octo | be715f43b4d3e96d6dda37a1c775c2e081f3e6d6f19c87f0e2143f9c8ff063b4 | Triage

Analysis

max time kernel
147s
max time network
152s
platform
android-9_x86
resource
android-x86-arm-20240910-en
resource tags

arch:armarch:x86image:android-x86-arm-20240910-enlocale:en-usos:android-9-x86system
submitted
29-12-2024 22:04

Sharing

Report Analysis Logs

General

Target

be715f43b4d3e96d6dda37a1c775c2e081f3e6d6f19c87f0e2143f9c8ff063b4.apk
Size

2.1MB
MD5

898237227ae7fcc2d8ff6b708fcbbe68
SHA1

9a8a5253d1f25cd3200fa72861a8257fb5e2883c
SHA256

be715f43b4d3e96d6dda37a1c775c2e081f3e6d6f19c87f0e2143f9c8ff063b4
SHA512

8d669d401a6b9b3d27f933c6ec970f1fdcf7d20a731e5acfb58bb76c6a6e40818f7bedf5734348db3d099baae26010bf27e639c86ce121c0c3632b5e16394342
SSDEEP

49152:qzp5NMSJ+5uT3vmt1z1JF4BBYVPDiXmIL/Tgd25mG2qWVuXa04XfA52/9RLnQhhn:VSJ+kLet1z1r4BBYkr3BWwq04X8+RLQ3

Score

10^/10

octo banker collection credential_access discovery evasion impact infostealer persistence rat stealth trojan

Malware Config

Extracted

Family

octo

C2

https://fenvefizikdusunceler.xyz/NzkzYmVjMjc2OGUz/

https://hayatvesanatinkaderhikayeleri.xyz/NzkzYmVjMjc2OGUz/

https://kaderdenkesişenyollarinhikayesi.xyz/NzkzYmVjMjc2OGUz/

https://arkadaslikinkaderlemuhabbeti.xyz/NzkzYmVjMjc2OGUz/

https://yoldasyolculugunfelsefikizleri.xyz/NzkzYmVjMjc2OGUz/

https://kaderserininsamimiyansimalari.xyz/NzkzYmVjMjc2OGUz/

https://dostlukvehayatinbaglantivekaderi.xyz/NzkzYmVjMjc2OGUz/

https://kaderdenarkadaslikveseruven.xyz/NzkzYmVjMjc2OGUz/

https://hayatvesamimiyetinkaderseltonu.xyz/NzkzYmVjMjc2OGUz/

https://kaderselbaglantilarvesanatyolu.xyz/NzkzYmVjMjc2OGUz/

https://dostlukveduygusalbaglarinkaderi.xyz/NzkzYmVjMjc2OGUz/

https://hayatvesamimiyetinbaglantikaderi.xyz/NzkzYmVjMjc2OGUz/

https://kaderinkesişenarkadaslikhikayesi.xyz/NzkzYmVjMjc2OGUz/

https://kadervesanatinbaglantilersanati.xyz/NzkzYmVjMjc2OGUz/

https://hayatinkaderdenbaglananhikayesi.xyz/NzkzYmVjMjc2OGUz/

https://arkadaslikinsanatselvehikayesi.xyz/NzkzYmVjMjc2OGUz/

https://kaderleyoldasserserivenvesanat.xyz/NzkzYmVjMjc2OGUz/

https://hayatinbaglantilarlaornenyanizi.xyz/NzkzYmVjMjc2OGUz/

https://arkadaslikbaglanserseruvehikaye.xyz/NzkzYmVjMjc2OGUz/

https://kaderinbaglantilarvehikayeleri.xyz/NzkzYmVjMjc2OGUz/

rc4.plain

Extracted

Family

octo

C2

https://fenvefizikdusunceler.xyz/NzkzYmVjMjc2OGUz/

https://hayatvesanatinkaderhikayeleri.xyz/NzkzYmVjMjc2OGUz/

https://kaderdenkesişenyollarinhikayesi.xyz/NzkzYmVjMjc2OGUz/

https://arkadaslikinkaderlemuhabbeti.xyz/NzkzYmVjMjc2OGUz/

https://yoldasyolculugunfelsefikizleri.xyz/NzkzYmVjMjc2OGUz/

https://kaderserininsamimiyansimalari.xyz/NzkzYmVjMjc2OGUz/

https://dostlukvehayatinbaglantivekaderi.xyz/NzkzYmVjMjc2OGUz/

https://kaderdenarkadaslikveseruven.xyz/NzkzYmVjMjc2OGUz/

https://hayatvesamimiyetinkaderseltonu.xyz/NzkzYmVjMjc2OGUz/

https://kaderselbaglantilarvesanatyolu.xyz/NzkzYmVjMjc2OGUz/

https://dostlukveduygusalbaglarinkaderi.xyz/NzkzYmVjMjc2OGUz/

https://hayatvesamimiyetinbaglantikaderi.xyz/NzkzYmVjMjc2OGUz/

https://kaderinkesişenarkadaslikhikayesi.xyz/NzkzYmVjMjc2OGUz/

https://kadervesanatinbaglantilersanati.xyz/NzkzYmVjMjc2OGUz/

https://hayatinkaderdenbaglananhikayesi.xyz/NzkzYmVjMjc2OGUz/

https://arkadaslikinsanatselvehikayesi.xyz/NzkzYmVjMjc2OGUz/

https://kaderleyoldasserserivenvesanat.xyz/NzkzYmVjMjc2OGUz/

https://hayatinbaglantilarlaornenyanizi.xyz/NzkzYmVjMjc2OGUz/

https://arkadaslikbaglanserseruvehikaye.xyz/NzkzYmVjMjc2OGUz/

https://kaderinbaglantilarvehikayeleri.xyz/NzkzYmVjMjc2OGUz/

AES_key

Signatures

Octo
Octo is a banking malware with remote access capabilities first seen in April 2022.
banker trojan infostealer rat octo
Octo family
octo

Octo payload 2 IoCs

resource	yara_rule
behavioral1/memory/4365-0.dex	family_octo
behavioral1/memory/4338-0.dex	family_octo

Removes its main activity from the application launcher 1 TTPs 1 IoCs

stealth trojan evasion

Suppress Application Icon

pid	Process
4338	com.healthlyfy.track

Loads dropped Dex/Jar 1 TTPs 2 IoCs

Runs executable file dropped to the device during analysis.

Download New Code at Runtime

ioc	pid	Process
/data/user/0/com.healthlyfy.track/app_original/atXTSy.json	4365	/system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.healthlyfy.track/app_original/atXTSy.json --output-vdex-fd=41 --oat-fd=42 --oat-location=/data/user/0/com.healthlyfy.track/app_original/oat/x86/atXTSy.odex --compiler-filter=quicken --class-loader-context=&
/data/user/0/com.healthlyfy.track/app_original/atXTSy.json	4338	com.healthlyfy.track

Makes use of the framework's Accessibility service 4 TTPs 2 IoCs

Retrieves information displayed on the phone screen using AccessibilityService.

collection evasion credential_access

Input Injection

Screen Capture

Keylogging

GUI Input Capture

description	ioc	Process
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId	com.healthlyfy.track
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByViewId	com.healthlyfy.track

Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
banker discovery

Security Software Discovery
T1418.001
Queries the phone number (MSISDN for GSM devices) 1 TTPs
discovery

System Network Configuration Discovery
T1422

Acquires the wake lock 1 IoCs

description	ioc	Process
Framework service call	android.os.IPowerManager.acquireWakeLock	com.healthlyfy.track

Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs

Application may abuse the framework's foreground service to continue running in the foreground.

evasion persistence

Foreground Persistence

description	ioc	Process
Framework service call	android.app.IActivityManager.setServiceForeground	com.healthlyfy.track

Performs UI accessibility actions on behalf of the user 1 TTPs 4 IoCs

Application may abuse the accessibility service to prevent their removal.

Prevent Application Removal

ioc	Process
android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction	com.healthlyfy.track
android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction	com.healthlyfy.track
android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction	com.healthlyfy.track
android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction	com.healthlyfy.track

Queries the mobile country code (MCC) 1 TTPs 1 IoCs

System Network Configuration Discovery

description	ioc	Process
Framework service call	com.android.internal.telephony.ITelephony.getNetworkCountryIsoForPhone	com.healthlyfy.track

Queries the unique device ID (IMEI, MEID, IMSI) 1 TTPs
discovery

System Network Configuration Discovery
T1422
Reads information about phone network operator. 1 TTPs
discovery

System Network Configuration Discovery
T1422

Requests accessing notifications (often used to intercept notifications before users become aware). 1 TTPs 1 IoCs

collection credential_access

Access Notifications

description	ioc	Process
Intent action	android.settings.ACTION_NOTIFICATION_LISTENER_SETTINGS	com.healthlyfy.track

Requests disabling of battery optimizations (often used to enable hiding in the background). 1 TTPs 1 IoCs

User Evasion

description	ioc	Process
Intent action	android.settings.REQUEST_IGNORE_BATTERY_OPTIMIZATIONS	com.healthlyfy.track

Requests modifying system settings. 1 IoCs

description	ioc	Process
Intent action	android.settings.action.MANAGE_WRITE_SETTINGS	com.healthlyfy.track

Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs

Broadcast Receivers

description	ioc	Process
Framework service call	android.app.IActivityManager.registerReceiver	com.healthlyfy.track

Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs

Data Encrypted for Impact

description	ioc	Process
Framework API call	javax.crypto.Cipher.doFinal	com.healthlyfy.track

com.healthlyfy.track
1⤵
- Removes its main activity from the application launcher
- Loads dropped Dex/Jar
- Makes use of the framework's Accessibility service
- Acquires the wake lock
- Makes use of the framework's foreground persistence service
- Performs UI accessibility actions on behalf of the user
- Queries the mobile country code (MCC)
- Requests accessing notifications (often used to intercept notifications before users become aware).
- Requests disabling of battery optimizations (often used to enable hiding in the background).
- Requests modifying system settings.
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Uses Crypto APIs (Might try to encrypt user data)
PID:4338
- /system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.healthlyfy.track/app_original/atXTSy.json --output-vdex-fd=41 --oat-fd=42 --oat-location=/data/user/0/com.healthlyfy.track/app_original/oat/x86/atXTSy.odex --compiler-filter=quicken --class-loader-context=&
  2⤵
  - Loads dropped Dex/Jar
  PID:4365

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Event Triggered Execution

Broadcast Receivers

Foreground Persistence

Privilege Escalation

Defense Evasion

Download New Code at Runtime

Foreground Persistence

Hide Artifacts

Suppress Application Icon

User Evasion

Impair Defenses

Prevent Application Removal

Input Injection

Credential Access

Access Notifications

Input Capture

GUI Input Capture

Keylogging

Discovery

Software Discovery

Security Software Discovery

System Network Configuration Discovery

Lateral Movement

Collection

Access Notifications

Input Capture

GUI Input Capture

Keylogging

Screen Capture

Command and Control

Exfiltration

Impact

Data Encrypted for Impact

Input Injection

Replay Monitor

Loading Replay Monitor...

Downloads

/data/data/com.healthlyfy.track/app_original/atXTSy.json

Filesize
153KB

MD5
f27dc9fdc2f5fdfb2173f3c990e8fcea

SHA1
f69a5e2f3791ed58886fa06819023bac1244ccf9

SHA256
0cc6a76db6d68bdc116d001c2481742ba1af3a35640970db624c2e5f1676c70b

SHA512
1c9bead613124e908cfbce3f555be36e7f9d215b5a8fea763fc66c1532209cc2e07232cb136a6deba93a2db41f496c767d17b75217d8fc1f206beb85bbe479aa

Download Submit
/data/data/com.healthlyfy.track/app_original/atXTSy.json

Filesize
153KB

MD5
1f11b725a7bb6da88616e47a8a23d6ee

SHA1
b35319846bad5b2e8ec80913aca4f932570c8606

SHA256
874fa84cd80c67c0e48fb8a53b2f5be243caa00b74c00ca494222ea93f7468c7

SHA512
e320d43a92bbd01099242b164ab7be0c3c231f646a1cabf0cd52fb21bce22cd404d7d4fddefaf03ab4fbe2e3f39dae448c5e0d8ca41a07ba9834512556b1fb73

Download Submit
/data/user/0/com.healthlyfy.track/app_original/atXTSy.json

Filesize
451KB

MD5
f33433d00ddca457399bbf9a6192432a

SHA1
8a11e6b2891b2765a1a3e8f9041e95390ff19946

SHA256
8960a92c29c162c9b7d232a355fbc80061ccbebd48ff5ad924685dae419c6357

SHA512
997e7592163fcae1c097d0c94202bd1b68a018b0f2d9550e51269655a33de90940cbadeb1ef09958a5359756e3b23842ac32e208164e4b0f649ec7a810fae123

Download Submit
/data/user/0/com.healthlyfy.track/app_original/atXTSy.json

Filesize
451KB

MD5
8f6e6c66b56501ac5ebbaf2a5ac08926

SHA1
f6839fef0e0d04fd0feabfe32bd183d1e88c6684

SHA256
8555eb03026b8555d50e1e2593ae984062bf79f271ffee29a47249547f1beadc

SHA512
fa027f563c01cd8d23bfb0d04e264678f1ad6af1eae140fd4a27c864ab9bbe37f43e2c692a3d59d86ba0b1f233543ee16c8a30f530dcf1b3e407be93470f0090

Download Submit