octo | 1dfd6d723300730bfbc35d1f52f3a4c091ab6b87b093ea9dea28017985351923

Analysis

max time kernel
148s
max time network
131s
platform
android_x86
resource
android-x86-arm-20240624-en
resource tags

androidarch:armarch:x86image:android-x86-arm-20240624-enlocale:en-usos:android-9-x86system
submitted
22-12-2024 22:06

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

1dfd6d723300730bfbc35d1f52f3a4c091ab6b87b093ea9dea28017985351923.apk
Size

2.2MB
MD5

832e4f3aa43c1ad52a1c84ef21af2f16
SHA1

4785024a8a8a6a2b91bdd6bf783cab804ff98514
SHA256

1dfd6d723300730bfbc35d1f52f3a4c091ab6b87b093ea9dea28017985351923
SHA512

9ef866f3b54e5a32ac4181a48992ae5796664be8db154961c9054043360213c88eaf8da78bc8d76a30e5b514f0f0484bc20bb7b35c6c02ff80e32a1700acaf46
SSDEEP

49152:wTBKw/sDJC0SGX1IZkh+90Kjhc5ZGZbmqy2YcYZP5YTO5GxZPsnAE4KoSBcEDGK/:eBKw6JTnX2kh+boZQ/y/cYZ2CALAkKME

Score

10^/10

octo banker collection credential_access discovery evasion impact infostealer persistence rat stealth trojan

Malware Config

Extracted

Family

octo

https://bukkub.top/Y2U5ZjYxZTA5Zjcw/

https://bobnoopopo.org/Y2U5ZjYxZTA5Zjcw/

https://junggvrebvqqpo.org/Y2U5ZjYxZTA5Zjcw/

https://junggpervbvqqqqqqpo.com/Y2U5ZjYxZTA5Zjcw/

https://junggvbvqqgrouppo.com/Y2U5ZjYxZTA5Zjcw/

https://junggvbvqqnetokpo.com/Y2U5ZjYxZTA5Zjcw/

https://junggvbvq.top/Y2U5ZjYxZTA5Zjcw/

https://junggvbvq5656.top/Y2U5ZjYxZTA5Zjcw/

https://jungjunjunggvbvq.top/Y2U5ZjYxZTA5Zjcw/

rc4.plain

Extracted

Family

octo

https://bukkub.top/Y2U5ZjYxZTA5Zjcw/

https://bobnoopopo.org/Y2U5ZjYxZTA5Zjcw/

https://junggvrebvqqpo.org/Y2U5ZjYxZTA5Zjcw/

https://junggpervbvqqqqqqpo.com/Y2U5ZjYxZTA5Zjcw/

https://junggvbvqqgrouppo.com/Y2U5ZjYxZTA5Zjcw/

https://junggvbvqqnetokpo.com/Y2U5ZjYxZTA5Zjcw/

https://junggvbvq.top/Y2U5ZjYxZTA5Zjcw/

https://junggvbvq5656.top/Y2U5ZjYxZTA5Zjcw/

https://jungjunjunggvbvq.top/Y2U5ZjYxZTA5Zjcw/

AES_key

Signatures

Octo
Octo is a banking malware with remote access capabilities first seen in April 2022.
banker trojan infostealer rat octo
Octo family
octo

Octo payload 1 IoCs

resource	yara_rule
behavioral1/files/fstream-6.dat	family_octo

Removes its main activity from the application launcher 1 TTPs 1 IoCs

stealth trojan evasion

Suppress Application Icon

T1628.001

pid	Process
4259	com.teachvery73

Checks Android system properties for emulator presence. 1 TTPs 1 IoCs

evasion

System Checks

T1633.001

description	ioc	Process
Accessed system property	key: ro.product.model	com.teachvery73

Loads dropped Dex/Jar 1 TTPs 4 IoCs

Runs executable file dropped to the device during analysis.

evasion

Download New Code at Runtime

T1407

ioc	pid	Process
/data/user/0/com.teachvery73/app_DynamicOptDex/Yw.json	4283	/system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.teachvery73/app_DynamicOptDex/Yw.json --output-vdex-fd=41 --oat-fd=42 --oat-location=/data/user/0/com.teachvery73/app_DynamicOptDex/oat/x86/Yw.odex --compiler-filter=quicken --class-loader-context=&
/data/user/0/com.teachvery73/app_DynamicOptDex/Yw.json	4259	com.teachvery73
/data/user/0/com.teachvery73/cache/fvtdomk	4259	com.teachvery73
/data/user/0/com.teachvery73/cache/fvtdomk	4259	com.teachvery73

Makes use of the framework's Accessibility service 4 TTPs 2 IoCs

Retrieves information displayed on the phone screen using AccessibilityService.

collection evasion credential_access

Input Injection

T1516

Screen Capture

T1513

Keylogging

T1417.001

GUI Input Capture

T1417.002

description	ioc	Process
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId	com.teachvery73
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByViewId	com.teachvery73

Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
banker discovery

Security Software Discovery
T1418.001
Queries the phone number (MSISDN for GSM devices) 1 TTPs
discovery

System Network Configuration Discovery
T1422

Acquires the wake lock 1 IoCs

description	ioc	Process
Framework service call	android.os.IPowerManager.acquireWakeLock	com.teachvery73

Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs

Application may abuse the framework's foreground service to continue running in the foreground.

evasion persistence

Foreground Persistence

T1541

description	ioc	Process
Framework service call	android.app.IActivityManager.setServiceForeground	com.teachvery73

Performs UI accessibility actions on behalf of the user 1 TTPs 3 IoCs

Application may abuse the accessibility service to prevent their removal.

evasion

Prevent Application Removal

T1629.001

ioc	Process
android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction	com.teachvery73
android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction	com.teachvery73
android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction	com.teachvery73

Queries the mobile country code (MCC) 1 TTPs 1 IoCs

discovery

System Network Configuration Discovery

T1422

description	ioc	Process
Framework service call	com.android.internal.telephony.ITelephony.getNetworkCountryIsoForPhone	com.teachvery73

Queries the unique device ID (IMEI, MEID, IMSI) 1 TTPs
discovery

System Network Configuration Discovery
T1422

Requests accessing notifications (often used to intercept notifications before users become aware). 1 TTPs 1 IoCs

collection credential_access

Access Notifications

T1517

description	ioc	Process
Intent action	android.settings.ACTION_NOTIFICATION_LISTENER_SETTINGS	com.teachvery73

Requests disabling of battery optimizations (often used to enable hiding in the background). 1 TTPs 1 IoCs

evasion

User Evasion

T1628.002

description	ioc	Process
Intent action	android.settings.REQUEST_IGNORE_BATTERY_OPTIMIZATIONS	com.teachvery73

Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs

persistence

Broadcast Receivers

T1624.001

description	ioc	Process
Framework service call	android.app.IActivityManager.registerReceiver	com.teachvery73

Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs

impact

Data Encrypted for Impact

T1471

description	ioc	Process
Framework API call	javax.crypto.Cipher.doFinal	com.teachvery73

Checks CPU information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/cpuinfo	com.teachvery73

Checks memory information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/meminfo	com.teachvery73

com.teachvery73
1⤵
- Removes its main activity from the application launcher
- Checks Android system properties for emulator presence.
- Loads dropped Dex/Jar
- Makes use of the framework's Accessibility service
- Acquires the wake lock
- Makes use of the framework's foreground persistence service
- Performs UI accessibility actions on behalf of the user
- Queries the mobile country code (MCC)
- Requests accessing notifications (often used to intercept notifications before users become aware).
- Requests disabling of battery optimizations (often used to enable hiding in the background).
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Uses Crypto APIs (Might try to encrypt user data)
- Checks CPU information
- Checks memory information
PID:4259
- /system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.teachvery73/app_DynamicOptDex/Yw.json --output-vdex-fd=41 --oat-fd=42 --oat-location=/data/user/0/com.teachvery73/app_DynamicOptDex/oat/x86/Yw.odex --compiler-filter=quicken --class-loader-context=&
  2⤵
  - Loads dropped Dex/Jar
  PID:4283

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Event Triggered Execution

T1624

Broadcast Receivers

T1624.001

Foreground Persistence

T1541

Privilege Escalation

Defense Evasion

Download New Code at Runtime

T1407

Foreground Persistence

T1541

Hide Artifacts

T1628

Suppress Application Icon

T1628.001

User Evasion

T1628.002

Impair Defenses

T1629

Prevent Application Removal

T1629.001

Input Injection

T1516

Virtualization/Sandbox Evasion

T1633

System Checks

T1633.001

Credential Access

Access Notifications

T1517

Input Capture

T1417

GUI Input Capture

T1417.002

Keylogging

T1417.001

Discovery

Software Discovery

T1418

Security Software Discovery

T1418.001

System Information Discovery

T1426

System Network Configuration Discovery

T1422

Lateral Movement

Collection

Access Notifications

T1517

Input Capture

T1417

GUI Input Capture

T1417.002

Keylogging

T1417.001

Screen Capture

T1513

Command and Control

Exfiltration

Impact

Data Encrypted for Impact

T1471

Input Injection

T1516

Replay Monitor

Loading Replay Monitor...

Downloads

/data/data/com.teachvery73/app_DynamicOptDex/Yw.json

Filesize
1KB

MD5
242192f6df97240e80e2d4b8973b4899

SHA1
777acd712e8b3df0c1e3383edc76420756b060db

SHA256
e71eea378bfa38b1d8afd4931be62f76aaaa65f6522ca6d04c839797148cdc93

SHA512
bf510f76eed948e14d8f7a18bbffa685ca15930f1d2081f9b4a061f8fc96dc224a5352acf938a4087bdc69eca1e982a177e5bfb63a3edcda23e781e37b5b3200

Download Submit
/data/data/com.teachvery73/app_DynamicOptDex/Yw.json

Filesize
1KB

MD5
57174662b9c8f8f3d66accf272196e8f

SHA1
1da5ca630bd19702bd76f3926e2dafed0683533b

SHA256
319355be4adb36b80760a68ec62f33649470f2a07239ff172da4d73d4d4cdc3c

SHA512
0f66d970f249220a7fb99b5eba9d6d76ea8fb02967da8f16fcd6dc22e56c58d8bb1e1c78e9237c9e4036337f83b5504605cd9b6554f0ec012d22f672e90fe3ea

Download Submit
/data/data/com.teachvery73/cache/fvtdomk

Filesize
448KB

MD5
9ee318062514b7f71261d6fc72667749

SHA1
a7fd53306207a2cd540987187b35ea552dbd8b42

SHA256
08e30e95a576ec6e889b91c2088413353508bd81e5c3a73d1e28623094a5e778

SHA512
6e5b7505d8b67c892a7967de473231a4635082be210f6d3a40f90dbd89ade5874eb7e384dc6e70833f6aec943430504a7cf9698fc543c16cbb005311e89ec4e1

Download Submit
/data/data/com.teachvery73/cache/oat/fvtdomk.cur.prof

Filesize
450B

MD5
5b6aaeb61ed21e97781f6e2a1dcafd68

SHA1
3909cb08ea61cbe96690cb1bdfdfa8c8d810e0a3

SHA256
00c2620a52b1687324eeb830a6d2b7a5157273489049b528a8558dd16a8ee674

SHA512
e928c0fba4b3e87c39ea3168c658d887c4f6f9680904a2d9ce3f00f0988f25297ab3ccba6afccb46b58247f9ae03d3e3682a094e1ddfef9f507180aa9513cc1a

Download Submit
/data/data/com.teachvery73/kl.txt

Filesize
28B

MD5
6311c3fd15588bb5c126e6c28ff5fffe

SHA1
ce81d136fce31779f4dd62e20bdaf99c91e2fc57

SHA256
8b82f6032e29a2b5c96031a3630fb6173d12ff0295bc20bb21b877d08f0812d8

SHA512
2975fe2e94b6a8adc9cfc1a865ad113772b54572883a537b02a16dd2d029c0f7d9cca3b154fd849bdfe978e18b396bcf9fa6e67e7c61f92bdc089a29a9c355c6

Download Submit
/data/data/com.teachvery73/kl.txt

Filesize
63B

MD5
a5e1cbdd2b59000784b79e920f2e64c4

SHA1
399d08cc3f9b3ea157fde312b366d1b433929e61

SHA256
cd98e62396a5733d119d182bcd6ba00bb514857a248cec2b244bd3d8de0615d9

SHA512
c0becab90c1a1f5f0d04ead5c62318d41f5057b44d7eb609e0053bb31d8b5de298eb0a50e62fa2fea0c055fc759577c5df266da7b0b3681ded9bda79d57638bc

Download Submit
/data/data/com.teachvery73/kl.txt

Filesize
237B

MD5
1899cf56b6d5b2881b65a32b296541d6

SHA1
9e54a4b280ff180845a6bebac42ee9bac3c37a0d

SHA256
ed0def30a9ae2e7b69ea166841152d1902a0a03d79e4af2369ffb40c443e5bbb

SHA512
7b4c5904adad9ec1324e1d9d4bca465fbf1b54b09c3ccff489c82653f23e6350f26aafaec15e6ad6f17274712697b20ef0c34c326882c728ea13e3a1ad8ead64

Download Submit
/data/data/com.teachvery73/kl.txt

Filesize
54B

MD5
62919da5b485e7d99e24f4fd7edf907a

SHA1
6bb1ac6397c5f86f27d299efdd534d18ab30a45a

SHA256
31cc2f62299b3bea993227dcb2858801102fbe552ffc77b9dda8a528c257c974

SHA512
44bf53db349a8363f0a8fa24e978933f60bbae1fe150d2d95740a4ea8d0b61586f34fc2a86d8912d7e443c1e770974e7da6f998497b3d9df24df36a8bced0859

Download Submit
/data/data/com.teachvery73/kl.txt

Filesize
437B

MD5
82dfcec79cff7c49d4793f14ceda1c73

SHA1
3810d62e34cffb4484da6055e4206f8c83498d7a

SHA256
5929c9f1c8b843016b0156b5e39dc38748d82979590c26f868e1181c93f163d5

SHA512
3a73ba3cea89193a5251afe238b2a39a8e495f1cfe50a1462b4c01f307b727c8a22fe0ec63f1469c498511aa99e396f229fe6cdac365b0ab84dee6c87434b958

Download Submit
/data/user/0/com.teachvery73/app_DynamicOptDex/Yw.json

Filesize
2KB

MD5
ad35c7bafdd247cdb395177ba7e4a570

SHA1
6ef800088babfa65e45ff9e8c5cb6de5df9ff10d

SHA256
2891dd82454600b9ba059e68c493a710e6389ea444a50c72d81530fea24f013d

SHA512
4ad21a08e40e264885ade3b2aabb7b28d99777578a99fc2a4d984f2b636cbe5995a9b729bdb59189f0393a67cf9570eaf0d8b60e2c7356a566f97197501cf674

Download Submit
/data/user/0/com.teachvery73/app_DynamicOptDex/Yw.json

Filesize
2KB

MD5
308da6966f1facdd629080f5f5acde51

SHA1
fa147254117114ad05b4bd658cf29107efd71099

SHA256
49b9e65192af241c6a99326ab37235d3145631b7f28848c76c0e4e6eae321310

SHA512
3ba545ef31a971ac144a99821f93e0c41fed5a862d509634973e0dd920549e3839a4a85173c9bde298f5f50ca7bd508dade16ac2e96f5113ef7e456bd1ddf471

Download Submit

Analysis

Sharing

General

Malware Config

Extracted

Extracted

Signatures

Processes

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads