octo | fe410d57a57af135929fe0287b4eb8a4351fab0522014bfc098183927575eaa2

Analysis

max time kernel
148s
max time network
155s
platform
android-11_x64
resource
android-x64-arm64-20240910-en
resource tags

arch:armarch:arm64arch:x64arch:x86image:android-x64-arm64-20240910-enlocale:en-usos:android-11-x64system
submitted
27-12-2024 22:07

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

fe410d57a57af135929fe0287b4eb8a4351fab0522014bfc098183927575eaa2.apk
Size

2.3MB
MD5

97e81ea7801c2da253f07c44edf1c0fb
SHA1

2f784acf765c2133038583ebf35231bf5b2c75df
SHA256

fe410d57a57af135929fe0287b4eb8a4351fab0522014bfc098183927575eaa2
SHA512

178ea581547c51c6a275e9b1b489534cf1f681945d7d80bd85f10b28701de26ef61b05018c393b7aa1b280a82f0ecde8294f40f2727c8ae2c565f573a0f8eaee
SSDEEP

49152:09DkAOW3jvQ5c90K/hc/ZGZbmqG2YVQZP5itErONZPsfAE4KoSX2EDgKF2gQZ/My:8kAT3j4ybyZQ/G/VQZI6C7OQKMgQZ/My

Score

10^/10

octo banker collection credential_access discovery evasion impact infostealer persistence rat trojan

Malware Config

Extracted

Family

octo

https://gustooook.top/Y2U5ZjYxZTA5Zjcw/

https://bobnoopopo.org/Y2U5ZjYxZTA5Zjcw/

https://junggvrebvqqpo.org/Y2U5ZjYxZTA5Zjcw/

https://junggpervbvqqqqqqpo.com/Y2U5ZjYxZTA5Zjcw/

https://junggvbvqqgrouppo.com/Y2U5ZjYxZTA5Zjcw/

https://junggvbvqqnetokpo.com/Y2U5ZjYxZTA5Zjcw/

https://junggvbvq.top/Y2U5ZjYxZTA5Zjcw/

https://junggvbvq5656.top/Y2U5ZjYxZTA5Zjcw/

https://jungjunjunggvbvq.top/Y2U5ZjYxZTA5Zjcw/

rc4.plain

Extracted

Family

octo

https://gustooook.top/Y2U5ZjYxZTA5Zjcw/

https://bobnoopopo.org/Y2U5ZjYxZTA5Zjcw/

https://junggvrebvqqpo.org/Y2U5ZjYxZTA5Zjcw/

https://junggpervbvqqqqqqpo.com/Y2U5ZjYxZTA5Zjcw/

https://junggvbvqqgrouppo.com/Y2U5ZjYxZTA5Zjcw/

https://junggvbvqqnetokpo.com/Y2U5ZjYxZTA5Zjcw/

https://junggvbvq.top/Y2U5ZjYxZTA5Zjcw/

https://junggvbvq5656.top/Y2U5ZjYxZTA5Zjcw/

https://jungjunjunggvbvq.top/Y2U5ZjYxZTA5Zjcw/

AES_key

Signatures

Octo
Octo is a banking malware with remote access capabilities first seen in April 2022.
banker trojan infostealer rat octo
Octo family
octo

Octo payload 1 IoCs

resource	yara_rule
behavioral2/files/fstream-3.dat	family_octo

Loads dropped Dex/Jar 1 TTPs 3 IoCs

Runs executable file dropped to the device during analysis.

evasion

Download New Code at Runtime

T1407

ioc	pid	Process
/data/user/0/com.nextduringcnsh/app_DynamicOptDex/uSUGi.json	4613	com.nextduringcnsh
/data/user/0/com.nextduringcnsh/cache/dztkccznf	4613	com.nextduringcnsh
/data/user/0/com.nextduringcnsh/cache/dztkccznf	4613	com.nextduringcnsh

Makes use of the framework's Accessibility service 4 TTPs 2 IoCs

Retrieves information displayed on the phone screen using AccessibilityService.

collection evasion credential_access

Input Injection

T1516

Screen Capture

T1513

Keylogging

T1417.001

GUI Input Capture

T1417.002

description	ioc	Process
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByViewId	com.nextduringcnsh
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId	com.nextduringcnsh

Obtains sensitive information copied to the device clipboard 2 TTPs 1 IoCs

Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.

collection credential_access impact

Clipboard Data

T1414

Transmitted Data Manipulation

T1641.001

description	ioc	Process
Framework service call	android.content.IClipboard.addPrimaryClipChangedListener	com.nextduringcnsh

Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
banker discovery

Security Software Discovery
T1418.001
Queries the phone number (MSISDN for GSM devices) 1 TTPs
discovery

System Network Configuration Discovery
T1422

Acquires the wake lock 1 IoCs

description	ioc	Process
Framework service call	android.os.IPowerManager.acquireWakeLock	com.nextduringcnsh

Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs

Application may abuse the framework's foreground service to continue running in the foreground.

evasion persistence

Foreground Persistence

T1541

description	ioc	Process
Framework service call	android.app.IActivityManager.setServiceForeground	com.nextduringcnsh

Queries the mobile country code (MCC) 1 TTPs 1 IoCs

discovery

System Network Configuration Discovery

T1422

description	ioc	Process
Framework service call	com.android.internal.telephony.ITelephony.getNetworkCountryIsoForPhone	com.nextduringcnsh

Reads information about phone network operator. 1 TTPs
discovery

System Network Configuration Discovery
T1422

Requests accessing notifications (often used to intercept notifications before users become aware). 1 TTPs 1 IoCs

collection credential_access

Access Notifications

T1517

description	ioc	Process
Intent action	android.settings.ACTION_NOTIFICATION_LISTENER_SETTINGS	com.nextduringcnsh

Requests disabling of battery optimizations (often used to enable hiding in the background). 1 TTPs 1 IoCs

evasion

User Evasion

T1628.002

description	ioc	Process
Intent action	android.settings.REQUEST_IGNORE_BATTERY_OPTIMIZATIONS	com.nextduringcnsh

Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs

impact

Data Encrypted for Impact

T1471

description	ioc	Process
Framework API call	javax.crypto.Cipher.doFinal	com.nextduringcnsh

Checks CPU information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/cpuinfo	com.nextduringcnsh

Checks memory information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/meminfo	com.nextduringcnsh

com.nextduringcnsh
1⤵
- Loads dropped Dex/Jar
- Makes use of the framework's Accessibility service
- Obtains sensitive information copied to the device clipboard
- Acquires the wake lock
- Makes use of the framework's foreground persistence service
- Queries the mobile country code (MCC)
- Requests accessing notifications (often used to intercept notifications before users become aware).
- Requests disabling of battery optimizations (often used to enable hiding in the background).
- Uses Crypto APIs (Might try to encrypt user data)
- Checks CPU information
- Checks memory information
PID:4613

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Foreground Persistence

T1541

Privilege Escalation

Defense Evasion

Download New Code at Runtime

T1407

Foreground Persistence

T1541

Hide Artifacts

T1628

User Evasion

T1628.002

Input Injection

T1516

Virtualization/Sandbox Evasion

T1633

System Checks

T1633.001

Credential Access

Access Notifications

T1517

Clipboard Data

T1414

Input Capture

T1417

GUI Input Capture

T1417.002

Keylogging

T1417.001

Discovery

Software Discovery

T1418

Security Software Discovery

T1418.001

System Information Discovery

T1426

System Network Configuration Discovery

T1422

Lateral Movement

Collection

Access Notifications

T1517

Clipboard Data

T1414

Input Capture

T1417

GUI Input Capture

T1417.002

Keylogging

T1417.001

Screen Capture

T1513

Command and Control

Exfiltration

Impact

Data Encrypted for Impact

T1471

Data Manipulation

T1641

Transmitted Data Manipulation

T1641.001

Input Injection

T1516

Replay Monitor

Loading Replay Monitor...

Downloads

/data/user/0/com.nextduringcnsh/app_DynamicOptDex/uSUGi.json

Filesize
1KB

MD5
85831d08dfc47cb76fe6ba06e957788c

SHA1
8afd875b7d75ee01556fc2fc29124ec025c66744

SHA256
a7d35bc807e3d450f2b3001c9852edf9fdb3631c98a8554875db81d2ab2821b8

SHA512
ad4c547306816100d4f7ba475c870217a0e181738a6fcd4be0351e0f6cce76ea0bbebb36584de3289078b3f5c83348aeda8d3f58f7a0a713a69f004a0bb00851

Download Submit
/data/user/0/com.nextduringcnsh/app_DynamicOptDex/uSUGi.json

Filesize
1KB

MD5
1c40f3c0fc0814cb7eac943c29ae00d3

SHA1
266f3d81cb45ba6dac76563a4c6ae3651581457b

SHA256
c0b5d3e4d141004a635a79efb5916b88a5678ba18b71a7e42d066958b7a69f70

SHA512
3514ceaca5a416e20c6352e890f803a4134ec580ba8364057578a31014588204fc1073c6cbb5f6cc6227ec7505fceb730f7255c580d004d18b9ba8e7b7ee6595

Download Submit
/data/user/0/com.nextduringcnsh/app_DynamicOptDex/uSUGi.json

Filesize
2KB

MD5
839d885e45396f2c8fb1af9e109a6ff3

SHA1
eb5f684dde75ce1da7fcb03cad40dc4862e3743a

SHA256
97db4ddc5459710b4674bb5f5f04384f29140c2c024e33b10acab377c38f6744

SHA512
8d357740d282fb9fa1bac4a9d9141396f536548caccbc75b835a4aaf0b569b82320871ee84afbb10a62068d3627830d4ffd9ac931d98f753100b44ca085b2c22

Download Submit
/data/user/0/com.nextduringcnsh/cache/dztkccznf

Filesize
448KB

MD5
85f40ae8a897b0dc2f17a932ff5873fa

SHA1
a4d08c5962fcbe4c35e449e868186fc5431c5d98

SHA256
1a1afed56ca364523890bf3b39d0cd04b4ab488453ba2db7c9aefef62c28de22

SHA512
6ea02f5d024af168b060a3b0232b818c8e3a9e10b6daffb56dd0a354c7516333689a15d8ea3c1f310ecc00ca7fa2d561f0fec655c6e206d9352e931e1de5ed22

Download Submit
/data/user/0/com.nextduringcnsh/cache/oat/dztkccznf.cur.prof

Filesize
332B

MD5
61f03fad6c03b25b51aaa6dcede6f2e5

SHA1
abc5304a56aa0c2a524ab1d2fe73a5e77e9085c8

SHA256
1b5b720816bcd1ab07600eb8b2987e638b2f8bc184d6dd670799e185c7b85367

SHA512
727969f38cbcf0aba75c8e56445bc76dd6d5ad724a27cbe60c4ce9fa661b0c107417c00f3638233d603844803a75d2924ce54988d9afb01eed4f20a48c87109e

Download Submit
/data/user/0/com.nextduringcnsh/kl.txt

Filesize
28B

MD5
6311c3fd15588bb5c126e6c28ff5fffe

SHA1
ce81d136fce31779f4dd62e20bdaf99c91e2fc57

SHA256
8b82f6032e29a2b5c96031a3630fb6173d12ff0295bc20bb21b877d08f0812d8

SHA512
2975fe2e94b6a8adc9cfc1a865ad113772b54572883a537b02a16dd2d029c0f7d9cca3b154fd849bdfe978e18b396bcf9fa6e67e7c61f92bdc089a29a9c355c6

Download Submit
/data/user/0/com.nextduringcnsh/kl.txt

Filesize
68B

MD5
61e3eb2722aebd00b165b67138a79068

SHA1
ab61fc3ea564db4031c577709875e264e168819d

SHA256
2d9c8ddc5ee5f5fe9d78e5191a04037fdfa7472382b897da24d1429679a3d92d

SHA512
fcf834148f3c8c68e3f58e5888799f8a797c1c0db63ed66ea034f9a621739d62fe98e063a6bb3ed13ae32095886510122d2334c865baca8468f0084a283d1e65

Download Submit
/data/user/0/com.nextduringcnsh/kl.txt

Filesize
68B

MD5
8ecf8d05c863527ae1b2c220314ca9a2

SHA1
ebad4d93045eabb872e6ccb034993787e59ae6d6

SHA256
23cfdb37a0149153b11279082d9a7fe12a11360f5c6edb0ba87076a159e236d1

SHA512
42572e14083a467dc0f1accc7800c1a788fe850c4437ff57a3a28bd14dd0cfccc81e032ff9045e286bd8b7038b9a2350cee637a179bb37b322aac2d8d00063cf

Download Submit
/data/user/0/com.nextduringcnsh/kl.txt

Filesize
76B

MD5
a3ecd50ea3c529b0021e4a74d02b8597

SHA1
54f5f51abc1326d78ded4348110d9a6de9be09a3

SHA256
e94876a631630893f40b68820e74d6261cbe256101efb662a4903c9142805e11

SHA512
3a99fcaa7ef071dd4853a19fb5d997c6ad764eb71d44d88bf66c1a96ba599f75de29441af23e58c31dc0ad84b718899f2b1175a253a91b06905a06837096dbed

Download Submit

Analysis

Sharing

General

Malware Config

Extracted

Extracted

Signatures

Processes

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads