octo | fd1b4b38899ce7f0c377df7e37a4d15c8e6d6f17c35873804bf93390bbc2c131

Analysis

max time kernel
145s
max time network
146s
platform
android_x64
resource
android-x64-20240624-en
resource tags

androidarch:x64arch:x86image:android-x64-20240624-enlocale:en-usos:android-10-x64system
submitted
25-01-2025 07:36

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Chrome.apk
Size

341KB
MD5

f48258156865b253724ee9da2ab7a6fe
SHA1

1ca685977957f4d458743b932f51cc708f500d90
SHA256

fd1b4b38899ce7f0c377df7e37a4d15c8e6d6f17c35873804bf93390bbc2c131
SHA512

970c800eda8c4e53855ce55211e4a28baf77cdf4504227d21d43896e0988a90a2b8967e9d2521aa253e5747efbc8daf8e262fbbbd78f1978261a84a02cd7ef76
SSDEEP

6144:wWwmF53L8XYh/YK1+T4aP2UwzzsWoilnY6Rg0XaXNUnrUB/EuGn:+m/3IX/9Tstz4xilDg0qXNaUBn4

Score

10^/10

octo banker collection credential_access defense_evasion discovery evasion impact infostealer persistence rat trojan

Malware Config

Extracted

Family

octo

https://ravovifroz.xyz/Yjk5MjI3MDljYThi/

https://xervilbraz.xyz/Yjk5MjI3MDljYThi/

https://zoxapirvet.xyz/Yjk5MjI3MDljYThi/

https://draxonovse.xyz/Yjk5MjI3MDljYThi/

https://quvralexa.xyz/Yjk5MjI3MDljYThi/

https://vorklixur.xyz/Yjk5MjI3MDljYThi/

https://felmarixu.xyz/Yjk5MjI3MDljYThi/

https://zopalikza.xyz/Yjk5MjI3MDljYThi/

https://qurovikra.xyz/Yjk5MjI3MDljYThi/

https://veltrixor.xyz/Yjk5MjI3MDljYThi/

https://jovynexa.xyz/Yjk5MjI3MDljYThi/

https://kraxilzen.xyz/Yjk5MjI3MDljYThi/

https://lorvexas.xyz/Yjk5MjI3MDljYThi/

https://zaromixu.xyz/Yjk5MjI3MDljYThi/

AES_key

Signatures

Octo
Octo is a banking malware with remote access capabilities first seen in April 2022.
banker trojan infostealer rat octo
Octo family
octo

Makes use of the framework's Accessibility service 4 TTPs 2 IoCs

Retrieves information displayed on the phone screen using AccessibilityService.

collection defense_evasion credential_access

Input Injection

T1516

Screen Capture

T1513

Keylogging

T1417.001

GUI Input Capture

T1417.002

description	ioc	Process
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId	com.nameown12
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByViewId	com.nameown12

Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
banker discovery

Security Software Discovery
T1418.001
Queries the phone number (MSISDN for GSM devices) 1 TTPs
discovery

System Network Configuration Discovery
T1422

Acquires the wake lock 1 IoCs

description	ioc	Process
Framework service call	android.os.IPowerManager.acquireWakeLock	com.nameown12

Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs

Application may abuse the framework's foreground service to continue running in the foreground.

defense_evasion persistence

Foreground Persistence

T1541

description	ioc	Process
Framework service call	android.app.IActivityManager.setServiceForeground	com.nameown12

Performs UI accessibility actions on behalf of the user 1 TTPs 4 IoCs

Application may abuse the accessibility service to prevent their removal.

evasion

Prevent Application Removal

T1629.001

ioc	Process
android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction	com.nameown12
android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction	com.nameown12
android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction	com.nameown12
android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction	com.nameown12

Queries the mobile country code (MCC) 1 TTPs 1 IoCs

discovery

System Network Configuration Discovery

T1422

description	ioc	Process
Framework service call	com.android.internal.telephony.ITelephony.getNetworkCountryIsoForPhone	com.nameown12

Reads information about phone network operator. 1 TTPs
discovery

System Network Configuration Discovery
T1422

Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs

persistence

Broadcast Receivers

T1624.001

description	ioc	Process
Framework service call	android.app.IActivityManager.registerReceiver	com.nameown12

Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs

impact

Data Encrypted for Impact

T1471

description	ioc	Process
Framework API call	javax.crypto.Cipher.doFinal	com.nameown12

com.nameown12
1⤵
- Makes use of the framework's Accessibility service
- Acquires the wake lock
- Makes use of the framework's foreground persistence service
- Performs UI accessibility actions on behalf of the user
- Queries the mobile country code (MCC)
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Uses Crypto APIs (Might try to encrypt user data)
PID:4961