octo | 5536911c259634d705f38a4c7e584a845f1bdaac2a8ea5e18253d19623503def

Analysis

max time kernel
148s
max time network
154s
platform
android-11_x64
resource
android-x64-arm64-20240910-en
resource tags

arch:armarch:arm64arch:x64arch:x86image:android-x64-arm64-20240910-enlocale:en-usos:android-11-x64system
submitted
22/01/2025, 22:08

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

5536911c259634d705f38a4c7e584a845f1bdaac2a8ea5e18253d19623503def.apk
Size

2.3MB
MD5

a2e9e7659dff1cbbae76c392218b63e8
SHA1

14a551cf396c3bd98a55d18966ef74ffdf221a71
SHA256

5536911c259634d705f38a4c7e584a845f1bdaac2a8ea5e18253d19623503def
SHA512

0bec421fc977c7d77d20375bb62ecc996bd55d93e3ebe8b1489cd6d6037fdc97d30051cf4aaffab4bd2702c74ed1106c1623451cdea0071688c7775ae542a3e1
SSDEEP

49152:svA+HinzUbK5e9GF+TV/46AQ0c90KPhcRZGZbmqC2Y80ZP50vmVy0ZPszAE4KoS4:s4nzQuFEi6AQzb4ZQ/C/80ZSuBfc8KMZ

Score

10^/10

octo banker collection credential_access defense_evasion discovery evasion impact infostealer persistence rat trojan

Malware Config

Extracted

Family

octo

https://vippivok.top/ZTZkNTJjNTkwYzk3/

https://bobnoopopo.org/ZTZkNTJjNTkwYzk3/

https://junggvrebvqqpo.org/ZTZkNTJjNTkwYzk3/

https://junggpervbvqqqqqqpo.com/ZTZkNTJjNTkwYzk3/

https://junggvbvqqgrouppo.com/ZTZkNTJjNTkwYzk3/

https://junggvbvqqnetokpo.com/ZTZkNTJjNTkwYzk3/

https://junggvbvq.top/ZTZkNTJjNTkwYzk3/

https://junggvbvq5656.top/ZTZkNTJjNTkwYzk3/

https://jungjunjunggvbvq.top/ZTZkNTJjNTkwYzk3/

rc4.plain

Extracted

Family

octo

https://vippivok.top/ZTZkNTJjNTkwYzk3/

https://bobnoopopo.org/ZTZkNTJjNTkwYzk3/

https://junggvrebvqqpo.org/ZTZkNTJjNTkwYzk3/

https://junggpervbvqqqqqqpo.com/ZTZkNTJjNTkwYzk3/

https://junggvbvqqgrouppo.com/ZTZkNTJjNTkwYzk3/

https://junggvbvqqnetokpo.com/ZTZkNTJjNTkwYzk3/

https://junggvbvq.top/ZTZkNTJjNTkwYzk3/

https://junggvbvq5656.top/ZTZkNTJjNTkwYzk3/

https://jungjunjunggvbvq.top/ZTZkNTJjNTkwYzk3/

AES_key

Signatures

Octo
Octo is a banking malware with remote access capabilities first seen in April 2022.
banker trojan infostealer rat octo
Octo family
octo

Octo payload 1 IoCs

resource	yara_rule
behavioral2/files/fstream-3.dat	family_octo

Loads dropped Dex/Jar 1 TTPs 3 IoCs

Runs executable file dropped to the device during analysis.

evasion

Download New Code at Runtime

T1407

ioc	pid	Process
/data/user/0/com.mapmuch76/app_DynamicOptDex/DcEYsxP.json	4580	com.mapmuch76
/data/user/0/com.mapmuch76/cache/qacfhsc	4580	com.mapmuch76
/data/user/0/com.mapmuch76/cache/qacfhsc	4580	com.mapmuch76

Makes use of the framework's Accessibility service 4 TTPs 2 IoCs

Retrieves information displayed on the phone screen using AccessibilityService.

collection defense_evasion credential_access

Input Injection

T1516

Screen Capture

T1513

Keylogging

T1417.001

GUI Input Capture

T1417.002

description	ioc	Process
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId	com.mapmuch76
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByViewId	com.mapmuch76

Obtains sensitive information copied to the device clipboard 2 TTPs 1 IoCs

Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.

collection credential_access impact

Clipboard Data

T1414

Transmitted Data Manipulation

T1641.001

description	ioc	Process
Framework service call	android.content.IClipboard.addPrimaryClipChangedListener	com.mapmuch76

Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
banker discovery

Security Software Discovery
T1418.001
Queries the phone number (MSISDN for GSM devices) 1 TTPs
discovery

System Network Configuration Discovery
T1422

Acquires the wake lock 1 IoCs

description	ioc	Process
Framework service call	android.os.IPowerManager.acquireWakeLock	com.mapmuch76

Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs

Application may abuse the framework's foreground service to continue running in the foreground.

defense_evasion persistence

Foreground Persistence

T1541

description	ioc	Process
Framework service call	android.app.IActivityManager.setServiceForeground	com.mapmuch76

Performs UI accessibility actions on behalf of the user 1 TTPs 3 IoCs

Application may abuse the accessibility service to prevent their removal.

evasion

Prevent Application Removal

T1629.001

ioc	Process
android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction	com.mapmuch76
android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction	com.mapmuch76
android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction	com.mapmuch76

Queries the mobile country code (MCC) 1 TTPs 1 IoCs

discovery

System Network Configuration Discovery

T1422

description	ioc	Process
Framework service call	com.android.internal.telephony.ITelephony.getNetworkCountryIsoForPhone	com.mapmuch76

Reads information about phone network operator. 1 TTPs
discovery

System Network Configuration Discovery
T1422

Requests accessing notifications (often used to intercept notifications before users become aware). 1 TTPs 1 IoCs

collection credential_access

Access Notifications

T1517

description	ioc	Process
Intent action	android.settings.ACTION_NOTIFICATION_LISTENER_SETTINGS	com.mapmuch76

Requests disabling of battery optimizations (often used to enable hiding in the background). 1 TTPs 1 IoCs

defense_evasion

User Evasion

T1628.002

description	ioc	Process
Intent action	android.settings.REQUEST_IGNORE_BATTERY_OPTIMIZATIONS	com.mapmuch76

Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs

impact

Data Encrypted for Impact

T1471

description	ioc	Process
Framework API call	javax.crypto.Cipher.doFinal	com.mapmuch76

Checks CPU information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/cpuinfo	com.mapmuch76

Checks memory information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/meminfo	com.mapmuch76

com.mapmuch76
1⤵
- Loads dropped Dex/Jar
- Makes use of the framework's Accessibility service
- Obtains sensitive information copied to the device clipboard
- Acquires the wake lock
- Makes use of the framework's foreground persistence service
- Performs UI accessibility actions on behalf of the user
- Queries the mobile country code (MCC)
- Requests accessing notifications (often used to intercept notifications before users become aware).
- Requests disabling of battery optimizations (often used to enable hiding in the background).
- Uses Crypto APIs (Might try to encrypt user data)
- Checks CPU information
- Checks memory information
PID:4580

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Foreground Persistence

T1541

Privilege Escalation

Defense Evasion

Download New Code at Runtime

T1407

Foreground Persistence

T1541

Hide Artifacts

T1628

User Evasion

T1628.002

Impair Defenses

T1629

Prevent Application Removal

T1629.001

Input Injection

T1516

Virtualization/Sandbox Evasion

T1633

System Checks

T1633.001

Credential Access

Access Notifications

T1517

Clipboard Data

T1414

Input Capture

T1417

GUI Input Capture

T1417.002

Keylogging

T1417.001

Discovery

Software Discovery

T1418

Security Software Discovery

T1418.001

System Information Discovery

T1426

System Network Configuration Discovery

T1422

Lateral Movement

Collection

Access Notifications

T1517

Clipboard Data

T1414

Input Capture

T1417

GUI Input Capture

T1417.002

Keylogging

T1417.001

Screen Capture

T1513

Command and Control

Exfiltration

Impact

Data Encrypted for Impact

T1471

Data Manipulation

T1641

Transmitted Data Manipulation

T1641.001

Input Injection

T1516

Replay Monitor

Loading Replay Monitor...

Downloads

/data/user/0/com.mapmuch76/app_DynamicOptDex/DcEYsxP.json

Filesize
1KB

MD5
39dd028f76fbefa638df1225e126ae56

SHA1
f9efd16f9cdd4c091ceacd5276986022200a460c

SHA256
91a70b23a3ab3565d1a9c3bb5400997599026ef041cbf5aa53c76e8dd3a4e192

SHA512
11eb57624124ec664ace55d953ec4f5edbcc6faf1436544ed9a4359cb215b2b3ea3a4b66a852c528b592e02ab043202ae577e0fede349efb48bbe7bfcd78c348

Download Submit
/data/user/0/com.mapmuch76/app_DynamicOptDex/DcEYsxP.json

Filesize
1KB

MD5
dd6381e034e6e08c971a6996809eb9e5

SHA1
0a9a5371f7c58a6ced77f49dd38ab75e7b6e77d8

SHA256
52f03a8ac765b75ac4018c522320b03eaef2fd32e8886e53b2c66bad97d35f78

SHA512
9d1887cf43beb856415d8aa72bbab268d0784e1e4b03c37b02364cd9714ddf4a2bf7d2dbc16b57d7819ceaab5cad4c4f2250e79c9a48bb4e8c84ab332261268d

Download Submit
/data/user/0/com.mapmuch76/app_DynamicOptDex/DcEYsxP.json

Filesize
2KB

MD5
aabe1bb4ec23a6e1e2f8ef61d561eeda

SHA1
e93d85098c4340ca952a5a0f016cc667af783265

SHA256
6f18f903e99284cc0e903a7ececfacdcfe832baae86da144c1ead45fd4ff35b9

SHA512
c81d0e2583d17435e87af83c90e226e332eaaf06aaaecdd17a2dae68a6cd05d0881b0facfd36ecd8a03d79f3fde37cbe9f2dfeae25e046a99fdb17f06e2e2df0

Download Submit
/data/user/0/com.mapmuch76/cache/oat/qacfhsc.cur.prof

Filesize
338B

MD5
e53a5d8fa5c547a26869dcca89ca7482

SHA1
234434422453a07f02ee6dea819330cbdd65a5c3

SHA256
7aafb7d8bdda336b6f55a4b4d9d44272c3d3ff9338fcb8bb786a791e9924c25c

SHA512
16dd7be0d9bf070e3e6afb51dd0c1ea07794a3e06b35da1b11aa51870a00f9c83539574e33fdf4da39863a8c0fc4092a950052920c7db944b55fe2dba8699853

Download Submit
/data/user/0/com.mapmuch76/cache/qacfhsc

Filesize
448KB

MD5
a3d17f1d324a54370dad9352708995ff

SHA1
eaf4a34fcea9333d16413732de74025e8fd7c1e6

SHA256
9e4b5bcf300e2c2433fdde427a8a12e32cc17d7f640575e89754c5a24f1d3d4c

SHA512
aefb4e592c5193ff38c5dea05ea062588152c7686360f9a06dab198a50062416828076b60e91b7361a8260debb5b0c69333eb1585c0df3353909ab3b485c2607

Download Submit
/data/user/0/com.mapmuch76/kl.txt

Filesize
480B

MD5
829c95629f0a75c9688a54078b6fe7a9

SHA1
4da86809c918fbcd114f9fb29f7ae9edade6d9e1

SHA256
04357104f902922c38bdb2b3e0ec539556d3cb9e9392cfc581a32377350264fa

SHA512
6d3e89e8b4068b1c9604c2f085c7e71183e4fdf8ae7e53665eebe8cf4dd1ece466a7e6fd9cf10adabf6142bdee57e90969f3033c5deb01142400ba5356cbf5b4

Download Submit
/data/user/0/com.mapmuch76/kl.txt

Filesize
28B

MD5
6311c3fd15588bb5c126e6c28ff5fffe

SHA1
ce81d136fce31779f4dd62e20bdaf99c91e2fc57

SHA256
8b82f6032e29a2b5c96031a3630fb6173d12ff0295bc20bb21b877d08f0812d8

SHA512
2975fe2e94b6a8adc9cfc1a865ad113772b54572883a537b02a16dd2d029c0f7d9cca3b154fd849bdfe978e18b396bcf9fa6e67e7c61f92bdc089a29a9c355c6

Download Submit
/data/user/0/com.mapmuch76/kl.txt

Filesize
237B

MD5
e33294501afca64a6b2b0208f5c2a745

SHA1
a2976af79d86f0f03e643302c92375feabb8b1af

SHA256
604dee7b10ee731842862339044e06cf6daeab1be6bab2dcdef77b89abe929de

SHA512
5f3d3d273cd052b88cf69b61085606e4035241b6f1d1ee63e70993f18c994cb870fea1fd4e2471b66b2d7625cfc528cc372aae6fd9d9338b8187f2ee973c42ba

Download Submit
/data/user/0/com.mapmuch76/kl.txt

Filesize
63B

MD5
61f7f2e0754335b97d2044eea882d10a

SHA1
21dd7322984e823d3cb7c0dd503b044ef9f6ed8c

SHA256
d0115f4a0f1761c9a5b697fe0bec89e6f9fbb4d64ddb12d83e1aac2e8665a17e

SHA512
16bd10cf075718493dc4a7c6c853ff97eed0fa8624b77d189e1ae68c81c4b31ca949ed2e8da10e38d0646a7de09f410d0e2bc5d02f3537b55af4dde6a7594c34

Download Submit
/data/user/0/com.mapmuch76/kl.txt

Filesize
45B

MD5
418614ab4ee242f820c95ecf0377a3f4

SHA1
66e65d5fa6d2afa30f39ab60a9c396abb102ef22

SHA256
20a1dac17e4e9cf1d55f8b61d6dbe6cce3184f7bbdc06c5eaac1f1b8184bfe8a

SHA512
f1b0ebdda33603c90676bdf536d742cbe42389829194a62e1bfd1bcffde1557fe5058871449300951fbd6e3d2ebcf2e5a1cfcb3d0bd06e286bd3eea98673034a

Download Submit

Analysis

Sharing

General

Malware Config

Extracted

Extracted

Signatures

Processes

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads