octo | 8bc96b484f22c9fa9aa7c0fe25164c901fbc0902e177b16a24463399f9922979

Analysis

max time kernel
149s
max time network
157s
platform
android_x64
resource
android-33-x64-arm64-20240624-en
resource tags

androidarch:arm64arch:x64image:android-33-x64-arm64-20240624-enlocale:en-usos:android-13-x64system
submitted
16-12-2024 04:08

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

8bc96b484f22c9fa9aa7c0fe25164c901fbc0902e177b16a24463399f9922979.apk
Size

3.5MB
MD5

62c640d6c474637739a0f3490b078761
SHA1

2ac391515f65c82322ea959500f625adf4c64dee
SHA256

8bc96b484f22c9fa9aa7c0fe25164c901fbc0902e177b16a24463399f9922979
SHA512

83524675d78bbab8b8489028529b2763df23a058af60aa4572f4b5fda4e0371ffdaea272c856ebc74789f074a9367c6a81606e5b0aab5ff77482a2e5241b2bf2
SSDEEP

98304:DuCSjT05mB8XXWexaEdRxsWYo9eoNe0pFl+/fk5e2PJ:qCKmtR/YsNe0ZqwJ

Score

10^/10

octo banker collection credential_access discovery evasion impact infostealer persistence rat trojan

Malware Config

Extracted

Family

octo

https://gezginlerkitabi.store/NzcyNjQ2ODQ5ZGJk/

https://sanatveeglence.fun/NzcyNjQ2ODQ5ZGJk/

https://eniyiteknoloji.icu/NzcyNjQ2ODQ5ZGJk/

https://bebekrehberim.baby/NzcyNjQ2ODQ5ZGJk/

https://denizseverler.boats/NzcyNjQ2ODQ5ZGJk/

https://tatilcigunlugu.xyz/NzcyNjQ2ODQ5ZGJk/

https://evdekispor.store/NzcyNjQ2ODQ5ZGJk/

https://oyunmekani.fun/NzcyNjQ2ODQ5ZGJk/

https://bilgipaylasim.icu/NzcyNjQ2ODQ5ZGJk/

https://cocukveoyuncak.baby/NzcyNjQ2ODQ5ZGJk/

https://yelkencilerklubu.boats/NzcyNjQ2ODQ5ZGJk/

https://sanatvecanli.xyz/NzcyNjQ2ODQ5ZGJk/

https://kitapdunyasi.store/NzcyNjQ2ODQ5ZGJk/

https://eglencedolu.fun/NzcyNjQ2ODQ5ZGJk/

https://ucuzteknoloji.icu/NzcyNjQ2ODQ5ZGJk/

https://bebekbakimi.baby/NzcyNjQ2ODQ5ZGJk/

https://teknevetur.boats/NzcyNjQ2ODQ5ZGJk/

https://yenilikcisanat.xyz/NzcyNjQ2ODQ5ZGJk/

https://elektronikstore.store/NzcyNjQ2ODQ5ZGJk/

https://karnavalzamani.fun/NzcyNjQ2ODQ5ZGJk/

rc4.plain

Extracted

Family

octo

https://gezginlerkitabi.store/NzcyNjQ2ODQ5ZGJk/

https://sanatveeglence.fun/NzcyNjQ2ODQ5ZGJk/

https://eniyiteknoloji.icu/NzcyNjQ2ODQ5ZGJk/

https://bebekrehberim.baby/NzcyNjQ2ODQ5ZGJk/

https://denizseverler.boats/NzcyNjQ2ODQ5ZGJk/

https://tatilcigunlugu.xyz/NzcyNjQ2ODQ5ZGJk/

https://evdekispor.store/NzcyNjQ2ODQ5ZGJk/

https://oyunmekani.fun/NzcyNjQ2ODQ5ZGJk/

https://bilgipaylasim.icu/NzcyNjQ2ODQ5ZGJk/

https://cocukveoyuncak.baby/NzcyNjQ2ODQ5ZGJk/

https://yelkencilerklubu.boats/NzcyNjQ2ODQ5ZGJk/

https://sanatvecanli.xyz/NzcyNjQ2ODQ5ZGJk/

https://kitapdunyasi.store/NzcyNjQ2ODQ5ZGJk/

https://eglencedolu.fun/NzcyNjQ2ODQ5ZGJk/

https://ucuzteknoloji.icu/NzcyNjQ2ODQ5ZGJk/

https://bebekbakimi.baby/NzcyNjQ2ODQ5ZGJk/

https://teknevetur.boats/NzcyNjQ2ODQ5ZGJk/

https://yenilikcisanat.xyz/NzcyNjQ2ODQ5ZGJk/

https://elektronikstore.store/NzcyNjQ2ODQ5ZGJk/

https://karnavalzamani.fun/NzcyNjQ2ODQ5ZGJk/

AES_key

Signatures

Octo
Octo is a banking malware with remote access capabilities first seen in April 2022.
banker trojan infostealer rat octo
Octo family
octo

Octo payload 1 IoCs

resource	yara_rule
behavioral2/memory/4321-0.dex	family_octo

Loads dropped Dex/Jar 1 TTPs 1 IoCs

Runs executable file dropped to the device during analysis.

evasion

Download New Code at Runtime

T1407

ioc	pid	Process
/data/user/0/com.verb.impose/app_witness/YfoBYQ.json	4321	com.verb.impose

Makes use of the framework's Accessibility service 4 TTPs 2 IoCs

Retrieves information displayed on the phone screen using AccessibilityService.

collection evasion credential_access

Input Injection

T1516

Screen Capture

T1513

Keylogging

T1417.001

GUI Input Capture

T1417.002

description	ioc	Process
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId	com.verb.impose
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByViewId	com.verb.impose

Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
banker discovery

Security Software Discovery
T1418.001
Queries the phone number (MSISDN for GSM devices) 1 TTPs
discovery

System Network Configuration Discovery
T1422

Acquires the wake lock 1 IoCs

description	ioc	Process
Framework service call	android.os.IPowerManager.acquireWakeLock	com.verb.impose

Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs

Application may abuse the framework's foreground service to continue running in the foreground.

evasion persistence

Foreground Persistence

T1541

description	ioc	Process
Framework service call	android.app.IActivityManager.setServiceForeground	com.verb.impose

Performs UI accessibility actions on behalf of the user 1 TTPs 4 IoCs

Application may abuse the accessibility service to prevent their removal.

evasion

Prevent Application Removal

T1629.001

ioc	Process
android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction	com.verb.impose
android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction	com.verb.impose
android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction	com.verb.impose
android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction	com.verb.impose

Queries the mobile country code (MCC) 1 TTPs 1 IoCs

discovery

System Network Configuration Discovery

T1422

description	ioc	Process
Framework service call	com.android.internal.telephony.ITelephony.getNetworkCountryIsoForPhone	com.verb.impose

Reads information about phone network operator. 1 TTPs
discovery

System Network Configuration Discovery
T1422

Requests accessing notifications (often used to intercept notifications before users become aware). 1 TTPs 1 IoCs

collection credential_access

Access Notifications

T1517

description	ioc	Process
Intent action	android.settings.ACTION_NOTIFICATION_LISTENER_SETTINGS	com.verb.impose

Requests disabling of battery optimizations (often used to enable hiding in the background). 1 TTPs 1 IoCs

evasion

User Evasion

T1628.002

description	ioc	Process
Intent action	android.settings.REQUEST_IGNORE_BATTERY_OPTIMIZATIONS	com.verb.impose

Requests modifying system settings. 1 IoCs

evasion

description	ioc	Process
Intent action	android.settings.action.MANAGE_WRITE_SETTINGS	com.verb.impose

Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs

impact

Data Encrypted for Impact

T1471

description	ioc	Process
Framework API call	javax.crypto.Cipher.doFinal	com.verb.impose

com.verb.impose
1⤵
- Loads dropped Dex/Jar
- Makes use of the framework's Accessibility service
- Acquires the wake lock
- Makes use of the framework's foreground persistence service
- Performs UI accessibility actions on behalf of the user
- Queries the mobile country code (MCC)
- Requests accessing notifications (often used to intercept notifications before users become aware).
- Requests disabling of battery optimizations (often used to enable hiding in the background).
- Requests modifying system settings.
- Uses Crypto APIs (Might try to encrypt user data)
PID:4321

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Foreground Persistence

T1541

Privilege Escalation

Defense Evasion

Download New Code at Runtime

T1407

Foreground Persistence

T1541

Hide Artifacts

T1628

User Evasion

T1628.002

Impair Defenses

T1629

Prevent Application Removal

T1629.001

Input Injection

T1516

Credential Access

Access Notifications

T1517

Input Capture

T1417

GUI Input Capture

T1417.002

Keylogging

T1417.001

Discovery

Software Discovery

T1418

Security Software Discovery

T1418.001

System Network Configuration Discovery

T1422

Lateral Movement

Collection

Access Notifications

T1517

Input Capture

T1417

GUI Input Capture

T1417.002

Keylogging

T1417.001

Screen Capture

T1513

Command and Control

Exfiltration

Impact

Data Encrypted for Impact

T1471

Input Injection

T1516

Replay Monitor

Loading Replay Monitor...

Downloads

/data/data/com.verb.impose/app_witness/YfoBYQ.json

Filesize
153KB

MD5
36f12e1383e23aa7a0fb2ca7d54c0eda

SHA1
23e1781d760488f07216a1c13285f11f4b4800d0

SHA256
0625e720c6aca0b0c8ce46190a543eca96c4cb2b8377310e6fa5899447f60176

SHA512
c940b63fc5701135f35d4ed252d49d9e8cbc382b19788870cc81ef0b4f52831ad89aaa31a5f1f5890c96c9f58f3277a907c8910c21d9b29e5df0c540f6afec76

Download Submit
/data/data/com.verb.impose/app_witness/YfoBYQ.json

Filesize
153KB

MD5
58ba57037dea8a01f21efaf5d3ea53d3

SHA1
c8eb74ff5e87cfab76fe079bff94bec4ce096561

SHA256
e6dee0b60e32c1221ff29f76a6f8091080654cf44cdc60a9dfad95772ada5f65

SHA512
c2df9d0c30f6c8a252893f03dc935fb1f4138696e21ed1f2bdbfb0654f9f5c19fb53e76fc12727d597307c0471726b57eeb714bbeb48db52091290299111a320

Download Submit
/data/user/0/com.verb.impose/app_witness/YfoBYQ.json

Filesize
450KB

MD5
f335d2cb7997323731078fee818e8b57

SHA1
c87bcaa54da8e2d96bfc01ac322a9b8c40793d6c

SHA256
9f6eefac2c588b612b940f2c97377730b743f161a065c445b46570306b848f94

SHA512
c2198e32bb6f4099461d73d01689a7fdcd9ee6a9a25bf035558e32feee015356e2546a88ded09769e286850e3166af7a5b5456d8d8e40c0a69eefb7eb9b6fba7

Download Submit

Analysis

Sharing

General

Malware Config

Extracted

Extracted

Signatures

Processes

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads