octo | 20f7f3802a6d2d2ad98fc7acf6d468413e9ec7d6849ccae41b8d0a793fbc7e86

Analysis

max time kernel
148s
max time network
136s
platform
android_x64
resource
android-33-x64-arm64-20240624-en
resource tags

androidarch:arm64arch:x64image:android-33-x64-arm64-20240624-enlocale:en-usos:android-13-x64system
submitted
18-12-2024 22:09

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

20f7f3802a6d2d2ad98fc7acf6d468413e9ec7d6849ccae41b8d0a793fbc7e86.apk
Size

1.4MB
MD5

3f6421621f70010dd0da8f66ae82cc8c
SHA1

397cc283467d8bc849318723f68be9e1be0cad58
SHA256

20f7f3802a6d2d2ad98fc7acf6d468413e9ec7d6849ccae41b8d0a793fbc7e86
SHA512

7edddb711b6074c420620d19204cfdf3f5f3ffece0401f3b601d81d0a8215435d47597b98581d735b4b7432548f9343ee7f01e2371a5552db6eb6b75402e8d19
SSDEEP

24576:71WbRS1T9vWD0YYY2hSUlfd+Hny9Jc9OJ8qY0LwgZ3t3b3Oa65G7wWa/6hqZxFCK:7ORS1T9XhRfd+CO9TWjZ9r+a65GPWOqP

Score

10^/10

octo banker collection credential_access discovery evasion impact infostealer persistence rat trojan

Malware Config

Extracted

Family

octo

https://uhgtr9jjdiuriegvjudf.top/N2Y5ZmU3OTI5ZDky/

https://ukhfrerl84hnfjdlns.online/N2Y5ZmU3OTI5ZDky/

https://menetory4gert.xyz/N2Y5ZmU3OTI5ZDky/

https://hdewuhunfrv74f.site/N2Y5ZmU3OTI5ZDky/

https://kuurjfds8rjrdiwse.online/N2Y5ZmU3OTI5ZDky/

rc4.plain

Extracted

Family

octo

https://uhgtr9jjdiuriegvjudf.top/N2Y5ZmU3OTI5ZDky/

https://ukhfrerl84hnfjdlns.online/N2Y5ZmU3OTI5ZDky/

https://menetory4gert.xyz/N2Y5ZmU3OTI5ZDky/

https://hdewuhunfrv74f.site/N2Y5ZmU3OTI5ZDky/

https://kuurjfds8rjrdiwse.online/N2Y5ZmU3OTI5ZDky/

AES_key

Signatures

Octo
Octo is a banking malware with remote access capabilities first seen in April 2022.
banker trojan infostealer rat octo
Octo family
octo

Octo payload 1 IoCs

resource	yara_rule
behavioral2/files/fstream-3.dat	family_octo

Loads dropped Dex/Jar 1 TTPs 2 IoCs

Runs executable file dropped to the device during analysis.

evasion

Download New Code at Runtime

T1407

ioc	pid	Process
/data/user/0/com.askpoint6/app_DynamicOptDex/bTAq.json	4351	com.askpoint6
/data/user/0/com.askpoint6/cache/merfpcinwqc	4351	com.askpoint6

Makes use of the framework's Accessibility service 4 TTPs 2 IoCs

Retrieves information displayed on the phone screen using AccessibilityService.

collection evasion credential_access

Input Injection

T1516

Screen Capture

T1513

Keylogging

T1417.001

GUI Input Capture

T1417.002

description	ioc	Process
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId	com.askpoint6
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByViewId	com.askpoint6

Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
banker discovery

Security Software Discovery
T1418.001
Queries the phone number (MSISDN for GSM devices) 1 TTPs
discovery

System Network Configuration Discovery
T1422

Acquires the wake lock 1 IoCs

description	ioc	Process
Framework service call	android.os.IPowerManager.acquireWakeLock	com.askpoint6

Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs

Application may abuse the framework's foreground service to continue running in the foreground.

evasion persistence

Foreground Persistence

T1541

description	ioc	Process
Framework service call	android.app.IActivityManager.setServiceForeground	com.askpoint6

Performs UI accessibility actions on behalf of the user 1 TTPs 2 IoCs

Application may abuse the accessibility service to prevent their removal.

evasion

Prevent Application Removal

T1629.001

ioc	Process
android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction	com.askpoint6
android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction	com.askpoint6

Queries the mobile country code (MCC) 1 TTPs 1 IoCs

discovery

System Network Configuration Discovery

T1422

description	ioc	Process
Framework service call	com.android.internal.telephony.ITelephony.getNetworkCountryIsoForPhone	com.askpoint6

Reads information about phone network operator. 1 TTPs
discovery

System Network Configuration Discovery
T1422

Requests accessing notifications (often used to intercept notifications before users become aware). 1 TTPs 1 IoCs

collection credential_access

Access Notifications

T1517

description	ioc	Process
Intent action	android.settings.ACTION_NOTIFICATION_LISTENER_SETTINGS	com.askpoint6

Requests disabling of battery optimizations (often used to enable hiding in the background). 1 TTPs 1 IoCs

evasion

User Evasion

T1628.002

description	ioc	Process
Intent action	android.settings.REQUEST_IGNORE_BATTERY_OPTIMIZATIONS	com.askpoint6

Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs

impact

Data Encrypted for Impact

T1471

description	ioc	Process
Framework API call	javax.crypto.Cipher.doFinal	com.askpoint6

com.askpoint6
1⤵
- Loads dropped Dex/Jar
- Makes use of the framework's Accessibility service
- Acquires the wake lock
- Makes use of the framework's foreground persistence service
- Performs UI accessibility actions on behalf of the user
- Queries the mobile country code (MCC)
- Requests accessing notifications (often used to intercept notifications before users become aware).
- Requests disabling of battery optimizations (often used to enable hiding in the background).
- Uses Crypto APIs (Might try to encrypt user data)
PID:4351

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Foreground Persistence

T1541

Privilege Escalation

Defense Evasion

Download New Code at Runtime

T1407

Foreground Persistence

T1541

Hide Artifacts

T1628

User Evasion

T1628.002

Impair Defenses

T1629

Prevent Application Removal

T1629.001

Input Injection

T1516

Credential Access

Access Notifications

T1517

Input Capture

T1417

GUI Input Capture

T1417.002

Keylogging

T1417.001

Discovery

Software Discovery

T1418

Security Software Discovery

T1418.001

System Network Configuration Discovery

T1422

Lateral Movement

Collection

Access Notifications

T1517

Input Capture

T1417

GUI Input Capture

T1417.002

Keylogging

T1417.001

Screen Capture

T1513

Command and Control

Exfiltration

Impact

Data Encrypted for Impact

T1471

Input Injection

T1516

Replay Monitor

Loading Replay Monitor...

Downloads

/data/user/0/com.askpoint6/app_DynamicOptDex/bTAq.json

Filesize
2KB

MD5
8315a2cca12417f2d13cf8e3f7487ba3

SHA1
8e1f9b7464d0289236a858da39b601ca041fbda5

SHA256
2d6f73d504af27971c4cf1133fa4ae6cc6e999c9f94237d0771ff88a2b27e2c5

SHA512
b4db30a2eb0df6f03bc04e113376ab7e6167f88d9ba247c681a918dfcab074f71234c08e606ea845c8091748b2ad6130c8c66fa93932e657c3ff43f667cf51ae

Download Submit
/data/user/0/com.askpoint6/app_DynamicOptDex/bTAq.json

Filesize
2KB

MD5
9efb8c110406a2929219b2fcd6ca243a

SHA1
165f306ae0996fc7a503efc0813de01c402e9488

SHA256
1e44eaa5c9b6e36da701d5406bf32f28f2cc08052602e595bb70d845c3023f29

SHA512
102e46e41c4dd513bf1f35dfaf318ce3e5e825ec070b02d1c82439a7f56175247ea8d73a3a074e2d91b455edf7cd5ee77f53f8f6d9a2cc6d045ae34eb6f79f8f

Download Submit
/data/user/0/com.askpoint6/app_DynamicOptDex/bTAq.json

Filesize
6KB

MD5
feb736a7533f218b714da8599144b7b6

SHA1
bb93b945048b9f9e5e24ec335e0f4690020f75c3

SHA256
58cfd48de0938427ea10f3c6a7c3868dc69538736b17e3f1ca59ff44bdbe365d

SHA512
063c0f9f4529b6a807bc54ea1e443f146e2e71b92a4e3c23b11237ce6d94b18a1a69cb592fee76ba114221bbc44e2334eacb9718f6f597b9c0c76b5998a0b60d

Download Submit
/data/user/0/com.askpoint6/cache/merfpcinwqc

Filesize
449KB

MD5
83e55de2f80f830e15b7894c6fca0ad7

SHA1
713abd053c185467f2433009a640684eeebed694

SHA256
e2e7506760a2892f82200b3d47a573daeb0234dd5f893b1b3cfb03fc47824fad

SHA512
96766f07ce213115a73f778f4f518b2a1cc0b143b7d2523e28ce49b2a90def6f589d9bb67be6bbf309eacd655d0f094433c1aa0cbb6e13ca9a66970597ed7427

Download Submit
/data/user/0/com.askpoint6/cache/oat/merfpcinwqc.cur.prof

Filesize
383B

MD5
e359e1a74048548f4dbb72bee1eb2f2b

SHA1
6aed4626a32d432f23e027517988d6e534dcdc17

SHA256
78e1f26b8278f4bc549492c49a57c4e429454d973b66c7e11ab1851300b12c2b

SHA512
17fa5882fe1d07679b1adafa43ea9e199d8ede1bda09d415b9b74d557ded237d8a805c5a416eb0f0ebea6ee82691cd917640fc55073827366aeb2211a2bd9104

Download Submit

Analysis

Sharing

General

Malware Config

Extracted

Extracted

Signatures

Processes

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads