Overview

overview

10

Static

static

6

a5ac11fe22...8a.apk

android-9-x86

a5ac11fe22...8a.apk

android-10-x64

10

Analysis

  • max time kernel
    149s
  • max time network
    160s
  • platform
    android-10_x64
  • resource
    android-x64-20240910-en
  • resource tags

    arch:x64arch:x86image:android-x64-20240910-enlocale:en-usos:android-10-x64system
  • submitted
    08-01-2025 22:01

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    a5ac11fe22c4511ead90169838ea9e477cd6bf317ff8b68ae38df95c7fb3628a.apk

  • Size

    1.9MB

  • MD5

    a7ece3c5e1b435f62e10f544b6dc980b

  • SHA1

    3f85014292eab172b8048b58c8936dd26cb4b07f

  • SHA256

    a5ac11fe22c4511ead90169838ea9e477cd6bf317ff8b68ae38df95c7fb3628a

  • SHA512

    cc140a97fc4419f634468a790f4b1bdd98b30fcf0ffa9d7710459b12d35173ade0a2b3b5b6ded1476eac5a8a5ecf952e7d2f008269f99f82a18fbe71f484740c

  • SSDEEP

    49152:dD+nnFDh5VkZdoRrr6Ad92PPfsvFFIBrjlM8uXw/a:dIFDh5VYdoR6AdgnwuBr5duga

Score
10/10
octobankercollectioncredential_accessdiscoveryevasionimpactinfostealerpersistencerattrojan

Malware Config

Extracted

Family

octo

C2

https://yesmincanruslane.xyz/YjVmNGU0NmNhODlm/

https://kaderbaglantilarindayanisma.xyz/YjVmNGU0NmNhODlm/

https://sevgikadervedostlukhikayesi.xyz/YjVmNGU0NmNhODlm/

https://kaderseverleryolculuknotlari.xyz/YjVmNGU0NmNhODlm/

https://kadersohbetleriilepaylasim.xyz/YjVmNGU0NmNhODlm/

https://kaderinyansimalarindankareler.xyz/YjVmNGU0NmNhODlm/

https://kaderduygularivebaglantilar.xyz/YjVmNGU0NmNhODlm/

https://kadersevgininkalptenhikayesi.xyz/YjVmNGU0NmNhODlm/

https://kaderdostlukvegizemlianilar.xyz/YjVmNGU0NmNhODlm/

https://kadersozlerlehikayeveriyor.xyz/YjVmNGU0NmNhODlm/

https://kaderlerarasisamimiuyum.xyz/YjVmNGU0NmNhODlm/

https://kaderduygusalbagvetutkular.xyz/YjVmNGU0NmNhODlm/

https://kaderseverlerinrenklidunyasi.xyz/YjVmNGU0NmNhODlm/

https://kadersanatisozlerdeninsanlara.xyz/YjVmNGU0NmNhODlm/

https://kadersevgiyletasanumut.xyz/YjVmNGU0NmNhODlm/

https://kaderseverlerpaylasimbahcesi.xyz/YjVmNGU0NmNhODlm/

https://kaderdostlarivehayatbaglari.xyz/YjVmNGU0NmNhODlm/

https://kadersanatinrenkligolgeleri.xyz/YjVmNGU0NmNhODlm/

https://kaderinhayatdolasimbirligi.xyz/YjVmNGU0NmNhODlm/

https://kaderinsadekalptenyansimalari.xyz/YjVmNGU0NmNhODlm/
rc4.plain

Extracted

Family

octo

C2

https://yesmincanruslane.xyz/YjVmNGU0NmNhODlm/

https://kaderbaglantilarindayanisma.xyz/YjVmNGU0NmNhODlm/

https://sevgikadervedostlukhikayesi.xyz/YjVmNGU0NmNhODlm/

https://kaderseverleryolculuknotlari.xyz/YjVmNGU0NmNhODlm/

https://kadersohbetleriilepaylasim.xyz/YjVmNGU0NmNhODlm/

https://kaderinyansimalarindankareler.xyz/YjVmNGU0NmNhODlm/

https://kaderduygularivebaglantilar.xyz/YjVmNGU0NmNhODlm/

https://kadersevgininkalptenhikayesi.xyz/YjVmNGU0NmNhODlm/

https://kaderdostlukvegizemlianilar.xyz/YjVmNGU0NmNhODlm/

https://kadersozlerlehikayeveriyor.xyz/YjVmNGU0NmNhODlm/

https://kaderlerarasisamimiuyum.xyz/YjVmNGU0NmNhODlm/

https://kaderduygusalbagvetutkular.xyz/YjVmNGU0NmNhODlm/

https://kaderseverlerinrenklidunyasi.xyz/YjVmNGU0NmNhODlm/

https://kadersanatisozlerdeninsanlara.xyz/YjVmNGU0NmNhODlm/

https://kadersevgiyletasanumut.xyz/YjVmNGU0NmNhODlm/

https://kaderseverlerpaylasimbahcesi.xyz/YjVmNGU0NmNhODlm/

https://kaderdostlarivehayatbaglari.xyz/YjVmNGU0NmNhODlm/

https://kadersanatinrenkligolgeleri.xyz/YjVmNGU0NmNhODlm/

https://kaderinhayatdolasimbirligi.xyz/YjVmNGU0NmNhODlm/

https://kaderinsadekalptenyansimalari.xyz/YjVmNGU0NmNhODlm/
AES_key

Signatures

  • Octo

    Octo is a banking malware with remote access capabilities first seen in April 2022.

    bankertrojaninfostealerratocto
  • Octo family
    octo
  • Octo payload 1 IoCs
  • Loads dropped Dex/Jar 1 TTPs 1 IoCs

    Runs executable file dropped to the device during analysis.

    evasion
  • Makes use of the framework's Accessibility service 4 TTPs 2 IoCs

    Retrieves information displayed on the phone screen using AccessibilityService.

    collectionevasioncredential_access
  • Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
    bankerdiscovery
  • Queries the phone number (MSISDN for GSM devices) 1 TTPs
    discovery
  • Acquires the wake lock 1 IoCs
  • Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs

    Application may abuse the framework's foreground service to continue running in the foreground.

    evasionpersistence
  • Performs UI accessibility actions on behalf of the user 1 TTPs 4 IoCs

    Application may abuse the accessibility service to prevent their removal.

    evasion
  • Queries the mobile country code (MCC) 1 TTPs 1 IoCs
    discovery
  • Reads information about phone network operator. 1 TTPs
    discovery
  • Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs
    persistence
  • Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs
    impact

Processes

  • com.primary.option
    1⤵
    • Loads dropped Dex/Jar
    • Makes use of the framework's Accessibility service
    • Acquires the wake lock
    • Makes use of the framework's foreground persistence service
    • Performs UI accessibility actions on behalf of the user
    • Queries the mobile country code (MCC)
    • Registers a broadcast receiver at runtime (usually for listening for system events)
    • Uses Crypto APIs (Might try to encrypt user data)
    PID:5123

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • /data/data/com.primary.option/app_fault/fO.json
    Filesize

    153KB

    MD5

    7180a397431566d62f7c0fed378ff5bf

    SHA1

    1ae1de059a5e8c4b6f6bf7275f301d94425bcde8

    SHA256

    64885b11159b7fc37533ab51628b7ddb45ff238eac735faa34cb917ae6bda4d9

    SHA512

    1b2216cf3758577959da53e254b2ff4a8c5f19bae70ff47a62deb9260e572715dd89ae8a191036fe75a1214a5c8bab6fd1f5b546bf6b0b7cdfa48605c2a108f9

    Download Submit

  • /data/data/com.primary.option/app_fault/fO.json
    Filesize

    153KB

    MD5

    e2659beacf244b78be24c58249e1773a

    SHA1

    0cf1b119fc26c1806d952d71b737334e52abe817

    SHA256

    2d286e0765acd95a00f0ad64e630353d07ed95d24a332175ab5d974ca49bdafc

    SHA512

    c3fbc3af8274a75d921986bcc42f1edafaa419031e1c98dfc18f6a07e637d89ea9440cb9368d8a25179b87ae18feb4eb46c12e479f7578661595faff79453049

    Download Submit

  • /data/user/0/com.primary.option/app_fault/fO.json
    Filesize

    451KB

    MD5

    25125358384e36c49c4abf52c11baa8b

    SHA1

    3d121a851464db3415a005b43f38dcbf625c14b7

    SHA256

    09f1ca2664b373eae660f91ce7ee98922fa9b2b3a96a6a97b1aa915bf2e59259

    SHA512

    fc9fe099d4a226962e844055531a7d80c21a83194e49b691008e16fe8b6ee075dc52f39d6292532d6105481e89fabbca9dc3b5706ae8ca1785e61ea78c40c2ec

    Download Submit