octo | 4ce28e23d211d706cfa717101a2ee2fe707d42bbc952bec677587035bdc07f05

Analysis

max time kernel
148s
max time network
150s
platform
android-9_x86
resource
android-x86-arm-20240910-en
resource tags

arch:armarch:x86image:android-x86-arm-20240910-enlocale:en-usos:android-9-x86system
submitted
03-01-2025 22:02

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

4ce28e23d211d706cfa717101a2ee2fe707d42bbc952bec677587035bdc07f05.apk
Size

2.3MB
MD5

70ffd46652002e7986d1242422de194c
SHA1

e7b0a1872c9c101ade1d3614c8f2d2a2e57aa5ae
SHA256

4ce28e23d211d706cfa717101a2ee2fe707d42bbc952bec677587035bdc07f05
SHA512

360839f73f1a887e9ed1f98d89404c786f906dae011f1315a217719ee6dc79b451dae73a1771d80dfb19c612ab688afdcfc46617a975ddaa2ae73b9a12e7a9a8
SSDEEP

49152:bhMWmFTqzAgGnuUVEvf6Vbxj57sD8GAa5PWL7oznvhLnuJj6ZFQ9yroSJOQyVi0p:bhTmFH3nVEvq+PWL7svZud9yESJO1iVE

Score

10^/10

octo banker collection credential_access discovery evasion impact infostealer persistence rat stealth trojan

Malware Config

Extracted

Family

octo

https://karakalpakdostlugutasarimi.xyz/NWNlNzMzN2Y4NmI2/

https://karakalpakmodavesanat.xyz/NWNlNzMzN2Y4NmI2/

https://karakalpakkulturunsirlari.xyz/NWNlNzMzN2Y4NmI2/

https://karakalpakgeleneklerikosesi.xyz/NWNlNzMzN2Y4NmI2/

https://karakalpakdesentasarimlari.xyz/NWNlNzMzN2Y4NmI2/

https://karakalpakdokumasanati.xyz/NWNlNzMzN2Y4NmI2/

https://karakalpakmodasıvehayat.xyz/NWNlNzMzN2Y4NmI2/

https://karakalpakyanihikayeler.xyz/NWNlNzMzN2Y4NmI2/

https://karakalpakginensanatdiyari.xyz/NWNlNzMzN2Y4NmI2/

https://karakalpakdesenvesanatkosesi.xyz/NWNlNzMzN2Y4NmI2/

https://karakalpaklagelenektasima.xyz/NWNlNzMzN2Y4NmI2/

https://karakalpakustalarinakil.xyz/NWNlNzMzN2Y4NmI2/

https://karakalpakmodagercegi.xyz/NWNlNzMzN2Y4NmI2/

https://karakalpakvesanateserleri.xyz/NWNlNzMzN2Y4NmI2/

https://karakalpakdaguzelrenkler.xyz/NWNlNzMzN2Y4NmI2/

https://karakalpakseverlerinkosesi.xyz/NWNlNzMzN2Y4NmI2/

https://karakalpakileribakiyor.xyz/NWNlNzMzN2Y4NmI2/

https://karakalpakdernegitutkusu.xyz/NWNlNzMzN2Y4NmI2/

https://karakalpakvesanattasarimi.xyz/NWNlNzMzN2Y4NmI2/

https://karakalpakyarenlerisever.xyz/NWNlNzMzN2Y4NmI2/

rc4.plain

Extracted

Family

octo

https://karakalpakdostlugutasarimi.xyz/NWNlNzMzN2Y4NmI2/

https://karakalpakmodavesanat.xyz/NWNlNzMzN2Y4NmI2/

https://karakalpakkulturunsirlari.xyz/NWNlNzMzN2Y4NmI2/

https://karakalpakgeleneklerikosesi.xyz/NWNlNzMzN2Y4NmI2/

https://karakalpakdesentasarimlari.xyz/NWNlNzMzN2Y4NmI2/

https://karakalpakdokumasanati.xyz/NWNlNzMzN2Y4NmI2/

https://karakalpakmodasıvehayat.xyz/NWNlNzMzN2Y4NmI2/

https://karakalpakyanihikayeler.xyz/NWNlNzMzN2Y4NmI2/

https://karakalpakginensanatdiyari.xyz/NWNlNzMzN2Y4NmI2/

https://karakalpakdesenvesanatkosesi.xyz/NWNlNzMzN2Y4NmI2/

https://karakalpaklagelenektasima.xyz/NWNlNzMzN2Y4NmI2/

https://karakalpakustalarinakil.xyz/NWNlNzMzN2Y4NmI2/

https://karakalpakmodagercegi.xyz/NWNlNzMzN2Y4NmI2/

https://karakalpakvesanateserleri.xyz/NWNlNzMzN2Y4NmI2/

https://karakalpakdaguzelrenkler.xyz/NWNlNzMzN2Y4NmI2/

https://karakalpakseverlerinkosesi.xyz/NWNlNzMzN2Y4NmI2/

https://karakalpakileribakiyor.xyz/NWNlNzMzN2Y4NmI2/

https://karakalpakdernegitutkusu.xyz/NWNlNzMzN2Y4NmI2/

https://karakalpakvesanattasarimi.xyz/NWNlNzMzN2Y4NmI2/

https://karakalpakyarenlerisever.xyz/NWNlNzMzN2Y4NmI2/

AES_key

Signatures

Octo
Octo is a banking malware with remote access capabilities first seen in April 2022.
banker trojan infostealer rat octo
Octo family
octo

Octo payload 2 IoCs

resource	yara_rule
behavioral1/memory/4291-0.dex	family_octo
behavioral1/memory/4265-0.dex	family_octo

Removes its main activity from the application launcher 1 TTPs 1 IoCs

stealth trojan evasion

Suppress Application Icon

T1628.001

pid	Process
4265	com.tennis.lunch

Loads dropped Dex/Jar 1 TTPs 2 IoCs

Runs executable file dropped to the device during analysis.

evasion

Download New Code at Runtime

T1407

ioc	pid	Process
/data/user/0/com.tennis.lunch/app_flee/aw.json	4291	/system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.tennis.lunch/app_flee/aw.json --output-vdex-fd=41 --oat-fd=42 --oat-location=/data/user/0/com.tennis.lunch/app_flee/oat/x86/aw.odex --compiler-filter=quicken --class-loader-context=&
/data/user/0/com.tennis.lunch/app_flee/aw.json	4265	com.tennis.lunch

Makes use of the framework's Accessibility service 4 TTPs 2 IoCs

Retrieves information displayed on the phone screen using AccessibilityService.

collection evasion credential_access

Input Injection

T1516

Screen Capture

T1513

Keylogging

T1417.001

GUI Input Capture

T1417.002

description	ioc	Process
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId	com.tennis.lunch
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByViewId	com.tennis.lunch

Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
banker discovery

Security Software Discovery
T1418.001
Queries the phone number (MSISDN for GSM devices) 1 TTPs
discovery

System Network Configuration Discovery
T1422

Acquires the wake lock 1 IoCs

description	ioc	Process
Framework service call	android.os.IPowerManager.acquireWakeLock	com.tennis.lunch

Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs

Application may abuse the framework's foreground service to continue running in the foreground.

evasion persistence

Foreground Persistence

T1541

description	ioc	Process
Framework service call	android.app.IActivityManager.setServiceForeground	com.tennis.lunch

Performs UI accessibility actions on behalf of the user 1 TTPs 4 IoCs

Application may abuse the accessibility service to prevent their removal.

evasion

Prevent Application Removal

T1629.001

ioc	Process
android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction	com.tennis.lunch
android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction	com.tennis.lunch
android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction	com.tennis.lunch
android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction	com.tennis.lunch

Queries the mobile country code (MCC) 1 TTPs 1 IoCs

discovery

System Network Configuration Discovery

T1422

description	ioc	Process
Framework service call	com.android.internal.telephony.ITelephony.getNetworkCountryIsoForPhone	com.tennis.lunch

Queries the unique device ID (IMEI, MEID, IMSI) 1 TTPs
discovery

System Network Configuration Discovery
T1422
Reads information about phone network operator. 1 TTPs
discovery

System Network Configuration Discovery
T1422

Requests accessing notifications (often used to intercept notifications before users become aware). 1 TTPs 1 IoCs

collection credential_access

Access Notifications

T1517

description	ioc	Process
Intent action	android.settings.ACTION_NOTIFICATION_LISTENER_SETTINGS	com.tennis.lunch

Requests disabling of battery optimizations (often used to enable hiding in the background). 1 TTPs 1 IoCs

evasion

User Evasion

T1628.002

description	ioc	Process
Intent action	android.settings.REQUEST_IGNORE_BATTERY_OPTIMIZATIONS	com.tennis.lunch

Requests modifying system settings. 1 IoCs

evasion

description	ioc	Process
Intent action	android.settings.action.MANAGE_WRITE_SETTINGS	com.tennis.lunch

Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs

persistence

Broadcast Receivers

T1624.001

description	ioc	Process
Framework service call	android.app.IActivityManager.registerReceiver	com.tennis.lunch

Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs

impact

Data Encrypted for Impact

T1471

description	ioc	Process
Framework API call	javax.crypto.Cipher.doFinal	com.tennis.lunch

com.tennis.lunch
1⤵
- Removes its main activity from the application launcher
- Loads dropped Dex/Jar
- Makes use of the framework's Accessibility service
- Acquires the wake lock
- Makes use of the framework's foreground persistence service
- Performs UI accessibility actions on behalf of the user
- Queries the mobile country code (MCC)
- Requests accessing notifications (often used to intercept notifications before users become aware).
- Requests disabling of battery optimizations (often used to enable hiding in the background).
- Requests modifying system settings.
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Uses Crypto APIs (Might try to encrypt user data)
PID:4265
- /system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.tennis.lunch/app_flee/aw.json --output-vdex-fd=41 --oat-fd=42 --oat-location=/data/user/0/com.tennis.lunch/app_flee/oat/x86/aw.odex --compiler-filter=quicken --class-loader-context=&
  2⤵
  - Loads dropped Dex/Jar
  PID:4291

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Event Triggered Execution

T1624

Broadcast Receivers

T1624.001

Foreground Persistence

T1541

Privilege Escalation

Defense Evasion

Download New Code at Runtime

T1407

Foreground Persistence

T1541

Hide Artifacts

T1628

Suppress Application Icon

T1628.001

User Evasion

T1628.002

Impair Defenses

T1629

Prevent Application Removal

T1629.001

Input Injection

T1516

Credential Access

Access Notifications

T1517

Input Capture

T1417

GUI Input Capture

T1417.002

Keylogging

T1417.001

Discovery

Software Discovery

T1418

Security Software Discovery

T1418.001

System Network Configuration Discovery

T1422

Lateral Movement

Collection

Access Notifications

T1517

Input Capture

T1417

GUI Input Capture

T1417.002

Keylogging

T1417.001

Screen Capture

T1513

Command and Control

Exfiltration

Impact

Data Encrypted for Impact

T1471

Input Injection

T1516

Replay Monitor

Loading Replay Monitor...

Downloads

/data/data/com.tennis.lunch/app_flee/aw.json

Filesize
153KB

MD5
6217cbbca05c77d7791ea2e85c22e1d2

SHA1
5254134add1811ca58ed8a6edcf2fd32b83d3371

SHA256
70b94fb580925f102692461fac95f9d7498966821cba679369bb74e93236eb35

SHA512
0d70d36b385c0e8ded96d24686d417f1c1c142953b4b2b7c5d503ada8aa7e177ddb04364531501b1d592406f3b7381867ce4c7ea4b624e3fcf82b8f170302a63

Download Submit
/data/data/com.tennis.lunch/app_flee/aw.json

Filesize
153KB

MD5
c0d1d7e5525d42d2ed538a7ce63ac0f4

SHA1
ac6049fa86270bc8f87f5a20b4a2361a6acc431d

SHA256
e898d5a54ff758b82f3f36526c634c5fc99eccb524caa637550fc3f36cadf421

SHA512
7b173c0e0b74b03c8a502c71f1e87f5672bf2f3839bc44f5e8d9e09ad96057c9a481fc364e2976cc6c0524cf50168f74c89a8b97c3731b01417e97733e2e9b9f

Download Submit
/data/user/0/com.tennis.lunch/app_flee/aw.json

Filesize
451KB

MD5
ed83cf96a3d5a46ebfcfc24652982dd5

SHA1
1ccfed32bc7e05b4f3106098745da6e2caa75f6e

SHA256
5f7e1be944e14b058d242f66841ce1f5aca4959455ae22515e0ccf55962c6bb7

SHA512
76eed7941ef588339b5507d0cad4426416947f9ad8cc4f3ba7912afd1446ea37e1759e65af2de3cb547f8e017c17e49aef6ec10f807a8cfa13637b6f6d1e0463

Download Submit
/data/user/0/com.tennis.lunch/app_flee/aw.json

Filesize
451KB

MD5
182b02d7488b7d20422ccd18c55095f8

SHA1
b8280a9b8da7553dd9744952bb5fd41fb3c850a2

SHA256
4dc422f9b7b8fa6d671f2c70f229386f90db16fca140ec9f8b98a2bf08fb4111

SHA512
097025e0849328e91615ff0f5ba8f267e645132a2db73bbbf521584397f1b9d65d9dec043c33486e5113f40b8346ec657806c5d735c320486161093e7d9a745a

Download Submit

Analysis

Sharing

General

Malware Config

Extracted

Extracted

Signatures

Processes

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads