octo | 99dffabdabd7806101a6da877a58c22958c020edc01c425d537ffac21c98b963

Analysis

max time kernel
149s
max time network
159s
platform
android-13_x64
resource
android-33-x64-arm64-20240910-en
resource tags

arch:arm64arch:x64arch:x86image:android-33-x64-arm64-20240910-enlocale:en-usos:android-13-x64system
submitted
10-01-2025 22:01

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

99dffabdabd7806101a6da877a58c22958c020edc01c425d537ffac21c98b963.apk
Size

3.3MB
MD5

8e75483bd93bb66962945abb5cf88780
SHA1

855f5a541515bb2db6b994d698b3bfcc699f7c4b
SHA256

99dffabdabd7806101a6da877a58c22958c020edc01c425d537ffac21c98b963
SHA512

ba24f3070b0f6c65d9c2bbe46d6984dc7d5618e7675237f15fc1ae6d698040cfa1da3c4af61b1f0c5ac6aacfa454ed49fbd0db04b9e5181a9d928c883921f4c7
SSDEEP

98304:6mBBd5xmuGMczOLITlIhubbJSf12AVfblMw3sLZpGXLp7g2Tl60AQnpfs:PwMciQSN5uMg

Score

10^/10

octo banker collection credential_access discovery evasion impact infostealer persistence rat trojan

Malware Config

Extracted

Family

octo

https://ruceayipma.xyz/YjVmNGU0NmNhODlm/

https://yapayzekaisyanlari.xyz/YjVmNGU0NmNhODlm/

https://makineordulariyukseliyor.xyz/YjVmNGU0NmNhODlm/

https://teknolojinisyanhikayesi.xyz/YjVmNGU0NmNhODlm/

https://robotkorsanlargeliyor.xyz/YjVmNGU0NmNhODlm/

https://dunyayirobotlarkapliyor.xyz/YjVmNGU0NmNhODlm/

https://mekanikordularinintikam.xyz/YjVmNGU0NmNhODlm/

https://otomasyonkalesindemucadele.xyz/YjVmNGU0NmNhODlm/

https://robotlarvemakineisyanlari.xyz/YjVmNGU0NmNhODlm/

https://teknolojikseferberlik.xyz/YjVmNGU0NmNhODlm/

https://yapayordularinhikayesi.xyz/YjVmNGU0NmNhODlm/

https://makinevekodisyancilari.xyz/YjVmNGU0NmNhODlm/

https://mekanikorduyolculugu.xyz/YjVmNGU0NmNhODlm/

https://robotikturunculer.xyz/YjVmNGU0NmNhODlm/

https://mekanikisyanveteknoloji.xyz/YjVmNGU0NmNhODlm/

https://makineuyanikaynaklari.xyz/YjVmNGU0NmNhODlm/

https://mekanikseferisyani.xyz/YjVmNGU0NmNhODlm/

https://yapayzekauyanislari.xyz/YjVmNGU0NmNhODlm/

https://robotinsanvedunyavasfi.xyz/YjVmNGU0NmNhODlm/

https://dunyayisaranmekanik.xyz/YjVmNGU0NmNhODlm/

rc4.plain

Extracted

Family

octo

https://ruceayipma.xyz/YjVmNGU0NmNhODlm/

https://yapayzekaisyanlari.xyz/YjVmNGU0NmNhODlm/

https://makineordulariyukseliyor.xyz/YjVmNGU0NmNhODlm/

https://teknolojinisyanhikayesi.xyz/YjVmNGU0NmNhODlm/

https://robotkorsanlargeliyor.xyz/YjVmNGU0NmNhODlm/

https://dunyayirobotlarkapliyor.xyz/YjVmNGU0NmNhODlm/

https://mekanikordularinintikam.xyz/YjVmNGU0NmNhODlm/

https://otomasyonkalesindemucadele.xyz/YjVmNGU0NmNhODlm/

https://robotlarvemakineisyanlari.xyz/YjVmNGU0NmNhODlm/

https://teknolojikseferberlik.xyz/YjVmNGU0NmNhODlm/

https://yapayordularinhikayesi.xyz/YjVmNGU0NmNhODlm/

https://makinevekodisyancilari.xyz/YjVmNGU0NmNhODlm/

https://mekanikorduyolculugu.xyz/YjVmNGU0NmNhODlm/

https://robotikturunculer.xyz/YjVmNGU0NmNhODlm/

https://mekanikisyanveteknoloji.xyz/YjVmNGU0NmNhODlm/

https://makineuyanikaynaklari.xyz/YjVmNGU0NmNhODlm/

https://mekanikseferisyani.xyz/YjVmNGU0NmNhODlm/

https://yapayzekauyanislari.xyz/YjVmNGU0NmNhODlm/

https://robotinsanvedunyavasfi.xyz/YjVmNGU0NmNhODlm/

https://dunyayisaranmekanik.xyz/YjVmNGU0NmNhODlm/

AES_key

Signatures

Octo
Octo is a banking malware with remote access capabilities first seen in April 2022.
banker trojan infostealer rat octo
Octo family
octo

Octo payload 1 IoCs

resource	yara_rule
behavioral2/memory/4467-0.dex	family_octo

Loads dropped Dex/Jar 1 TTPs 1 IoCs

Runs executable file dropped to the device during analysis.

evasion

Download New Code at Runtime

T1407

ioc	pid	Process
/data/user/0/jp.neoscorp.android.valuewallet.sole/app_ensure/OiXjUBL.json	4467	jp.neoscorp.android.valuewallet.sole

Makes use of the framework's Accessibility service 4 TTPs 2 IoCs

Retrieves information displayed on the phone screen using AccessibilityService.

collection evasion credential_access

Input Injection

T1516

Screen Capture

T1513

Keylogging

T1417.001

GUI Input Capture

T1417.002

description	ioc	Process
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId	jp.neoscorp.android.valuewallet.sole
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByViewId	jp.neoscorp.android.valuewallet.sole

Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
banker discovery

Security Software Discovery
T1418.001
Queries the phone number (MSISDN for GSM devices) 1 TTPs
discovery

System Network Configuration Discovery
T1422

Acquires the wake lock 1 IoCs

description	ioc	Process
Framework service call	android.os.IPowerManager.acquireWakeLock	jp.neoscorp.android.valuewallet.sole

Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs

Application may abuse the framework's foreground service to continue running in the foreground.

evasion persistence

Foreground Persistence

T1541

description	ioc	Process
Framework service call	android.app.IActivityManager.setServiceForeground	jp.neoscorp.android.valuewallet.sole

Performs UI accessibility actions on behalf of the user 1 TTPs 6 IoCs

Application may abuse the accessibility service to prevent their removal.

evasion

Prevent Application Removal

T1629.001

ioc	Process
android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction	jp.neoscorp.android.valuewallet.sole
android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction	jp.neoscorp.android.valuewallet.sole
android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction	jp.neoscorp.android.valuewallet.sole
android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction	jp.neoscorp.android.valuewallet.sole
android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction	jp.neoscorp.android.valuewallet.sole
android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction	jp.neoscorp.android.valuewallet.sole

Queries the mobile country code (MCC) 1 TTPs 1 IoCs

discovery

System Network Configuration Discovery

T1422

description	ioc	Process
Framework service call	com.android.internal.telephony.ITelephony.getNetworkCountryIsoForPhone	jp.neoscorp.android.valuewallet.sole

Reads information about phone network operator. 1 TTPs
discovery

System Network Configuration Discovery
T1422

Requests accessing notifications (often used to intercept notifications before users become aware). 1 TTPs 1 IoCs

collection credential_access

Access Notifications

T1517

description	ioc	Process
Intent action	android.settings.ACTION_NOTIFICATION_LISTENER_SETTINGS	jp.neoscorp.android.valuewallet.sole

Requests disabling of battery optimizations (often used to enable hiding in the background). 1 TTPs 1 IoCs

evasion

User Evasion

T1628.002

description	ioc	Process
Intent action	android.settings.REQUEST_IGNORE_BATTERY_OPTIMIZATIONS	jp.neoscorp.android.valuewallet.sole

Requests modifying system settings. 1 IoCs

evasion

description	ioc	Process
Intent action	android.settings.action.MANAGE_WRITE_SETTINGS	jp.neoscorp.android.valuewallet.sole

Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs

impact

Data Encrypted for Impact

T1471

description	ioc	Process
Framework API call	javax.crypto.Cipher.doFinal	jp.neoscorp.android.valuewallet.sole

jp.neoscorp.android.valuewallet.sole
1⤵
- Loads dropped Dex/Jar
- Makes use of the framework's Accessibility service
- Acquires the wake lock
- Makes use of the framework's foreground persistence service
- Performs UI accessibility actions on behalf of the user
- Queries the mobile country code (MCC)
- Requests accessing notifications (often used to intercept notifications before users become aware).
- Requests disabling of battery optimizations (often used to enable hiding in the background).
- Requests modifying system settings.
- Uses Crypto APIs (Might try to encrypt user data)
PID:4467

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Foreground Persistence

T1541

Privilege Escalation

Defense Evasion

Download New Code at Runtime

T1407

Foreground Persistence

T1541

Hide Artifacts

T1628

User Evasion

T1628.002

Impair Defenses

T1629

Prevent Application Removal

T1629.001

Input Injection

T1516

Credential Access

Access Notifications

T1517

Input Capture

T1417

GUI Input Capture

T1417.002

Keylogging

T1417.001

Discovery

Software Discovery

T1418

Security Software Discovery

T1418.001

System Network Configuration Discovery

T1422

Lateral Movement

Collection

Access Notifications

T1517

Input Capture

T1417

GUI Input Capture

T1417.002

Keylogging

T1417.001

Screen Capture

T1513

Command and Control

Exfiltration

Impact

Data Encrypted for Impact

T1471

Input Injection

T1516

Replay Monitor

Loading Replay Monitor...

Downloads

/data/user/0/jp.neoscorp.android.valuewallet.sole/app_ensure/OiXjUBL.json

Filesize
153KB

MD5
c48a297419414b5220808036a2a64d71

SHA1
6f02b09fd420eb7238bcd446f4d6c28bf6a2e91a

SHA256
df2829487a45783a277233bbce4e983aa2f22abf4d18f58294353373947747e2

SHA512
a90212076875782c8e470964cf4fb87b7d0b6edde67e56de2c08dbc315fec5a959e9c2c8b609978861bba3fbf2d27060f3143729ed8e7b34c7f4150d24c9eb46

Download Submit
/data/user/0/jp.neoscorp.android.valuewallet.sole/app_ensure/OiXjUBL.json

Filesize
153KB

MD5
067a9776350ec7a7fe8b7e1321065a99

SHA1
385ee7faeabd5b72ba996cb97056673dd48eee52

SHA256
58a50c03520b670266073976b29afffb58964c83c0b51bed42aee83471ed4122

SHA512
11ed0e1060ce9462bd504d997c3c18faacdb37d494a197da0cda258c842817a7aa927450114ee523f08627646d140af0800ac426e0e38ad5d3034ed169a30fc7

Download Submit
/data/user/0/jp.neoscorp.android.valuewallet.sole/app_ensure/OiXjUBL.json

Filesize
451KB

MD5
6f209f2df02693ab68392ec262bc2216

SHA1
e92dcc0df5a5dd3bd9d066f0ba4f9652f19bbc9d

SHA256
c175c4580a5319af8925cab92a82655358d9840c14de672e35227869a9b2f9a5

SHA512
d45aa79e8dc6b49d382d9428132e5d32455491440007c7e20eb5f7369c7517307693974f6ec4bb746a1577f5e89c742459ce71f9c78c1f06076a091500dee48c

Download Submit

Analysis

Sharing

General

Malware Config

Extracted

Extracted

Signatures

Processes

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads