octo | fa55bcffc2f0838af5c33518b651e7c5f62260c0703b7f2931ecaed24bf2a761

Analysis

max time kernel
149s
max time network
151s
platform
android-9_x86
resource
android-x86-arm-20240910-en
resource tags

arch:armarch:x86image:android-x86-arm-20240910-enlocale:en-usos:android-9-x86system
submitted
25-12-2024 22:10

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

fa55bcffc2f0838af5c33518b651e7c5f62260c0703b7f2931ecaed24bf2a761.apk
Size

1.5MB
MD5

49997b2004683a79ab6bb8ab077e1c3c
SHA1

11aca8254231a682a65fa1f8936179f3b2f26596
SHA256

fa55bcffc2f0838af5c33518b651e7c5f62260c0703b7f2931ecaed24bf2a761
SHA512

ea36647f8c03d82dfb5e9e2562c064c76b829752b6a98e35098d2ffb7c38051d3edda2366ecb6d6e1a2698b5a63bc20d9e09941a4e2e652547ddb1e890c06d19
SSDEEP

49152:X+o9joGP4HqTQyqG3zlr3F/i33veEDw6kIn3pg4:Xpx4HOQ9sruWkky24

Score

10^/10

octo banker collection credential_access discovery evasion impact infostealer persistence rat stealth trojan

Malware Config

Extracted

Family

octo

https://karateustalariningizemlisan.xyz/MTk5MTQ4ZGNkMDBi/

https://karateyolcususamuraidurusu.xyz/MTk5MTQ4ZGNkMDBi/

https://karatefelsefesininizleri.xyz/MTk5MTQ4ZGNkMDBi/

https://dojovekaretekahramanlari.xyz/MTk5MTQ4ZGNkMDBi/

https://karatesanatvesavasustasi.xyz/MTk5MTQ4ZGNkMDBi/

https://samuraivekarateduruslari.xyz/MTk5MTQ4ZGNkMDBi/

https://karatedoguveteoribilgileri.xyz/MTk5MTQ4ZGNkMDBi/

https://karateantrenmanvesanat.xyz/MTk5MTQ4ZGNkMDBi/

https://karetecininkusursuzvurus.xyz/MTk5MTQ4ZGNkMDBi/

https://kareteharaketveteknik.xyz/MTk5MTQ4ZGNkMDBi/

https://savassanatlarinindunyasi.xyz/MTk5MTQ4ZGNkMDBi/

https://karateustalaringizemlibilgisi.xyz/MTk5MTQ4ZGNkMDBi/

https://dojoyolundagecenanilar.xyz/MTk5MTQ4ZGNkMDBi/

https://karatetarihvesanatustalari.xyz/MTk5MTQ4ZGNkMDBi/

https://karateustalikursunumetodu.xyz/MTk5MTQ4ZGNkMDBi/

https://karatekahramankitalarustasi.xyz/MTk5MTQ4ZGNkMDBi/

https://samuraikavramvesanatifelsefe.xyz/MTk5MTQ4ZGNkMDBi/

https://karateevrenselustalikbilgisi.xyz/MTk5MTQ4ZGNkMDBi/

https://karatekapsamlisanatustalari.xyz/MTk5MTQ4ZGNkMDBi/

https://dojotarihiyolundandegisime.xyz/MTk5MTQ4ZGNkMDBi/

rc4.plain

Extracted

Family

octo

https://karateustalariningizemlisan.xyz/MTk5MTQ4ZGNkMDBi/

https://karateyolcususamuraidurusu.xyz/MTk5MTQ4ZGNkMDBi/

https://karatefelsefesininizleri.xyz/MTk5MTQ4ZGNkMDBi/

https://dojovekaretekahramanlari.xyz/MTk5MTQ4ZGNkMDBi/

https://karatesanatvesavasustasi.xyz/MTk5MTQ4ZGNkMDBi/

https://samuraivekarateduruslari.xyz/MTk5MTQ4ZGNkMDBi/

https://karatedoguveteoribilgileri.xyz/MTk5MTQ4ZGNkMDBi/

https://karateantrenmanvesanat.xyz/MTk5MTQ4ZGNkMDBi/

https://karetecininkusursuzvurus.xyz/MTk5MTQ4ZGNkMDBi/

https://kareteharaketveteknik.xyz/MTk5MTQ4ZGNkMDBi/

https://savassanatlarinindunyasi.xyz/MTk5MTQ4ZGNkMDBi/

https://karateustalaringizemlibilgisi.xyz/MTk5MTQ4ZGNkMDBi/

https://dojoyolundagecenanilar.xyz/MTk5MTQ4ZGNkMDBi/

https://karatetarihvesanatustalari.xyz/MTk5MTQ4ZGNkMDBi/

https://karateustalikursunumetodu.xyz/MTk5MTQ4ZGNkMDBi/

https://karatekahramankitalarustasi.xyz/MTk5MTQ4ZGNkMDBi/

https://samuraikavramvesanatifelsefe.xyz/MTk5MTQ4ZGNkMDBi/

https://karateevrenselustalikbilgisi.xyz/MTk5MTQ4ZGNkMDBi/

https://karatekapsamlisanatustalari.xyz/MTk5MTQ4ZGNkMDBi/

https://dojotarihiyolundandegisime.xyz/MTk5MTQ4ZGNkMDBi/

AES_key

Signatures

Octo
Octo is a banking malware with remote access capabilities first seen in April 2022.
banker trojan infostealer rat octo
Octo family
octo

Octo payload 2 IoCs

resource	yara_rule
behavioral1/memory/4354-0.dex	family_octo
behavioral1/memory/4329-0.dex	family_octo

Removes its main activity from the application launcher 1 TTPs 1 IoCs

stealth trojan evasion

Suppress Application Icon

T1628.001

pid	Process
4329	com.pulp.report

Loads dropped Dex/Jar 1 TTPs 2 IoCs

Runs executable file dropped to the device during analysis.

evasion

Download New Code at Runtime

T1407

ioc	pid	Process
/data/user/0/com.pulp.report/app_venue/yry.json	4354	/system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.pulp.report/app_venue/yry.json --output-vdex-fd=41 --oat-fd=42 --oat-location=/data/user/0/com.pulp.report/app_venue/oat/x86/yry.odex --compiler-filter=quicken --class-loader-context=&
/data/user/0/com.pulp.report/app_venue/yry.json	4329	com.pulp.report

Makes use of the framework's Accessibility service 4 TTPs 2 IoCs

Retrieves information displayed on the phone screen using AccessibilityService.

collection evasion credential_access

Input Injection

T1516

Screen Capture

T1513

Keylogging

T1417.001

GUI Input Capture

T1417.002

description	ioc	Process
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId	com.pulp.report
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByViewId	com.pulp.report

Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
banker discovery

Security Software Discovery
T1418.001
Queries the phone number (MSISDN for GSM devices) 1 TTPs
discovery

System Network Configuration Discovery
T1422

Acquires the wake lock 1 IoCs

description	ioc	Process
Framework service call	android.os.IPowerManager.acquireWakeLock	com.pulp.report

Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs

Application may abuse the framework's foreground service to continue running in the foreground.

evasion persistence

Foreground Persistence

T1541

description	ioc	Process
Framework service call	android.app.IActivityManager.setServiceForeground	com.pulp.report

Performs UI accessibility actions on behalf of the user 1 TTPs 4 IoCs

Application may abuse the accessibility service to prevent their removal.

evasion

Prevent Application Removal

T1629.001

ioc	Process
android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction	com.pulp.report
android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction	com.pulp.report
android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction	com.pulp.report
android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction	com.pulp.report

Queries the mobile country code (MCC) 1 TTPs 1 IoCs

discovery

System Network Configuration Discovery

T1422

description	ioc	Process
Framework service call	com.android.internal.telephony.ITelephony.getNetworkCountryIsoForPhone	com.pulp.report

Queries the unique device ID (IMEI, MEID, IMSI) 1 TTPs
discovery

System Network Configuration Discovery
T1422

Requests accessing notifications (often used to intercept notifications before users become aware). 1 TTPs 1 IoCs

collection credential_access

Access Notifications

T1517

description	ioc	Process
Intent action	android.settings.ACTION_NOTIFICATION_LISTENER_SETTINGS	com.pulp.report

Requests disabling of battery optimizations (often used to enable hiding in the background). 1 TTPs 1 IoCs

evasion

User Evasion

T1628.002

description	ioc	Process
Intent action	android.settings.REQUEST_IGNORE_BATTERY_OPTIMIZATIONS	com.pulp.report

Requests modifying system settings. 1 IoCs

evasion

description	ioc	Process
Intent action	android.settings.action.MANAGE_WRITE_SETTINGS	com.pulp.report

Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs

persistence

Broadcast Receivers

T1624.001

description	ioc	Process
Framework service call	android.app.IActivityManager.registerReceiver	com.pulp.report

Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs

impact

Data Encrypted for Impact

T1471

description	ioc	Process
Framework API call	javax.crypto.Cipher.doFinal	com.pulp.report

com.pulp.report
1⤵
- Removes its main activity from the application launcher
- Loads dropped Dex/Jar
- Makes use of the framework's Accessibility service
- Acquires the wake lock
- Makes use of the framework's foreground persistence service
- Performs UI accessibility actions on behalf of the user
- Queries the mobile country code (MCC)
- Requests accessing notifications (often used to intercept notifications before users become aware).
- Requests disabling of battery optimizations (often used to enable hiding in the background).
- Requests modifying system settings.
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Uses Crypto APIs (Might try to encrypt user data)
PID:4329
- /system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.pulp.report/app_venue/yry.json --output-vdex-fd=41 --oat-fd=42 --oat-location=/data/user/0/com.pulp.report/app_venue/oat/x86/yry.odex --compiler-filter=quicken --class-loader-context=&
  2⤵
  - Loads dropped Dex/Jar
  PID:4354

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Event Triggered Execution

T1624

Broadcast Receivers

T1624.001

Foreground Persistence

T1541

Privilege Escalation

Defense Evasion

Download New Code at Runtime

T1407

Foreground Persistence

T1541

Hide Artifacts

T1628

Suppress Application Icon

T1628.001

User Evasion

T1628.002

Impair Defenses

T1629

Prevent Application Removal

T1629.001

Input Injection

T1516

Credential Access

Access Notifications

T1517

Input Capture

T1417

GUI Input Capture

T1417.002

Keylogging

T1417.001

Discovery

Software Discovery

T1418

Security Software Discovery

T1418.001

System Network Configuration Discovery

T1422

Lateral Movement

Collection

Access Notifications

T1517

Input Capture

T1417

GUI Input Capture

T1417.002

Keylogging

T1417.001

Screen Capture

T1513

Command and Control

Exfiltration

Impact

Data Encrypted for Impact

T1471

Input Injection

T1516

Replay Monitor

Loading Replay Monitor...

Downloads

/data/data/com.pulp.report/app_venue/yry.json

Filesize
153KB

MD5
5fe0592d7cd12e3cc23bf70fe12894e4

SHA1
acb5ceffc7f703c3220cbc11141024f3436e6323

SHA256
6b062751ab0163a9ec7a6f4fe9fbd375084b02e13e44d7a8b9d27aac47d6075c

SHA512
23098496b1215a0b3c5fe254e4c6a769f17a06f31bd7e02b1dba5abd84d1b3ffb7334346c3e41c38aa7101a6971a0ffa0df247dfbbf5707cde6bd36a7d0ea2e5

Download Submit
/data/data/com.pulp.report/app_venue/yry.json

Filesize
153KB

MD5
dfd941772c36999d5408ca315af3bd7b

SHA1
d1188241647e7fa593d91f7fa29750caa4d079ea

SHA256
c09109e477c3d207fa0b964b50454fa505e1cbcad881c42d3866de231894042b

SHA512
32d1de44ab39bf540e9308fb26e6998a0c38e73e772d5c283c5ddf0f90818db94e22d6a4c4cd6411f4c663608777cfa6083dbaa9fe9145dfb8f5caf426acdece

Download Submit
/data/user/0/com.pulp.report/app_venue/yry.json

Filesize
451KB

MD5
4ae810d44e1d9752136c29fa4a6a069a

SHA1
941b6686146ebffa77116f1b77d474e3fbe3ecd6

SHA256
0b2e49e1776ea53a9e58795de9ba83f2b9142eb59793390b036678828c0f325e

SHA512
64ae2163f123c092a71103ebbd93724027b8554715db46da9f9d3c17f60879ed9165b7c4e98b5b96d9100b8ddd3f91e3076ada3b94ba813ea90bfeced3193283

Download Submit
/data/user/0/com.pulp.report/app_venue/yry.json

Filesize
451KB

MD5
9b71475342d998b876b047663c02619a

SHA1
f9f22d7b4687cecf7630e5c61685b3156d74fd80

SHA256
bd7fcd88b087ce71a03a19d228dcaf3a82ecda56c44ce5971bad7f6b55d45321

SHA512
df81522a2ae92f841e0c416afaac4f4e538b6c374e5263ffdf5b0effa547b79436bbb2934546cee121ef809daf217b20662bcac9f98d59083067c6318363db6a

Download Submit

Analysis

Sharing

General

Malware Config

Extracted

Extracted

Signatures

Processes

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads