octo | a49074de3f3c659c193525004848663d7b426c4165718793cee02ff7317bc7fc

Analysis

max time kernel
25s
max time network
148s
platform
android_x86
resource
android-x86-arm-20240624-en
resource tags

androidarch:armarch:x86image:android-x86-arm-20240624-enlocale:en-usos:android-9-x86system
submitted
21-01-2025 22:13

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

a49074de3f3c659c193525004848663d7b426c4165718793cee02ff7317bc7fc.apk
Size

2.6MB
MD5

a53c890155cad7dc39ecdbd6da575107
SHA1

84dcc2cae08ef308e824fa82aa13177cc74d9381
SHA256

a49074de3f3c659c193525004848663d7b426c4165718793cee02ff7317bc7fc
SHA512

e1580e80aecf75a691f8f132bc241397293dc8ca531899c450f266f5d18fa783a23958f936527ab7f037f2a5ec1fb5e1dcf1b45a3f9c3beaa8cee2b67d5ef6d3
SSDEEP

49152:UuueVxQKcqShuobhOGApE4/kUKx7euzbXWcxLanlUoswHbvv62nBxEzfMDCyYnOL:UteVxQK8ThOnpE4/kJkuzScelRLNBx8c

Score

10^/10

octo banker collection credential_access defense_evasion discovery evasion impact infostealer persistence rat stealth trojan

Malware Config

Extracted

Family

octo

https://holaolabien.top/ZmU2YzQ2NjZlNjc2/

https://lauytropo.net/ZmU2YzQ2NjZlNjc2/

https://bobnoopo.org/ZmU2YzQ2NjZlNjc2/

https://junggvrebvqq.org/ZmU2YzQ2NjZlNjc2/

https://junggpervbvqqqqqq.com/ZmU2YzQ2NjZlNjc2/

https://junggvbvqqgroup.com/ZmU2YzQ2NjZlNjc2/

https://junggvbvqqnetok.com/ZmU2YzQ2NjZlNjc2/

rc4.plain

Extracted

Family

octo

https://holaolabien.top/ZmU2YzQ2NjZlNjc2/

https://lauytropo.net/ZmU2YzQ2NjZlNjc2/

https://bobnoopo.org/ZmU2YzQ2NjZlNjc2/

https://junggvrebvqq.org/ZmU2YzQ2NjZlNjc2/

https://junggpervbvqqqqqq.com/ZmU2YzQ2NjZlNjc2/

https://junggvbvqqgroup.com/ZmU2YzQ2NjZlNjc2/

https://junggvbvqqnetok.com/ZmU2YzQ2NjZlNjc2/

AES_key

Signatures

Octo
Octo is a banking malware with remote access capabilities first seen in April 2022.
banker trojan infostealer rat octo
Octo family
octo

Octo payload 1 IoCs

resource	yara_rule
behavioral1/files/fstream-6.dat	family_octo

Removes its main activity from the application launcher 1 TTPs 1 IoCs

stealth trojan evasion

Suppress Application Icon

T1628.001

pid	Process
4264	com.objectwhichhca

Loads dropped Dex/Jar 1 TTPs 4 IoCs

Runs executable file dropped to the device during analysis.

evasion

Download New Code at Runtime

T1407

ioc	pid	Process
/data/user/0/com.objectwhichhca/app_DynamicOptDex/wejT.json	4291	/system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.objectwhichhca/app_DynamicOptDex/wejT.json --output-vdex-fd=41 --oat-fd=42 --oat-location=/data/user/0/com.objectwhichhca/app_DynamicOptDex/oat/x86/wejT.odex --compiler-filter=quicken --class-loader-context=&
/data/user/0/com.objectwhichhca/app_DynamicOptDex/wejT.json	4264	com.objectwhichhca
/data/user/0/com.objectwhichhca/cache/dujbaaoh	4264	com.objectwhichhca
/data/user/0/com.objectwhichhca/cache/dujbaaoh	4264	com.objectwhichhca

Makes use of the framework's Accessibility service 4 TTPs 2 IoCs

Retrieves information displayed on the phone screen using AccessibilityService.

collection defense_evasion credential_access

Input Injection

T1516

Screen Capture

T1513

Keylogging

T1417.001

GUI Input Capture

T1417.002

description	ioc	Process
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId	com.objectwhichhca
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByViewId	com.objectwhichhca

Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
banker discovery

Security Software Discovery
T1418.001
Queries the phone number (MSISDN for GSM devices) 1 TTPs
discovery

System Network Configuration Discovery
T1422

Acquires the wake lock 1 IoCs

description	ioc	Process
Framework service call	android.os.IPowerManager.acquireWakeLock	com.objectwhichhca

Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs

Application may abuse the framework's foreground service to continue running in the foreground.

defense_evasion persistence

Foreground Persistence

T1541

description	ioc	Process
Framework service call	android.app.IActivityManager.setServiceForeground	com.objectwhichhca

Performs UI accessibility actions on behalf of the user 1 TTPs 4 IoCs

Application may abuse the accessibility service to prevent their removal.

evasion

Prevent Application Removal

T1629.001

ioc	Process
android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction	com.objectwhichhca
android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction	com.objectwhichhca
android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction	com.objectwhichhca
android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction	com.objectwhichhca

Queries the mobile country code (MCC) 1 TTPs 1 IoCs

discovery

System Network Configuration Discovery

T1422

description	ioc	Process
Framework service call	com.android.internal.telephony.ITelephony.getNetworkCountryIsoForPhone	com.objectwhichhca

Queries the unique device ID (IMEI, MEID, IMSI) 1 TTPs
discovery

System Network Configuration Discovery
T1422

Requests accessing notifications (often used to intercept notifications before users become aware). 1 TTPs 1 IoCs

collection credential_access

Access Notifications

T1517

description	ioc	Process
Intent action	android.settings.ACTION_NOTIFICATION_LISTENER_SETTINGS	com.objectwhichhca

Requests disabling of battery optimizations (often used to enable hiding in the background). 1 TTPs 1 IoCs

defense_evasion

User Evasion

T1628.002

description	ioc	Process
Intent action	android.settings.REQUEST_IGNORE_BATTERY_OPTIMIZATIONS	com.objectwhichhca

Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs

persistence

Broadcast Receivers

T1624.001

description	ioc	Process
Framework service call	android.app.IActivityManager.registerReceiver	com.objectwhichhca

Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs

impact

Data Encrypted for Impact

T1471

description	ioc	Process
Framework API call	javax.crypto.Cipher.doFinal	com.objectwhichhca

Checks CPU information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/cpuinfo	com.objectwhichhca

Checks memory information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/meminfo	com.objectwhichhca

com.objectwhichhca
1⤵
- Removes its main activity from the application launcher
- Loads dropped Dex/Jar
- Makes use of the framework's Accessibility service
- Acquires the wake lock
- Makes use of the framework's foreground persistence service
- Performs UI accessibility actions on behalf of the user
- Queries the mobile country code (MCC)
- Requests accessing notifications (often used to intercept notifications before users become aware).
- Requests disabling of battery optimizations (often used to enable hiding in the background).
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Uses Crypto APIs (Might try to encrypt user data)
- Checks CPU information
- Checks memory information
PID:4264
- /system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.objectwhichhca/app_DynamicOptDex/wejT.json --output-vdex-fd=41 --oat-fd=42 --oat-location=/data/user/0/com.objectwhichhca/app_DynamicOptDex/oat/x86/wejT.odex --compiler-filter=quicken --class-loader-context=&
  2⤵
  - Loads dropped Dex/Jar
  PID:4291

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Event Triggered Execution

T1624

Broadcast Receivers

T1624.001

Foreground Persistence

T1541

Privilege Escalation

Defense Evasion

Download New Code at Runtime

T1407

Foreground Persistence

T1541

Hide Artifacts

T1628

Suppress Application Icon

T1628.001

User Evasion

T1628.002

Impair Defenses

T1629

Prevent Application Removal

T1629.001

Input Injection

T1516

Virtualization/Sandbox Evasion

T1633

System Checks

T1633.001

Credential Access

Access Notifications

T1517

Input Capture

T1417

GUI Input Capture

T1417.002

Keylogging

T1417.001

Discovery

Software Discovery

T1418

Security Software Discovery

T1418.001

System Information Discovery

T1426

System Network Configuration Discovery

T1422

Lateral Movement

Collection

Access Notifications

T1517

Input Capture

T1417

GUI Input Capture

T1417.002

Keylogging

T1417.001

Screen Capture

T1513

Command and Control

Exfiltration

Impact

Data Encrypted for Impact

T1471

Input Injection

T1516

Replay Monitor

Loading Replay Monitor...

Downloads

/data/data/com.objectwhichhca/app_DynamicOptDex/wejT.json

Filesize
2KB

MD5
e9dd0745b294f7e77ff8cf0e6c4d5cf1

SHA1
ef2f9c6c8d32c66936e818d6443110c2531f7721

SHA256
82be5eb03cc101770e4640b4afcee9209fb4c9f682f74ea3072d2653637cb0e2

SHA512
b6522fd7b61ba8f96a837b3d382a941397fcb3c3ed0c3e3c9a52cc71a1afc38ff91b91306628c98a3ba9b683f89e3c4aaa3db4f6d7b5be893cf12de12094df3f

Download Submit
/data/data/com.objectwhichhca/app_DynamicOptDex/wejT.json

Filesize
2KB

MD5
a2417b020e9c6198c51597b58a217372

SHA1
dff615a6625039bdd04badbbd5216cd9ed012add

SHA256
bd3aaa263c80eddd639c9eb8e918f4447f1af846536465e2baa3e764094c153f

SHA512
e10c4d0aff1b7e634feec38f8980a71ce0f15d288a63e04431c735ae0e494debe4546c95fc4741abbe3f835a360aca8151e54b5bc238966801f98c1df6ccde34

Download Submit
/data/data/com.objectwhichhca/cache/dujbaaoh

Filesize
449KB

MD5
c2a32b32c09fe6f4553fbfef06b69c92

SHA1
493509f5663b41ae49fcac2e234849274fb48be8

SHA256
72072b463ca6573331766a292b42220e6b414052e12ef70824d84c2c87f1d3c8

SHA512
a8eb8514050211e9ba51a24d54772f0e5b624d7cca8bdeca45ae8a92a9285e5827dd5233e6095bb94718e436bc3a9af1fed1ddce34e68776ee6dfafc6701f4f3

Download Submit
/data/data/com.objectwhichhca/kl.txt

Filesize
28B

MD5
6311c3fd15588bb5c126e6c28ff5fffe

SHA1
ce81d136fce31779f4dd62e20bdaf99c91e2fc57

SHA256
8b82f6032e29a2b5c96031a3630fb6173d12ff0295bc20bb21b877d08f0812d8

SHA512
2975fe2e94b6a8adc9cfc1a865ad113772b54572883a537b02a16dd2d029c0f7d9cca3b154fd849bdfe978e18b396bcf9fa6e67e7c61f92bdc089a29a9c355c6

Download Submit
/data/data/com.objectwhichhca/kl.txt

Filesize
237B

MD5
f9e9b0942db5792958db8705e6211be2

SHA1
2be01bad1842910f791482774039050ec337adb7

SHA256
abe5faff73eef0cb8c9ca61cf919155d958d18c02f153844a9029e89fe3f7902

SHA512
acff542e81880cf525fd0806b1e44067c33a34ae2b08126369433a79370e49cb2b7adc585591799146e50a1cc289100fc220521111c9521329d07af424683bad

Download Submit
/data/user/0/com.objectwhichhca/app_DynamicOptDex/wejT.json

Filesize
7KB

MD5
efd029a055a08b2bdde7b0615d155f89

SHA1
0b1cf2776c208b2eab5cbff52303d906de2a88cb

SHA256
ee29404a6b016a97694228890a8f6c93fc1bc70b6c71e452d14beaca14d788f5

SHA512
335e31797a57e4d740fe93134d1ba81fa0a41997c0444cbb8062acdb255f3bd8d8fc60cb9c14c490cd3d09d4f60f9c366bf394616518ade97576ebbb93bb7282

Download Submit
/data/user/0/com.objectwhichhca/app_DynamicOptDex/wejT.json

Filesize
7KB

MD5
cffc1ed8e20582a69d603f40720b77fa

SHA1
9c79892cbb3553910875f63a1cef86ab5664aaea

SHA256
d6de5b52085217b1605a4a63794247675f7ac7a6ac10a4319c37081847f73314

SHA512
86e55b8f290d7cd3c8b6d7a4cc5c40c55e20acb0f05d183b94b46750749efce4ea2ea8c46d5345a4499dc19109e3526651b05f7fe86828f5e5753dd2e7d6a71a

Download Submit

Analysis

Sharing

General

Malware Config

Extracted

Extracted

Signatures

Processes

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads