octo | 3a058e837c817aa8179202f754850a1bebdeca1a22421b17b9947c3e75ab923c

Analysis

max time kernel
139s
max time network
137s
platform
android_x86
resource
android-x86-arm-20240624-en
resource tags

androidarch:armarch:x86image:android-x86-arm-20240624-enlocale:en-usos:android-9-x86system
submitted
11-01-2025 17:22

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

3a058e837c817aa8179202f754850a1bebdeca1a22421b17b9947c3e75ab923c.apk
Size

8.6MB
MD5

3f08d0978d80de888fd1c7c2e37e6a53
SHA1

4fabace698ba3f8923217bf0282096d250232456
SHA256

3a058e837c817aa8179202f754850a1bebdeca1a22421b17b9947c3e75ab923c
SHA512

9534e0b05b44e37398c8f7d9a08a95e59f3220a6f98ea5f23eeb84d603cee2a46c53a87d45803a5b8058af58d39597e9a9165b427f12d68c5b27746d6b9e376d
SSDEEP

98304:0idbxVKJ2vn3Xc5iSRGt8RsPE+ZeNe4E3KVFozsswwCfO:0ibxUIP3XcrBRzlJoz95H

Score

10^/10

octo banker collection credential_access discovery evasion impact infostealer persistence rat trojan

Malware Config

Extracted

Family

octo

https://8caf6a13209282f9dadc9eac58c5007e.com

https://f3ad8ca1cecfb4942d9b6cec53bbfe94.org

AES_key

Signatures

Octo
Octo is a banking malware with remote access capabilities first seen in April 2022.
banker trojan infostealer rat octo
Octo family
octo

Octo payload 1 IoCs

resource	yara_rule
behavioral1/memory/4259-1.dex	family_octo

Checks Android system properties for emulator presence. 1 TTPs 1 IoCs

evasion

System Checks

T1633.001

description	ioc	Process
Accessed system property	key: ro.product.model	com.marketintelligenceklms71

Loads dropped Dex/Jar 1 TTPs 3 IoCs

Runs executable file dropped to the device during analysis.

evasion

Download New Code at Runtime

T1407

ioc	pid	Process
/data/user/0/com.marketintelligenceklms71/app_ribbon/CT.json	4285	/system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.marketintelligenceklms71/app_ribbon/CT.json --output-vdex-fd=41 --oat-fd=42 --oat-location=/data/user/0/com.marketintelligenceklms71/app_ribbon/oat/x86/CT.odex --compiler-filter=quicken --class-loader-context=&
/data/user/0/com.marketintelligenceklms71/app_ribbon/CT.json	4259	com.marketintelligenceklms71
Anonymous-DexFile@0xcb6cb000-0xcb74eae8	4259	com.marketintelligenceklms71

Makes use of the framework's Accessibility service 4 TTPs 2 IoCs

Retrieves information displayed on the phone screen using AccessibilityService.

collection evasion credential_access

Input Injection

T1516

Screen Capture

T1513

Keylogging

T1417.001

GUI Input Capture

T1417.002

description	ioc	Process
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId	com.marketintelligenceklms71
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByViewId	com.marketintelligenceklms71

Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
banker discovery

Security Software Discovery
T1418.001
Queries the phone number (MSISDN for GSM devices) 1 TTPs
discovery

System Network Configuration Discovery
T1422

Acquires the wake lock 1 IoCs

description	ioc	Process
Framework service call	android.os.IPowerManager.acquireWakeLock	com.marketintelligenceklms71

Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs

Application may abuse the framework's foreground service to continue running in the foreground.

evasion persistence

Foreground Persistence

T1541

description	ioc	Process
Framework service call	android.app.IActivityManager.setServiceForeground	com.marketintelligenceklms71

Queries the mobile country code (MCC) 1 TTPs 1 IoCs

discovery

System Network Configuration Discovery

T1422

description	ioc	Process
Framework service call	com.android.internal.telephony.ITelephony.getNetworkCountryIsoForPhone	com.marketintelligenceklms71

Queries the unique device ID (IMEI, MEID, IMSI) 1 TTPs
discovery

System Network Configuration Discovery
T1422
Reads information about phone network operator. 1 TTPs
discovery

System Network Configuration Discovery
T1422

Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs

persistence

Broadcast Receivers

T1624.001

description	ioc	Process
Framework service call	android.app.IActivityManager.registerReceiver	com.marketintelligenceklms71

Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs

impact

Data Encrypted for Impact

T1471

description	ioc	Process
Framework API call	javax.crypto.Cipher.doFinal	com.marketintelligenceklms71

Checks CPU information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/cpuinfo	com.marketintelligenceklms71

Checks memory information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/meminfo	com.marketintelligenceklms71

com.marketintelligenceklms71
1⤵
- Checks Android system properties for emulator presence.
- Loads dropped Dex/Jar
- Makes use of the framework's Accessibility service
- Acquires the wake lock
- Makes use of the framework's foreground persistence service
- Queries the mobile country code (MCC)
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Uses Crypto APIs (Might try to encrypt user data)
- Checks CPU information
- Checks memory information
PID:4259
- /system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.marketintelligenceklms71/app_ribbon/CT.json --output-vdex-fd=41 --oat-fd=42 --oat-location=/data/user/0/com.marketintelligenceklms71/app_ribbon/oat/x86/CT.odex --compiler-filter=quicken --class-loader-context=&
  2⤵
  - Loads dropped Dex/Jar
  PID:4285

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Event Triggered Execution

T1624

Broadcast Receivers

T1624.001

Foreground Persistence

T1541

Privilege Escalation

Defense Evasion

Download New Code at Runtime

T1407

Foreground Persistence

T1541

Input Injection

T1516

Virtualization/Sandbox Evasion

T1633

System Checks

T1633.001

Credential Access

Input Capture

T1417

GUI Input Capture

T1417.002

Keylogging

T1417.001

Discovery

Software Discovery

T1418

Security Software Discovery

T1418.001

System Information Discovery

T1426

System Network Configuration Discovery

T1422

Lateral Movement

Collection

Input Capture

T1417

GUI Input Capture

T1417.002

Keylogging

T1417.001

Screen Capture

T1513

Command and Control

Exfiltration

Impact

Data Encrypted for Impact

T1471

Input Injection

T1516

Replay Monitor

Loading Replay Monitor...

Downloads

/data/data/com.marketintelligenceklms71/.global.com.marketintelligenceklms71

Filesize
48B

MD5
046a414913add6f5bb60072c7db819b6

SHA1
451ee4f6809260aec622d772fd329c7d0297a842

SHA256
b66c1320cb063a1d391c94273572ea6edae76c8c8b0a07f8d75c88686f0df72a

SHA512
4e6355f3051ed5e811ab030abde1f5be7f5e1cf33be99cd08477e9b6c015deb1d8bd75a09fb9c7176b8511c5ad0a67abc0902a3531e97564ccb6afc57496a47c

Download Submit
/data/data/com.marketintelligenceklms71/app_ribbon/CT.json

Filesize
1020B

MD5
75c1f9b930fc4ea29de3f23fcf278537

SHA1
fb12d6d8126771b395beb17520d3600918f290c0

SHA256
9f48f2dd8ee77db4f4ae8dac2d36bbd6ca658e2eb3a1c4e14c70f04794e529fd

SHA512
4c69ec16701a0a6d881f0ffffe049dfefbef532d77a4373b7b7c0b55949ec78e7f65621f5a88301044484c6cecc582e13d47b2e9f63ddb02828273fde02f4d5c

Download Submit
/data/data/com.marketintelligenceklms71/app_ribbon/CT.json

Filesize
1020B

MD5
dbd45af644fb8251733ebb7ee5953698

SHA1
e5cfc8d3e8a88a101ae59c6ca0e9d0d5e3e4528a

SHA256
82a3d5bff9763a46954dbf066dff8b6e2b111bc3dc014cbe8ae8b5d79eda42cb

SHA512
412627187e40b4f104dae83a1944f3d99e778b625584a37a8f2086547ee41f626c24792f4f673b6cf089f44eba0c53806eabcddfc84d0307efb8ceccb1f3c92c

Download Submit
/data/data/com.marketintelligenceklms71/files/.m

Filesize
307KB

MD5
4e73947cabb5db3f92ca85004981b754

SHA1
6d9667fdb0280ed2dcb782b4683e422a51bdc601

SHA256
6db94232e756b90ed437f1bc87dc38cf20fb2e7c7a19a5e40c6c17254b7e234c

SHA512
be8b500a7070af1dfb53b0cf1a7b327dadc4e163a6dad905496ac228c58cd1ed87b054533917924455d35e9b300683ae33e1bcdd91935a5dbae1d693c3e13d69

Download Submit
/data/user/0/com.marketintelligenceklms71/app_ribbon/CT.json

Filesize
1KB

MD5
655294bef7005acf77aac0eed04c88f5

SHA1
1045ff0360078cd56c3f5a50166e4665f9749374

SHA256
91844638369266732d7319a337da71b450c0c4546354d6e5d5165b05a3381985

SHA512
c5f206008047c0b14dc64c97a09d1ff8240afe1a517a9a350d1136bb15d490e8151ed6f96811e924b28972585aa84c01b9ea485d4788a6961ccc20018ffccae6

Download Submit
/data/user/0/com.marketintelligenceklms71/app_ribbon/CT.json

Filesize
1KB

MD5
21bc926ffbb89b059316f2c38698a51f

SHA1
d7b1c571c8ea5382fb42710cb4258f3a341bfa10

SHA256
3ac80d4d248536ffc16298aa38b0de533f649f711d6c348c85e95303e500dada

SHA512
b941c4ebdf481510e5d784567ef549aa3856c47cf90cd49e044f730343acc240a20a1e8a61ab76d440d498bf112a683cea1fe5deb7a735bd41b4f880366c0f8b

Download Submit
Anonymous-DexFile@0xcb6cb000-0xcb74eae8

Filesize
526KB

MD5
3d399c409f180e05a105ecf5c06703e1

SHA1
963b98a8cda502bebba98a084c9d5f95d351ffb9

SHA256
3352cbfad9a0ea1a67b48096c13e31573f2e56d604b097cc53481a11e852da1a

SHA512
cc6de73e55ca1e5ec2c503633d6f0ca1a62aef1d5bf2878bafbc76103f8decc302cd3356c4222b391a9ab04c8c568225cdb7f22f44155f3643c257e25cfda34f

Download Submit

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads