octo | 0d06dfbe7bc873a6037fa6398bbb0f7d9aec4da52491553b4e8a4e4de3920e30

Analysis

max time kernel
17s
max time network
33s
platform
android-9_x86
resource
android-x86-arm-20240910-en
resource tags

arch:armarch:x86image:android-x86-arm-20240910-enlocale:en-usos:android-9-x86system
submitted
09-01-2025 17:28

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

0d06dfbe7bc873a6037fa6398bbb0f7d9aec4da52491553b4e8a4e4de3920e30.apk
Size

9.4MB
MD5

254702b67d41f8fdb330cc3bd71619cc
SHA1

0374b6e57038a5666273e6ab94013ff83c10f8e8
SHA256

0d06dfbe7bc873a6037fa6398bbb0f7d9aec4da52491553b4e8a4e4de3920e30
SHA512

d5935ed3e67c03344f4dd293284fd8e3a8083f54a5e088e8122ce91a1750ec1cff61ca8d20a79646aa89d705dcc7e0667e8b8d48909630cb160999bbc51836b1
SSDEEP

196608:NR857ej7ZRKUhrADpTGmhcgNa2dscgwdW:NR855ArKp6wcgNa2xgIW

Score

10^/10

octo banker collection credential_access discovery evasion impact infostealer persistence rat trojan

Malware Config

Extracted

Family

octo

AES_key

Signatures

Octo
Octo is a banking malware with remote access capabilities first seen in April 2022.
banker trojan infostealer rat octo
Octo family
octo

Octo payload 1 IoCs

resource	yara_rule
behavioral1/memory/4221-1.dex	family_octo

Loads dropped Dex/Jar 1 TTPs 3 IoCs

Runs executable file dropped to the device during analysis.

evasion

Download New Code at Runtime

T1407

ioc	pid	Process
/data/user/0/com.ipservicepush_provider81/app_veteran/lseRux.json	4246	/system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.ipservicepush_provider81/app_veteran/lseRux.json --output-vdex-fd=41 --oat-fd=42 --oat-location=/data/user/0/com.ipservicepush_provider81/app_veteran/oat/x86/lseRux.odex --compiler-filter=quicken --class-loader-context=&
/data/user/0/com.ipservicepush_provider81/app_veteran/lseRux.json	4221	com.ipservicepush_provider81
Anonymous-DexFile@0xcc48f000-0xcc512a9c	4221	com.ipservicepush_provider81

Makes use of the framework's Accessibility service 4 TTPs 2 IoCs

Retrieves information displayed on the phone screen using AccessibilityService.

collection evasion credential_access

Input Injection

T1516

Screen Capture

T1513

Keylogging

T1417.001

GUI Input Capture

T1417.002

description	ioc	Process
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId	com.ipservicepush_provider81
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByViewId	com.ipservicepush_provider81

Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
banker discovery

Security Software Discovery
T1418.001
Queries the phone number (MSISDN for GSM devices) 1 TTPs
discovery

System Network Configuration Discovery
T1422

Acquires the wake lock 1 IoCs

description	ioc	Process
Framework service call	android.os.IPowerManager.acquireWakeLock	com.ipservicepush_provider81

Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs

Application may abuse the framework's foreground service to continue running in the foreground.

evasion persistence

Foreground Persistence

T1541

description	ioc	Process
Framework service call	android.app.IActivityManager.setServiceForeground	com.ipservicepush_provider81

Queries the mobile country code (MCC) 1 TTPs 1 IoCs

discovery

System Network Configuration Discovery

T1422

description	ioc	Process
Framework service call	com.android.internal.telephony.ITelephony.getNetworkCountryIsoForPhone	com.ipservicepush_provider81

Queries the unique device ID (IMEI, MEID, IMSI) 1 TTPs
discovery

System Network Configuration Discovery
T1422

Requests disabling of battery optimizations (often used to enable hiding in the background). 1 TTPs 1 IoCs

evasion

User Evasion

T1628.002

description	ioc	Process
Intent action	android.settings.REQUEST_IGNORE_BATTERY_OPTIMIZATIONS	com.ipservicepush_provider81

Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs

persistence

Broadcast Receivers

T1624.001

description	ioc	Process
Framework service call	android.app.IActivityManager.registerReceiver	com.ipservicepush_provider81

Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs

impact

Data Encrypted for Impact

T1471

description	ioc	Process
Framework API call	javax.crypto.Cipher.doFinal	com.ipservicepush_provider81

Checks CPU information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/cpuinfo	com.ipservicepush_provider81

Checks memory information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/meminfo	com.ipservicepush_provider81

com.ipservicepush_provider81
1⤵
- Loads dropped Dex/Jar
- Makes use of the framework's Accessibility service
- Acquires the wake lock
- Makes use of the framework's foreground persistence service
- Queries the mobile country code (MCC)
- Requests disabling of battery optimizations (often used to enable hiding in the background).
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Uses Crypto APIs (Might try to encrypt user data)
- Checks CPU information
- Checks memory information
PID:4221
- /system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.ipservicepush_provider81/app_veteran/lseRux.json --output-vdex-fd=41 --oat-fd=42 --oat-location=/data/user/0/com.ipservicepush_provider81/app_veteran/oat/x86/lseRux.odex --compiler-filter=quicken --class-loader-context=&
  2⤵
  - Loads dropped Dex/Jar
  PID:4246

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Event Triggered Execution

T1624

Broadcast Receivers

T1624.001

Foreground Persistence

T1541

Privilege Escalation

Defense Evasion

Download New Code at Runtime

T1407

Foreground Persistence

T1541

Hide Artifacts

T1628

User Evasion

T1628.002

Input Injection

T1516

Virtualization/Sandbox Evasion

T1633

System Checks

T1633.001

Credential Access

Input Capture

T1417

GUI Input Capture

T1417.002

Keylogging

T1417.001

Discovery

Software Discovery

T1418

Security Software Discovery

T1418.001

System Information Discovery

T1426

System Network Configuration Discovery

T1422

Lateral Movement

Collection

Input Capture

T1417

GUI Input Capture

T1417.002

Keylogging

T1417.001

Screen Capture

T1513

Command and Control

Exfiltration

Impact

Data Encrypted for Impact

T1471

Input Injection

T1516

Replay Monitor

Loading Replay Monitor...

Downloads

/data/data/com.ipservicepush_provider81/.global.com.ipservicepush_provider81

Filesize
48B

MD5
046a414913add6f5bb60072c7db819b6

SHA1
451ee4f6809260aec622d772fd329c7d0297a842

SHA256
b66c1320cb063a1d391c94273572ea6edae76c8c8b0a07f8d75c88686f0df72a

SHA512
4e6355f3051ed5e811ab030abde1f5be7f5e1cf33be99cd08477e9b6c015deb1d8bd75a09fb9c7176b8511c5ad0a67abc0902a3531e97564ccb6afc57496a47c

Download Submit
/data/data/com.ipservicepush_provider81/app_veteran/lseRux.json

Filesize
1021B

MD5
07427a5795d6b775334706bf0297d548

SHA1
0d071478c68581145c3030c70755a6d9cfe9a574

SHA256
224f20269e9fdfd3544c1abc7d92f3b066be2129eed7e7d95e6bd85b74006132

SHA512
355b4d8a1c9914fc2f3fccb513edda10d747db9bf155cf1f70c5daf8bde942d2d0a184033d981fcfdee53eb52ef06d9a4fbe8fbd2cf66c84121504331a07ff57

Download Submit
/data/data/com.ipservicepush_provider81/app_veteran/lseRux.json

Filesize
1021B

MD5
11ebf0d2660e1a7f2610f20b4b30c037

SHA1
7a0dee3217f4f49ea7d72d4fd3075b94c8459055

SHA256
20fc8cae69a65b8827e2eda8ace84a86719af14c13e9637555705bafc3d15502

SHA512
823d209d1e0e08f52045c1fc5310afdcfb437e421f5aea96071e39f73a6545f4336137bf0b1db0aa0f357f0714c81e7bd1c4ca5989e17353455235854d5bfef3

Download Submit
/data/data/com.ipservicepush_provider81/files/.l

Filesize
307KB

MD5
4e73947cabb5db3f92ca85004981b754

SHA1
6d9667fdb0280ed2dcb782b4683e422a51bdc601

SHA256
6db94232e756b90ed437f1bc87dc38cf20fb2e7c7a19a5e40c6c17254b7e234c

SHA512
be8b500a7070af1dfb53b0cf1a7b327dadc4e163a6dad905496ac228c58cd1ed87b054533917924455d35e9b300683ae33e1bcdd91935a5dbae1d693c3e13d69

Download Submit
/data/user/0/com.ipservicepush_provider81/app_veteran/lseRux.json

Filesize
1KB

MD5
ed81edc3246f666440c3785e30c557b1

SHA1
0481c52504a205637f0dd662075ee76ba00ae37b

SHA256
3d3348c8bf347d01a9b7f136380458ebd6a421ca596c917211107ce2d6f6863e

SHA512
74a162d2cdbf95b5beb1f146c50c4c5de4c13a705ccad03f1e2819bf4f32c58d9537e79676183c69912a8f13e37895d1bd1821c791d2c75ce9a54db7094b2272

Download Submit
/data/user/0/com.ipservicepush_provider81/app_veteran/lseRux.json

Filesize
1KB

MD5
8b80ea491a41063dea42fbdcaf757c9c

SHA1
73c492dcf2453e69e04a2a5544f1dac6bc27347d

SHA256
a04f29d104331c639f78ac01e1c6a92213102c035fa07b24e26b27cdedd6740f

SHA512
fedefa3792eb49b2e13b22fc84cc7d08676e3707c93f19ef74807cf92e0783dd775317fc69999e79681749128c4aab947b02240d603edc37c4d193a78bd4227d

Download Submit
Anonymous-DexFile@0xcc48f000-0xcc512a9c

Filesize
526KB

MD5
a89d7a0ec6e1f9c519b21d59c26301d2

SHA1
46907771e52fb16c9fa8b8bb192ca8a54b10e32d

SHA256
3f62c5568a0977c4f15eff4a853283ed6f02d500eab6df67b3399346343e145c

SHA512
01daa56000d23f0b981e46c6ce9ff8deb4e907ca5d26f8bfa440f767f5b62304cf483d39aa360ebc445f743bf74766038a5867bee45fceeedf8912df4e438d2c

Download Submit

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads