octo | 77f328c158d095d36ca1b1c0b2aea943bb484b46133ee2886732b8343ab99d7a

Analysis

max time kernel
139s
max time network
159s
platform
android_x86
resource
android-x86-arm-20240624-en
resource tags

androidarch:armarch:x86image:android-x86-arm-20240624-enlocale:en-usos:android-9-x86system
submitted
21-01-2025 06:07

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

file.apk
Size

8.1MB
MD5

7216713f42d7a1a66ff014070b5f8778
SHA1

40117df4a0b1114bf9152ae65bfdb5e3702b32b9
SHA256

77f328c158d095d36ca1b1c0b2aea943bb484b46133ee2886732b8343ab99d7a
SHA512

b5b5594b3d13a60231ffd828d0b2509befe341eee2e7300293be2729d368cef650284ce68e08d78311480f234f9a53efdbf53b4448bcb3d7dede92bbdfce046d
SSDEEP

196608:Afx3X0RvrTUwFpVL28fV4ap3Zt99UKGP/AQ:AIrT/FpVVaaU

Score

10^/10

octo banker collection credential_access defense_evasion discovery evasion impact infostealer persistence rat trojan

Malware Config

Extracted

Family

octo

AES_key

Signatures

Octo
Octo is a banking malware with remote access capabilities first seen in April 2022.
banker trojan infostealer rat octo
Octo family
octo

Octo payload 1 IoCs

resource	yara_rule
behavioral1/memory/4245-1.dex	family_octo

Loads dropped Dex/Jar 1 TTPs 3 IoCs

Runs executable file dropped to the device during analysis.

evasion

Download New Code at Runtime

T1407

ioc	pid	Process
/data/user/0/com.launchermonitor_sec57/app_episode/DGWRQ.json	4270	/system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.launchermonitor_sec57/app_episode/DGWRQ.json --output-vdex-fd=41 --oat-fd=42 --oat-location=/data/user/0/com.launchermonitor_sec57/app_episode/oat/x86/DGWRQ.odex --compiler-filter=quicken --class-loader-context=&
/data/user/0/com.launchermonitor_sec57/app_episode/DGWRQ.json	4245	com.launchermonitor_sec57
Anonymous-DexFile@0xd1e78000-0xd1efb9a8	4245	com.launchermonitor_sec57

Makes use of the framework's Accessibility service 4 TTPs 2 IoCs

Retrieves information displayed on the phone screen using AccessibilityService.

collection defense_evasion credential_access

Input Injection

T1516

Screen Capture

T1513

Keylogging

T1417.001

GUI Input Capture

T1417.002

description	ioc	Process
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId	com.launchermonitor_sec57
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByViewId	com.launchermonitor_sec57

Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
banker discovery

Security Software Discovery
T1418.001
Queries the phone number (MSISDN for GSM devices) 1 TTPs
discovery

System Network Configuration Discovery
T1422

Acquires the wake lock 1 IoCs

description	ioc	Process
Framework service call	android.os.IPowerManager.acquireWakeLock	com.launchermonitor_sec57

Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs

Application may abuse the framework's foreground service to continue running in the foreground.

defense_evasion persistence

Foreground Persistence

T1541

description	ioc	Process
Framework service call	android.app.IActivityManager.setServiceForeground	com.launchermonitor_sec57

Queries the mobile country code (MCC) 1 TTPs 1 IoCs

discovery

System Network Configuration Discovery

T1422

description	ioc	Process
Framework service call	com.android.internal.telephony.ITelephony.getNetworkCountryIsoForPhone	com.launchermonitor_sec57

Queries the unique device ID (IMEI, MEID, IMSI) 1 TTPs
discovery

System Network Configuration Discovery
T1422
Reads information about phone network operator. 1 TTPs
discovery

System Network Configuration Discovery
T1422

Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs

persistence

Broadcast Receivers

T1624.001

description	ioc	Process
Framework service call	android.app.IActivityManager.registerReceiver	com.launchermonitor_sec57

Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs

impact

Data Encrypted for Impact

T1471

description	ioc	Process
Framework API call	javax.crypto.Cipher.doFinal	com.launchermonitor_sec57

Checks CPU information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/cpuinfo	com.launchermonitor_sec57

Checks memory information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/meminfo	com.launchermonitor_sec57

com.launchermonitor_sec57
1⤵
- Loads dropped Dex/Jar
- Makes use of the framework's Accessibility service
- Acquires the wake lock
- Makes use of the framework's foreground persistence service
- Queries the mobile country code (MCC)
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Uses Crypto APIs (Might try to encrypt user data)
- Checks CPU information
- Checks memory information
PID:4245
- /system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.launchermonitor_sec57/app_episode/DGWRQ.json --output-vdex-fd=41 --oat-fd=42 --oat-location=/data/user/0/com.launchermonitor_sec57/app_episode/oat/x86/DGWRQ.odex --compiler-filter=quicken --class-loader-context=&
  2⤵
  - Loads dropped Dex/Jar
  PID:4270

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Event Triggered Execution

T1624

Broadcast Receivers

T1624.001

Foreground Persistence

T1541

Privilege Escalation

Defense Evasion

Download New Code at Runtime

T1407

Foreground Persistence

T1541

Input Injection

T1516

Virtualization/Sandbox Evasion

T1633

System Checks

T1633.001

Credential Access

Input Capture

T1417

GUI Input Capture

T1417.002

Keylogging

T1417.001

Discovery

Software Discovery

T1418

Security Software Discovery

T1418.001

System Information Discovery

T1426

System Network Configuration Discovery

T1422

Lateral Movement

Collection

Input Capture

T1417

GUI Input Capture

T1417.002

Keylogging

T1417.001

Screen Capture

T1513

Command and Control

Exfiltration

Impact

Data Encrypted for Impact

T1471

Input Injection

T1516

Replay Monitor

Loading Replay Monitor...

Downloads

/data/data/com.launchermonitor_sec57/.global.com.launchermonitor_sec57

Filesize
48B

MD5
046a414913add6f5bb60072c7db819b6

SHA1
451ee4f6809260aec622d772fd329c7d0297a842

SHA256
b66c1320cb063a1d391c94273572ea6edae76c8c8b0a07f8d75c88686f0df72a

SHA512
4e6355f3051ed5e811ab030abde1f5be7f5e1cf33be99cd08477e9b6c015deb1d8bd75a09fb9c7176b8511c5ad0a67abc0902a3531e97564ccb6afc57496a47c

Download Submit
/data/data/com.launchermonitor_sec57/app_episode/DGWRQ.json

Filesize
1023B

MD5
e022495720963f31c4c1163c6e3f632d

SHA1
188761b2ff22fea101d8a2fb4bbb8cff57c927cd

SHA256
3a89e01e05c1c28704e18872fb922bda03fab7ffa84ec8dc69053af9a1a716a9

SHA512
56122fee009aaa7c63069cf1fa1c649391fa58129399057953f25b14e6ccf3c04eb16e33e27645ab034b6cedae7e7d9ddb6e4b7152fdba472158baf17ac65d0d

Download Submit
/data/data/com.launchermonitor_sec57/app_episode/DGWRQ.json

Filesize
1023B

MD5
fed243237d4d5bea77ebf64fc2ba488b

SHA1
63868f6bf104757bbcdab3cb1c8eb78867bac508

SHA256
8450670b4501bda2cd46f819bd48f8b3e8a4c94323dcd09044e74e22bd3dc674

SHA512
a19fac62b3dc5858aa962cd5d0200cc7dca48b1643f328f8ce64717a014afae1faf79ced0f108275cbed9baeb6fc20db454b53a0c615f5d1cbc64cb33800be72

Download Submit
/data/data/com.launchermonitor_sec57/files/.c

Filesize
307KB

MD5
4e73947cabb5db3f92ca85004981b754

SHA1
6d9667fdb0280ed2dcb782b4683e422a51bdc601

SHA256
6db94232e756b90ed437f1bc87dc38cf20fb2e7c7a19a5e40c6c17254b7e234c

SHA512
be8b500a7070af1dfb53b0cf1a7b327dadc4e163a6dad905496ac228c58cd1ed87b054533917924455d35e9b300683ae33e1bcdd91935a5dbae1d693c3e13d69

Download Submit
/data/user/0/com.launchermonitor_sec57/app_episode/DGWRQ.json

Filesize
1KB

MD5
1141437427e664eb7945d633c342636f

SHA1
79cced3d03111780bf71dacf785cb9f1ef3bde3c

SHA256
54345550eebfacf9b942b23b1b01d67bba3b8bb4248feeb373181cd4822eaa77

SHA512
0c9a57bf7af90d2a2de25b55e087fa4f89e5d4712ecb9d301d59f718c2913e410c35bd84957a99b57d10efd3764eca86259d431e3b5a9626c20e84869928233e

Download Submit
/data/user/0/com.launchermonitor_sec57/app_episode/DGWRQ.json

Filesize
1KB

MD5
d832750e5fcead617b8ef8a1b9386d37

SHA1
9787dc49f1dc41637f81511171a87ecc67181ccc

SHA256
cd920a4baeaa2feaff76f8a6633bd8a95cf09d1d4c72ec0ae19d06c5392f8b4b

SHA512
ab8c26eb3e9314264a683f7b4d9d96313a3bee98c360616c93dfa839a34eb218a4042345dfb6e39efc7459eb67c2334c3df98fbacce2c22ac5cc736db545238f

Download Submit
Anonymous-DexFile@0xd1e78000-0xd1efb9a8

Filesize
526KB

MD5
492e7c0e49e72308d41ec4f2e8ca2837

SHA1
71ec18234de15af83c609ac5d1acde6e9b2c0cba

SHA256
54370d178c66d85424a9074528f7b30cba978f8be8183a5ef71e20555667ac07

SHA512
d281afe4400b5d589541f9cda8ccafccc4c3601e3ae62065d19520c5748cc26fad62c0f571e8eb51560de4f53097d55a8b6323b8dc71348bccdd6458d6c33e7a

Download Submit

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads