octo | 2460619916af8958ccd6a6cb365f92c8ac6e4ffb9664df9d16194d19aed697f7

Analysis

max time kernel
146s
max time network
137s
platform
android_x64
resource
android-x64-20240624-en
resource tags

androidarch:x64arch:x86image:android-x64-20240624-enlocale:en-usos:android-10-x64system
submitted
25-12-2024 22:03

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2460619916af8958ccd6a6cb365f92c8ac6e4ffb9664df9d16194d19aed697f7.apk
Size

2.5MB
MD5

84790c21ebbda0c7cf23ab0800357475
SHA1

b5dbf5b8fa8cb3294be64f50e4fa60a2fa109f36
SHA256

2460619916af8958ccd6a6cb365f92c8ac6e4ffb9664df9d16194d19aed697f7
SHA512

cd53f829b60addaf76512de89ed1f99e932080b1ad8c330e237454e188094275f0e9921907182a05c2a036a9463e9d0cede364dee180c62cb03bdbe132644754
SSDEEP

49152:DVmAmA0c3QsecWeASUGdWraqQWwO6CYXZVjV73MA02:x3QseRSga9vO6CYJ/3302

Score

10^/10

octo banker collection credential_access discovery evasion impact infostealer persistence rat trojan

Malware Config

Extracted

Family

octo

https://karateustalariningizemlisan.xyz/MTk5MTQ4ZGNkMDBi/

https://karateyolcususamuraidurusu.xyz/MTk5MTQ4ZGNkMDBi/

https://karatefelsefesininizleri.xyz/MTk5MTQ4ZGNkMDBi/

https://dojovekaretekahramanlari.xyz/MTk5MTQ4ZGNkMDBi/

https://karatesanatvesavasustasi.xyz/MTk5MTQ4ZGNkMDBi/

https://samuraivekarateduruslari.xyz/MTk5MTQ4ZGNkMDBi/

https://karatedoguveteoribilgileri.xyz/MTk5MTQ4ZGNkMDBi/

https://karateantrenmanvesanat.xyz/MTk5MTQ4ZGNkMDBi/

https://karetecininkusursuzvurus.xyz/MTk5MTQ4ZGNkMDBi/

https://kareteharaketveteknik.xyz/MTk5MTQ4ZGNkMDBi/

https://savassanatlarinindunyasi.xyz/MTk5MTQ4ZGNkMDBi/

https://karateustalaringizemlibilgisi.xyz/MTk5MTQ4ZGNkMDBi/

https://dojoyolundagecenanilar.xyz/MTk5MTQ4ZGNkMDBi/

https://karatetarihvesanatustalari.xyz/MTk5MTQ4ZGNkMDBi/

https://karateustalikursunumetodu.xyz/MTk5MTQ4ZGNkMDBi/

https://karatekahramankitalarustasi.xyz/MTk5MTQ4ZGNkMDBi/

https://samuraikavramvesanatifelsefe.xyz/MTk5MTQ4ZGNkMDBi/

https://karateevrenselustalikbilgisi.xyz/MTk5MTQ4ZGNkMDBi/

https://karatekapsamlisanatustalari.xyz/MTk5MTQ4ZGNkMDBi/

https://dojotarihiyolundandegisime.xyz/MTk5MTQ4ZGNkMDBi/

rc4.plain

Extracted

Family

octo

https://karateustalariningizemlisan.xyz/MTk5MTQ4ZGNkMDBi/

https://karateyolcususamuraidurusu.xyz/MTk5MTQ4ZGNkMDBi/

https://karatefelsefesininizleri.xyz/MTk5MTQ4ZGNkMDBi/

https://dojovekaretekahramanlari.xyz/MTk5MTQ4ZGNkMDBi/

https://karatesanatvesavasustasi.xyz/MTk5MTQ4ZGNkMDBi/

https://samuraivekarateduruslari.xyz/MTk5MTQ4ZGNkMDBi/

https://karatedoguveteoribilgileri.xyz/MTk5MTQ4ZGNkMDBi/

https://karateantrenmanvesanat.xyz/MTk5MTQ4ZGNkMDBi/

https://karetecininkusursuzvurus.xyz/MTk5MTQ4ZGNkMDBi/

https://kareteharaketveteknik.xyz/MTk5MTQ4ZGNkMDBi/

https://savassanatlarinindunyasi.xyz/MTk5MTQ4ZGNkMDBi/

https://karateustalaringizemlibilgisi.xyz/MTk5MTQ4ZGNkMDBi/

https://dojoyolundagecenanilar.xyz/MTk5MTQ4ZGNkMDBi/

https://karatetarihvesanatustalari.xyz/MTk5MTQ4ZGNkMDBi/

https://karateustalikursunumetodu.xyz/MTk5MTQ4ZGNkMDBi/

https://karatekahramankitalarustasi.xyz/MTk5MTQ4ZGNkMDBi/

https://samuraikavramvesanatifelsefe.xyz/MTk5MTQ4ZGNkMDBi/

https://karateevrenselustalikbilgisi.xyz/MTk5MTQ4ZGNkMDBi/

https://karatekapsamlisanatustalari.xyz/MTk5MTQ4ZGNkMDBi/

https://dojotarihiyolundandegisime.xyz/MTk5MTQ4ZGNkMDBi/

AES_key

Signatures

Octo
Octo is a banking malware with remote access capabilities first seen in April 2022.
banker trojan infostealer rat octo
Octo family
octo

Octo payload 1 IoCs

resource	yara_rule
behavioral2/memory/5052-0.dex	family_octo

Loads dropped Dex/Jar 1 TTPs 1 IoCs

Runs executable file dropped to the device during analysis.

evasion

Download New Code at Runtime

T1407

ioc	pid	Process
/data/user/0/com.antenna.bid/app_sing/cRu.json	5052	com.antenna.bid

Makes use of the framework's Accessibility service 4 TTPs 2 IoCs

Retrieves information displayed on the phone screen using AccessibilityService.

collection evasion credential_access

Input Injection

T1516

Screen Capture

T1513

Keylogging

T1417.001

GUI Input Capture

T1417.002

description	ioc	Process
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId	com.antenna.bid
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByViewId	com.antenna.bid

Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
banker discovery

Security Software Discovery
T1418.001
Queries the phone number (MSISDN for GSM devices) 1 TTPs
discovery

System Network Configuration Discovery
T1422

Acquires the wake lock 1 IoCs

description	ioc	Process
Framework service call	android.os.IPowerManager.acquireWakeLock	com.antenna.bid

Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs

Application may abuse the framework's foreground service to continue running in the foreground.

evasion persistence

Foreground Persistence

T1541

description	ioc	Process
Framework service call	android.app.IActivityManager.setServiceForeground	com.antenna.bid

Performs UI accessibility actions on behalf of the user 1 TTPs 4 IoCs

Application may abuse the accessibility service to prevent their removal.

evasion

Prevent Application Removal

T1629.001

ioc	Process
android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction	com.antenna.bid
android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction	com.antenna.bid
android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction	com.antenna.bid
android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction	com.antenna.bid

Queries the mobile country code (MCC) 1 TTPs 1 IoCs

discovery

System Network Configuration Discovery

T1422

description	ioc	Process
Framework service call	com.android.internal.telephony.ITelephony.getNetworkCountryIsoForPhone	com.antenna.bid

Reads information about phone network operator. 1 TTPs
discovery

System Network Configuration Discovery
T1422

Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs

persistence

Broadcast Receivers

T1624.001

description	ioc	Process
Framework service call	android.app.IActivityManager.registerReceiver	com.antenna.bid

Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs

impact

Data Encrypted for Impact

T1471

description	ioc	Process
Framework API call	javax.crypto.Cipher.doFinal	com.antenna.bid

com.antenna.bid
1⤵
- Loads dropped Dex/Jar
- Makes use of the framework's Accessibility service
- Acquires the wake lock
- Makes use of the framework's foreground persistence service
- Performs UI accessibility actions on behalf of the user
- Queries the mobile country code (MCC)
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Uses Crypto APIs (Might try to encrypt user data)
PID:5052

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Event Triggered Execution

T1624

Broadcast Receivers

T1624.001

Foreground Persistence

T1541

Privilege Escalation

Defense Evasion

Download New Code at Runtime

T1407

Foreground Persistence

T1541

Impair Defenses

T1629

Prevent Application Removal

T1629.001

Input Injection

T1516

Credential Access

Input Capture

T1417

GUI Input Capture

T1417.002

Keylogging

T1417.001

Discovery

Software Discovery

T1418

Security Software Discovery

T1418.001

System Network Configuration Discovery

T1422

Lateral Movement

Collection

Input Capture

T1417

GUI Input Capture

T1417.002

Keylogging

T1417.001

Screen Capture

T1513

Command and Control

Exfiltration

Impact

Data Encrypted for Impact

T1471

Input Injection

T1516

Replay Monitor

Loading Replay Monitor...

Downloads

/data/data/com.antenna.bid/app_sing/cRu.json

Filesize
153KB

MD5
788d6365142072bc7f2ac465061f54b6

SHA1
1939876a3fd66ab1b65c2618da44145fe4c52efe

SHA256
071ed175c7ce0f0c28884209f2af09c48e109ba5e4d7874f531c98ce14c33396

SHA512
635a8ad342889f53a9c3af39bc86a6c26c99857de5524b8503140877f6049c9a7c2ab914c275513c7fbe2b468d4e7d77950c0eb71c917ee2ef3b3c9697d4122d

Download Submit
/data/data/com.antenna.bid/app_sing/cRu.json

Filesize
153KB

MD5
43ab009cc8cd5409aef1e5a132a28c9b

SHA1
c4216c7e791d6df7c9102a35b6c4ba0df9d2c9b8

SHA256
2614bfe851ccdc1929219d830a8f8035f6d88c3bba7e9eeae5a3ca38cf5d07fc

SHA512
f5afc4f45a08f624ee6c9da2393f15a5584e495c2668391a0daac67faf6cf9346824e62265ac522f152cac2217b1d9718412e6c79a985d8ffec87b0bf296a28e

Download Submit
/data/user/0/com.antenna.bid/app_sing/cRu.json

Filesize
451KB

MD5
ae2916ca9d1bf00c706a088de6bdd273

SHA1
27255e7de853ffdc6e080faaad28e48588c59ad4

SHA256
4464ffc631bf20fa739b0209959d9cbb0706caad087b13f06799055f689999f9

SHA512
6f644d68ff657491a1f7b7b1f2311a6743488b8009e45221473c5fd10d9a36ad55d17d93b41a8b84003f31a5524eb27a28ee2ecf99b441a2a05b53a61988416e

Download Submit

Analysis

Sharing

General

Malware Config

Extracted

Extracted

Signatures

Processes

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads