octo | 08828dbb25b5c57aa167560bb9e8225ad6eff72b562febd04870049d5192ec1c

Analysis

max time kernel
148s
max time network
151s
platform
android-11_x64
resource
android-x64-arm64-20240910-en
resource tags

arch:armarch:arm64arch:x64arch:x86image:android-x64-arm64-20240910-enlocale:en-usos:android-11-x64system
submitted
15-12-2024 22:09

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

08828dbb25b5c57aa167560bb9e8225ad6eff72b562febd04870049d5192ec1c.apk
Size

2.3MB
MD5

744e0537f2e0520e4cfc0ee150caaf4b
SHA1

98f0c72e3738027a4436764a33a1456c5df4037a
SHA256

08828dbb25b5c57aa167560bb9e8225ad6eff72b562febd04870049d5192ec1c
SHA512

c06eb4e960b921a9e6f18382798b174624b4d604d17b0ab6e76fc0b38bfefaa1d6ee93b138a5bf6e9b41ca76b001e3d9f8ad86552e2655f8cf50541e54d335b8
SSDEEP

49152:b5dr1U8+2mCactW79qjhG+okLdw64OgCmx9ryeLny3urEOyAF4F6FQQJuUqSXb:b53UWmyY74hG+okLe6CrPzxIOynF6TJ5

Score

10^/10

octo banker collection credential_access discovery evasion impact infostealer persistence rat trojan

Malware Config

Extracted

Family

octo

https://mutlubirhayatinsirlari.xyz/NTU2NjJkZjVmZTNm/

https://sevginindegismeyecekyolu.xyz/NTU2NjJkZjVmZTNm/

https://hayatinaslamutlulukkat.xyz/NTU2NjJkZjVmZTNm/

https://kisacanindegeryolculugu.xyz/NTU2NjJkZjVmZTNm/

https://umudunvebarisinyolu.xyz/NTU2NjJkZjVmZTNm/

https://hayatvesevgiileilerle.xyz/NTU2NjJkZjVmZTNm/

https://iyilikkucukdokunuslar.xyz/NTU2NjJkZjVmZTNm/

https://dogalhayatmutluluk.xyz/NTU2NjJkZjVmZTNm/

https://paylasmaylaartanhayat.xyz/NTU2NjJkZjVmZTNm/

https://sevgidunyasiyenifirsatlar.xyz/NTU2NjJkZjVmZTNm/

https://hayatsevgiveumut.xyz/NTU2NjJkZjVmZTNm/

https://yasamdavemutlulukkaynagi.xyz/NTU2NjJkZjVmZTNm/

https://kisilerdensevgiogren.xyz/NTU2NjJkZjVmZTNm/

https://hayatpaylasiminsanlari.xyz/NTU2NjJkZjVmZTNm/

https://umuttaasanmutluluk.xyz/NTU2NjJkZjVmZTNm/

https://dogasevgisidunyayikef.xyz/NTU2NjJkZjVmZTNm/

https://sevginintazekaynagi.xyz/NTU2NjJkZjVmZTNm/

https://hayatamutlulukvesigorta.xyz/NTU2NjJkZjVmZTNm/

https://yasananmutlulukhikayesi.xyz/NTU2NjJkZjVmZTNm/

https://duygusalbagveyasam.xyz/NTU2NjJkZjVmZTNm/

rc4.plain

Extracted

Family

octo

https://mutlubirhayatinsirlari.xyz/NTU2NjJkZjVmZTNm/

https://sevginindegismeyecekyolu.xyz/NTU2NjJkZjVmZTNm/

https://hayatinaslamutlulukkat.xyz/NTU2NjJkZjVmZTNm/

https://kisacanindegeryolculugu.xyz/NTU2NjJkZjVmZTNm/

https://umudunvebarisinyolu.xyz/NTU2NjJkZjVmZTNm/

https://hayatvesevgiileilerle.xyz/NTU2NjJkZjVmZTNm/

https://iyilikkucukdokunuslar.xyz/NTU2NjJkZjVmZTNm/

https://dogalhayatmutluluk.xyz/NTU2NjJkZjVmZTNm/

https://paylasmaylaartanhayat.xyz/NTU2NjJkZjVmZTNm/

https://sevgidunyasiyenifirsatlar.xyz/NTU2NjJkZjVmZTNm/

https://hayatsevgiveumut.xyz/NTU2NjJkZjVmZTNm/

https://yasamdavemutlulukkaynagi.xyz/NTU2NjJkZjVmZTNm/

https://kisilerdensevgiogren.xyz/NTU2NjJkZjVmZTNm/

https://hayatpaylasiminsanlari.xyz/NTU2NjJkZjVmZTNm/

https://umuttaasanmutluluk.xyz/NTU2NjJkZjVmZTNm/

https://dogasevgisidunyayikef.xyz/NTU2NjJkZjVmZTNm/

https://sevginintazekaynagi.xyz/NTU2NjJkZjVmZTNm/

https://hayatamutlulukvesigorta.xyz/NTU2NjJkZjVmZTNm/

https://yasananmutlulukhikayesi.xyz/NTU2NjJkZjVmZTNm/

https://duygusalbagveyasam.xyz/NTU2NjJkZjVmZTNm/

AES_key

Signatures

Octo
Octo is a banking malware with remote access capabilities first seen in April 2022.
banker trojan infostealer rat octo
Octo family
octo

Octo payload 1 IoCs

resource	yara_rule
behavioral2/memory/4834-0.dex	family_octo

Loads dropped Dex/Jar 1 TTPs 1 IoCs

Runs executable file dropped to the device during analysis.

evasion

Download New Code at Runtime

T1407

ioc	pid	Process
/data/user/0/com.void.must/app_coyote/sQiAW.json	4834	com.void.must

Makes use of the framework's Accessibility service 4 TTPs 2 IoCs

Retrieves information displayed on the phone screen using AccessibilityService.

collection evasion credential_access

Input Injection

T1516

Screen Capture

T1513

Keylogging

T1417.001

GUI Input Capture

T1417.002

description	ioc	Process
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId	com.void.must
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByViewId	com.void.must

Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
banker discovery

Security Software Discovery
T1418.001
Queries the phone number (MSISDN for GSM devices) 1 TTPs
discovery

System Network Configuration Discovery
T1422

Acquires the wake lock 1 IoCs

description	ioc	Process
Framework service call	android.os.IPowerManager.acquireWakeLock	com.void.must

Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs

Application may abuse the framework's foreground service to continue running in the foreground.

evasion persistence

Foreground Persistence

T1541

description	ioc	Process
Framework service call	android.app.IActivityManager.setServiceForeground	com.void.must

Performs UI accessibility actions on behalf of the user 1 TTPs 5 IoCs

Application may abuse the accessibility service to prevent their removal.

evasion

Prevent Application Removal

T1629.001

ioc	Process
android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction	com.void.must
android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction	com.void.must
android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction	com.void.must
android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction	com.void.must
android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction	com.void.must

Queries the mobile country code (MCC) 1 TTPs 1 IoCs

discovery

System Network Configuration Discovery

T1422

description	ioc	Process
Framework service call	com.android.internal.telephony.ITelephony.getNetworkCountryIsoForPhone	com.void.must

Reads information about phone network operator. 1 TTPs
discovery

System Network Configuration Discovery
T1422

Requests accessing notifications (often used to intercept notifications before users become aware). 1 TTPs 1 IoCs

collection credential_access

Access Notifications

T1517

description	ioc	Process
Intent action	android.settings.ACTION_NOTIFICATION_LISTENER_SETTINGS	com.void.must

Requests disabling of battery optimizations (often used to enable hiding in the background). 1 TTPs 1 IoCs

evasion

User Evasion

T1628.002

description	ioc	Process
Intent action	android.settings.REQUEST_IGNORE_BATTERY_OPTIMIZATIONS	com.void.must

Requests modifying system settings. 1 IoCs

evasion

description	ioc	Process
Intent action	android.settings.action.MANAGE_WRITE_SETTINGS	com.void.must

Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs

impact

Data Encrypted for Impact

T1471

description	ioc	Process
Framework API call	javax.crypto.Cipher.doFinal	com.void.must

com.void.must
1⤵
- Loads dropped Dex/Jar
- Makes use of the framework's Accessibility service
- Acquires the wake lock
- Makes use of the framework's foreground persistence service
- Performs UI accessibility actions on behalf of the user
- Queries the mobile country code (MCC)
- Requests accessing notifications (often used to intercept notifications before users become aware).
- Requests disabling of battery optimizations (often used to enable hiding in the background).
- Requests modifying system settings.
- Uses Crypto APIs (Might try to encrypt user data)
PID:4834

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Foreground Persistence

T1541

Privilege Escalation

Defense Evasion

Download New Code at Runtime

T1407

Foreground Persistence

T1541

Hide Artifacts

T1628

User Evasion

T1628.002

Impair Defenses

T1629

Prevent Application Removal

T1629.001

Input Injection

T1516

Credential Access

Access Notifications

T1517

Input Capture

T1417

GUI Input Capture

T1417.002

Keylogging

T1417.001

Discovery

Software Discovery

T1418

Security Software Discovery

T1418.001

System Network Configuration Discovery

T1422

Lateral Movement

Collection

Access Notifications

T1517

Input Capture

T1417

GUI Input Capture

T1417.002

Keylogging

T1417.001

Screen Capture

T1513

Command and Control

Exfiltration

Impact

Data Encrypted for Impact

T1471

Input Injection

T1516

Replay Monitor

Loading Replay Monitor...

Downloads

/data/data/com.void.must/app_coyote/sQiAW.json

Filesize
153KB

MD5
52ae789a5600e9bceca7d44cd9c47573

SHA1
6de8f1e7c6f25cf13304a8ae152ed546800bc986

SHA256
a6c67d79fd939d383e32090d1b0c3f364d5b76a0174e3e7cd5123ef0a3816c60

SHA512
a26d22df2479f1b96284a7ba564f7f0cc071c4c10489ac7dc626aa322008c8a94e879aa997417838d262ed38186cbd55beba66b4f33e462a990a81891731621a

Download Submit
/data/data/com.void.must/app_coyote/sQiAW.json

Filesize
153KB

MD5
a61617343a0036f250e7533a1141e7c1

SHA1
df42bfacbad75a87d8f9549e6b15188ebc3ff844

SHA256
5706881dd0f8af7d1738ec4bae2a308346091353150972b96e868f462729ee2b

SHA512
be04815f4c3a54e1a97b5e38df24672accf60ffd6d96d1b1eed8b53389356138e30d6aa46dd54aed0a60d1e13d83764febc45bc273508c8a7d14218ca5185ed1

Download Submit
/data/user/0/com.void.must/app_coyote/sQiAW.json

Filesize
450KB

MD5
1c9feb017595e12dd3dda1cb410f79a1

SHA1
6287339a19c7d57b7ba49ebdb55c655dc1542b01

SHA256
c8ade648c19eba24228e0d431fe80cfa98e740bc8661e05c7e00ffa4bcd8acdd

SHA512
1a29a0235e7cfc60668153c06a1c54b40ffa2f024c0512263b80bbb6bc9a61380e76707be426e62131abc12064ec27efaaf7fdeda0fdd437e02c3205155470fe

Download Submit

Analysis

Sharing

General

Malware Config

Extracted

Extracted

Signatures

Processes

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads