octo | 338f2eff00577df7b9d7ef80c9cf69dc618124fd29a1a1655836e752b65f1972

Analysis

max time kernel
24s
max time network
37s
platform
android_x86
resource
android-x86-arm-20240624-en
resource tags

androidarch:armarch:x86image:android-x86-arm-20240624-enlocale:en-usos:android-9-x86system
submitted
11-01-2025 14:11

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

338f2eff00577df7b9d7ef80c9cf69dc618124fd29a1a1655836e752b65f1972.apk
Size

8.5MB
MD5

af77e267680954b02e6c5eb0c3aeadfb
SHA1

7a115e24f7a66ee68c3c07c2a676b19f1557c0d7
SHA256

338f2eff00577df7b9d7ef80c9cf69dc618124fd29a1a1655836e752b65f1972
SHA512

4dfa3bb1f3b98ea8a7c44e83342e84a69b817c654a12d763f5752febca25491330edd2b1af7f4b894b7d390606d53282ba9371bd375719a89d526e8ee16efa4e
SSDEEP

98304:ctUbq3XLRsyD5iSRGdIVKFJzmNsv7ihdy3Atp1IoLuPZJky:cqO3XLRDDrXUPosvk/sZH

Score

10^/10

octo banker collection credential_access discovery evasion impact infostealer persistence rat trojan

Malware Config

Extracted

Family

octo

AES_key

Signatures

Octo
Octo is a banking malware with remote access capabilities first seen in April 2022.
banker trojan infostealer rat octo
Octo family
octo

Octo payload 1 IoCs

resource	yara_rule
behavioral1/memory/4252-1.dex	family_octo

Loads dropped Dex/Jar 1 TTPs 3 IoCs

Runs executable file dropped to the device during analysis.

evasion

Download New Code at Runtime

T1407

ioc	pid	Process
/data/user/0/com.yarubin_clock1/app_peanut/cnBXFdL.json	4280	/system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.yarubin_clock1/app_peanut/cnBXFdL.json --output-vdex-fd=41 --oat-fd=42 --oat-location=/data/user/0/com.yarubin_clock1/app_peanut/oat/x86/cnBXFdL.odex --compiler-filter=quicken --class-loader-context=&
/data/user/0/com.yarubin_clock1/app_peanut/cnBXFdL.json	4252	com.yarubin_clock1
Anonymous-DexFile@0xcffbd000-0xd0040670	4252	com.yarubin_clock1

Makes use of the framework's Accessibility service 4 TTPs 2 IoCs

Retrieves information displayed on the phone screen using AccessibilityService.

collection evasion credential_access

Input Injection

T1516

Screen Capture

T1513

Keylogging

T1417.001

GUI Input Capture

T1417.002

description	ioc	Process
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId	com.yarubin_clock1
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByViewId	com.yarubin_clock1

Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
banker discovery

Security Software Discovery
T1418.001
Queries the phone number (MSISDN for GSM devices) 1 TTPs
discovery

System Network Configuration Discovery
T1422

Acquires the wake lock 1 IoCs

description	ioc	Process
Framework service call	android.os.IPowerManager.acquireWakeLock	com.yarubin_clock1

Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs

Application may abuse the framework's foreground service to continue running in the foreground.

evasion persistence

Foreground Persistence

T1541

description	ioc	Process
Framework service call	android.app.IActivityManager.setServiceForeground	com.yarubin_clock1

Queries the mobile country code (MCC) 1 TTPs 1 IoCs

discovery

System Network Configuration Discovery

T1422

description	ioc	Process
Framework service call	com.android.internal.telephony.ITelephony.getNetworkCountryIsoForPhone	com.yarubin_clock1

Queries the unique device ID (IMEI, MEID, IMSI) 1 TTPs
discovery

System Network Configuration Discovery
T1422
Reads information about phone network operator. 1 TTPs
discovery

System Network Configuration Discovery
T1422

Requests disabling of battery optimizations (often used to enable hiding in the background). 1 TTPs 1 IoCs

evasion

User Evasion

T1628.002

description	ioc	Process
Intent action	android.settings.REQUEST_IGNORE_BATTERY_OPTIMIZATIONS	com.yarubin_clock1

Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs

persistence

Broadcast Receivers

T1624.001

description	ioc	Process
Framework service call	android.app.IActivityManager.registerReceiver	com.yarubin_clock1

Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs

impact

Data Encrypted for Impact

T1471

description	ioc	Process
Framework API call	javax.crypto.Cipher.doFinal	com.yarubin_clock1

Checks CPU information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/cpuinfo	com.yarubin_clock1

Checks memory information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/meminfo	com.yarubin_clock1

com.yarubin_clock1
1⤵
- Loads dropped Dex/Jar
- Makes use of the framework's Accessibility service
- Acquires the wake lock
- Makes use of the framework's foreground persistence service
- Queries the mobile country code (MCC)
- Requests disabling of battery optimizations (often used to enable hiding in the background).
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Uses Crypto APIs (Might try to encrypt user data)
- Checks CPU information
- Checks memory information
PID:4252
- /system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.yarubin_clock1/app_peanut/cnBXFdL.json --output-vdex-fd=41 --oat-fd=42 --oat-location=/data/user/0/com.yarubin_clock1/app_peanut/oat/x86/cnBXFdL.odex --compiler-filter=quicken --class-loader-context=&
  2⤵
  - Loads dropped Dex/Jar
  PID:4280

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Event Triggered Execution

T1624

Broadcast Receivers

T1624.001

Foreground Persistence

T1541

Privilege Escalation

Defense Evasion

Download New Code at Runtime

T1407

Foreground Persistence

T1541

Hide Artifacts

T1628

User Evasion

T1628.002

Input Injection

T1516

Virtualization/Sandbox Evasion

T1633

System Checks

T1633.001

Credential Access

Input Capture

T1417

GUI Input Capture

T1417.002

Keylogging

T1417.001

Discovery

Software Discovery

T1418

Security Software Discovery

T1418.001

System Information Discovery

T1426

System Network Configuration Discovery

T1422

Lateral Movement

Collection

Input Capture

T1417

GUI Input Capture

T1417.002

Keylogging

T1417.001

Screen Capture

T1513

Command and Control

Exfiltration

Impact

Data Encrypted for Impact

T1471

Input Injection

T1516

Replay Monitor

Loading Replay Monitor...

Downloads

/data/data/com.yarubin_clock1/.global.com.yarubin_clock1

Filesize
48B

MD5
046a414913add6f5bb60072c7db819b6

SHA1
451ee4f6809260aec622d772fd329c7d0297a842

SHA256
b66c1320cb063a1d391c94273572ea6edae76c8c8b0a07f8d75c88686f0df72a

SHA512
4e6355f3051ed5e811ab030abde1f5be7f5e1cf33be99cd08477e9b6c015deb1d8bd75a09fb9c7176b8511c5ad0a67abc0902a3531e97564ccb6afc57496a47c

Download Submit
/data/data/com.yarubin_clock1/app_peanut/cnBXFdL.json

Filesize
1007B

MD5
5f1426ce98548006ceccc3fed6b0812f

SHA1
283c44219d1162f99231955f8fb4cc8e895d1944

SHA256
7c23e898e876146b664df45d1869742f48a969e86420bfddd409e5e19ba5ae16

SHA512
7fa510650f0f55f0d0fd6b27a87126cc6048d26cca9fcdb7d5a36850d660854881f2b304d68586bcfa5f03a7efdf0a6200e3da95cdacbcdb5e451c5883cd0dff

Download Submit
/data/data/com.yarubin_clock1/app_peanut/cnBXFdL.json

Filesize
1007B

MD5
4eb98c516b0c3c52faa923ffe91e25d2

SHA1
3300283cff008386d1a1d8b028095a9b80f2be8b

SHA256
a93c13f2596bd6895cf3f15f9c4809da2aa8b448ed66d18f340f90ebd4d1a13c

SHA512
78b44a27034c8d78214ce106d09af07bea4e79445c1c4fae20d7ccdf320a2453852230d323c5e9f34695d8aa039c03cb1037dd7f833d79d74b754bc4a76afb58

Download Submit
/data/data/com.yarubin_clock1/files/.p

Filesize
307KB

MD5
4e73947cabb5db3f92ca85004981b754

SHA1
6d9667fdb0280ed2dcb782b4683e422a51bdc601

SHA256
6db94232e756b90ed437f1bc87dc38cf20fb2e7c7a19a5e40c6c17254b7e234c

SHA512
be8b500a7070af1dfb53b0cf1a7b327dadc4e163a6dad905496ac228c58cd1ed87b054533917924455d35e9b300683ae33e1bcdd91935a5dbae1d693c3e13d69

Download Submit
/data/user/0/com.yarubin_clock1/app_peanut/cnBXFdL.json

Filesize
1KB

MD5
e99d59b577f45b4df78f6ee2835aaa53

SHA1
cef37a4420f019307523fdd9626a6ccaf3dd2043

SHA256
0d5cea6f3232cc85c22df34dbf9c2fcd4a863a37d6b823fdf1eb8dfc01f04d1d

SHA512
21589264ff04e9d308710c14d2e2db7858bcc2c5088f305db352c14c81d00bae4d1583d7361d84b59bddc87aa4bcc54c6112d77e212be2e5b1943ab55d972adf

Download Submit
/data/user/0/com.yarubin_clock1/app_peanut/cnBXFdL.json

Filesize
1KB

MD5
eb866aeba68cfcf4d4299a83d66120b8

SHA1
1abf00a42c7fb35e9a2f390f7337261d7af076a1

SHA256
86a93d89f0c0f3a2abd9b52c8f75835e2fb1dae358eab548c5a05f1cc95bfc1e

SHA512
d0057fab1f6922056c36027e9e756aef40fa44a03160db1a41b0aebfa38f8b46a1c6aefd6b1c3805132e5507f9ec0270b36956cf9c2078f9e9bfb30c5e4f190d

Download Submit
Anonymous-DexFile@0xcffbd000-0xd0040670

Filesize
525KB

MD5
f354eeac05c7ea9771e64dd5dfa3574e

SHA1
e4bf74d25a63052547f2aa236c3abd5bca3b8a72

SHA256
def8e80f9cb7a1ef381f8b74c3abb5bd784e935859371baed987683be4f929f8

SHA512
9c5af68cd4e2c0a6da8a88cbfa1ee18e0fafbb5bbeead8847bcf83c3ddcbe8a6545a16164e3693930b592e1acf7cc49bf904cb00e38bd7f845c88063e5bd0ad7

Download Submit

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads