octo | 5536911c259634d705f38a4c7e584a845f1bdaac2a8ea5e18253d19623503def

Analysis

max time kernel
149s
max time network
153s
platform
android-9_x86
resource
android-x86-arm-20240910-en
resource tags

arch:armarch:x86image:android-x86-arm-20240910-enlocale:en-usos:android-9-x86system
submitted
22-01-2025 22:08

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

5536911c259634d705f38a4c7e584a845f1bdaac2a8ea5e18253d19623503def.apk
Size

2.3MB
MD5

a2e9e7659dff1cbbae76c392218b63e8
SHA1

14a551cf396c3bd98a55d18966ef74ffdf221a71
SHA256

5536911c259634d705f38a4c7e584a845f1bdaac2a8ea5e18253d19623503def
SHA512

0bec421fc977c7d77d20375bb62ecc996bd55d93e3ebe8b1489cd6d6037fdc97d30051cf4aaffab4bd2702c74ed1106c1623451cdea0071688c7775ae542a3e1
SSDEEP

49152:svA+HinzUbK5e9GF+TV/46AQ0c90KPhcRZGZbmqC2Y80ZP50vmVy0ZPszAE4KoS4:s4nzQuFEi6AQzb4ZQ/C/80ZSuBfc8KMZ

Score

10^/10

octo banker collection credential_access defense_evasion discovery evasion impact infostealer persistence rat stealth trojan

Malware Config

Extracted

Family

octo

https://vippivok.top/ZTZkNTJjNTkwYzk3/

https://bobnoopopo.org/ZTZkNTJjNTkwYzk3/

https://junggvrebvqqpo.org/ZTZkNTJjNTkwYzk3/

https://junggpervbvqqqqqqpo.com/ZTZkNTJjNTkwYzk3/

https://junggvbvqqgrouppo.com/ZTZkNTJjNTkwYzk3/

https://junggvbvqqnetokpo.com/ZTZkNTJjNTkwYzk3/

https://junggvbvq.top/ZTZkNTJjNTkwYzk3/

https://junggvbvq5656.top/ZTZkNTJjNTkwYzk3/

https://jungjunjunggvbvq.top/ZTZkNTJjNTkwYzk3/

rc4.plain

Extracted

Family

octo

https://vippivok.top/ZTZkNTJjNTkwYzk3/

https://bobnoopopo.org/ZTZkNTJjNTkwYzk3/

https://junggvrebvqqpo.org/ZTZkNTJjNTkwYzk3/

https://junggpervbvqqqqqqpo.com/ZTZkNTJjNTkwYzk3/

https://junggvbvqqgrouppo.com/ZTZkNTJjNTkwYzk3/

https://junggvbvqqnetokpo.com/ZTZkNTJjNTkwYzk3/

https://junggvbvq.top/ZTZkNTJjNTkwYzk3/

https://junggvbvq5656.top/ZTZkNTJjNTkwYzk3/

https://jungjunjunggvbvq.top/ZTZkNTJjNTkwYzk3/

AES_key

Signatures

Octo
Octo is a banking malware with remote access capabilities first seen in April 2022.
banker trojan infostealer rat octo
Octo family
octo

Octo payload 1 IoCs

resource	yara_rule
behavioral1/files/fstream-6.dat	family_octo

Removes its main activity from the application launcher 1 TTPs 1 IoCs

stealth trojan evasion

Suppress Application Icon

T1628.001

pid	Process
4269	com.mapmuch76

Loads dropped Dex/Jar 1 TTPs 4 IoCs

Runs executable file dropped to the device during analysis.

evasion

Download New Code at Runtime

T1407

ioc	pid	Process
/data/user/0/com.mapmuch76/app_DynamicOptDex/DcEYsxP.json	4294	/system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.mapmuch76/app_DynamicOptDex/DcEYsxP.json --output-vdex-fd=41 --oat-fd=42 --oat-location=/data/user/0/com.mapmuch76/app_DynamicOptDex/oat/x86/DcEYsxP.odex --compiler-filter=quicken --class-loader-context=&
/data/user/0/com.mapmuch76/app_DynamicOptDex/DcEYsxP.json	4269	com.mapmuch76
/data/user/0/com.mapmuch76/cache/qacfhsc	4269	com.mapmuch76
/data/user/0/com.mapmuch76/cache/qacfhsc	4269	com.mapmuch76

Makes use of the framework's Accessibility service 4 TTPs 2 IoCs

Retrieves information displayed on the phone screen using AccessibilityService.

collection defense_evasion credential_access

Input Injection

T1516

Screen Capture

T1513

Keylogging

T1417.001

GUI Input Capture

T1417.002

description	ioc	Process
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId	com.mapmuch76
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByViewId	com.mapmuch76

Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
banker discovery

Security Software Discovery
T1418.001
Queries the phone number (MSISDN for GSM devices) 1 TTPs
discovery

System Network Configuration Discovery
T1422

Acquires the wake lock 1 IoCs

description	ioc	Process
Framework service call	android.os.IPowerManager.acquireWakeLock	com.mapmuch76

Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs

Application may abuse the framework's foreground service to continue running in the foreground.

defense_evasion persistence

Foreground Persistence

T1541

description	ioc	Process
Framework service call	android.app.IActivityManager.setServiceForeground	com.mapmuch76

Performs UI accessibility actions on behalf of the user 1 TTPs 2 IoCs

Application may abuse the accessibility service to prevent their removal.

evasion

Prevent Application Removal

T1629.001

ioc	Process
android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction	com.mapmuch76
android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction	com.mapmuch76

Queries the mobile country code (MCC) 1 TTPs 1 IoCs

discovery

System Network Configuration Discovery

T1422

description	ioc	Process
Framework service call	com.android.internal.telephony.ITelephony.getNetworkCountryIsoForPhone	com.mapmuch76

Queries the unique device ID (IMEI, MEID, IMSI) 1 TTPs
discovery

System Network Configuration Discovery
T1422
Reads information about phone network operator. 1 TTPs
discovery

System Network Configuration Discovery
T1422

Requests accessing notifications (often used to intercept notifications before users become aware). 1 TTPs 1 IoCs

collection credential_access

Access Notifications

T1517

description	ioc	Process
Intent action	android.settings.ACTION_NOTIFICATION_LISTENER_SETTINGS	com.mapmuch76

Requests disabling of battery optimizations (often used to enable hiding in the background). 1 TTPs 1 IoCs

defense_evasion

User Evasion

T1628.002

description	ioc	Process
Intent action	android.settings.REQUEST_IGNORE_BATTERY_OPTIMIZATIONS	com.mapmuch76

Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs

persistence

Broadcast Receivers

T1624.001

description	ioc	Process
Framework service call	android.app.IActivityManager.registerReceiver	com.mapmuch76

Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs

impact

Data Encrypted for Impact

T1471

description	ioc	Process
Framework API call	javax.crypto.Cipher.doFinal	com.mapmuch76

Checks CPU information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/cpuinfo	com.mapmuch76

Checks memory information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/meminfo	com.mapmuch76

com.mapmuch76
1⤵
- Removes its main activity from the application launcher
- Loads dropped Dex/Jar
- Makes use of the framework's Accessibility service
- Acquires the wake lock
- Makes use of the framework's foreground persistence service
- Performs UI accessibility actions on behalf of the user
- Queries the mobile country code (MCC)
- Requests accessing notifications (often used to intercept notifications before users become aware).
- Requests disabling of battery optimizations (often used to enable hiding in the background).
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Uses Crypto APIs (Might try to encrypt user data)
- Checks CPU information
- Checks memory information
PID:4269
- /system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.mapmuch76/app_DynamicOptDex/DcEYsxP.json --output-vdex-fd=41 --oat-fd=42 --oat-location=/data/user/0/com.mapmuch76/app_DynamicOptDex/oat/x86/DcEYsxP.odex --compiler-filter=quicken --class-loader-context=&
  2⤵
  - Loads dropped Dex/Jar
  PID:4294

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Event Triggered Execution

T1624

Broadcast Receivers

T1624.001

Foreground Persistence

T1541

Privilege Escalation

Defense Evasion

Download New Code at Runtime

T1407

Foreground Persistence

T1541

Hide Artifacts

T1628

Suppress Application Icon

T1628.001

User Evasion

T1628.002

Impair Defenses

T1629

Prevent Application Removal

T1629.001

Input Injection

T1516

Virtualization/Sandbox Evasion

T1633

System Checks

T1633.001

Credential Access

Access Notifications

T1517

Input Capture

T1417

GUI Input Capture

T1417.002

Keylogging

T1417.001

Discovery

Software Discovery

T1418

Security Software Discovery

T1418.001

System Information Discovery

T1426

System Network Configuration Discovery

T1422

Lateral Movement

Collection

Access Notifications

T1517

Input Capture

T1417

GUI Input Capture

T1417.002

Keylogging

T1417.001

Screen Capture

T1513

Command and Control

Exfiltration

Impact

Data Encrypted for Impact

T1471

Input Injection

T1516

Replay Monitor

Loading Replay Monitor...

Downloads

/data/data/com.mapmuch76/app_DynamicOptDex/DcEYsxP.json

Filesize
1KB

MD5
39dd028f76fbefa638df1225e126ae56

SHA1
f9efd16f9cdd4c091ceacd5276986022200a460c

SHA256
91a70b23a3ab3565d1a9c3bb5400997599026ef041cbf5aa53c76e8dd3a4e192

SHA512
11eb57624124ec664ace55d953ec4f5edbcc6faf1436544ed9a4359cb215b2b3ea3a4b66a852c528b592e02ab043202ae577e0fede349efb48bbe7bfcd78c348

Download Submit
/data/data/com.mapmuch76/app_DynamicOptDex/DcEYsxP.json

Filesize
1KB

MD5
dd6381e034e6e08c971a6996809eb9e5

SHA1
0a9a5371f7c58a6ced77f49dd38ab75e7b6e77d8

SHA256
52f03a8ac765b75ac4018c522320b03eaef2fd32e8886e53b2c66bad97d35f78

SHA512
9d1887cf43beb856415d8aa72bbab268d0784e1e4b03c37b02364cd9714ddf4a2bf7d2dbc16b57d7819ceaab5cad4c4f2250e79c9a48bb4e8c84ab332261268d

Download Submit
/data/data/com.mapmuch76/cache/oat/qacfhsc.cur.prof

Filesize
489B

MD5
6f4e69e0682557fd0c67bb5e5ee1c585

SHA1
834bc18d0bc1c50d99dc45e119637c56857b4f32

SHA256
b226770fe697b178b4bd512286c01d8aab86d0c4afb445894b6b8e6bfa10f013

SHA512
0da840fd3bf0916ea6fcb9b7a7a4d18d36b3e767ae362f89ca0eeb0a292f5fd8e2d145b8784e755ac089781cb8c87e09efda8d03cb51273f576829b71206dfcc

Download Submit
/data/data/com.mapmuch76/cache/qacfhsc

Filesize
448KB

MD5
a3d17f1d324a54370dad9352708995ff

SHA1
eaf4a34fcea9333d16413732de74025e8fd7c1e6

SHA256
9e4b5bcf300e2c2433fdde427a8a12e32cc17d7f640575e89754c5a24f1d3d4c

SHA512
aefb4e592c5193ff38c5dea05ea062588152c7686360f9a06dab198a50062416828076b60e91b7361a8260debb5b0c69333eb1585c0df3353909ab3b485c2607

Download Submit
/data/data/com.mapmuch76/kl.txt

Filesize
28B

MD5
6311c3fd15588bb5c126e6c28ff5fffe

SHA1
ce81d136fce31779f4dd62e20bdaf99c91e2fc57

SHA256
8b82f6032e29a2b5c96031a3630fb6173d12ff0295bc20bb21b877d08f0812d8

SHA512
2975fe2e94b6a8adc9cfc1a865ad113772b54572883a537b02a16dd2d029c0f7d9cca3b154fd849bdfe978e18b396bcf9fa6e67e7c61f92bdc089a29a9c355c6

Download Submit
/data/data/com.mapmuch76/kl.txt

Filesize
237B

MD5
b146ef7048cf87df3f8dd4492b8f43c0

SHA1
1dd78ca8311ab5275b1f7d9b12e2f5393dc5b8f9

SHA256
17d621b86e9f7be88795aa53c9be29d3ad1de6fa7195fded2f87ddfeed441ed3

SHA512
d4b07298f9f1217fc84bdac3f7e52650d541ac529afae0d79f9aa7d00bc37707757e209a566086c9cdf953e010e95ae4a410a44f8d265482589b70ff8768a852

Download Submit
/data/data/com.mapmuch76/kl.txt

Filesize
63B

MD5
28bd3bc8942b6e253ccaaced9305e6b1

SHA1
28cebdfc08703cd618fd6dc3cb4afd41c1ac289b

SHA256
66f086f84bd61c2afeafd9d7776ff3a7c88f6271738aa5ec8a6e8aa785c70fad

SHA512
f144d3ca504dbac9adc87ca6e5400ac19da592299fd94b45c2cc63ce0a8670174bc05d5937f1c2dbdab0ea8ab1e1a33b6df7da2158d314193798aedc4f51e149

Download Submit
/data/data/com.mapmuch76/kl.txt

Filesize
54B

MD5
46edfe94b3b7de5ea0b8814749864edb

SHA1
f6bd1ec734f1d46b4aa61035d5314149a900fe58

SHA256
1a0c8e2ca5666fa727afd8ee372daa4ca8b13d4201636ee9bdcbc6ae2a5e2384

SHA512
f61f88afddc79d8e70c19194501984bd57ee85c4b75a7fa03ae05f9029b081ff24c235867794218634a7417756b331a742e4c589a777ab1e5a602dd7cc2554a8

Download Submit
/data/data/com.mapmuch76/kl.txt

Filesize
437B

MD5
f889c5edf5033254bc3c0af4ab5e6739

SHA1
eaadb0fd7a18d4d21806166c820a3f87c21ec8aa

SHA256
c23ccc131ccf33fd2808a5c65b4a789ad75af0c5b6ab19c3e1ba63ed6a220cac

SHA512
83c72ac7ccd223abf72feb3f9a95b48119e5d4bfb090cfa400aa6b8016701c5391c7729e22e8ab8c4b19a17602366f927facb83558bcc1f3e78ca1b37bde0948

Download Submit
/data/user/0/com.mapmuch76/app_DynamicOptDex/DcEYsxP.json

Filesize
2KB

MD5
968cf3cd14c203ebdc6558bc6df22d4c

SHA1
9d395a9b284b6152398cb4892f80ab803b745582

SHA256
eba5929502bdad6e9898ab7d01e5503cff37de9cfde1ffc5758c87404626c88c

SHA512
51d31953c05ef190be6c14bcca8ac372d938dd8676442b2efa63610bbac31e82c5e3a64027c8bcff028c7bbba3bfb2edd8987c16b94f41aae7d2ee90212bb7a8

Download Submit
/data/user/0/com.mapmuch76/app_DynamicOptDex/DcEYsxP.json

Filesize
2KB

MD5
aabe1bb4ec23a6e1e2f8ef61d561eeda

SHA1
e93d85098c4340ca952a5a0f016cc667af783265

SHA256
6f18f903e99284cc0e903a7ececfacdcfe832baae86da144c1ead45fd4ff35b9

SHA512
c81d0e2583d17435e87af83c90e226e332eaaf06aaaecdd17a2dae68a6cd05d0881b0facfd36ecd8a03d79f3fde37cbe9f2dfeae25e046a99fdb17f06e2e2df0

Download Submit

Analysis

Sharing

General

Malware Config

Extracted

Extracted

Signatures

Processes

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads