octo | bffeb57aea97a942cbc98d198a72d5109b3cf2c2bf79eb7c147aefc20b9ef3d7

Analysis

max time kernel
149s
max time network
151s
platform
android-11_x64
resource
android-x64-arm64-20240910-en
resource tags

arch:armarch:arm64arch:x64arch:x86image:android-x64-arm64-20240910-enlocale:en-usos:android-11-x64system
submitted
05-01-2025 22:06

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

bffeb57aea97a942cbc98d198a72d5109b3cf2c2bf79eb7c147aefc20b9ef3d7.apk
Size

2.3MB
MD5

deeaf1e0987004f0b82c68b04fd6ec66
SHA1

50344a7718844add53194cfa92276886058e840c
SHA256

bffeb57aea97a942cbc98d198a72d5109b3cf2c2bf79eb7c147aefc20b9ef3d7
SHA512

548972ee7f24260e2c7b72003cc52fba7a9aab1125221d63532489851a6b6c7881bda026552a007290becda7605da0f8ec28b0c160c0d5376d57766b664e7ab7
SSDEEP

49152:CSigsYsm/+Khe/oBhc590KzhcdZGZbmqK2YQEZP5Ar25G0ZPs/AE4KoSJ8EDuKFE:CSFoO7e/15bUZQ/K/QEZSClvMQKMgQZx

Score

10^/10

octo banker collection credential_access discovery evasion impact infostealer persistence rat trojan

Malware Config

Extracted

Family

octo

https://zalokdr.top/ZTZkNTJjNTkwYzk3/

https://bobnoopopo.org/ZTZkNTJjNTkwYzk3/

https://junggvrebvqqpo.org/ZTZkNTJjNTkwYzk3/

https://junggpervbvqqqqqqpo.com/ZTZkNTJjNTkwYzk3/

https://junggvbvqqgrouppo.com/ZTZkNTJjNTkwYzk3/

https://junggvbvqqnetokpo.com/ZTZkNTJjNTkwYzk3/

https://junggvbvq.top/ZTZkNTJjNTkwYzk3/

https://junggvbvq5656.top/ZTZkNTJjNTkwYzk3/

https://jungjunjunggvbvq.top/ZTZkNTJjNTkwYzk3/

rc4.plain

Extracted

Family

octo

https://zalokdr.top/ZTZkNTJjNTkwYzk3/

https://bobnoopopo.org/ZTZkNTJjNTkwYzk3/

https://junggvrebvqqpo.org/ZTZkNTJjNTkwYzk3/

https://junggpervbvqqqqqqpo.com/ZTZkNTJjNTkwYzk3/

https://junggvbvqqgrouppo.com/ZTZkNTJjNTkwYzk3/

https://junggvbvqqnetokpo.com/ZTZkNTJjNTkwYzk3/

https://junggvbvq.top/ZTZkNTJjNTkwYzk3/

https://junggvbvq5656.top/ZTZkNTJjNTkwYzk3/

https://jungjunjunggvbvq.top/ZTZkNTJjNTkwYzk3/

AES_key

Signatures

Octo
Octo is a banking malware with remote access capabilities first seen in April 2022.
banker trojan infostealer rat octo
Octo family
octo

Octo payload 1 IoCs

resource	yara_rule
behavioral2/files/fstream-3.dat	family_octo

Loads dropped Dex/Jar 1 TTPs 3 IoCs

Runs executable file dropped to the device during analysis.

evasion

Download New Code at Runtime

T1407

ioc	pid	Process
/data/user/0/com.whichtalktppw/app_DynamicOptDex/KpO.json	4790	com.whichtalktppw
/data/user/0/com.whichtalktppw/cache/gjbzbumt	4790	com.whichtalktppw
/data/user/0/com.whichtalktppw/cache/gjbzbumt	4790	com.whichtalktppw

Makes use of the framework's Accessibility service 4 TTPs 2 IoCs

Retrieves information displayed on the phone screen using AccessibilityService.

collection evasion credential_access

Input Injection

T1516

Screen Capture

T1513

Keylogging

T1417.001

GUI Input Capture

T1417.002

description	ioc	Process
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId	com.whichtalktppw
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByViewId	com.whichtalktppw

Obtains sensitive information copied to the device clipboard 2 TTPs 1 IoCs

Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.

collection credential_access impact

Clipboard Data

T1414

Transmitted Data Manipulation

T1641.001

description	ioc	Process
Framework service call	android.content.IClipboard.addPrimaryClipChangedListener	com.whichtalktppw

Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
banker discovery

Security Software Discovery
T1418.001
Queries the phone number (MSISDN for GSM devices) 1 TTPs
discovery

System Network Configuration Discovery
T1422

Acquires the wake lock 1 IoCs

description	ioc	Process
Framework service call	android.os.IPowerManager.acquireWakeLock	com.whichtalktppw

Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs

Application may abuse the framework's foreground service to continue running in the foreground.

evasion persistence

Foreground Persistence

T1541

description	ioc	Process
Framework service call	android.app.IActivityManager.setServiceForeground	com.whichtalktppw

Performs UI accessibility actions on behalf of the user 1 TTPs 3 IoCs

Application may abuse the accessibility service to prevent their removal.

evasion

Prevent Application Removal

T1629.001

ioc	Process
android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction	com.whichtalktppw
android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction	com.whichtalktppw
android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction	com.whichtalktppw

Queries the mobile country code (MCC) 1 TTPs 1 IoCs

discovery

System Network Configuration Discovery

T1422

description	ioc	Process
Framework service call	com.android.internal.telephony.ITelephony.getNetworkCountryIsoForPhone	com.whichtalktppw

Reads information about phone network operator. 1 TTPs
discovery

System Network Configuration Discovery
T1422

Requests accessing notifications (often used to intercept notifications before users become aware). 1 TTPs 1 IoCs

collection credential_access

Access Notifications

T1517

description	ioc	Process
Intent action	android.settings.ACTION_NOTIFICATION_LISTENER_SETTINGS	com.whichtalktppw

Requests disabling of battery optimizations (often used to enable hiding in the background). 1 TTPs 1 IoCs

evasion

User Evasion

T1628.002

description	ioc	Process
Intent action	android.settings.REQUEST_IGNORE_BATTERY_OPTIMIZATIONS	com.whichtalktppw

Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs

impact

Data Encrypted for Impact

T1471

description	ioc	Process
Framework API call	javax.crypto.Cipher.doFinal	com.whichtalktppw

Checks CPU information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/cpuinfo	com.whichtalktppw

Checks memory information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/meminfo	com.whichtalktppw

com.whichtalktppw
1⤵
- Loads dropped Dex/Jar
- Makes use of the framework's Accessibility service
- Obtains sensitive information copied to the device clipboard
- Acquires the wake lock
- Makes use of the framework's foreground persistence service
- Performs UI accessibility actions on behalf of the user
- Queries the mobile country code (MCC)
- Requests accessing notifications (often used to intercept notifications before users become aware).
- Requests disabling of battery optimizations (often used to enable hiding in the background).
- Uses Crypto APIs (Might try to encrypt user data)
- Checks CPU information
- Checks memory information
PID:4790

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Foreground Persistence

T1541

Privilege Escalation

Defense Evasion

Download New Code at Runtime

T1407

Foreground Persistence

T1541

Hide Artifacts

T1628

User Evasion

T1628.002

Impair Defenses

T1629

Prevent Application Removal

T1629.001

Input Injection

T1516

Virtualization/Sandbox Evasion

T1633

System Checks

T1633.001

Credential Access

Access Notifications

T1517

Clipboard Data

T1414

Input Capture

T1417

GUI Input Capture

T1417.002

Keylogging

T1417.001

Discovery

Software Discovery

T1418

Security Software Discovery

T1418.001

System Information Discovery

T1426

System Network Configuration Discovery

T1422

Lateral Movement

Collection

Access Notifications

T1517

Clipboard Data

T1414

Input Capture

T1417

GUI Input Capture

T1417.002

Keylogging

T1417.001

Screen Capture

T1513

Command and Control

Exfiltration

Impact

Data Encrypted for Impact

T1471

Data Manipulation

T1641

Transmitted Data Manipulation

T1641.001

Input Injection

T1516

Replay Monitor

Loading Replay Monitor...

Downloads

/data/user/0/com.whichtalktppw/app_DynamicOptDex/KpO.json

Filesize
1KB

MD5
59b62e28e94fd68678e5be72282cc266

SHA1
0a597258860cb4a373ff495a4daf849969057626

SHA256
bfedc201bc4e3186528428be039c0c0228ecefb0c17af0bdb35fceb574a5371a

SHA512
0b31ff0fb275a67dd5019f3aa65a451b2f583b505b8717cc103ce5b817a25ca526ec927fff46cab95a7d3203559cef2b18a2e29cbce55ab40f756d2a59e38c53

Download Submit
/data/user/0/com.whichtalktppw/app_DynamicOptDex/KpO.json

Filesize
1KB

MD5
b417b193531a2ce9f7dd6c71ab4d7705

SHA1
760c7736e36b3d6e1ecde3a8b02a760fc7e79f7d

SHA256
410fbfd0378e326a4eef16adb78d72956f87201f2f8ecd9dcc783d4080a7819d

SHA512
3ed9939bbe255a2d3fe7123ff79199da69e6194c3a56981e0d8856661d15cd710ba2633152a440b223b7d80c4da9202c6a53781bdca76e6478ba84cd07f06298

Download Submit
/data/user/0/com.whichtalktppw/app_DynamicOptDex/KpO.json

Filesize
2KB

MD5
4427e76f3209a3317e5cfe90d0af3877

SHA1
e85f13a24a9c5abbd21bd5ac804e034ac9775308

SHA256
ae967165faced7394af002d223a3f64f67f9d117b1f6e0428e1979da47398457

SHA512
4d43d760e265d10fc17d061ad54f68cbf77c15507283b337b683be19c7149a940a8a529607ec534d7b87dae451af802c7f5f345b07479641642ea2e17a7f50b1

Download Submit
/data/user/0/com.whichtalktppw/cache/gjbzbumt

Filesize
448KB

MD5
4f1ea75911d5753f2b626ce4979f32db

SHA1
d8f8adf77dc6e5d4751a10d538fbe92cb842146b

SHA256
15b339de80b9b32cce56f014de18ca2af726d50331411840f90afc11b6e0ff0b

SHA512
74f7ef35e3b27c8568374e7a3fa29a5c67296b3248b65628af658f3eb94d635590d2c315053ab75388fbcd4959ad14bce65eaa080cfbb8b9ee11ab40214e745b

Download Submit
/data/user/0/com.whichtalktppw/cache/oat/gjbzbumt.cur.prof

Filesize
335B

MD5
fb145cd7c246991935d8b0c5e2f97056

SHA1
a4363696174651dfe08450d73f2231991923a838

SHA256
9815f80b0107b7813f4da3bf09dcf2926c37dda9485fc50c10e7f74c00063b57

SHA512
c8f5e76e5791b0442497e1ad958bb4a567f97099fb51cd8dab9a8a704005031bc61f92df508aba8a6587289105501b1f856080eacfa0eff859777af6724d814c

Download Submit
/data/user/0/com.whichtalktppw/kl.txt

Filesize
480B

MD5
81009fb2d3f1f4ca297b350d41768ef3

SHA1
c73a002faafe254987b3f8bf8d61741deeb9b273

SHA256
0dbc3aa8e7c95f2495629057b8516d2335bb02208309e0a80bd2094c6855bd4b

SHA512
22494fc0e5ebe36faaad3f30d48b28521e336bb6a9ba4fb0e1934f80ad5cde7b1cf8d714996180502d69146e4567afe9ea6a11a2537da4b96f84479892a9e3e4

Download Submit
/data/user/0/com.whichtalktppw/kl.txt

Filesize
28B

MD5
6311c3fd15588bb5c126e6c28ff5fffe

SHA1
ce81d136fce31779f4dd62e20bdaf99c91e2fc57

SHA256
8b82f6032e29a2b5c96031a3630fb6173d12ff0295bc20bb21b877d08f0812d8

SHA512
2975fe2e94b6a8adc9cfc1a865ad113772b54572883a537b02a16dd2d029c0f7d9cca3b154fd849bdfe978e18b396bcf9fa6e67e7c61f92bdc089a29a9c355c6

Download Submit
/data/user/0/com.whichtalktppw/kl.txt

Filesize
237B

MD5
d91a486f05f7e1b3f9c54d68bd957b47

SHA1
243a682c013a8beae34238c54a75999414f2bef7

SHA256
d6129fe252a58e9b0cbf3e8ca9044cf1a169c543b8a86384554ac1f5c938992e

SHA512
eb579dd45bbc35181ad1e5ae0f12e44d5d8f5242b386cca4f41ea2528f58c04d9ada3d514124301689f0ce276feac3669e2163747024a9d084a2603bfbc65bcc

Download Submit
/data/user/0/com.whichtalktppw/kl.txt

Filesize
63B

MD5
57dc19066355f00e454045881f27cc93

SHA1
b5d56bec1608a5e1dcab495175bf7c9294a9f992

SHA256
97b4de189ce538a05479b3f2f70d71b0d26bdcd29ff64d502b49fca346e691f8

SHA512
2b89f01d005fb31ddcbb4137ee62c16311fe6d47d53b887031937668db69e26aaa7f8f9855dc6b07a9161af9dea6804d406a515e042185ea55899f17fb412f46

Download Submit
/data/user/0/com.whichtalktppw/kl.txt

Filesize
58B

MD5
45406edf3a179b198d1928d3b194bc17

SHA1
1d6e0cfa468cee12754f752ee7283a5417ece746

SHA256
c848e6b5569ad1b6dc351371a198bed36fc96ef4bc4e6d9adb7881686b81132d

SHA512
d6fcd49b02f811c0261799eb57718cd1b73f6abadd6b3942edca1e14fb43ec82f2756c995d4bab9f57362c9554196730cb00b6b87e5f46c86b7cbeb4594fb9af

Download Submit

Analysis

Sharing

General

Malware Config

Extracted

Extracted

Signatures

Processes

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads