octo | 2a5b685c30dbf2337faea9ab0417d666506a545b9b9ce2cfc37602ecaf0c18e3

Analysis

max time kernel
149s
max time network
134s
platform
android_x64
resource
android-33-x64-arm64-20240624-en
resource tags

androidarch:arm64arch:x64image:android-33-x64-arm64-20240624-enlocale:en-usos:android-13-x64system
submitted
18-12-2024 22:09

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2a5b685c30dbf2337faea9ab0417d666506a545b9b9ce2cfc37602ecaf0c18e3.apk
Size

2.3MB
MD5

5fd97616f08b29703e97037cadda8c6f
SHA1

f7272c94d983d3bdd698f5ce24b3c4de0058903d
SHA256

2a5b685c30dbf2337faea9ab0417d666506a545b9b9ce2cfc37602ecaf0c18e3
SHA512

46eca7f56bec61d9b0b27b1307f1f2dd8dc413a21e775e5cd814b5c3437d41b241680605eec16d3ca8b4453a81d2935602a3c23645b11e85c76e86c806e896a9
SSDEEP

49152:3voNod9lEUfJrSEkf13915p0ag+NtYcUcBWnsvcf03F/7D++juRhw:3v3kf13915p0agsl8svcf03F/KRO

Score

10^/10

octo banker collection credential_access discovery evasion impact infostealer persistence rat trojan

Malware Config

Extracted

Family

octo

https://topflowow.top/ZmU2YzQ2NjZlNjc2/

https://bobnoopopo.org/ZmU2YzQ2NjZlNjc2/

https://junggvrebvqqpo.org/ZmU2YzQ2NjZlNjc2/

https://junggpervbvqqqqqqpo.com/ZmU2YzQ2NjZlNjc2/

https://junggvbvqqgrouppo.com/ZmU2YzQ2NjZlNjc2/

https://junggvbvqqnetokpo.com/ZmU2YzQ2NjZlNjc2/

https://junggvbvq.top/ZmU2YzQ2NjZlNjc2/

https://junggvbvq5656.top/ZmU2YzQ2NjZlNjc2/

https://jungjunjunggvbvq.top/ZmU2YzQ2NjZlNjc2/

rc4.plain

Extracted

Family

octo

https://topflowow.top/ZmU2YzQ2NjZlNjc2/

https://bobnoopopo.org/ZmU2YzQ2NjZlNjc2/

https://junggvrebvqqpo.org/ZmU2YzQ2NjZlNjc2/

https://junggpervbvqqqqqqpo.com/ZmU2YzQ2NjZlNjc2/

https://junggvbvqqgrouppo.com/ZmU2YzQ2NjZlNjc2/

https://junggvbvqqnetokpo.com/ZmU2YzQ2NjZlNjc2/

https://junggvbvq.top/ZmU2YzQ2NjZlNjc2/

https://junggvbvq5656.top/ZmU2YzQ2NjZlNjc2/

https://jungjunjunggvbvq.top/ZmU2YzQ2NjZlNjc2/

AES_key

Signatures

Octo
Octo is a banking malware with remote access capabilities first seen in April 2022.
banker trojan infostealer rat octo
Octo family
octo

Octo payload 1 IoCs

resource	yara_rule
behavioral2/files/fstream-3.dat	family_octo

Loads dropped Dex/Jar 1 TTPs 2 IoCs

Runs executable file dropped to the device during analysis.

evasion

Download New Code at Runtime

T1407

ioc	pid	Process
/data/user/0/com.seemrecord50/app_DynamicOptDex/Bak.json	4323	com.seemrecord50
/data/user/0/com.seemrecord50/cache/ufqfiqru	4323	com.seemrecord50

Makes use of the framework's Accessibility service 4 TTPs 2 IoCs

Retrieves information displayed on the phone screen using AccessibilityService.

collection evasion credential_access

Input Injection

T1516

Screen Capture

T1513

Keylogging

T1417.001

GUI Input Capture

T1417.002

description	ioc	Process
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByViewId	com.seemrecord50
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId	com.seemrecord50

Obtains sensitive information copied to the device clipboard 2 TTPs 1 IoCs

Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.

collection credential_access impact

Clipboard Data

T1414

Transmitted Data Manipulation

T1641.001

description	ioc	Process
Framework service call	android.content.IClipboard.addPrimaryClipChangedListener	com.seemrecord50

Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
banker discovery

Security Software Discovery
T1418.001
Queries the phone number (MSISDN for GSM devices) 1 TTPs
discovery

System Network Configuration Discovery
T1422

Acquires the wake lock 1 IoCs

description	ioc	Process
Framework service call	android.os.IPowerManager.acquireWakeLock	com.seemrecord50

Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs

Application may abuse the framework's foreground service to continue running in the foreground.

evasion persistence

Foreground Persistence

T1541

description	ioc	Process
Framework service call	android.app.IActivityManager.setServiceForeground	com.seemrecord50

Performs UI accessibility actions on behalf of the user 1 TTPs 3 IoCs

Application may abuse the accessibility service to prevent their removal.

evasion

Prevent Application Removal

T1629.001

ioc	Process
android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction	com.seemrecord50
android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction	com.seemrecord50
android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction	com.seemrecord50

Queries the mobile country code (MCC) 1 TTPs 1 IoCs

discovery

System Network Configuration Discovery

T1422

description	ioc	Process
Framework service call	com.android.internal.telephony.ITelephony.getNetworkCountryIsoForPhone	com.seemrecord50

Reads information about phone network operator. 1 TTPs
discovery

System Network Configuration Discovery
T1422

Requests accessing notifications (often used to intercept notifications before users become aware). 1 TTPs 1 IoCs

collection credential_access

Access Notifications

T1517

description	ioc	Process
Intent action	android.settings.ACTION_NOTIFICATION_LISTENER_SETTINGS	com.seemrecord50

Requests disabling of battery optimizations (often used to enable hiding in the background). 1 TTPs 1 IoCs

evasion

User Evasion

T1628.002

description	ioc	Process
Intent action	android.settings.REQUEST_IGNORE_BATTERY_OPTIMIZATIONS	com.seemrecord50

Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs

impact

Data Encrypted for Impact

T1471

description	ioc	Process
Framework API call	javax.crypto.Cipher.doFinal	com.seemrecord50

Checks CPU information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/cpuinfo	com.seemrecord50

Checks memory information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/meminfo	com.seemrecord50

com.seemrecord50
1⤵
- Loads dropped Dex/Jar
- Makes use of the framework's Accessibility service
- Obtains sensitive information copied to the device clipboard
- Acquires the wake lock
- Makes use of the framework's foreground persistence service
- Performs UI accessibility actions on behalf of the user
- Queries the mobile country code (MCC)
- Requests accessing notifications (often used to intercept notifications before users become aware).
- Requests disabling of battery optimizations (often used to enable hiding in the background).
- Uses Crypto APIs (Might try to encrypt user data)
- Checks CPU information
- Checks memory information
PID:4323

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Foreground Persistence

T1541

Privilege Escalation

Defense Evasion

Download New Code at Runtime

T1407

Foreground Persistence

T1541

Hide Artifacts

T1628

User Evasion

T1628.002

Impair Defenses

T1629

Prevent Application Removal

T1629.001

Input Injection

T1516

Virtualization/Sandbox Evasion

T1633

System Checks

T1633.001

Credential Access

Access Notifications

T1517

Clipboard Data

T1414

Input Capture

T1417

GUI Input Capture

T1417.002

Keylogging

T1417.001

Discovery

Software Discovery

T1418

Security Software Discovery

T1418.001

System Information Discovery

T1426

System Network Configuration Discovery

T1422

Lateral Movement

Collection

Access Notifications

T1517

Clipboard Data

T1414

Input Capture

T1417

GUI Input Capture

T1417.002

Keylogging

T1417.001

Screen Capture

T1513

Command and Control

Exfiltration

Impact

Data Encrypted for Impact

T1471

Data Manipulation

T1641

Transmitted Data Manipulation

T1641.001

Input Injection

T1516

Replay Monitor

Loading Replay Monitor...

Downloads

/data/user/0/com.seemrecord50/app_DynamicOptDex/Bak.json

Filesize
1KB

MD5
d6c1144683e562fc290020a7dc429ddf

SHA1
ed2290285aa55449906a78d9eeb1abcd92516b40

SHA256
30095185618f5a1dc553fdc0389d238b72e13aa438d9b140cb99442c32ac3dca

SHA512
1727fab88f27f3a94437359c0ae1955442a23e4affedd51c27ad0c942b9125c3498414e99bbf378d738b65b2344550a0f463d82f68cab92c9a4443a6f5cf1ae6

Download Submit
/data/user/0/com.seemrecord50/app_DynamicOptDex/Bak.json

Filesize
1KB

MD5
ec9147ab2083675ce262edd7dd6507b1

SHA1
73e99216f04828906406e72891452a992d09cd1e

SHA256
55e6bb2c554f4f962996212731293cdb61b34b8764146051ae87abf263ee3277

SHA512
7d84c88261ae2b6c355ff6e77af5cfe7c245fb58d66cede2fc35c0391fd7b29f269b15b5813cd007e590f138b7679545048955cd742734daf3632e0b6cd7abdc

Download Submit
/data/user/0/com.seemrecord50/app_DynamicOptDex/Bak.json

Filesize
2KB

MD5
4a4b5324d90db767f9420f5aa0eb4efe

SHA1
01b1fe6955e531b6ea62a30ea93170dbd31d380a

SHA256
eb1f100764519c7b3e77f14b284e06966c670067f7867a68090a2d535381685b

SHA512
3a8c92b1c7949a94a54da0de9c35c1693cd32801780a9aeeb18c530cfe530c214fd2b47b943d15f207802f171f6b47a86de54117d266386da048b34adb3b41bd

Download Submit
/data/user/0/com.seemrecord50/cache/oat/ufqfiqru.cur.prof

Filesize
381B

MD5
7bc2e3b742cc21ed827beef4fd01313c

SHA1
9ce97e7dfe318d9ce7d79822edfbe1d4fad1cbc8

SHA256
4267378cc81414fc7db3d807c182952537aa55ee3469819808d8edeb6143a83c

SHA512
f44deb858a5019ae45f9799a061e67f603f36e54d989162f8fc6066e16ec58ce364614de923d6fb76ae0d0dbaf2b44e6541b68da3480cb5e6dce0c32f1599ac2

Download Submit
/data/user/0/com.seemrecord50/cache/ufqfiqru

Filesize
448KB

MD5
2c0de30a99bb14fd2aa25eef4be4d3ff

SHA1
8225583d55873c798ba5c3cb81b3c0b796ee6e43

SHA256
56a5d625b2c185ffbbcd128e32b6ecbab85b2112b1b5a05ae4ff0648be096378

SHA512
f1201165d7861d7e8100aee52a48107f2f33a6ca4e74247825b04379269d86f2bb711aa925eb629d80840ca6357da1c4beb502514bcad52d39a9af154964633d

Download Submit
/data/user/0/com.seemrecord50/kl.txt

Filesize
61B

MD5
0be032ca0370cea80d3461322dfc68c4

SHA1
25aa07e1b7920f6087afd7d14119e9c0ec722344

SHA256
ff3862e6d2c494db71559354dd50cbb7f25a9565d242c621e8303190206ec4ef

SHA512
a29afe5428daab252c1c3c56667eeb527a4dcfe19f6e9d27eaba940bcc1c4df1bf0dd57ec8b2fa1feb7faf6d39547d861c488eed2c43607fd8c7c8b2c006206f

Download Submit
/data/user/0/com.seemrecord50/kl.txt

Filesize
72B

MD5
0b47b5f67754ce301e3e08228113735a

SHA1
37ecb57e8210402889d4ab7d4c0ae1ffc557d3cb

SHA256
7eac544e14f112da60520cd6d95c835e18bf8833cf142ae6a253f1af664cb57a

SHA512
3fa3a14a60a89dff08706e0ae9e6f2ba855d623609130af339378b56e37114d06e3f39ea3a03e2923ea50338f50b5fec7a856441c5ea5f53aef464597946b61a

Download Submit
/data/user/0/com.seemrecord50/kl.txt

Filesize
28B

MD5
6311c3fd15588bb5c126e6c28ff5fffe

SHA1
ce81d136fce31779f4dd62e20bdaf99c91e2fc57

SHA256
8b82f6032e29a2b5c96031a3630fb6173d12ff0295bc20bb21b877d08f0812d8

SHA512
2975fe2e94b6a8adc9cfc1a865ad113772b54572883a537b02a16dd2d029c0f7d9cca3b154fd849bdfe978e18b396bcf9fa6e67e7c61f92bdc089a29a9c355c6

Download Submit
/data/user/0/com.seemrecord50/kl.txt

Filesize
221B

MD5
b432622111461f624faa402023b97d8d

SHA1
3fef5063d0185a60ee55a3da33217c50476e6c62

SHA256
2456a2d4ee0ae50497c062252199c67b3b34e8ddab1e299886fa02be20055296

SHA512
4df3beb0223fc271691dc7c5935a552fb3027617250a79c5ad23ba80d870bbf7b845c21faa20bae2e0280b6f4197ff9fe30fb70b702c120a3e54de4b88762210

Download Submit
/data/user/0/com.seemrecord50/kl.txt

Filesize
60B

MD5
0910760e3e058263d6bf2d5db4e6c134

SHA1
5793648dd05e3118567e3f72b1491bc7ee12fe96

SHA256
90b3964796c0ab64a2d4439d29dfcc258ae522d09609176e26e28360e133ba78

SHA512
8fe65a6c275ab3a62f5cb207a859dd0e8e3a3847415e8a56e701cc79d55ffc594e7a495a085e7546acb395975d3d1580000787e435f43ee71c0d1353c6cfdb46

Download Submit

Analysis

Sharing

General

Malware Config

Extracted

Extracted

Signatures

Processes

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads