octo | cf149c6a3bbcbf14481a38684271c5f0ba0d3d3cf9eacdd740582a576e94156a

Analysis

max time kernel
149s
max time network
150s
platform
android_x86
resource
android-x86-arm-20240624-en
resource tags

androidarch:armarch:x86image:android-x86-arm-20240624-enlocale:en-usos:android-9-x86system
submitted
06-12-2024 22:13

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

cf149c6a3bbcbf14481a38684271c5f0ba0d3d3cf9eacdd740582a576e94156a.apk
Size

2.4MB
MD5

7c20b7c82d89cfadf1dfed97c20e8aa8
SHA1

6212df9880b0233869f2ce798b7a7fbc69381679
SHA256

cf149c6a3bbcbf14481a38684271c5f0ba0d3d3cf9eacdd740582a576e94156a
SHA512

e094793579880a0df331315be6b9b39c8540ec72bfae361037be45006f2a22f20a24b9bdd1bdef8fefcf0002495347f745febf6e310b264bf8e7bf814567cef7
SSDEEP

49152:p1QccWC5vr3bnJ1i6NqnnyDZGOsVWkUUwKwo3eY3GVtYB2YeNSsA/D92Xn/JmNx:sLvzvicMhHVZvwKwjY3G2e4ZC2x

Score

10^/10

octo banker collection credential_access discovery evasion impact infostealer persistence rat trojan

Malware Config

Extracted

Family

octo

https://332237453981d0595033c23.com/N2IzYzFlOTM3MWU3/

https://7237453981d0595033c23.com/N2IzYzFlOTM3MWU3/

https://62237453981d0595033c23.com/N2IzYzFlOTM3MWU3/

https://35237453981d0595033c23.com/N2IzYzFlOTM3MWU3/

https://332137453981d0595033c23.com/N2IzYzFlOTM3MWU3/

https://34437453981d0595033c23.com/N2IzYzFlOTM3MWU3/

https://3637453981d0595033c23.com/N2IzYzFlOTM3MWU3/

rc4.plain

Extracted

Family

octo

https://332237453981d0595033c23.com/N2IzYzFlOTM3MWU3/

https://7237453981d0595033c23.com/N2IzYzFlOTM3MWU3/

https://62237453981d0595033c23.com/N2IzYzFlOTM3MWU3/

https://35237453981d0595033c23.com/N2IzYzFlOTM3MWU3/

https://332137453981d0595033c23.com/N2IzYzFlOTM3MWU3/

https://34437453981d0595033c23.com/N2IzYzFlOTM3MWU3/

https://3637453981d0595033c23.com/N2IzYzFlOTM3MWU3/

AES_key

Signatures

Octo
Octo is a banking malware with remote access capabilities first seen in April 2022.
banker trojan infostealer rat octo
Octo family
octo

Octo payload 1 IoCs

resource	yara_rule
behavioral1/files/fstream-1.dat	family_octo

Loads dropped Dex/Jar 1 TTPs 2 IoCs

Runs executable file dropped to the device during analysis.

evasion

Download New Code at Runtime

T1407

ioc	pid	Process
/data/user/0/com.mountainenough7/cache/iiuvowcbzpmqnju	4253	com.mountainenough7
/data/user/0/com.mountainenough7/cache/iiuvowcbzpmqnju	4253	com.mountainenough7

Makes use of the framework's Accessibility service 4 TTPs 2 IoCs

Retrieves information displayed on the phone screen using AccessibilityService.

collection evasion credential_access

Input Injection

T1516

Screen Capture

T1513

Keylogging

T1417.001

GUI Input Capture

T1417.002

description	ioc	Process
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId	com.mountainenough7
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByViewId	com.mountainenough7

Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
banker discovery

Security Software Discovery
T1418.001
Queries the phone number (MSISDN for GSM devices) 1 TTPs
discovery

System Network Configuration Discovery
T1422

Acquires the wake lock 1 IoCs

description	ioc	Process
Framework service call	android.os.IPowerManager.acquireWakeLock	com.mountainenough7

Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs

Application may abuse the framework's foreground service to continue running in the foreground.

evasion persistence

Foreground Persistence

T1541

description	ioc	Process
Framework service call	android.app.IActivityManager.setServiceForeground	com.mountainenough7

Performs UI accessibility actions on behalf of the user 1 TTPs 7 IoCs

Application may abuse the accessibility service to prevent their removal.

evasion

Prevent Application Removal

T1629.001

ioc	Process
android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction	com.mountainenough7
android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction	com.mountainenough7
android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction	com.mountainenough7
android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction	com.mountainenough7
android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction	com.mountainenough7
android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction	com.mountainenough7
android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction	com.mountainenough7

Queries the mobile country code (MCC) 1 TTPs 1 IoCs

discovery

System Network Configuration Discovery

T1422

description	ioc	Process
Framework service call	com.android.internal.telephony.ITelephony.getNetworkCountryIsoForPhone	com.mountainenough7

Queries the unique device ID (IMEI, MEID, IMSI) 1 TTPs
discovery

System Network Configuration Discovery
T1422
Reads information about phone network operator. 1 TTPs
discovery

System Network Configuration Discovery
T1422

Requests accessing notifications (often used to intercept notifications before users become aware). 1 TTPs 1 IoCs

collection credential_access

Access Notifications

T1517

description	ioc	Process
Intent action	android.settings.ACTION_NOTIFICATION_LISTENER_SETTINGS	com.mountainenough7

Requests disabling of battery optimizations (often used to enable hiding in the background). 1 TTPs 1 IoCs

evasion

User Evasion

T1628.002

description	ioc	Process
Intent action	android.settings.REQUEST_IGNORE_BATTERY_OPTIMIZATIONS	com.mountainenough7

Requests modifying system settings. 1 IoCs

evasion

description	ioc	Process
Intent action	android.settings.action.MANAGE_WRITE_SETTINGS	com.mountainenough7

Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs

persistence

Broadcast Receivers

T1624.001

description	ioc	Process
Framework service call	android.app.IActivityManager.registerReceiver	com.mountainenough7

Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs

impact

Data Encrypted for Impact

T1471

description	ioc	Process
Framework API call	javax.crypto.Cipher.doFinal	com.mountainenough7

Checks CPU information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/cpuinfo	com.mountainenough7

Checks memory information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/meminfo	com.mountainenough7

com.mountainenough7
1⤵
- Loads dropped Dex/Jar
- Makes use of the framework's Accessibility service
- Acquires the wake lock
- Makes use of the framework's foreground persistence service
- Performs UI accessibility actions on behalf of the user
- Queries the mobile country code (MCC)
- Requests accessing notifications (often used to intercept notifications before users become aware).
- Requests disabling of battery optimizations (often used to enable hiding in the background).
- Requests modifying system settings.
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Uses Crypto APIs (Might try to encrypt user data)
- Checks CPU information
- Checks memory information
PID:4253

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Event Triggered Execution

T1624

Broadcast Receivers

T1624.001

Foreground Persistence

T1541

Privilege Escalation

Defense Evasion

Download New Code at Runtime

T1407

Foreground Persistence

T1541

Hide Artifacts

T1628

User Evasion

T1628.002

Impair Defenses

T1629

Prevent Application Removal

T1629.001

Input Injection

T1516

Virtualization/Sandbox Evasion

T1633

System Checks

T1633.001

Credential Access

Access Notifications

T1517

Input Capture

T1417

GUI Input Capture

T1417.002

Keylogging

T1417.001

Discovery

Software Discovery

T1418

Security Software Discovery

T1418.001

System Information Discovery

T1426

System Network Configuration Discovery

T1422

Lateral Movement

Collection

Access Notifications

T1517

Input Capture

T1417

GUI Input Capture

T1417.002

Keylogging

T1417.001

Screen Capture

T1513

Command and Control

Exfiltration

Impact

Data Encrypted for Impact

T1471

Input Injection

T1516

Replay Monitor

Loading Replay Monitor...

Downloads

/data/data/com.mountainenough7/cache/iiuvowcbzpmqnju

Filesize
2.3MB

MD5
8e97ad28b6674f87beab82467d38acb3

SHA1
aae1a6f0b1a4812935ef12cec3a5c11cbebce872

SHA256
181f2d1d50621a932969445a3195e09aa78818e2d075431615f77d8b8fff9ab9

SHA512
4ba8ed3ee4caf5525811316d8bf1a39da80992e6b7fdc756ac1b6f7fbb527daea30db4f3b064ceb11b7c6f5348441c32fb2a9bec39fd130bd231eba55253e20f

Download Submit
/data/data/com.mountainenough7/cache/oat/iiuvowcbzpmqnju.cur.prof

Filesize
538B

MD5
96f5cee5fc5d03b6390101a7ed9399bb

SHA1
ac19d30d424e6a3356d8039f84bc679d7a6a67ef

SHA256
46c91789ea47383022c712b7a34d21cece3ea369375e903c89e780251657ed76

SHA512
873c23a22cb00c4df1f3ab4efd016eb10e0428c2c6d7bedbbe4a73f88a7c760d3dca4d460795f60e1d877c793f333509b0ca1876c66901fb05171fbc53cc8841

Download Submit
/data/data/com.mountainenough7/kl.txt

Filesize
28B

MD5
6311c3fd15588bb5c126e6c28ff5fffe

SHA1
ce81d136fce31779f4dd62e20bdaf99c91e2fc57

SHA256
8b82f6032e29a2b5c96031a3630fb6173d12ff0295bc20bb21b877d08f0812d8

SHA512
2975fe2e94b6a8adc9cfc1a865ad113772b54572883a537b02a16dd2d029c0f7d9cca3b154fd849bdfe978e18b396bcf9fa6e67e7c61f92bdc089a29a9c355c6

Download Submit
/data/data/com.mountainenough7/kl.txt

Filesize
237B

MD5
e17d680995744106e529b1b773d1b0f8

SHA1
5c59a1bd5eb14544383aa9fc215dd59ec1c4c1b9

SHA256
6b202b32aa69fc3bd9b59a00858e556b8b95a6fb2f5d8119db856ba19cba0163

SHA512
972707999869f716400ed1616f18af51ca991bb5a796181cfe8d93535880a75824b6a02c204db60673a38abac7eb078abeb2a5c932680596bf8a9b1a6a34c84a

Download Submit
/data/data/com.mountainenough7/kl.txt

Filesize
63B

MD5
be0d2bfd05e075e2f334b1e613bb8433

SHA1
191485c4bfd4ff45144ddfc545febbf931efc4e4

SHA256
2cbe191b0846b2b69fc511657331c4010a8efe5ecea29ff8ecdca95a4978d513

SHA512
4ee76a604ffa253054331e9ebc022e196f679e7179f1d204b2730e127f81174e65dc0eafb8e5f9399abc9c49f9f48fca188be5bf4fbe6bc6ac5e386dfac1e27f

Download Submit
/data/data/com.mountainenough7/kl.txt

Filesize
54B

MD5
6a1be1334b41eab91bc15d8c336b5406

SHA1
d8ed26c4e06325fcb074a46ac9735a2286ac52c1

SHA256
5fcefb6303e9ec209206e2082e2498866172a7ac430f852ca95c627ca47e80a8

SHA512
28df8f8307d708a02d897748e66f59a0bd03cb7fcd92022b667db66a7db2c7012656af5a7b9023aa5d267b47638015ef4458f2881d760e043dbaebf739172d26

Download Submit
/data/data/com.mountainenough7/kl.txt

Filesize
437B

MD5
d41fd19f7add8264c408a27ef77b7404

SHA1
b0e3b13fa4a88ad6fe3a49c9268c105864b657f1

SHA256
bf7127b647a505e470d7c33595bcdb282ee4014febff0567ae9e81f71049c896

SHA512
005e86dfcbfc270d2e1ad13cba7e5d9cea0ff92d88927852cdf532cf9a40c1a1fcf5fb8370ef439f64f655972e5cdc5c4acdae1e3dc0eb407885eb9c510ae4b4

Download Submit

Analysis

Sharing

General

Malware Config

Extracted

Extracted

Signatures

Processes

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads