octo | 992a388d8409c370ea9d0ae4ab6115045b1ba5210ae8ed8b5fda9b10bd9bd3ca

Analysis

max time kernel
149s
max time network
154s
platform
android-10_x64
resource
android-x64-20240910-en
resource tags

arch:x64arch:x86image:android-x64-20240910-enlocale:en-usos:android-10-x64system
submitted
07-01-2025 22:02

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

992a388d8409c370ea9d0ae4ab6115045b1ba5210ae8ed8b5fda9b10bd9bd3ca.apk
Size

2.2MB
MD5

99ba48af35517b25b39eced83499335c
SHA1

ce12861f6eb65adf25a861c141a496a2696b4db8
SHA256

992a388d8409c370ea9d0ae4ab6115045b1ba5210ae8ed8b5fda9b10bd9bd3ca
SHA512

965a965a7cb95f9a86ea2ec370a36b9b53bbbacaf82ed6c1db987f5ce51573c544c0478a13384a98886221cfce6cd1618b4299615db0ee4af6d69a9663b92a47
SSDEEP

49152:aezUa5B/hP/bY4cp1Xthe7/P2z+I1ErD4YvZ711xfAtVcBJSTw3+c:JUC9hnup1PezP9I14DRZNfAtaO0uc

Score

10^/10

octo banker collection credential_access discovery evasion impact infostealer persistence rat trojan

Malware Config

Extracted

Family

octo

https://karakalpakdostlugutasarimi.xyz/NWNlNzMzN2Y4NmI2/

https://karakalpakmodavesanat.xyz/NWNlNzMzN2Y4NmI2/

https://karakalpakkulturunsirlari.xyz/NWNlNzMzN2Y4NmI2/

https://karakalpakgeleneklerikosesi.xyz/NWNlNzMzN2Y4NmI2/

https://karakalpakdesentasarimlari.xyz/NWNlNzMzN2Y4NmI2/

https://karakalpakdokumasanati.xyz/NWNlNzMzN2Y4NmI2/

https://karakalpakmodasıvehayat.xyz/NWNlNzMzN2Y4NmI2/

https://karakalpakyanihikayeler.xyz/NWNlNzMzN2Y4NmI2/

https://karakalpakginensanatdiyari.xyz/NWNlNzMzN2Y4NmI2/

https://karakalpakdesenvesanatkosesi.xyz/NWNlNzMzN2Y4NmI2/

https://karakalpaklagelenektasima.xyz/NWNlNzMzN2Y4NmI2/

https://karakalpakustalarinakil.xyz/NWNlNzMzN2Y4NmI2/

https://karakalpakmodagercegi.xyz/NWNlNzMzN2Y4NmI2/

https://karakalpakvesanateserleri.xyz/NWNlNzMzN2Y4NmI2/

https://karakalpakdaguzelrenkler.xyz/NWNlNzMzN2Y4NmI2/

https://karakalpakseverlerinkosesi.xyz/NWNlNzMzN2Y4NmI2/

https://karakalpakileribakiyor.xyz/NWNlNzMzN2Y4NmI2/

https://karakalpakdernegitutkusu.xyz/NWNlNzMzN2Y4NmI2/

https://karakalpakvesanattasarimi.xyz/NWNlNzMzN2Y4NmI2/

https://karakalpakyarenlerisever.xyz/NWNlNzMzN2Y4NmI2/

rc4.plain

Extracted

Family

octo

https://karakalpakdostlugutasarimi.xyz/NWNlNzMzN2Y4NmI2/

https://karakalpakmodavesanat.xyz/NWNlNzMzN2Y4NmI2/

https://karakalpakkulturunsirlari.xyz/NWNlNzMzN2Y4NmI2/

https://karakalpakgeleneklerikosesi.xyz/NWNlNzMzN2Y4NmI2/

https://karakalpakdesentasarimlari.xyz/NWNlNzMzN2Y4NmI2/

https://karakalpakdokumasanati.xyz/NWNlNzMzN2Y4NmI2/

https://karakalpakmodasıvehayat.xyz/NWNlNzMzN2Y4NmI2/

https://karakalpakyanihikayeler.xyz/NWNlNzMzN2Y4NmI2/

https://karakalpakginensanatdiyari.xyz/NWNlNzMzN2Y4NmI2/

https://karakalpakdesenvesanatkosesi.xyz/NWNlNzMzN2Y4NmI2/

https://karakalpaklagelenektasima.xyz/NWNlNzMzN2Y4NmI2/

https://karakalpakustalarinakil.xyz/NWNlNzMzN2Y4NmI2/

https://karakalpakmodagercegi.xyz/NWNlNzMzN2Y4NmI2/

https://karakalpakvesanateserleri.xyz/NWNlNzMzN2Y4NmI2/

https://karakalpakdaguzelrenkler.xyz/NWNlNzMzN2Y4NmI2/

https://karakalpakseverlerinkosesi.xyz/NWNlNzMzN2Y4NmI2/

https://karakalpakileribakiyor.xyz/NWNlNzMzN2Y4NmI2/

https://karakalpakdernegitutkusu.xyz/NWNlNzMzN2Y4NmI2/

https://karakalpakvesanattasarimi.xyz/NWNlNzMzN2Y4NmI2/

https://karakalpakyarenlerisever.xyz/NWNlNzMzN2Y4NmI2/

AES_key

Signatures

Octo
Octo is a banking malware with remote access capabilities first seen in April 2022.
banker trojan infostealer rat octo
Octo family
octo

Octo payload 1 IoCs

resource	yara_rule
behavioral2/memory/5131-0.dex	family_octo

Loads dropped Dex/Jar 1 TTPs 1 IoCs

Runs executable file dropped to the device during analysis.

evasion

Download New Code at Runtime

T1407

ioc	pid	Process
/data/user/0/com.sustain.mutual/app_boat/Lfn.json	5131	com.sustain.mutual

Makes use of the framework's Accessibility service 4 TTPs 2 IoCs

Retrieves information displayed on the phone screen using AccessibilityService.

collection evasion credential_access

Input Injection

T1516

Screen Capture

T1513

Keylogging

T1417.001

GUI Input Capture

T1417.002

description	ioc	Process
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId	com.sustain.mutual
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByViewId	com.sustain.mutual

Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
banker discovery

Security Software Discovery
T1418.001
Queries the phone number (MSISDN for GSM devices) 1 TTPs
discovery

System Network Configuration Discovery
T1422

Acquires the wake lock 1 IoCs

description	ioc	Process
Framework service call	android.os.IPowerManager.acquireWakeLock	com.sustain.mutual

Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs

Application may abuse the framework's foreground service to continue running in the foreground.

evasion persistence

Foreground Persistence

T1541

description	ioc	Process
Framework service call	android.app.IActivityManager.setServiceForeground	com.sustain.mutual

Performs UI accessibility actions on behalf of the user 1 TTPs 4 IoCs

Application may abuse the accessibility service to prevent their removal.

evasion

Prevent Application Removal

T1629.001

ioc	Process
android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction	com.sustain.mutual
android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction	com.sustain.mutual
android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction	com.sustain.mutual
android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction	com.sustain.mutual

Queries the mobile country code (MCC) 1 TTPs 1 IoCs

discovery

System Network Configuration Discovery

T1422

description	ioc	Process
Framework service call	com.android.internal.telephony.ITelephony.getNetworkCountryIsoForPhone	com.sustain.mutual

Reads information about phone network operator. 1 TTPs
discovery

System Network Configuration Discovery
T1422

Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs

persistence

Broadcast Receivers

T1624.001

description	ioc	Process
Framework service call	android.app.IActivityManager.registerReceiver	com.sustain.mutual

Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs

impact

Data Encrypted for Impact

T1471

description	ioc	Process
Framework API call	javax.crypto.Cipher.doFinal	com.sustain.mutual

com.sustain.mutual
1⤵
- Loads dropped Dex/Jar
- Makes use of the framework's Accessibility service
- Acquires the wake lock
- Makes use of the framework's foreground persistence service
- Performs UI accessibility actions on behalf of the user
- Queries the mobile country code (MCC)
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Uses Crypto APIs (Might try to encrypt user data)
PID:5131

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Event Triggered Execution

T1624

Broadcast Receivers

T1624.001

Foreground Persistence

T1541

Privilege Escalation

Defense Evasion

Download New Code at Runtime

T1407

Foreground Persistence

T1541

Impair Defenses

T1629

Prevent Application Removal

T1629.001

Input Injection

T1516

Credential Access

Input Capture

T1417

GUI Input Capture

T1417.002

Keylogging

T1417.001

Discovery

Software Discovery

T1418

Security Software Discovery

T1418.001

System Network Configuration Discovery

T1422

Lateral Movement

Collection

Input Capture

T1417

GUI Input Capture

T1417.002

Keylogging

T1417.001

Screen Capture

T1513

Command and Control

Exfiltration

Impact

Data Encrypted for Impact

T1471

Input Injection

T1516

Replay Monitor

Loading Replay Monitor...

Downloads

/data/data/com.sustain.mutual/app_boat/Lfn.json

Filesize
153KB

MD5
a5f6a8f133bcef36970f83eb126878a6

SHA1
339b43498bdeb521c0aa21f7e072d14d1ae0e2c6

SHA256
d64f9cdd92dddf743b2ac39341737827c2056f3cf050800c1bc9858318d8043e

SHA512
989f8cdf9a77cf1e4ebd5e9ddb789244766dc22b949ee4ab9546f3a4a0e4cf619b2330801a96b7f4949e6d0aa536a45237e43d31a332da95075e66da0d13d45e

Download Submit
/data/data/com.sustain.mutual/app_boat/Lfn.json

Filesize
153KB

MD5
fa605dfaf26ef76d5773b23db6fad50c

SHA1
5c19a6e7abca1f5878bc07099d1cdaabf5916a7e

SHA256
c3ffce34430e0ce374b5b7c4e516527a4e8ac70869f9dc60ed9ccf1b58dcffe1

SHA512
37f5afb0a2f3422731ed5da684d34fed1849e0bc46ab3a2e5b99a8911c4acf4925d9b0a78eb79be5244b54ed28097296a899bc9ba2a34673e8be21718d18518e

Download Submit
/data/user/0/com.sustain.mutual/app_boat/Lfn.json

Filesize
451KB

MD5
f25e4f353a3d4cfac1b83ef2c414a9cb

SHA1
da1f835049e4fb03cedfbd751d8ba49b14ec0d32

SHA256
68b97265f618d31a77810a432cfac2f3402cfdf8b0fc4cfcb0a075551bf36c55

SHA512
da776c4122a917e96abf86290e6bfa4ad2c5562dac77b309700e556374d73ae424f6c38e6ab081259823c16e43238397ee7adf04e81322e5892f97909e750642

Download Submit

Analysis

Sharing

General

Malware Config

Extracted

Extracted

Signatures

Processes

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads