoolform7/kl.txt

Filesize
28B

MD5
6311c3fd15588bb5c126e6c28ff5fffe

SHA1
ce81d136fce31779f4dd62e20bdaf99c91e2fc57

SHA256
8b82f6032e29a2b5c96031a3630fb6173d12ff0295bc20bb21b877d08f0812d8

SHA512
2975fe2e94b6a8adc9cfc1a865ad113772b54572883a537b02a16dd2d029c0f7d9cca3b154fd849bdfe978e18b396bcf9fa6e67e7c61f92bdc089a29a9c355c6

Download Submit
/data/data/com.schoolform7/kl.txt

Filesize
237B

MD5
f9e0b351faaee2c7de5cdd0ade757cd2

SHA1
3463a17ee66c0f02097c568d1b15f925e6911d48

SHA256
7257116a4598376bc6bc61cebeeafefc1186500fb4b195158333ca0b37f5a04d

SHA512
a22bf6d34d3a62f16d594470c1b355bc79121873d6d6b1ea9f40ed52d2009b7d5a0f463ee79f32f9dc042b45677a239114778365dc3f32c51550bee64ad51c6b

Download Submit
/data/data/com.schoolform7/kl.txt

Filesize
63B

MD5
da7db60c5ee7e0b0564d8169227b23a8

SHA1
fb108c2ae6232392f0d8cbe9c847a9159a3870a3

SHA256
53edafb401d1201440c6abec1fd72dd4f1d500b5cc25aa3fecb2be56d3596a4a

SHA512
94156a7f82ea7d379d37618ad2711cfbaa9f9bc5bf30735b08f8b7f6d6d41a721f7cb5469761579ceb3c1fe3f2a312ad059b406260a2a85a8a82df6bdc181404

Download Submit
/data/data/com.schoolform7/kl.txt

Filesize
45B

MD5
6367b5094b7bcb807e7de5b9c8ba3c8c

SHA1
a3db7483d6210d75bec4baa8391d4202019a4658

SHA256
108be436642e159decfd5b47dad223b0e36633813dc24d779fd38adb4953475c

SHA512
2f342f54e753069dbac80fd00fd312815c9124b9dddaf4e0103891362dbbfe9124e18126b5a4d6bd5a62d432b30cc7685835e25f4bbc92ce9bd51e1832c01b24

Download Submit
/data/data/com.schoolform7/kl.txt

Filesize
437B

MD5
3300e7451682c2fec3cf3f3747465203

SHA1
e05d138eeabb52b7a50b66ce3be5ef9393aa2c08

SHA256
32daa05d633c6618ea78406d51e7dd8c3527cd8af4f532498a7326b3e4042f9f

SHA512
af33b1de701507a07ace47abc256b76d96ec983b57b01e8c063f6c45b48cbd46b46fd85c8c214ab46695792a599577e37341f7193648161e6e04e7e63d64cb21

Download Submit

Analysis

Sharing

General

Malware Config

Extracted

Extracted

Signatures

Processes

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads