octo | 094bd054f9bd13ece421402bb500b7b5cd461b800a47c1de10390d933567217d

Analysis

max time kernel
149s
max time network
136s
platform
android_x86
resource
android-x86-arm-20240624-en
resource tags

androidarch:armarch:x86image:android-x86-arm-20240624-enlocale:en-usos:android-9-x86system
submitted
17/12/2024, 22:12 UTC

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

094bd054f9bd13ece421402bb500b7b5cd461b800a47c1de10390d933567217d.apk
Size

321KB
MD5

02db11799e8e407606298584c1f29ec4
SHA1

bc8ccf1d440ac6a02d63d1147237311d9c1f1e80
SHA256

094bd054f9bd13ece421402bb500b7b5cd461b800a47c1de10390d933567217d
SHA512

d8330da7d76acfd7f671fa4545e8fbb5dff8f0528c90fca58e2617c424074f03ffbf26e6e052d775884f16317658df1ee02afa49a7a1f843fee1c5194c20eb2a
SSDEEP

6144:KdzY4GCnYbBiHHDU62Cd0SCrWAyWj6Rg0OaaNUurty/EuG4m:KpYCYtuHDU62Cd0BkLg07aNVtOna

Score

10^/10

octo banker collection credential_access discovery evasion impact infostealer persistence rat stealth trojan

Malware Config

Extracted

Family

octo

https://fakalersokakkal.xyz/M2I2ZjI1MzMxMmMx/

https://sarocakasaxe.xyz/M2I2ZjI1MzMxMmMx/

https://saxamaszuseko.xyz/M2I2ZjI1MzMxMmMx/

https://rasfakstumahoxexe.xyz/M2I2ZjI1MzMxMmMx/

https://sadasurapsomyivano.xyz/M2I2ZjI1MzMxMmMx/

https://yasasananas.xyz/M2I2ZjI1MzMxMmMx/

https://rasddassadazexe.xyz/M2I2ZjI1MzMxMmMx/

https://trasafsakaasassuheno.xyz/M2I2ZjI1MzMxMmMx/

https://zalizadsasasa2a.xyz/M2I2ZjI1MzMxMmMx/

AES_key

1
3534353639643261616165373137363333356136376266373265383637333666

Signatures

Octo
Octo is a banking malware with remote access capabilities first seen in April 2022.
banker trojan infostealer rat octo
Octo family
octo

Removes its main activity from the application launcher 1 TTPs 1 IoCs

stealth trojan evasion

Suppress Application Icon

T1628.001

pid	Process
4257	com.nameown12

Makes use of the framework's Accessibility service 4 TTPs 2 IoCs

Retrieves information displayed on the phone screen using AccessibilityService.

collection evasion credential_access

Input Injection

T1516

Screen Capture

T1513

Keylogging

T1417.001

GUI Input Capture

T1417.002

description	ioc	Process
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId	com.nameown12
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByViewId	com.nameown12

Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
banker discovery

Security Software Discovery
T1418.001
Queries the phone number (MSISDN for GSM devices) 1 TTPs
discovery

System Network Configuration Discovery
T1422

Acquires the wake lock 1 IoCs

description	ioc	Process
Framework service call	android.os.IPowerManager.acquireWakeLock	com.nameown12

Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs

Application may abuse the framework's foreground service to continue running in the foreground.

evasion persistence

Foreground Persistence

T1541

description	ioc	Process
Framework service call	android.app.IActivityManager.setServiceForeground	com.nameown12

Performs UI accessibility actions on behalf of the user 1 TTPs 4 IoCs

Application may abuse the accessibility service to prevent their removal.

evasion

Prevent Application Removal

T1629.001

ioc	Process
android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction	com.nameown12
android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction	com.nameown12
android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction	com.nameown12
android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction	com.nameown12

Queries the mobile country code (MCC) 1 TTPs 1 IoCs

discovery

System Network Configuration Discovery

T1422

description	ioc	Process
Framework service call	com.android.internal.telephony.ITelephony.getNetworkCountryIsoForPhone	com.nameown12

Queries the unique device ID (IMEI, MEID, IMSI) 1 TTPs
discovery

System Network Configuration Discovery
T1422
Reads information about phone network operator. 1 TTPs
discovery

System Network Configuration Discovery
T1422

Requests accessing notifications (often used to intercept notifications before users become aware). 1 TTPs 1 IoCs

collection credential_access

Access Notifications

T1517

description	ioc	Process
Intent action	android.settings.ACTION_NOTIFICATION_LISTENER_SETTINGS	com.nameown12

Requests disabling of battery optimizations (often used to enable hiding in the background). 1 TTPs 1 IoCs

evasion

User Evasion

T1628.002

description	ioc	Process
Intent action	android.settings.REQUEST_IGNORE_BATTERY_OPTIMIZATIONS	com.nameown12

Requests modifying system settings. 1 IoCs

evasion

description	ioc	Process
Intent action	android.settings.action.MANAGE_WRITE_SETTINGS	com.nameown12

Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs

persistence

Broadcast Receivers

T1624.001

description	ioc	Process
Framework service call	android.app.IActivityManager.registerReceiver	com.nameown12

Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs

impact

Data Encrypted for Impact

T1471

description	ioc	Process
Framework API call	javax.crypto.Cipher.doFinal	com.nameown12

com.nameown12
1⤵
- Removes its main activity from the application launcher
- Makes use of the framework's Accessibility service
- Acquires the wake lock
- Makes use of the framework's foreground persistence service
- Performs UI accessibility actions on behalf of the user
- Queries the mobile country code (MCC)
- Requests accessing notifications (often used to intercept notifications before users become aware).
- Requests disabling of battery optimizations (often used to enable hiding in the background).
- Requests modifying system settings.
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Uses Crypto APIs (Might try to encrypt user data)
PID:4257

Network

DNS

semanticlocation-pa.googleapis.com

Remote address:

1.1.1.1:53

Request

semanticlocation-pa.googleapis.com

IN A

Response

semanticlocation-pa.googleapis.com

IN A

172.217.169.10

semanticlocation-pa.googleapis.com

IN A

142.250.200.42

semanticlocation-pa.googleapis.com

IN A

216.58.201.106

semanticlocation-pa.googleapis.com

IN A

216.58.212.202

semanticlocation-pa.googleapis.com

IN A

142.250.180.10

semanticlocation-pa.googleapis.com

IN A

216.58.204.74

semanticlocation-pa.googleapis.com

IN A

142.250.187.234

semanticlocation-pa.googleapis.com

IN A

142.250.179.234

semanticlocation-pa.googleapis.com

IN A

172.217.169.74

semanticlocation-pa.googleapis.com

IN A

172.217.169.42

semanticlocation-pa.googleapis.com

IN A

142.250.178.10

semanticlocation-pa.googleapis.com

IN A

216.58.212.234

semanticlocation-pa.googleapis.com

IN A

172.217.16.234

semanticlocation-pa.googleapis.com

IN A

216.58.213.10

semanticlocation-pa.googleapis.com

IN A

142.250.200.10

semanticlocation-pa.googleapis.com

IN A

142.250.187.202
DNS

sarocakasaxe.xyz

Remote address:

1.1.1.1:53

Request

sarocakasaxe.xyz

IN A

Response
DNS

rasfakstumahoxexe.xyz

Remote address:

1.1.1.1:53

Request

rasfakstumahoxexe.xyz

IN A

Response
DNS

www.ip-api.com

Remote address:

1.1.1.1:53

Request

www.ip-api.com

IN A

Response

www.ip-api.com

IN A

208.95.112.1
DNS

yasasananas.xyz

Remote address:

1.1.1.1:53

Request

yasasananas.xyz

IN A

Response
GET

http://www.ip-api.com/json

Remote address:

208.95.112.1:80

Request

GET /json HTTP/1.1
Host: www.ip-api.com
Connection: Keep-Alive

Response

HTTP/1.1 200 OK

Date: Tue, 17 Dec 2024 22:13:26 GMT
Content-Type: application/json; charset=utf-8
Content-Length: 291
Access-Control-Allow-Origin: *
X-Ttl: 13
X-Rl: 39
DNS

rasddassadazexe.xyz

Remote address:

1.1.1.1:53

Request

rasddassadazexe.xyz

IN A

Response
DNS

saxamaszuseko.xyz

Remote address:

1.1.1.1:53

Request

saxamaszuseko.xyz

IN A

Response
DNS

zalizadsasasa2a.xyz

Remote address:

1.1.1.1:53

Request

zalizadsasasa2a.xyz

IN A

Response
DNS

trasafsakaasassuheno.xyz

Remote address:

1.1.1.1:53

Request

trasafsakaasassuheno.xyz

IN A

Response
DNS

fakalersokakkal.xyz

Remote address:

1.1.1.1:53

Request

fakalersokakkal.xyz

IN A

Response
DNS

sadasurapsomyivano.xyz

Remote address:

1.1.1.1:53

Request

sadasurapsomyivano.xyz

IN A

Response
DNS

android.apis.google.com

Remote address:

1.1.1.1:53

Request

android.apis.google.com

IN A

Response

android.apis.google.com

IN CNAME

clients.l.google.com

clients.l.google.com

IN A

142.250.187.238

142.250.200.42:443

tls, https

202 B
40 B
1
1
208.95.112.1:80

http://www.ip-api.com/json

http

328 B
600 B
6
3

HTTP Request

GET http://www.ip-api.com/json

HTTP Response

200
216.58.204.78:443

tls, https

858 B
40 B
1
1
142.250.187.238:443

android.apis.google.com

tls

4.7kB
8.5kB
14
22
172.217.169.10:443

semanticlocation-pa.googleapis.com

tls

1.8kB
5.9kB
12
10
142.250.179.234:443

semanticlocation-pa.googleapis.com

tls, https

1.2kB
40 B
1
1

224.0.0.251:5353

3.7kB
11
1.1.1.1:53

semanticlocation-pa.googleapis.com

dns

80 B
336 B
1
1

DNS Request

semanticlocation-pa.googleapis.com

DNS Response

172.217.169.10

142.250.200.42

216.58.201.106

216.58.212.202

142.250.180.10

216.58.204.74

142.250.187.234

142.250.179.234

172.217.169.74

172.217.169.42

142.250.178.10

216.58.212.234

172.217.16.234

216.58.213.10

142.250.200.10

142.250.187.202
1.1.1.1:53

sarocakasaxe.xyz

dns

62 B
127 B
1
1

DNS Request

sarocakasaxe.xyz
1.1.1.1:53

rasfakstumahoxexe.xyz

dns

67 B
132 B
1
1

DNS Request

rasfakstumahoxexe.xyz
1.1.1.1:53

www.ip-api.com

dns

60 B
76 B
1
1

DNS Request

www.ip-api.com

DNS Response

208.95.112.1
1.1.1.1:53

yasasananas.xyz

dns

61 B
126 B
1
1

DNS Request

yasasananas.xyz
1.1.1.1:53

rasddassadazexe.xyz

dns

65 B
130 B
1
1

DNS Request

rasddassadazexe.xyz
1.1.1.1:53

saxamaszuseko.xyz

dns

63 B
128 B
1
1

DNS Request

saxamaszuseko.xyz
1.1.1.1:53

zalizadsasasa2a.xyz

dns

65 B
130 B
1
1

DNS Request

zalizadsasasa2a.xyz
1.1.1.1:53

trasafsakaasassuheno.xyz

dns

70 B
135 B
1
1

DNS Request

trasafsakaasassuheno.xyz
1.1.1.1:53

fakalersokakkal.xyz

dns

65 B
130 B
1
1

DNS Request

fakalersokakkal.xyz
1.1.1.1:53

sadasurapsomyivano.xyz

dns

68 B
133 B
1
1

DNS Request

sadasurapsomyivano.xyz
1.1.1.1:53

android.apis.google.com

dns

69 B
109 B
1
1

DNS Request

android.apis.google.com

DNS Response

142.250.187.238