octo | 44c2f875880f216fd5fdb6cf9fb6b94eb7e35682caa7f5a7b7d5eb7738ed2bed

Resubmissions

13-01-2025 06:02

250113-grq3pa1rem 10

12-01-2025 22:07

250112-11vl1stqfm 10

Analysis

max time kernel
149s
max time network
151s
platform
android-13_x64
resource
android-33-x64-arm64-20240910-en
resource tags

arch:arm64arch:x64arch:x86image:android-33-x64-arm64-20240910-enlocale:en-usos:android-13-x64system
submitted
12-01-2025 22:07

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

44c2f875880f216fd5fdb6cf9fb6b94eb7e35682caa7f5a7b7d5eb7738ed2bed.apk
Size

3.1MB
MD5

6c0e41bc5138a2931303297604c8630d
SHA1

6688673a9f7cbce497406de4563a16a665895865
SHA256

44c2f875880f216fd5fdb6cf9fb6b94eb7e35682caa7f5a7b7d5eb7738ed2bed
SHA512

7ad539982d46f8d40ed796bba356b983cbd65df4c887e42a5b194483ed059e14868998ff1834c4c3d7c1ba579bcdb213259d06595a0e0858812918213bea0941
SSDEEP

98304:wPXtbA5KTK7E7ne1On2BVBUUfgZUdBjCvbE:ESKmye1a2PBU9ZUzjsbE

Score

10^/10

octo banker collection credential_access discovery evasion impact infostealer persistence rat trojan

Malware Config

Extracted

Family

octo

https://94.156.68.231/NmM2YjMyYjE4MmMx/

https://mmma8291play.xyz/NmM2YjMyYjE4MmMx/

https://94.156.68.232/NmM2YjMyYjE4MmMx/

https://94.156.68.233/NmM2YjMyYjE4MmMx/

https://94.156.68.234/NmM2YjMyYjE4MmMx/

https://mmma8291play.net/NmM2YjMyYjE4MmMx/

https://mmma8291play.com/NmM2YjMyYjE4MmMx/

https://mmma7811play.net/NmM2YjMyYjE4MmMx/

https://mmma7811play.xyz/NmM2YjMyYjE4MmMx/

https://mmma7811play.com/NmM2YjMyYjE4MmMx/

rc4.plain

Extracted

Family

octo

https://94.156.68.231/NmM2YjMyYjE4MmMx/

https://mmma8291play.xyz/NmM2YjMyYjE4MmMx/

https://94.156.68.232/NmM2YjMyYjE4MmMx/

https://94.156.68.233/NmM2YjMyYjE4MmMx/

https://94.156.68.234/NmM2YjMyYjE4MmMx/

https://mmma8291play.net/NmM2YjMyYjE4MmMx/

https://mmma8291play.com/NmM2YjMyYjE4MmMx/

https://mmma7811play.net/NmM2YjMyYjE4MmMx/

https://mmma7811play.xyz/NmM2YjMyYjE4MmMx/

https://mmma7811play.com/NmM2YjMyYjE4MmMx/

AES_key

Signatures

Octo
Octo is a banking malware with remote access capabilities first seen in April 2022.
banker trojan infostealer rat octo
Octo family
octo

Octo payload 1 IoCs

resource	yara_rule
behavioral2/files/fstream-1.dat	family_octo

Loads dropped Dex/Jar 1 TTPs 1 IoCs

Runs executable file dropped to the device during analysis.

evasion

Download New Code at Runtime

T1407

ioc	pid	Process
/data/user/0/com.unitrulet/cache/dooztfqy	4522	com.unitrulet

Makes use of the framework's Accessibility service 4 TTPs 2 IoCs

Retrieves information displayed on the phone screen using AccessibilityService.

collection evasion credential_access

Input Injection

T1516

Screen Capture

T1513

Keylogging

T1417.001

GUI Input Capture

T1417.002

description	ioc	Process
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId	com.unitrulet
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByViewId	com.unitrulet

Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
banker discovery

Security Software Discovery
T1418.001
Queries the phone number (MSISDN for GSM devices) 1 TTPs
discovery

System Network Configuration Discovery
T1422

Acquires the wake lock 1 IoCs

description	ioc	Process
Framework service call	android.os.IPowerManager.acquireWakeLock	com.unitrulet

Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs

Application may abuse the framework's foreground service to continue running in the foreground.

evasion persistence

Foreground Persistence

T1541

description	ioc	Process
Framework service call	android.app.IActivityManager.setServiceForeground	com.unitrulet

Queries the mobile country code (MCC) 1 TTPs 1 IoCs

discovery

System Network Configuration Discovery

T1422

description	ioc	Process
Framework service call	com.android.internal.telephony.ITelephony.getNetworkCountryIsoForPhone	com.unitrulet

Reads information about phone network operator. 1 TTPs
discovery

System Network Configuration Discovery
T1422

Requests accessing notifications (often used to intercept notifications before users become aware). 1 TTPs 1 IoCs

collection credential_access

Access Notifications

T1517

description	ioc	Process
Intent action	android.settings.ACTION_NOTIFICATION_LISTENER_SETTINGS	com.unitrulet

Requests disabling of battery optimizations (often used to enable hiding in the background). 1 TTPs 1 IoCs

evasion

User Evasion

T1628.002

description	ioc	Process
Intent action	android.settings.REQUEST_IGNORE_BATTERY_OPTIMIZATIONS	com.unitrulet

Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs

impact

Data Encrypted for Impact

T1471

description	ioc	Process
Framework API call	javax.crypto.Cipher.doFinal	com.unitrulet

com.unitrulet
1⤵
- Loads dropped Dex/Jar
- Makes use of the framework's Accessibility service
- Acquires the wake lock
- Makes use of the framework's foreground persistence service
- Queries the mobile country code (MCC)
- Requests accessing notifications (often used to intercept notifications before users become aware).
- Requests disabling of battery optimizations (often used to enable hiding in the background).
- Uses Crypto APIs (Might try to encrypt user data)
PID:4522

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Foreground Persistence

T1541

Privilege Escalation

Defense Evasion

Download New Code at Runtime

T1407

Foreground Persistence

T1541

Hide Artifacts

T1628

User Evasion

T1628.002

Input Injection

T1516

Credential Access

Access Notifications

T1517

Input Capture

T1417

GUI Input Capture

T1417.002

Keylogging

T1417.001

Discovery

Software Discovery

T1418

Security Software Discovery

T1418.001

System Network Configuration Discovery

T1422

Lateral Movement

Collection

Access Notifications

T1517

Input Capture

T1417

GUI Input Capture

T1417.002

Keylogging

T1417.001

Screen Capture

T1513

Command and Control

Exfiltration

Impact

Data Encrypted for Impact

T1471

Input Injection

T1516

Replay Monitor

Loading Replay Monitor...

Downloads

/data/user/0/com.unitrulet/cache/dooztfqy

Filesize
449KB

MD5
a38bf1a4d940f39a88ddde1d16608cfe

SHA1
f22ca8a4257c25a9634ee929f848ca0f291ac139

SHA256
c66a314b1b04004defbeec0dc2bf3de006b023a405b4a478f824333f2c1de0b1

SHA512
3b2599c35a499e0d64b18cc5a16a9cf4c73838c3f284f5c5ed52c75823bf52d4cd01a8a5e71b91164565ec8c1e900afdf649b86428e16700e327257bb63d0a13

Download Submit
/data/user/0/com.unitrulet/cache/oat/dooztfqy.cur.prof

Filesize
360B

MD5
c7fc64301bc640bcbb3abcfa0ac497e9

SHA1
d86253cb78e07fb64bc68a04b5ad9eec0187af8a

SHA256
1d8a15ebd01522400b9c735d7e460bdc6be14a53e776456de4175cb082c85c39

SHA512
8039eb2aea517c503ca6d9f1e700b68e11965aa90cabfa9508fb9d2f08ae89943afe779c182c150ec72e00460524bf2e0c9328183d7ca9da63ff860689175559

Download Submit

Resubmissions

Analysis

Sharing

General

Malware Config

Extracted

Extracted

Signatures

Processes

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads