octo | 000e1154e43775f66d21293c18fefe158c9c65a775a5466d70cbb94a8c2a5b40

Analysis

max time kernel
52s
max time network
133s
platform
android_x86
resource
android-x86-arm-20240624-en
resource tags

androidarch:armarch:x86image:android-x86-arm-20240624-enlocale:en-usos:android-9-x86system
submitted
09-12-2024 22:02

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

000e1154e43775f66d21293c18fefe158c9c65a775a5466d70cbb94a8c2a5b40.apk
Size

2.4MB
MD5

c8c9c3ca4b0ceb2ab394b3b2156bd4ba
SHA1

e057780fd8879d35b385769f34700d261e66860d
SHA256

000e1154e43775f66d21293c18fefe158c9c65a775a5466d70cbb94a8c2a5b40
SHA512

15088e9964ecf1cb813d5ed28f3e8e41dcdfd710302240dd40e64624c42a856aa118bd16cdc07aff109f6c77fe97dd8bcfe79e74b1f053bc8bec0d85df3f6863
SSDEEP

49152:fb7dO72zzmlgaV0lOvWyrLAnEb6GdYY/z2+ZwAVNMitvEIV8e:/Y2z6gaq0vFvl6GuYrP+Srj+e

Score

10^/10

octo banker collection credential_access discovery evasion impact infostealer persistence rat trojan

Malware Config

Extracted

Family

octo

https://934437453981d0595033c23.xyz/MzQ3NjU5NDBhMjNj/

https://88237453981d0595033c23.xyz/MzQ3NjU5NDBhMjNj/

https://662333981d0595033c23.xyz/MzQ3NjU5NDBhMjNj/

https://96255553981d0595033c23.xyz/MzQ3NjU5NDBhMjNj/

https://28237453981d0595033c23.xyz/MzQ3NjU5NDBhMjNj/

https://162333981d0595033c23.xyz/MzQ3NjU5NDBhMjNj/

https://26255553981d0595033c23.xyz/MzQ3NjU5NDBhMjNj/

rc4.plain

Extracted

Family

octo

https://934437453981d0595033c23.xyz/MzQ3NjU5NDBhMjNj/

https://88237453981d0595033c23.xyz/MzQ3NjU5NDBhMjNj/

https://662333981d0595033c23.xyz/MzQ3NjU5NDBhMjNj/

https://96255553981d0595033c23.xyz/MzQ3NjU5NDBhMjNj/

https://28237453981d0595033c23.xyz/MzQ3NjU5NDBhMjNj/

https://162333981d0595033c23.xyz/MzQ3NjU5NDBhMjNj/

https://26255553981d0595033c23.xyz/MzQ3NjU5NDBhMjNj/

https://934437453981d0595033c23.com/MzQ3NjU5NDBhMjNj/

https://7894437453981d0595033c23.xyz/MzQ3NjU5NDBhMjNj/

https://8774437453981d0595033c23.xyz/MzQ3NjU5NDBhMjNj/

https://5564237453981d0595033c23.xyz/MzQ3NjU5NDBhMjNj/

https://661544537453981d0595033c23.xyz/MzQ3NjU5NDBhMjNj/

AES_key

Signatures

Octo
Octo is a banking malware with remote access capabilities first seen in April 2022.
banker trojan infostealer rat octo
Octo family
octo

Octo payload 1 IoCs

resource	yara_rule
behavioral1/files/fstream-1.dat	family_octo

Loads dropped Dex/Jar 1 TTPs 2 IoCs

Runs executable file dropped to the device during analysis.

evasion

Download New Code at Runtime

T1407

ioc	pid	Process
/data/user/0/com.twopaperjnqm/cache/olsllzmgwzobixs	4218	com.twopaperjnqm
/data/user/0/com.twopaperjnqm/cache/olsllzmgwzobixs	4218	com.twopaperjnqm

Makes use of the framework's Accessibility service 4 TTPs 2 IoCs

Retrieves information displayed on the phone screen using AccessibilityService.

collection evasion credential_access

Input Injection

T1516

Screen Capture

T1513

Keylogging

T1417.001

GUI Input Capture

T1417.002

description	ioc	Process
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId	com.twopaperjnqm
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByViewId	com.twopaperjnqm

Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
banker discovery

Security Software Discovery
T1418.001
Queries the phone number (MSISDN for GSM devices) 1 TTPs
discovery

System Network Configuration Discovery
T1422

Acquires the wake lock 1 IoCs

description	ioc	Process
Framework service call	android.os.IPowerManager.acquireWakeLock	com.twopaperjnqm

Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs

Application may abuse the framework's foreground service to continue running in the foreground.

evasion persistence

Foreground Persistence

T1541

description	ioc	Process
Framework service call	android.app.IActivityManager.setServiceForeground	com.twopaperjnqm

Performs UI accessibility actions on behalf of the user 1 TTPs 7 IoCs

Application may abuse the accessibility service to prevent their removal.

evasion

Prevent Application Removal

T1629.001

ioc	Process
android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction	com.twopaperjnqm
android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction	com.twopaperjnqm
android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction	com.twopaperjnqm
android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction	com.twopaperjnqm
android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction	com.twopaperjnqm
android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction	com.twopaperjnqm
android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction	com.twopaperjnqm

Queries the mobile country code (MCC) 1 TTPs 1 IoCs

discovery

System Network Configuration Discovery

T1422

description	ioc	Process
Framework service call	com.android.internal.telephony.ITelephony.getNetworkCountryIsoForPhone	com.twopaperjnqm

Queries the unique device ID (IMEI, MEID, IMSI) 1 TTPs
discovery

System Network Configuration Discovery
T1422
Reads information about phone network operator. 1 TTPs
discovery

System Network Configuration Discovery
T1422

Requests accessing notifications (often used to intercept notifications before users become aware). 1 TTPs 1 IoCs

collection credential_access

Access Notifications

T1517

description	ioc	Process
Intent action	android.settings.ACTION_NOTIFICATION_LISTENER_SETTINGS	com.twopaperjnqm

Requests disabling of battery optimizations (often used to enable hiding in the background). 1 TTPs 1 IoCs

evasion

User Evasion

T1628.002

description	ioc	Process
Intent action	android.settings.REQUEST_IGNORE_BATTERY_OPTIMIZATIONS	com.twopaperjnqm

Requests modifying system settings. 1 IoCs

evasion

description	ioc	Process
Intent action	android.settings.action.MANAGE_WRITE_SETTINGS	com.twopaperjnqm

Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs

persistence

Broadcast Receivers

T1624.001

description	ioc	Process
Framework service call	android.app.IActivityManager.registerReceiver	com.twopaperjnqm

Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs

impact

Data Encrypted for Impact

T1471

description	ioc	Process
Framework API call	javax.crypto.Cipher.doFinal	com.twopaperjnqm

Checks CPU information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/cpuinfo	com.twopaperjnqm

Checks memory information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/meminfo	com.twopaperjnqm

com.twopaperjnqm
1⤵
- Loads dropped Dex/Jar
- Makes use of the framework's Accessibility service
- Acquires the wake lock
- Makes use of the framework's foreground persistence service
- Performs UI accessibility actions on behalf of the user
- Queries the mobile country code (MCC)
- Requests accessing notifications (often used to intercept notifications before users become aware).
- Requests disabling of battery optimizations (often used to enable hiding in the background).
- Requests modifying system settings.
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Uses Crypto APIs (Might try to encrypt user data)
- Checks CPU information
- Checks memory information
PID:4218

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Event Triggered Execution

T1624

Broadcast Receivers

T1624.001

Foreground Persistence

T1541

Privilege Escalation

Defense Evasion

Download New Code at Runtime

T1407

Foreground Persistence

T1541

Hide Artifacts

T1628

User Evasion

T1628.002

Impair Defenses

T1629

Prevent Application Removal

T1629.001

Input Injection

T1516

Virtualization/Sandbox Evasion

T1633

System Checks

T1633.001

Credential Access

Access Notifications

T1517

Input Capture

T1417

GUI Input Capture

T1417.002

Keylogging

T1417.001

Discovery

Software Discovery

T1418

Security Software Discovery

T1418.001

System Information Discovery

T1426

System Network Configuration Discovery

T1422

Lateral Movement

Collection

Access Notifications

T1517

Input Capture

T1417

GUI Input Capture

T1417.002

Keylogging

T1417.001

Screen Capture

T1513

Command and Control

Exfiltration

Impact

Data Encrypted for Impact

T1471

Input Injection

T1516

Replay Monitor

Loading Replay Monitor...

Downloads

/data/data/com.twopaperjnqm/cache/oat/olsllzmgwzobixs.cur.prof

Filesize
535B

MD5
f22998cc19a6a7da33f878ba9d8e623f

SHA1
98314d503f6fee51ee7c93bc2bc1274df125f61c

SHA256
e1301c6848ac7101c41c2555451826451401b1456c9bb24497a93a0b8adddd89

SHA512
ec68de794fabc414b65ddc6582c118f7982b179e6c65da8352a3d6d2f998c50db5077faa7ef02bc290465a47de2705796a95518523672c29795dbd01588ee99c

Download Submit
/data/data/com.twopaperjnqm/cache/olsllzmgwzobixs

Filesize
2.3MB

MD5
080c1770c31c4de7ea7d39c72548a76d

SHA1
a66be31ee38bfe156543f87bb648f7b97857a525

SHA256
224e383e499ce025824c4f5eabf892fea7a2c4a2733493c64cbe1a92b4fe52ee

SHA512
b0ee4b5dc77be555a0b5809503fdf17c733ce48f6c9e75120e11e045985fae02d138a5a8b8d8008cd132b3f704daae94767e4cfa0336a10de13538cfcfb00c65

Download Submit
/data/data/com.twopaperjnqm/kl.txt

Filesize
28B

MD5
6311c3fd15588bb5c126e6c28ff5fffe

SHA1
ce81d136fce31779f4dd62e20bdaf99c91e2fc57

SHA256
8b82f6032e29a2b5c96031a3630fb6173d12ff0295bc20bb21b877d08f0812d8

SHA512
2975fe2e94b6a8adc9cfc1a865ad113772b54572883a537b02a16dd2d029c0f7d9cca3b154fd849bdfe978e18b396bcf9fa6e67e7c61f92bdc089a29a9c355c6

Download Submit
/data/data/com.twopaperjnqm/kl.txt

Filesize
230B

MD5
593a8f04616259c6e4613a1737dbd543

SHA1
b9c59b44b1d61dce5a723447b62b74f0de6b7b24

SHA256
972d7d6c09b2feaa2f3b355ff181a74a8eb03caf62cac755e568322e5570e85b

SHA512
44ef765ba0e2b5be851a880804aa258d063d17f68dd90fdd9e5d63adeb5fbea255c484b3e79330f794e24b0b4382a5e8495ee519f2b64b6f00f06ec5d2832e44

Download Submit
/data/data/com.twopaperjnqm/kl.txt

Filesize
63B

MD5
6984870baa9d63a1b1eddefb5e178716

SHA1
b43b9c76707f2814ab7252de0829a0d0e7e3f584

SHA256
7d86b2a0fc6fe86ea6a6143f921251ccb1f7dc2aaf5f4cae9fc50f5a07642ed7

SHA512
c4fe0a4a4b1daf4e9a345f947d4cf303a2303eb8ec73a83322dc2f563d5c6037fd7f23ef320ed793fa486e8bd770b2651c25282a77c70e745ac8db77fc8159cd

Download Submit
/data/data/com.twopaperjnqm/kl.txt

Filesize
54B

MD5
99241973ff2ba2d1de7f5cddbd0e30d3

SHA1
5d0ec6dc39596d39c044e39917cc8399858374aa

SHA256
0d34f55cf83742d3d3606ab645c21d1d66a77b1a142fc5a246f1231d568d9a5d

SHA512
bb6281d1ed838d6fc8e4d03606424bc04a4ca237918aea8a21306663be9412fc8c6b2d8a1b9fc3f1e186529bb339b9227c3bfe7698b38ab351fd615f3d1b1254

Download Submit
/data/data/com.twopaperjnqm/kl.txt

Filesize
423B

MD5
e9e4c0f4e642902f2f471f63da5de299

SHA1
1fd8f1532e666570079bd229f412425f9da246f4

SHA256
8f4c4fa919cec57e1f05c6f4ffc09bf48554cb8c232b6663e09929b40e4a077e

SHA512
a4bb78df36cc8b3f235f92c2a4b38235e92221b91fb7af7a3a07dacf128dd140dbd3d02274a79886c812672b0de9ac67e65f5ed61fd8ff05bfb0599af69fecf6

Download Submit

Analysis

Sharing

General

Malware Config

Extracted

Extracted

Signatures

Processes

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads