octo | 7f6ea3155d55c2463cbf8e62b18b22956258ef3adf25ed998d540e9accf3bf08

Analysis

max time kernel
21s
max time network
38s
platform
android_x86
resource
android-x86-arm-20240624-en
resource tags

androidarch:armarch:x86image:android-x86-arm-20240624-enlocale:en-usos:android-9-x86system
submitted
16/12/2024, 02:45

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

7f6ea3155d55c2463cbf8e62b18b22956258ef3adf25ed998d540e9accf3bf08.apk
Size

7.7MB
MD5

dff1889e5db5d5db6b1c5eaf923e0227
SHA1

2aa200b7f5b05152fb927d8bc062f0f1c10e1e76
SHA256

7f6ea3155d55c2463cbf8e62b18b22956258ef3adf25ed998d540e9accf3bf08
SHA512

0c4213943bfe08da4f2339b9f07fcd2f0f361ca0682dbd8bbec035f22a5a04301b00d51b82cc9ea806004a05cd78014cc6d87f31980d608a7916e19fc6fb9514
SSDEEP

98304:g9b5iSRGjSRs9odlmoKnw6VK0umngj74lOmv0Q9Yh4z6:g9brdRkodlGBU/mgj7Yf9Y9

Score

10^/10

octo banker collection credential_access discovery evasion impact infostealer persistence rat trojan

Malware Config

Extracted

Family

octo

AES_key

Signatures

Octo
Octo is a banking malware with remote access capabilities first seen in April 2022.
banker trojan infostealer rat octo
Octo family
octo

Octo payload 1 IoCs

resource	yara_rule
behavioral1/memory/4248-1.dex	family_octo

Checks Android system properties for emulator presence. 1 TTPs 1 IoCs

evasion

System Checks

T1633.001

description	ioc	Process
Accessed system property	key: ro.product.model	com.csystem69_sound

Loads dropped Dex/Jar 1 TTPs 3 IoCs

Runs executable file dropped to the device during analysis.

evasion

Download New Code at Runtime

T1407

ioc	pid	Process
/data/user/0/com.csystem69_sound/app_march/SwkrprN.json	4274	/system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.csystem69_sound/app_march/SwkrprN.json --output-vdex-fd=41 --oat-fd=42 --oat-location=/data/user/0/com.csystem69_sound/app_march/oat/x86/SwkrprN.odex --compiler-filter=quicken --class-loader-context=&
/data/user/0/com.csystem69_sound/app_march/SwkrprN.json	4248	com.csystem69_sound
Anonymous-DexFile@0xd2d78000-0xd2dfb720	4248	com.csystem69_sound

Makes use of the framework's Accessibility service 4 TTPs 2 IoCs

Retrieves information displayed on the phone screen using AccessibilityService.

collection evasion credential_access

Input Injection

T1516

Screen Capture

T1513

Keylogging

T1417.001

GUI Input Capture

T1417.002

description	ioc	Process
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId	com.csystem69_sound
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByViewId	com.csystem69_sound

Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
banker discovery

Security Software Discovery
T1418.001
Queries the phone number (MSISDN for GSM devices) 1 TTPs
discovery

System Network Configuration Discovery
T1422

Acquires the wake lock 1 IoCs

description	ioc	Process
Framework service call	android.os.IPowerManager.acquireWakeLock	com.csystem69_sound

Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs

Application may abuse the framework's foreground service to continue running in the foreground.

evasion persistence

Foreground Persistence

T1541

description	ioc	Process
Framework service call	android.app.IActivityManager.setServiceForeground	com.csystem69_sound

Queries the mobile country code (MCC) 1 TTPs 1 IoCs

discovery

System Network Configuration Discovery

T1422

description	ioc	Process
Framework service call	com.android.internal.telephony.ITelephony.getNetworkCountryIsoForPhone	com.csystem69_sound

Queries the unique device ID (IMEI, MEID, IMSI) 1 TTPs
discovery

System Network Configuration Discovery
T1422

Requests disabling of battery optimizations (often used to enable hiding in the background). 1 TTPs 1 IoCs

evasion

User Evasion

T1628.002

description	ioc	Process
Intent action	android.settings.REQUEST_IGNORE_BATTERY_OPTIMIZATIONS	com.csystem69_sound

Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs

persistence

Broadcast Receivers

T1624.001

description	ioc	Process
Framework service call	android.app.IActivityManager.registerReceiver	com.csystem69_sound

Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs

impact

Data Encrypted for Impact

T1471

description	ioc	Process
Framework API call	javax.crypto.Cipher.doFinal	com.csystem69_sound

Checks CPU information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/cpuinfo	com.csystem69_sound

Checks memory information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/meminfo	com.csystem69_sound

com.csystem69_sound
1⤵
- Checks Android system properties for emulator presence.
- Loads dropped Dex/Jar
- Makes use of the framework's Accessibility service
- Acquires the wake lock
- Makes use of the framework's foreground persistence service
- Queries the mobile country code (MCC)
- Requests disabling of battery optimizations (often used to enable hiding in the background).
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Uses Crypto APIs (Might try to encrypt user data)
- Checks CPU information
- Checks memory information
PID:4248
- /system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.csystem69_sound/app_march/SwkrprN.json --output-vdex-fd=41 --oat-fd=42 --oat-location=/data/user/0/com.csystem69_sound/app_march/oat/x86/SwkrprN.odex --compiler-filter=quicken --class-loader-context=&
  2⤵
  - Loads dropped Dex/Jar
  PID:4274

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Event Triggered Execution

T1624

Broadcast Receivers

T1624.001

Foreground Persistence

T1541

Privilege Escalation

Defense Evasion

Download New Code at Runtime

T1407

Foreground Persistence

T1541

Hide Artifacts

T1628

User Evasion

T1628.002

Input Injection

T1516

Virtualization/Sandbox Evasion

T1633

System Checks

T1633.001

Credential Access

Input Capture

T1417

GUI Input Capture

T1417.002

Keylogging

T1417.001

Discovery

Software Discovery

T1418

Security Software Discovery

T1418.001

System Information Discovery

T1426

System Network Configuration Discovery

T1422

Lateral Movement

Collection

Input Capture

T1417

GUI Input Capture

T1417.002

Keylogging

T1417.001

Screen Capture

T1513

Command and Control

Exfiltration

Impact

Data Encrypted for Impact

T1471

Input Injection

T1516

Replay Monitor

Loading Replay Monitor...

Downloads

/data/data/com.csystem69_sound/.global.com.csystem69_sound

Filesize
48B

MD5
046a414913add6f5bb60072c7db819b6

SHA1
451ee4f6809260aec622d772fd329c7d0297a842

SHA256
b66c1320cb063a1d391c94273572ea6edae76c8c8b0a07f8d75c88686f0df72a

SHA512
4e6355f3051ed5e811ab030abde1f5be7f5e1cf33be99cd08477e9b6c015deb1d8bd75a09fb9c7176b8511c5ad0a67abc0902a3531e97564ccb6afc57496a47c

Download Submit
/data/data/com.csystem69_sound/app_march/SwkrprN.json

Filesize
1008B

MD5
908f4673aff944e549fa0b7d76384c2c

SHA1
b5eb639e27432e8e69cec8b08a3ccf68ca6e9484

SHA256
998e21c072560f755f12112891f93e043350e66691ead263b43574281bcc78b3

SHA512
b16b5275ab9628860df2d0f8f9a7478b1bd8df1ae1878305a51e1ed15409c83d9c55a351febe45d677e3b6f01bf6185b91e8d01b63a35b39cebfae645df23c26

Download Submit
/data/data/com.csystem69_sound/app_march/SwkrprN.json

Filesize
1008B

MD5
41fd9e6035077a293375a98bab0c61b3

SHA1
08d7a0bfb60b805f7679f7a6c5b94014d238ea32

SHA256
977c5e6606a877e31429630833de15e37c180378bddec38bc83c20b07d822b6f

SHA512
bdfc6cae1bacee8c0e7e8f610e3839d0024c5019bcef9773e35c2c0abe0e4c13e30bd1840fc6521226bb81a75b0c2edb6aece606dd9ff07af3800c626ee9641c

Download Submit
/data/data/com.csystem69_sound/files/.k

Filesize
307KB

MD5
4e73947cabb5db3f92ca85004981b754

SHA1
6d9667fdb0280ed2dcb782b4683e422a51bdc601

SHA256
6db94232e756b90ed437f1bc87dc38cf20fb2e7c7a19a5e40c6c17254b7e234c

SHA512
be8b500a7070af1dfb53b0cf1a7b327dadc4e163a6dad905496ac228c58cd1ed87b054533917924455d35e9b300683ae33e1bcdd91935a5dbae1d693c3e13d69

Download Submit
/data/user/0/com.csystem69_sound/app_march/SwkrprN.json

Filesize
1KB

MD5
08738c36865ffb3339d3ffe622e08e8d

SHA1
80a19964ba1dc8e9e3a27823db0adc09757c6a73

SHA256
3d3e6f2c0880648c219cad3b8f4800335510f4112c8ce69e45f4619a20af648e

SHA512
e2147135e2484e852ed321943c3094bb270dd84f887ddca88cef9decdd8df5748b2732cd25cc7c52d68e935b3fde8905f95b5d2f87e433028b49202562b19c87

Download Submit
/data/user/0/com.csystem69_sound/app_march/SwkrprN.json

Filesize
1KB

MD5
802a38cf26ea25537d1b89311bc3f1b5

SHA1
bde9bfb0c0bd5edcb71f2d3f54037fa5d31b59d3

SHA256
5b262035183369c5c7efe77aa44efb914c93aaedac052300bb90136314724487

SHA512
96ae8bc872c109117dd1d781d2086003513fbc960e9af7fa0586109cc9cd5c0d553b3cd6023005dca3b691fdea3fcb6674b12fe860a4a74c70664969934017df

Download Submit
Anonymous-DexFile@0xd2d78000-0xd2dfb720

Filesize
525KB

MD5
8bd9da32518848d183d039a87ec83e75

SHA1
dbfbf9d7cb61fa4001d1b0d4617aec6454779e12

SHA256
f792b4b319817797e584bd9f065051614693fc33d1c3a476c627d13d03de9cd6

SHA512
882ca1a5e59b77cfe5f60331bc51399f51dbfd1b2645a2a465c09543c230e1709c7418ad40f83739a4d3b3e899e2ec939b93435319943fc341748c21d36a6725

Download Submit

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads