octo | 83637cd6f00a0d5efaecdafea12a496c22716548aa076b3371b0af523a3ecc4f

Analysis

max time kernel
33s
max time network
132s
platform
android_x86
resource
android-x86-arm-20240624-en
resource tags

androidarch:armarch:x86image:android-x86-arm-20240624-enlocale:en-usos:android-9-x86system
submitted
19-12-2024 22:00

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

83637cd6f00a0d5efaecdafea12a496c22716548aa076b3371b0af523a3ecc4f.apk
Size

1.8MB
MD5

9053c49c23c385963d4c2fea0d2e4968
SHA1

ed8f4804268aa4bb26283b5f03d658267f11cabe
SHA256

83637cd6f00a0d5efaecdafea12a496c22716548aa076b3371b0af523a3ecc4f
SHA512

2594313e6aa0aa2d42ec2cf1ded22701efba2d75b8865db18411728b8dd2063f2b04db152eefd1306331da58e0068071cc14596d2574f44f3e1c3ec76ff1b4eb
SSDEEP

49152:jcNxAVbGDmK2kN/7eBp178ldqOZG3R/wifomSsDC7iehC8UF:jcNbyKvdSB8/eFdAmS8TQC1F

Score

10^/10

octo banker collection credential_access discovery evasion impact infostealer persistence rat stealth trojan

Malware Config

Extracted

Family

octo

https://cosmosalienadventures.xyz/YmJlYTFiODdkMjcz/

https://intergalacticvoyages.xyz/YmJlYTFiODdkMjcz/

https://stellarexplorations.xyz/YmJlYTFiODdkMjcz/

https://quantumspaceodyssey.xyz/YmJlYTFiODdkMjcz/

https://extraterrestrialhub.xyz/YmJlYTFiODdkMjcz/

https://nebularresearchlabs.xyz/YmJlYTFiODdkMjcz/

https://cosmicfrontiersquad.xyz/YmJlYTFiODdkMjcz/

https://andromedamissions.xyz/YmJlYTFiODdkMjcz/

https://orbitalknowledgenet.xyz/YmJlYTFiODdkMjcz/

https://aliencivilizations.xyz/YmJlYTFiODdkMjcz/

https://celestialinventions.xyz/YmJlYTFiODdkMjcz/

https://astralnavigationxyz.xyz/YmJlYTFiODdkMjcz/

https://galacticcodexbase.xyz/YmJlYTFiODdkMjcz/

https://proximaexpedition.xyz/YmJlYTFiODdkMjcz/

https://universespectrum.xyz/YmJlYTFiODdkMjcz/

https://keplerinfinityteam.xyz/YmJlYTFiODdkMjcz/

https://astronomicalpioneers.xyz/YmJlYTFiODdkMjcz/

https://xenoscientificera.xyz/YmJlYTFiODdkMjcz/

https://orbitalscientists.xyz/YmJlYTFiODdkMjcz/

https://cosmicventurespro.xyz/YmJlYTFiODdkMjcz/

rc4.plain

Extracted

Family

octo

https://cosmosalienadventures.xyz/YmJlYTFiODdkMjcz/

https://intergalacticvoyages.xyz/YmJlYTFiODdkMjcz/

https://stellarexplorations.xyz/YmJlYTFiODdkMjcz/

https://quantumspaceodyssey.xyz/YmJlYTFiODdkMjcz/

https://extraterrestrialhub.xyz/YmJlYTFiODdkMjcz/

https://nebularresearchlabs.xyz/YmJlYTFiODdkMjcz/

https://cosmicfrontiersquad.xyz/YmJlYTFiODdkMjcz/

https://andromedamissions.xyz/YmJlYTFiODdkMjcz/

https://orbitalknowledgenet.xyz/YmJlYTFiODdkMjcz/

https://aliencivilizations.xyz/YmJlYTFiODdkMjcz/

https://celestialinventions.xyz/YmJlYTFiODdkMjcz/

https://astralnavigationxyz.xyz/YmJlYTFiODdkMjcz/

https://galacticcodexbase.xyz/YmJlYTFiODdkMjcz/

https://proximaexpedition.xyz/YmJlYTFiODdkMjcz/

https://universespectrum.xyz/YmJlYTFiODdkMjcz/

https://keplerinfinityteam.xyz/YmJlYTFiODdkMjcz/

https://astronomicalpioneers.xyz/YmJlYTFiODdkMjcz/

https://xenoscientificera.xyz/YmJlYTFiODdkMjcz/

https://orbitalscientists.xyz/YmJlYTFiODdkMjcz/

https://cosmicventurespro.xyz/YmJlYTFiODdkMjcz/

AES_key

Signatures

Octo
Octo is a banking malware with remote access capabilities first seen in April 2022.
banker trojan infostealer rat octo
Octo family
octo

Octo payload 2 IoCs

resource	yara_rule
behavioral1/memory/4339-0.dex	family_octo
behavioral1/memory/4312-0.dex	family_octo

Removes its main activity from the application launcher 1 TTPs 1 IoCs

stealth trojan evasion

Suppress Application Icon

T1628.001

pid	Process
4312	com.hungry.total

Loads dropped Dex/Jar 1 TTPs 2 IoCs

Runs executable file dropped to the device during analysis.

evasion

Download New Code at Runtime

T1407

ioc	pid	Process
/data/user/0/com.hungry.total/app_timber/jQTiBL.json	4339	/system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.hungry.total/app_timber/jQTiBL.json --output-vdex-fd=41 --oat-fd=42 --oat-location=/data/user/0/com.hungry.total/app_timber/oat/x86/jQTiBL.odex --compiler-filter=quicken --class-loader-context=&
/data/user/0/com.hungry.total/app_timber/jQTiBL.json	4312	com.hungry.total

Makes use of the framework's Accessibility service 4 TTPs 2 IoCs

Retrieves information displayed on the phone screen using AccessibilityService.

collection evasion credential_access

Input Injection

T1516

Screen Capture

T1513

Keylogging

T1417.001

GUI Input Capture

T1417.002

description	ioc	Process
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId	com.hungry.total
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByViewId	com.hungry.total

Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
banker discovery

Security Software Discovery
T1418.001
Queries the phone number (MSISDN for GSM devices) 1 TTPs
discovery

System Network Configuration Discovery
T1422

Acquires the wake lock 1 IoCs

description	ioc	Process
Framework service call	android.os.IPowerManager.acquireWakeLock	com.hungry.total

Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs

Application may abuse the framework's foreground service to continue running in the foreground.

evasion persistence

Foreground Persistence

T1541

description	ioc	Process
Framework service call	android.app.IActivityManager.setServiceForeground	com.hungry.total

Performs UI accessibility actions on behalf of the user 1 TTPs 4 IoCs

Application may abuse the accessibility service to prevent their removal.

evasion

Prevent Application Removal

T1629.001

ioc	Process
android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction	com.hungry.total
android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction	com.hungry.total
android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction	com.hungry.total
android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction	com.hungry.total

Queries the mobile country code (MCC) 1 TTPs 1 IoCs

discovery

System Network Configuration Discovery

T1422

description	ioc	Process
Framework service call	com.android.internal.telephony.ITelephony.getNetworkCountryIsoForPhone	com.hungry.total

Queries the unique device ID (IMEI, MEID, IMSI) 1 TTPs
discovery

System Network Configuration Discovery
T1422

Requests accessing notifications (often used to intercept notifications before users become aware). 1 TTPs 1 IoCs

collection credential_access

Access Notifications

T1517

description	ioc	Process
Intent action	android.settings.ACTION_NOTIFICATION_LISTENER_SETTINGS	com.hungry.total

Requests disabling of battery optimizations (often used to enable hiding in the background). 1 TTPs 1 IoCs

evasion

User Evasion

T1628.002

description	ioc	Process
Intent action	android.settings.REQUEST_IGNORE_BATTERY_OPTIMIZATIONS	com.hungry.total

Requests modifying system settings. 1 IoCs

evasion

description	ioc	Process
Intent action	android.settings.action.MANAGE_WRITE_SETTINGS	com.hungry.total

Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs

persistence

Broadcast Receivers

T1624.001

description	ioc	Process
Framework service call	android.app.IActivityManager.registerReceiver	com.hungry.total

Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs

impact

Data Encrypted for Impact

T1471

description	ioc	Process
Framework API call	javax.crypto.Cipher.doFinal	com.hungry.total

com.hungry.total
1⤵
- Removes its main activity from the application launcher
- Loads dropped Dex/Jar
- Makes use of the framework's Accessibility service
- Acquires the wake lock
- Makes use of the framework's foreground persistence service
- Performs UI accessibility actions on behalf of the user
- Queries the mobile country code (MCC)
- Requests accessing notifications (often used to intercept notifications before users become aware).
- Requests disabling of battery optimizations (often used to enable hiding in the background).
- Requests modifying system settings.
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Uses Crypto APIs (Might try to encrypt user data)
PID:4312
- /system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.hungry.total/app_timber/jQTiBL.json --output-vdex-fd=41 --oat-fd=42 --oat-location=/data/user/0/com.hungry.total/app_timber/oat/x86/jQTiBL.odex --compiler-filter=quicken --class-loader-context=&
  2⤵
  - Loads dropped Dex/Jar
  PID:4339

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Event Triggered Execution

T1624

Broadcast Receivers

T1624.001

Foreground Persistence

T1541

Privilege Escalation

Defense Evasion

Download New Code at Runtime

T1407

Foreground Persistence

T1541

Hide Artifacts

T1628

Suppress Application Icon

T1628.001

User Evasion

T1628.002

Impair Defenses

T1629

Prevent Application Removal

T1629.001

Input Injection

T1516

Credential Access

Access Notifications

T1517

Input Capture

T1417

GUI Input Capture

T1417.002

Keylogging

T1417.001

Discovery

Software Discovery

T1418

Security Software Discovery

T1418.001

System Network Configuration Discovery

T1422

Lateral Movement

Collection

Access Notifications

T1517

Input Capture

T1417

GUI Input Capture

T1417.002

Keylogging

T1417.001

Screen Capture

T1513

Command and Control

Exfiltration

Impact

Data Encrypted for Impact

T1471

Input Injection

T1516

Replay Monitor

Loading Replay Monitor...

Downloads

/data/data/com.hungry.total/app_timber/jQTiBL.json

Filesize
153KB

MD5
036c56b3467b68cb950e50dd93538fc9

SHA1
fc361dcc964be6fd89885721bee6e78df7216ee5

SHA256
03fe27c9e7fda8458158c2590fb6f3c8e05335b3aa72308f163f4cd58bacd742

SHA512
ecaffff390ce4bed6a83bd17ef52d92db72df54fa4b426c860e9e14a83f7050d15fb60c1658433945e6ea6439cfaab7d0851acf2a993591c8fd52168cc363482

Download Submit
/data/data/com.hungry.total/app_timber/jQTiBL.json

Filesize
153KB

MD5
76ed2c7c1047cf8d557ce7a9ae2a08dc

SHA1
f6ea5e81372bb704cc1336549c2dde0af55ae837

SHA256
52eaab8ceb05c63f83a804ada71e90a1101340870412c9c67f4146303d18030f

SHA512
6783e4635b7de7b65ae9ac0187d034aa574c22f7ed79fe06087326ea465342998201be5e55993bf1bb3649e0e21b9e12a1125676b1d23ea603c141192277ad02

Download Submit
/data/user/0/com.hungry.total/app_timber/jQTiBL.json

Filesize
450KB

MD5
ff03098e9c5eef9861badb7ea96487ac

SHA1
ef26f68e63fffd72246531f65cd23433d0f8bd8f

SHA256
8fc36b21b9c021d9d9d68db7a49c1e0e612b42c7ab4b598b7524452152b6c1b2

SHA512
f2459aa7cb55cac87ca6108f211705d63e969430703d702ebb2ac72f2f13b9950cd4f7f41f040afe1309e32d17baca0cad24171715e53e54f9ab0e563e319533

Download Submit
/data/user/0/com.hungry.total/app_timber/jQTiBL.json

Filesize
450KB

MD5
eb9896da0dd5baef5758312994e6eece

SHA1
58a309b401ff57a1c5e98d6683d604f7ec24bfed

SHA256
b0413f9c8005ae5c6926028ba09966c0f5ae20b47efd7347b3dc253995b8bdae

SHA512
b07593d04c832b4c206e4e9e04e600baf7ef0bd60db0e6f4d350a600f4ec637def9b31b9bf6fa7d2e95dc788fb013153ebc49157405d3dc6161ab9426ea9b624

Download Submit

Analysis

Sharing

General

Malware Config

Extracted

Extracted

Signatures

Processes

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads