octo | fe410d57a57af135929fe0287b4eb8a4351fab0522014bfc098183927575eaa2

Analysis

max time kernel
149s
max time network
154s
platform
android-9_x86
resource
android-x86-arm-20240910-en
resource tags

arch:armarch:x86image:android-x86-arm-20240910-enlocale:en-usos:android-9-x86system
submitted
27-12-2024 22:07

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

fe410d57a57af135929fe0287b4eb8a4351fab0522014bfc098183927575eaa2.apk
Size

2.3MB
MD5

97e81ea7801c2da253f07c44edf1c0fb
SHA1

2f784acf765c2133038583ebf35231bf5b2c75df
SHA256

fe410d57a57af135929fe0287b4eb8a4351fab0522014bfc098183927575eaa2
SHA512

178ea581547c51c6a275e9b1b489534cf1f681945d7d80bd85f10b28701de26ef61b05018c393b7aa1b280a82f0ecde8294f40f2727c8ae2c565f573a0f8eaee
SSDEEP

49152:09DkAOW3jvQ5c90K/hc/ZGZbmqG2YVQZP5itErONZPsfAE4KoSX2EDgKF2gQZ/My:8kAT3j4ybyZQ/G/VQZI6C7OQKMgQZ/My

Score

10^/10

octo banker collection credential_access discovery evasion impact infostealer persistence rat stealth trojan

Malware Config

Extracted

Family

octo

https://gustooook.top/Y2U5ZjYxZTA5Zjcw/

https://bobnoopopo.org/Y2U5ZjYxZTA5Zjcw/

https://junggvrebvqqpo.org/Y2U5ZjYxZTA5Zjcw/

https://junggpervbvqqqqqqpo.com/Y2U5ZjYxZTA5Zjcw/

https://junggvbvqqgrouppo.com/Y2U5ZjYxZTA5Zjcw/

https://junggvbvqqnetokpo.com/Y2U5ZjYxZTA5Zjcw/

https://junggvbvq.top/Y2U5ZjYxZTA5Zjcw/

https://junggvbvq5656.top/Y2U5ZjYxZTA5Zjcw/

https://jungjunjunggvbvq.top/Y2U5ZjYxZTA5Zjcw/

rc4.plain

Extracted

Family

octo

https://gustooook.top/Y2U5ZjYxZTA5Zjcw/

https://bobnoopopo.org/Y2U5ZjYxZTA5Zjcw/

https://junggvrebvqqpo.org/Y2U5ZjYxZTA5Zjcw/

https://junggpervbvqqqqqqpo.com/Y2U5ZjYxZTA5Zjcw/

https://junggvbvqqgrouppo.com/Y2U5ZjYxZTA5Zjcw/

https://junggvbvqqnetokpo.com/Y2U5ZjYxZTA5Zjcw/

https://junggvbvq.top/Y2U5ZjYxZTA5Zjcw/

https://junggvbvq5656.top/Y2U5ZjYxZTA5Zjcw/

https://jungjunjunggvbvq.top/Y2U5ZjYxZTA5Zjcw/

AES_key

Signatures

Octo
Octo is a banking malware with remote access capabilities first seen in April 2022.
banker trojan infostealer rat octo
Octo family
octo

Octo payload 1 IoCs

resource	yara_rule
behavioral1/files/fstream-6.dat	family_octo

Removes its main activity from the application launcher 1 TTPs 1 IoCs

stealth trojan evasion

Suppress Application Icon

T1628.001

pid	Process
4308	com.nextduringcnsh

Loads dropped Dex/Jar 1 TTPs 4 IoCs

Runs executable file dropped to the device during analysis.

evasion

Download New Code at Runtime

T1407

ioc	pid	Process
/data/user/0/com.nextduringcnsh/app_DynamicOptDex/uSUGi.json	4334	/system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.nextduringcnsh/app_DynamicOptDex/uSUGi.json --output-vdex-fd=41 --oat-fd=42 --oat-location=/data/user/0/com.nextduringcnsh/app_DynamicOptDex/oat/x86/uSUGi.odex --compiler-filter=quicken --class-loader-context=&
/data/user/0/com.nextduringcnsh/app_DynamicOptDex/uSUGi.json	4308	com.nextduringcnsh
/data/user/0/com.nextduringcnsh/cache/dztkccznf	4308	com.nextduringcnsh
/data/user/0/com.nextduringcnsh/cache/dztkccznf	4308	com.nextduringcnsh

Makes use of the framework's Accessibility service 4 TTPs 2 IoCs

Retrieves information displayed on the phone screen using AccessibilityService.

collection evasion credential_access

Input Injection

T1516

Screen Capture

T1513

Keylogging

T1417.001

GUI Input Capture

T1417.002

description	ioc	Process
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId	com.nextduringcnsh
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByViewId	com.nextduringcnsh

Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
banker discovery

Security Software Discovery
T1418.001
Queries the phone number (MSISDN for GSM devices) 1 TTPs
discovery

System Network Configuration Discovery
T1422

Acquires the wake lock 1 IoCs

description	ioc	Process
Framework service call	android.os.IPowerManager.acquireWakeLock	com.nextduringcnsh

Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs

Application may abuse the framework's foreground service to continue running in the foreground.

evasion persistence

Foreground Persistence

T1541

description	ioc	Process
Framework service call	android.app.IActivityManager.setServiceForeground	com.nextduringcnsh

Performs UI accessibility actions on behalf of the user 1 TTPs 3 IoCs

Application may abuse the accessibility service to prevent their removal.

evasion

Prevent Application Removal

T1629.001

ioc	Process
android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction	com.nextduringcnsh
android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction	com.nextduringcnsh
android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction	com.nextduringcnsh

Queries the mobile country code (MCC) 1 TTPs 1 IoCs

discovery

System Network Configuration Discovery

T1422

description	ioc	Process
Framework service call	com.android.internal.telephony.ITelephony.getNetworkCountryIsoForPhone	com.nextduringcnsh

Queries the unique device ID (IMEI, MEID, IMSI) 1 TTPs
discovery

System Network Configuration Discovery
T1422
Reads information about phone network operator. 1 TTPs
discovery

System Network Configuration Discovery
T1422

Requests accessing notifications (often used to intercept notifications before users become aware). 1 TTPs 1 IoCs

collection credential_access

Access Notifications

T1517

description	ioc	Process
Intent action	android.settings.ACTION_NOTIFICATION_LISTENER_SETTINGS	com.nextduringcnsh

Requests disabling of battery optimizations (often used to enable hiding in the background). 1 TTPs 1 IoCs

evasion

User Evasion

T1628.002

description	ioc	Process
Intent action	android.settings.REQUEST_IGNORE_BATTERY_OPTIMIZATIONS	com.nextduringcnsh

Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs

persistence

Broadcast Receivers

T1624.001

description	ioc	Process
Framework service call	android.app.IActivityManager.registerReceiver	com.nextduringcnsh

Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs

impact

Data Encrypted for Impact

T1471

description	ioc	Process
Framework API call	javax.crypto.Cipher.doFinal	com.nextduringcnsh

Checks CPU information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/cpuinfo	com.nextduringcnsh

Checks memory information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/meminfo	com.nextduringcnsh

com.nextduringcnsh
1⤵
- Removes its main activity from the application launcher
- Loads dropped Dex/Jar
- Makes use of the framework's Accessibility service
- Acquires the wake lock
- Makes use of the framework's foreground persistence service
- Performs UI accessibility actions on behalf of the user
- Queries the mobile country code (MCC)
- Requests accessing notifications (often used to intercept notifications before users become aware).
- Requests disabling of battery optimizations (often used to enable hiding in the background).
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Uses Crypto APIs (Might try to encrypt user data)
- Checks CPU information
- Checks memory information
PID:4308
- /system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.nextduringcnsh/app_DynamicOptDex/uSUGi.json --output-vdex-fd=41 --oat-fd=42 --oat-location=/data/user/0/com.nextduringcnsh/app_DynamicOptDex/oat/x86/uSUGi.odex --compiler-filter=quicken --class-loader-context=&
  2⤵
  - Loads dropped Dex/Jar
  PID:4334

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Event Triggered Execution

T1624

Broadcast Receivers

T1624.001

Foreground Persistence

T1541

Privilege Escalation

Defense Evasion

Download New Code at Runtime

T1407

Foreground Persistence

T1541

Hide Artifacts

T1628

Suppress Application Icon

T1628.001

User Evasion

T1628.002

Impair Defenses

T1629

Prevent Application Removal

T1629.001

Input Injection

T1516

Virtualization/Sandbox Evasion

T1633

System Checks

T1633.001

Credential Access

Access Notifications

T1517

Input Capture

T1417

GUI Input Capture

T1417.002

Keylogging

T1417.001

Discovery

Software Discovery

T1418

Security Software Discovery

T1418.001

System Information Discovery

T1426

System Network Configuration Discovery

T1422

Lateral Movement

Collection

Access Notifications

T1517

Input Capture

T1417

GUI Input Capture

T1417.002

Keylogging

T1417.001

Screen Capture

T1513

Command and Control

Exfiltration

Impact

Data Encrypted for Impact

T1471

Input Injection

T1516

Replay Monitor

Loading Replay Monitor...

Downloads

/data/data/com.nextduringcnsh/app_DynamicOptDex/uSUGi.json

Filesize
1KB

MD5
85831d08dfc47cb76fe6ba06e957788c

SHA1
8afd875b7d75ee01556fc2fc29124ec025c66744

SHA256
a7d35bc807e3d450f2b3001c9852edf9fdb3631c98a8554875db81d2ab2821b8

SHA512
ad4c547306816100d4f7ba475c870217a0e181738a6fcd4be0351e0f6cce76ea0bbebb36584de3289078b3f5c83348aeda8d3f58f7a0a713a69f004a0bb00851

Download Submit
/data/data/com.nextduringcnsh/app_DynamicOptDex/uSUGi.json

Filesize
1KB

MD5
1c40f3c0fc0814cb7eac943c29ae00d3

SHA1
266f3d81cb45ba6dac76563a4c6ae3651581457b

SHA256
c0b5d3e4d141004a635a79efb5916b88a5678ba18b71a7e42d066958b7a69f70

SHA512
3514ceaca5a416e20c6352e890f803a4134ec580ba8364057578a31014588204fc1073c6cbb5f6cc6227ec7505fceb730f7255c580d004d18b9ba8e7b7ee6595

Download Submit
/data/data/com.nextduringcnsh/cache/dztkccznf

Filesize
448KB

MD5
85f40ae8a897b0dc2f17a932ff5873fa

SHA1
a4d08c5962fcbe4c35e449e868186fc5431c5d98

SHA256
1a1afed56ca364523890bf3b39d0cd04b4ab488453ba2db7c9aefef62c28de22

SHA512
6ea02f5d024af168b060a3b0232b818c8e3a9e10b6daffb56dd0a354c7516333689a15d8ea3c1f310ecc00ca7fa2d561f0fec655c6e206d9352e931e1de5ed22

Download Submit
/data/data/com.nextduringcnsh/cache/oat/dztkccznf.cur.prof

Filesize
489B

MD5
e4bb6fb274d769b60a29dafc220f257c

SHA1
709d0651e817ab491dcd715ab09fca9137b49fdc

SHA256
b123606b0f8d5a41b9319770e2898d10bbdbf133df66aeb325b5a329402a8e66

SHA512
5872754fdffcf10c4d3813a8c2dd2431529ffb0dade066e0b04c53aa9246c70d99f3a06087bb3c7023ea92507918154b9c69fe2e1a7380aeaf589c271a31f0ed

Download Submit
/data/data/com.nextduringcnsh/kl.txt

Filesize
28B

MD5
6311c3fd15588bb5c126e6c28ff5fffe

SHA1
ce81d136fce31779f4dd62e20bdaf99c91e2fc57

SHA256
8b82f6032e29a2b5c96031a3630fb6173d12ff0295bc20bb21b877d08f0812d8

SHA512
2975fe2e94b6a8adc9cfc1a865ad113772b54572883a537b02a16dd2d029c0f7d9cca3b154fd849bdfe978e18b396bcf9fa6e67e7c61f92bdc089a29a9c355c6

Download Submit
/data/data/com.nextduringcnsh/kl.txt

Filesize
237B

MD5
aa864817e832772c803cff4cf31bec8e

SHA1
cc73a8374272cd472e37d994b562b307b6961518

SHA256
9204e527839caea926dd0f3a45ebcfc50b3eb7b30c18f4c6b3c37c0cd2fe0a71

SHA512
d0c7de0c4d6501ed9f65a689b8d9024b0df7833d1afca7d2ea1680d271947630694497f11f52876e4c361b153e447fcc1061295c74e2a5ee2eca3402d21f344d

Download Submit
/data/data/com.nextduringcnsh/kl.txt

Filesize
54B

MD5
ab84db05354e30bf6d229f945815b3a3

SHA1
591c16975bbe330f3a890a27f5ef167f893f19b8

SHA256
708c4dd04ca6b6d79c6acba67db803253f28c0e5581cd277c080567831e3ae6e

SHA512
89fc3dc0d2f69e8db1a8ebca26c378b0fa814acdb21a36ece8c66fc092971f2638eba811543bf4f30f64f6cbc25b882d3a50607948c4da3335382424fdf5a6a9

Download Submit
/data/data/com.nextduringcnsh/kl.txt

Filesize
63B

MD5
de186c136d60ad4d645a839b597869ea

SHA1
135f0591008dd3f49264e7b45b879a7a36907314

SHA256
9ca209a3aa08fc82f79f7f155c89dc146dfa6133158829016a30c91d048b8dc7

SHA512
3045677957067e8845e66953a5e0527fd2c7f388a7b9d8880b8a4e9b35327a14594af2380b5ca1dd495b72fcdc5a27a9a37cc1f0b17b35822d08db62b3894873

Download Submit
/data/data/com.nextduringcnsh/kl.txt

Filesize
437B

MD5
0e71d0b79b72020292b21dbc9f964e90

SHA1
976bbdcf2e7094beaca37192ecae2ec9e49651fd

SHA256
07432fdc1751fa76eaf0ccc27bc51e5d98c7defa18ac1541ff1efde79919a6fd

SHA512
c985904b3aa196868b1e16c91065c6ac7f0271807dfc5d28ef468d8209bdfc4ec2af7db682f5999f54be4f05742ba6765b40f7fc631cc566d0bed563879fabbf

Download Submit
/data/user/0/com.nextduringcnsh/app_DynamicOptDex/uSUGi.json

Filesize
2KB

MD5
95f811e2c49532060804e50af28e2a4e

SHA1
e1e3108d6f17aabbf38d4a1b4b2422723f669d09

SHA256
bfd611af02babbba2e521486f14ce66915cfe8bf03c45293bef2bae4561a8ca5

SHA512
6cae00bebf8514b4b6654a21d94c11b207fe8e4eae7143ef3aa1df9e36e0c0291a71e68d4e1d0fb1de6ae980b7a9d2330f558639431f9464a2ec33f567d31b29

Download Submit
/data/user/0/com.nextduringcnsh/app_DynamicOptDex/uSUGi.json

Filesize
2KB

MD5
839d885e45396f2c8fb1af9e109a6ff3

SHA1
eb5f684dde75ce1da7fcb03cad40dc4862e3743a

SHA256
97db4ddc5459710b4674bb5f5f04384f29140c2c024e33b10acab377c38f6744

SHA512
8d357740d282fb9fa1bac4a9d9141396f536548caccbc75b835a4aaf0b569b82320871ee84afbb10a62068d3627830d4ffd9ac931d98f753100b44ca085b2c22

Download Submit

Analysis

Sharing

General

Malware Config

Extracted

Extracted

Signatures

Processes

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads