octo | 2a5b685c30dbf2337faea9ab0417d666506a545b9b9ce2cfc37602ecaf0c18e3

Analysis

max time kernel
149s
max time network
131s
platform
android_x86
resource
android-x86-arm-20240624-en
resource tags

androidarch:armarch:x86image:android-x86-arm-20240624-enlocale:en-usos:android-9-x86system
submitted
18-12-2024 22:09

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2a5b685c30dbf2337faea9ab0417d666506a545b9b9ce2cfc37602ecaf0c18e3.apk
Size

2.3MB
MD5

5fd97616f08b29703e97037cadda8c6f
SHA1

f7272c94d983d3bdd698f5ce24b3c4de0058903d
SHA256

2a5b685c30dbf2337faea9ab0417d666506a545b9b9ce2cfc37602ecaf0c18e3
SHA512

46eca7f56bec61d9b0b27b1307f1f2dd8dc413a21e775e5cd814b5c3437d41b241680605eec16d3ca8b4453a81d2935602a3c23645b11e85c76e86c806e896a9
SSDEEP

49152:3voNod9lEUfJrSEkf13915p0ag+NtYcUcBWnsvcf03F/7D++juRhw:3v3kf13915p0agsl8svcf03F/KRO

Score

10^/10

octo banker collection credential_access discovery evasion impact infostealer persistence rat stealth trojan

Malware Config

Extracted

Family

octo

https://topflowow.top/ZmU2YzQ2NjZlNjc2/

https://bobnoopopo.org/ZmU2YzQ2NjZlNjc2/

https://junggvrebvqqpo.org/ZmU2YzQ2NjZlNjc2/

https://junggpervbvqqqqqqpo.com/ZmU2YzQ2NjZlNjc2/

https://junggvbvqqgrouppo.com/ZmU2YzQ2NjZlNjc2/

https://junggvbvqqnetokpo.com/ZmU2YzQ2NjZlNjc2/

https://junggvbvq.top/ZmU2YzQ2NjZlNjc2/

https://junggvbvq5656.top/ZmU2YzQ2NjZlNjc2/

https://jungjunjunggvbvq.top/ZmU2YzQ2NjZlNjc2/

rc4.plain

Extracted

Family

octo

https://topflowow.top/ZmU2YzQ2NjZlNjc2/

https://bobnoopopo.org/ZmU2YzQ2NjZlNjc2/

https://junggvrebvqqpo.org/ZmU2YzQ2NjZlNjc2/

https://junggpervbvqqqqqqpo.com/ZmU2YzQ2NjZlNjc2/

https://junggvbvqqgrouppo.com/ZmU2YzQ2NjZlNjc2/

https://junggvbvqqnetokpo.com/ZmU2YzQ2NjZlNjc2/

https://junggvbvq.top/ZmU2YzQ2NjZlNjc2/

https://junggvbvq5656.top/ZmU2YzQ2NjZlNjc2/

https://jungjunjunggvbvq.top/ZmU2YzQ2NjZlNjc2/

AES_key

Signatures

Octo
Octo is a banking malware with remote access capabilities first seen in April 2022.
banker trojan infostealer rat octo
Octo family
octo

Octo payload 1 IoCs

resource	yara_rule
behavioral1/files/fstream-6.dat	family_octo

Removes its main activity from the application launcher 1 TTPs 1 IoCs

stealth trojan evasion

Suppress Application Icon

T1628.001

pid	Process
4248	com.seemrecord50

Checks Android system properties for emulator presence. 1 TTPs 1 IoCs

evasion

System Checks

T1633.001

description	ioc	Process
Accessed system property	key: ro.product.model	com.seemrecord50

Loads dropped Dex/Jar 1 TTPs 4 IoCs

Runs executable file dropped to the device during analysis.

evasion

Download New Code at Runtime

T1407

ioc	pid	Process
/data/user/0/com.seemrecord50/app_DynamicOptDex/Bak.json	4275	/system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.seemrecord50/app_DynamicOptDex/Bak.json --output-vdex-fd=41 --oat-fd=42 --oat-location=/data/user/0/com.seemrecord50/app_DynamicOptDex/oat/x86/Bak.odex --compiler-filter=quicken --class-loader-context=&
/data/user/0/com.seemrecord50/app_DynamicOptDex/Bak.json	4248	com.seemrecord50
/data/user/0/com.seemrecord50/cache/ufqfiqru	4248	com.seemrecord50
/data/user/0/com.seemrecord50/cache/ufqfiqru	4248	com.seemrecord50

Makes use of the framework's Accessibility service 4 TTPs 2 IoCs

Retrieves information displayed on the phone screen using AccessibilityService.

collection evasion credential_access

Input Injection

T1516

Screen Capture

T1513

Keylogging

T1417.001

GUI Input Capture

T1417.002

description	ioc	Process
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId	com.seemrecord50
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByViewId	com.seemrecord50

Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
banker discovery

Security Software Discovery
T1418.001
Queries the phone number (MSISDN for GSM devices) 1 TTPs
discovery

System Network Configuration Discovery
T1422

Acquires the wake lock 1 IoCs

description	ioc	Process
Framework service call	android.os.IPowerManager.acquireWakeLock	com.seemrecord50

Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs

Application may abuse the framework's foreground service to continue running in the foreground.

evasion persistence

Foreground Persistence

T1541

description	ioc	Process
Framework service call	android.app.IActivityManager.setServiceForeground	com.seemrecord50

Performs UI accessibility actions on behalf of the user 1 TTPs 3 IoCs

Application may abuse the accessibility service to prevent their removal.

evasion

Prevent Application Removal

T1629.001

ioc	Process
android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction	com.seemrecord50
android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction	com.seemrecord50
android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction	com.seemrecord50

Queries the mobile country code (MCC) 1 TTPs 1 IoCs

discovery

System Network Configuration Discovery

T1422

description	ioc	Process
Framework service call	com.android.internal.telephony.ITelephony.getNetworkCountryIsoForPhone	com.seemrecord50

Queries the unique device ID (IMEI, MEID, IMSI) 1 TTPs
discovery

System Network Configuration Discovery
T1422
Reads information about phone network operator. 1 TTPs
discovery

System Network Configuration Discovery
T1422

Requests accessing notifications (often used to intercept notifications before users become aware). 1 TTPs 1 IoCs

collection credential_access

Access Notifications

T1517

description	ioc	Process
Intent action	android.settings.ACTION_NOTIFICATION_LISTENER_SETTINGS	com.seemrecord50

Requests disabling of battery optimizations (often used to enable hiding in the background). 1 TTPs 1 IoCs

evasion

User Evasion

T1628.002

description	ioc	Process
Intent action	android.settings.REQUEST_IGNORE_BATTERY_OPTIMIZATIONS	com.seemrecord50

Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs

persistence

Broadcast Receivers

T1624.001

description	ioc	Process
Framework service call	android.app.IActivityManager.registerReceiver	com.seemrecord50

Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs

impact

Data Encrypted for Impact

T1471

description	ioc	Process
Framework API call	javax.crypto.Cipher.doFinal	com.seemrecord50

Checks CPU information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/cpuinfo	com.seemrecord50

Checks memory information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/meminfo	com.seemrecord50

com.seemrecord50
1⤵
- Removes its main activity from the application launcher
- Checks Android system properties for emulator presence.
- Loads dropped Dex/Jar
- Makes use of the framework's Accessibility service
- Acquires the wake lock
- Makes use of the framework's foreground persistence service
- Performs UI accessibility actions on behalf of the user
- Queries the mobile country code (MCC)
- Requests accessing notifications (often used to intercept notifications before users become aware).
- Requests disabling of battery optimizations (often used to enable hiding in the background).
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Uses Crypto APIs (Might try to encrypt user data)
- Checks CPU information
- Checks memory information
PID:4248
- /system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.seemrecord50/app_DynamicOptDex/Bak.json --output-vdex-fd=41 --oat-fd=42 --oat-location=/data/user/0/com.seemrecord50/app_DynamicOptDex/oat/x86/Bak.odex --compiler-filter=quicken --class-loader-context=&
  2⤵
  - Loads dropped Dex/Jar
  PID:4275

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Event Triggered Execution

T1624

Broadcast Receivers

T1624.001

Foreground Persistence

T1541

Privilege Escalation

Defense Evasion

Download New Code at Runtime

T1407

Foreground Persistence

T1541

Hide Artifacts

T1628

Suppress Application Icon

T1628.001

User Evasion

T1628.002

Impair Defenses

T1629

Prevent Application Removal

T1629.001

Input Injection

T1516

Virtualization/Sandbox Evasion

T1633

System Checks

T1633.001

Credential Access

Access Notifications

T1517

Input Capture

T1417

GUI Input Capture

T1417.002

Keylogging

T1417.001

Discovery

Software Discovery

T1418

Security Software Discovery

T1418.001

System Information Discovery

T1426

System Network Configuration Discovery

T1422

Lateral Movement

Collection

Access Notifications

T1517

Input Capture

T1417

GUI Input Capture

T1417.002

Keylogging

T1417.001

Screen Capture

T1513

Command and Control

Exfiltration

Impact

Data Encrypted for Impact

T1471

Input Injection

T1516

Replay Monitor

Loading Replay Monitor...

Downloads

/data/data/com.seemrecord50/app_DynamicOptDex/Bak.json

Filesize
1KB

MD5
d6c1144683e562fc290020a7dc429ddf

SHA1
ed2290285aa55449906a78d9eeb1abcd92516b40

SHA256
30095185618f5a1dc553fdc0389d238b72e13aa438d9b140cb99442c32ac3dca

SHA512
1727fab88f27f3a94437359c0ae1955442a23e4affedd51c27ad0c942b9125c3498414e99bbf378d738b65b2344550a0f463d82f68cab92c9a4443a6f5cf1ae6

Download Submit
/data/data/com.seemrecord50/app_DynamicOptDex/Bak.json

Filesize
1KB

MD5
ec9147ab2083675ce262edd7dd6507b1

SHA1
73e99216f04828906406e72891452a992d09cd1e

SHA256
55e6bb2c554f4f962996212731293cdb61b34b8764146051ae87abf263ee3277

SHA512
7d84c88261ae2b6c355ff6e77af5cfe7c245fb58d66cede2fc35c0391fd7b29f269b15b5813cd007e590f138b7679545048955cd742734daf3632e0b6cd7abdc

Download Submit
/data/data/com.seemrecord50/cache/oat/ufqfiqru.cur.prof

Filesize
470B

MD5
70f76da4617c41b5a239acbd28c919ca

SHA1
224c107650548e75987e710ed2cb49fafc019dbf

SHA256
b2fefa3428f255cac45797b833d828405dd0c6c4088320dcb910b6292b22bd12

SHA512
1c9adbda1244fe00f532757f535b1c498617d132dae0ec99624b822857ae0df9a357197e9bb2f2000884a225ff86631669d9d5382307407930ae583b3589ffe6

Download Submit
/data/data/com.seemrecord50/cache/ufqfiqru

Filesize
448KB

MD5
2c0de30a99bb14fd2aa25eef4be4d3ff

SHA1
8225583d55873c798ba5c3cb81b3c0b796ee6e43

SHA256
56a5d625b2c185ffbbcd128e32b6ecbab85b2112b1b5a05ae4ff0648be096378

SHA512
f1201165d7861d7e8100aee52a48107f2f33a6ca4e74247825b04379269d86f2bb711aa925eb629d80840ca6357da1c4beb502514bcad52d39a9af154964633d

Download Submit
/data/data/com.seemrecord50/kl.txt

Filesize
28B

MD5
6311c3fd15588bb5c126e6c28ff5fffe

SHA1
ce81d136fce31779f4dd62e20bdaf99c91e2fc57

SHA256
8b82f6032e29a2b5c96031a3630fb6173d12ff0295bc20bb21b877d08f0812d8

SHA512
2975fe2e94b6a8adc9cfc1a865ad113772b54572883a537b02a16dd2d029c0f7d9cca3b154fd849bdfe978e18b396bcf9fa6e67e7c61f92bdc089a29a9c355c6

Download Submit
/data/data/com.seemrecord50/kl.txt

Filesize
237B

MD5
6471e9eb88d175d119b2977f6cc29f60

SHA1
1638efce86f64b5f95caabf24d94d74ae54d1253

SHA256
f7b6f6f9273e9d32840c8b2c74c9cafb8084c3af047a40c791d8366f6b87226a

SHA512
ded9c3d115376087ca4743ef9febacdf92124cd14ac033ffbf6d360a02d5287bb95385e0fa1de90bc7cdf21cbe89e02a067facb6b10d05a6fba990e25f8f34bf

Download Submit
/data/data/com.seemrecord50/kl.txt

Filesize
63B

MD5
496db16bd4a51666801e10e22c8346cd

SHA1
309503a260d99a859d02c23586dc6c37bec78a3f

SHA256
e4198ac4a8ae53fbe5dee525c239a53b77132c3f82f3100bb3c3473e89bb8a17

SHA512
1365ba27d4eed6e80fb94497282804ae994eaadf14a0edc5937a05b4c60e299a1aa40d1cdd05d72e8fc8d6e63d2bcd2f5446f889cc77753b7f0543c37e8ec223

Download Submit
/data/data/com.seemrecord50/kl.txt

Filesize
54B

MD5
2fa806e9c5121f96dc5f946c49eb01b9

SHA1
09681cdb6f59761febdfcb524091d0b4cd68c4bd

SHA256
90036c749c8e0eae16eb252f2f4569415368aa800d039ace288eafa8f8d6ecdf

SHA512
688de8c14c48ded6696a9e13c53653a8fdba26e108fa4911bb721f493290fb08b32c6464e2f1dcb0b9a668f30af49fe6fa89710fb0d64be9842889c67e7c0a0b

Download Submit
/data/data/com.seemrecord50/kl.txt

Filesize
437B

MD5
649f90badcf51e16a922816219e175d7

SHA1
a271a6a8a7324fd35c05864905c547a2cff43ed8

SHA256
f4e6b48bed78554271dae9c3488e824d92e26a34962aab991d40b0cfc5220d23

SHA512
e8c55c0fa6655db7c9b3c831e9baeff1886da3e3b38c3103e467d8d45ba89bcb0a34680f1501add0c44a727e43e8e098b54a2af1a53455fdc0a333fac0a2a11a

Download Submit
/data/user/0/com.seemrecord50/app_DynamicOptDex/Bak.json

Filesize
2KB

MD5
bf26f47053b14150dfae1c66b19bd044

SHA1
a75925a375cc6a1185929ad032ff1b303124b85c

SHA256
1782693039156c4a15ebd22ff8938d7d612189c74f78d865f90b9ad60c77f36c

SHA512
f5fcf5206ef7caa99404d26aae864880e8fe2d4873b687b584a7969b0117261bcd822c9af9c93ed89fbab7d357c2efcbfcd3fb0c7ca298d7eebb942992f1626e

Download Submit
/data/user/0/com.seemrecord50/app_DynamicOptDex/Bak.json

Filesize
2KB

MD5
4a4b5324d90db767f9420f5aa0eb4efe

SHA1
01b1fe6955e531b6ea62a30ea93170dbd31d380a

SHA256
eb1f100764519c7b3e77f14b284e06966c670067f7867a68090a2d535381685b

SHA512
3a8c92b1c7949a94a54da0de9c35c1693cd32801780a9aeeb18c530cfe530c214fd2b47b943d15f207802f171f6b47a86de54117d266386da048b34adb3b41bd

Download Submit

Analysis

Sharing

General

Malware Config

Extracted

Extracted

Signatures

Processes

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads