octo | 17f75e1fc2e3ba668902e87ccbf07b8b41ec04562d8b93cf58e7154de76fe767

Analysis

max time kernel
58s
max time network
133s
platform
android_x86
resource
android-x86-arm-20240624-en
resource tags

androidarch:armarch:x86image:android-x86-arm-20240624-enlocale:en-usos:android-9-x86system
submitted
17-12-2024 22:09

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

17f75e1fc2e3ba668902e87ccbf07b8b41ec04562d8b93cf58e7154de76fe767.apk
Size

1.3MB
MD5

090491ca4ebf3f37ae1ce745950f8990
SHA1

71e031c502bd84610bb520c856f05095046376a5
SHA256

17f75e1fc2e3ba668902e87ccbf07b8b41ec04562d8b93cf58e7154de76fe767
SHA512

e4493f157539cddb78d45711f70af8b5d08f9e64c9578f850f86660539891e7d3066bc190412616fe8835b52409bf180c8e9591f00aaaa572375d3cd46832d39
SSDEEP

24576:5fsl36W7cUdVm1/pAy+jwqLKS9vA2vQYIzAp2BC/fN/1MBkgTtPsMuLsF:q++VmbQjzKWrZIzAwB2fHMBBTtPssF

Score

10^/10

octo banker collection credential_access discovery evasion impact infostealer persistence rat stealth trojan

Malware Config

Extracted

Family

octo

https://hayatvesanatguzellikduygusu.xyz/YmJlYTFiODdkMjcz/

https://mutlulukvesessizlikyolculugu.xyz/YmJlYTFiODdkMjcz/

https://yasamvesahtekarguzellik.xyz/YmJlYTFiODdkMjcz/

https://sevincligunlertatminkar.xyz/YmJlYTFiODdkMjcz/

https://dogaltatvesanatyaklasimi.xyz/YmJlYTFiODdkMjcz/

https://hayatlarinhuzurvesessiz.xyz/YmJlYTFiODdkMjcz/

https://keyifligunlerinfirsatlari.xyz/YmJlYTFiODdkMjcz/

https://sevgiiledoluyasamyolu.xyz/YmJlYTFiODdkMjcz/

https://sakinlikvehayatderinligi.xyz/YmJlYTFiODdkMjcz/

https://sanatvesanatcihayatlari.xyz/YmJlYTFiODdkMjcz/

https://ilhamdolubirhayat.xyz/YmJlYTFiODdkMjcz/

https://zenginlikvebasarihikayesi.xyz/YmJlYTFiODdkMjcz/

https://kalpvesanatdostlukhikaye.xyz/YmJlYTFiODdkMjcz/

https://mutlugunlerinyasamayolu.xyz/YmJlYTFiODdkMjcz/

https://yasananhayatinduygular.xyz/YmJlYTFiODdkMjcz/

https://dogaylaisbirligiyolu.xyz/YmJlYTFiODdkMjcz/

https://hosgoruhayatvekultur.xyz/YmJlYTFiODdkMjcz/

https://hayalguclesanatbaglantisi.xyz/YmJlYTFiODdkMjcz/

https://sadelikvehayatfelsefesi.xyz/YmJlYTFiODdkMjcz/

https://dogaldostlukvesanat.xyz/YmJlYTFiODdkMjcz/

rc4.plain

Extracted

Family

octo

https://hayatvesanatguzellikduygusu.xyz/YmJlYTFiODdkMjcz/

https://mutlulukvesessizlikyolculugu.xyz/YmJlYTFiODdkMjcz/

https://yasamvesahtekarguzellik.xyz/YmJlYTFiODdkMjcz/

https://sevincligunlertatminkar.xyz/YmJlYTFiODdkMjcz/

https://dogaltatvesanatyaklasimi.xyz/YmJlYTFiODdkMjcz/

https://hayatlarinhuzurvesessiz.xyz/YmJlYTFiODdkMjcz/

https://keyifligunlerinfirsatlari.xyz/YmJlYTFiODdkMjcz/

https://sevgiiledoluyasamyolu.xyz/YmJlYTFiODdkMjcz/

https://sakinlikvehayatderinligi.xyz/YmJlYTFiODdkMjcz/

https://sanatvesanatcihayatlari.xyz/YmJlYTFiODdkMjcz/

https://ilhamdolubirhayat.xyz/YmJlYTFiODdkMjcz/

https://zenginlikvebasarihikayesi.xyz/YmJlYTFiODdkMjcz/

https://kalpvesanatdostlukhikaye.xyz/YmJlYTFiODdkMjcz/

https://mutlugunlerinyasamayolu.xyz/YmJlYTFiODdkMjcz/

https://yasananhayatinduygular.xyz/YmJlYTFiODdkMjcz/

https://dogaylaisbirligiyolu.xyz/YmJlYTFiODdkMjcz/

https://hosgoruhayatvekultur.xyz/YmJlYTFiODdkMjcz/

https://hayalguclesanatbaglantisi.xyz/YmJlYTFiODdkMjcz/

https://sadelikvehayatfelsefesi.xyz/YmJlYTFiODdkMjcz/

https://dogaldostlukvesanat.xyz/YmJlYTFiODdkMjcz/

AES_key

Signatures

Octo
Octo is a banking malware with remote access capabilities first seen in April 2022.
banker trojan infostealer rat octo
Octo family
octo

Octo payload 2 IoCs

resource	yara_rule
behavioral1/memory/4275-0.dex	family_octo
behavioral1/memory/4249-0.dex	family_octo

Removes its main activity from the application launcher 1 TTPs 1 IoCs

stealth trojan evasion

Suppress Application Icon

T1628.001

pid	Process
4249	com.delay.sniff

Loads dropped Dex/Jar 1 TTPs 2 IoCs

Runs executable file dropped to the device during analysis.

evasion

Download New Code at Runtime

T1407

ioc	pid	Process
/data/user/0/com.delay.sniff/app_brick/NUFFpjS.json	4275	/system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.delay.sniff/app_brick/NUFFpjS.json --output-vdex-fd=41 --oat-fd=42 --oat-location=/data/user/0/com.delay.sniff/app_brick/oat/x86/NUFFpjS.odex --compiler-filter=quicken --class-loader-context=&
/data/user/0/com.delay.sniff/app_brick/NUFFpjS.json	4249	com.delay.sniff

Makes use of the framework's Accessibility service 4 TTPs 2 IoCs

Retrieves information displayed on the phone screen using AccessibilityService.

collection evasion credential_access

Input Injection

T1516

Screen Capture

T1513

Keylogging

T1417.001

GUI Input Capture

T1417.002

description	ioc	Process
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByViewId	com.delay.sniff
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId	com.delay.sniff

Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
banker discovery

Security Software Discovery
T1418.001
Queries the phone number (MSISDN for GSM devices) 1 TTPs
discovery

System Network Configuration Discovery
T1422

Acquires the wake lock 1 IoCs

description	ioc	Process
Framework service call	android.os.IPowerManager.acquireWakeLock	com.delay.sniff

Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs

Application may abuse the framework's foreground service to continue running in the foreground.

evasion persistence

Foreground Persistence

T1541

description	ioc	Process
Framework service call	android.app.IActivityManager.setServiceForeground	com.delay.sniff

Performs UI accessibility actions on behalf of the user 1 TTPs 4 IoCs

Application may abuse the accessibility service to prevent their removal.

evasion

Prevent Application Removal

T1629.001

ioc	Process
android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction	com.delay.sniff
android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction	com.delay.sniff
android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction	com.delay.sniff
android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction	com.delay.sniff

Queries the mobile country code (MCC) 1 TTPs 1 IoCs

discovery

System Network Configuration Discovery

T1422

description	ioc	Process
Framework service call	com.android.internal.telephony.ITelephony.getNetworkCountryIsoForPhone	com.delay.sniff

Queries the unique device ID (IMEI, MEID, IMSI) 1 TTPs
discovery

System Network Configuration Discovery
T1422

Requests accessing notifications (often used to intercept notifications before users become aware). 1 TTPs 1 IoCs

collection credential_access

Access Notifications

T1517

description	ioc	Process
Intent action	android.settings.ACTION_NOTIFICATION_LISTENER_SETTINGS	com.delay.sniff

Requests disabling of battery optimizations (often used to enable hiding in the background). 1 TTPs 1 IoCs

evasion

User Evasion

T1628.002

description	ioc	Process
Intent action	android.settings.REQUEST_IGNORE_BATTERY_OPTIMIZATIONS	com.delay.sniff

Requests modifying system settings. 1 IoCs

evasion

description	ioc	Process
Intent action	android.settings.action.MANAGE_WRITE_SETTINGS	com.delay.sniff

Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs

persistence

Broadcast Receivers

T1624.001

description	ioc	Process
Framework service call	android.app.IActivityManager.registerReceiver	com.delay.sniff

Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs

impact

Data Encrypted for Impact

T1471

description	ioc	Process
Framework API call	javax.crypto.Cipher.doFinal	com.delay.sniff

com.delay.sniff
1⤵
- Removes its main activity from the application launcher
- Loads dropped Dex/Jar
- Makes use of the framework's Accessibility service
- Acquires the wake lock
- Makes use of the framework's foreground persistence service
- Performs UI accessibility actions on behalf of the user
- Queries the mobile country code (MCC)
- Requests accessing notifications (often used to intercept notifications before users become aware).
- Requests disabling of battery optimizations (often used to enable hiding in the background).
- Requests modifying system settings.
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Uses Crypto APIs (Might try to encrypt user data)
PID:4249
- /system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.delay.sniff/app_brick/NUFFpjS.json --output-vdex-fd=41 --oat-fd=42 --oat-location=/data/user/0/com.delay.sniff/app_brick/oat/x86/NUFFpjS.odex --compiler-filter=quicken --class-loader-context=&
  2⤵
  - Loads dropped Dex/Jar
  PID:4275

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Event Triggered Execution

T1624

Broadcast Receivers

T1624.001

Foreground Persistence

T1541

Privilege Escalation

Defense Evasion

Download New Code at Runtime

T1407

Foreground Persistence

T1541

Hide Artifacts

T1628

Suppress Application Icon

T1628.001

User Evasion

T1628.002

Impair Defenses

T1629

Prevent Application Removal

T1629.001

Input Injection

T1516

Credential Access

Access Notifications

T1517

Input Capture

T1417

GUI Input Capture

T1417.002

Keylogging

T1417.001

Discovery

Software Discovery

T1418

Security Software Discovery

T1418.001

System Network Configuration Discovery

T1422

Lateral Movement

Collection

Access Notifications

T1517

Input Capture

T1417

GUI Input Capture

T1417.002

Keylogging

T1417.001

Screen Capture

T1513

Command and Control

Exfiltration

Impact

Data Encrypted for Impact

T1471

Input Injection

T1516

Replay Monitor

Loading Replay Monitor...

Downloads

/data/data/com.delay.sniff/app_brick/NUFFpjS.json

Filesize
153KB

MD5
ece7de5bb246a4351d65a3ee0d503c13

SHA1
a2a4a101b4935e49ebc2e662c9083edf9dcec85c

SHA256
deeedc3625185b2f84c12a8545917a793de0dba62cd6cf5d56d24fa4e4e73aaa

SHA512
66de5e2e4a5a06c9f87694331313c0c8a805492565014f2f230b3b5b10d9a812968e0d75ca3cd4eed5c142e304d492c427e6ae601bbf23fb3553338be89a5ad5

Download Submit
/data/data/com.delay.sniff/app_brick/NUFFpjS.json

Filesize
153KB

MD5
d144608c0448738c0195bc4f5333f69e

SHA1
9a438c9f1bff3fd31b1ef707c761d9c07930e8f6

SHA256
e76f5f8af353de0ec905dfd4eedad7211ff91a469cb417a25fbcf863c6a8971c

SHA512
8dbd99be47890343a4f6d66fe6084baeb88295fc2123cdcc01591dff3d520aae4ccc9429be8746cae595dd463433745298241970161846ed1ff91fdb494c7d6f

Download Submit
/data/user/0/com.delay.sniff/app_brick/NUFFpjS.json

Filesize
451KB

MD5
f05c85fc167a6e3f0ac60b83f45e2152

SHA1
bf40cb99e65beb608bb7fba23dc329545050b0b8

SHA256
abb315a411523560044413860b047acb4ee67aa4084172a1dd28e021cd6fc86e

SHA512
30b2f8fbd9b1d6220a8b102f4b6f3bb9b883b9c48f941d487b2f121c5c6b87cccb39e148fdb72f13145e16e50497b322dba2c3dcc2fef37cec6e962a76ded6f0

Download Submit
/data/user/0/com.delay.sniff/app_brick/NUFFpjS.json

Filesize
451KB

MD5
1cac5ff15b8e9a569b0f794bfb780b92

SHA1
23be3b59a2fd7cf779f7bf144093933a42a584f1

SHA256
757eee14b0cf15e996aebe523a607c74b3d2f5773dceded50b1eade4fa47fc31

SHA512
832a92ea16f19cacec953b4a4d61b39fe8f06c2580bb9c0c9526398450c7ae2365345e779f3f9b9531f688fa3dbad35719dc0504bc8218fbfdba6b8f8515ee32

Download Submit

Analysis

Sharing

General

Malware Config

Extracted

Extracted

Signatures

Processes

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads