octo | 14ca669d92024e8608282b8493ab384bab2213f8d5a9d33a552eb6d79e67c42a

Analysis

max time kernel
147s
max time network
151s
platform
android-11_x64
resource
android-x64-arm64-20240910-en
resource tags

arch:armarch:arm64arch:x64arch:x86image:android-x64-arm64-20240910-enlocale:en-usos:android-11-x64system
submitted
21/03/2025, 23:45

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

14ca669d92024e8608282b8493ab384bab2213f8d5a9d33a552eb6d79e67c42a.apk
Size

5.9MB
MD5

e1941a05a5af6152d9afc6db32352ec7
SHA1

3d4a832700d2ac717ac38b0c90dc72e284e2f889
SHA256

14ca669d92024e8608282b8493ab384bab2213f8d5a9d33a552eb6d79e67c42a
SHA512

18ca0d53ff7914b208e00230fad06a918603795dcbc24b73bce6e4eb78b294e48d9d9836b2debb576ab3b5142985eed38f125a074d600eeb96bd6a5e1ef6b3d9
SSDEEP

98304:85U4yMmEE/kcDg9o1r11zaZGdhCfyaFgQ2cVxh0BmyCOtePcZkCnot/lYeBL6Ei6:85AwyAHyGQsnBr0QN8A6yO8AG0E

Score

10^/10

octo banker collection credential_access defense_evasion discovery evasion impact infostealer persistence rat trojan

Malware Config

Extracted

Family

octo

https://otorisotobuyukisyan.xyz/MzhiMTg0NTAwOTY5/

https://otorisotomakineler.xyz/MzhiMTg0NTAwOTY5/

https://otorisotoyukselishik.xyz/MzhiMTg0NTAwOTY5/

https://otorisotokontrol.xyz/MzhiMTg0NTAwOTY5/

https://otorisotomucadele.xyz/MzhiMTg0NTAwOTY5/

https://otorisotodunyasiyasi.xyz/MzhiMTg0NTAwOTY5/

https://otorisotogelecek.xyz/MzhiMTg0NTAwOTY5/

https://otorisotoveintikam.xyz/MzhiMTg0NTAwOTY5/

https://otorisotouyanisi.xyz/MzhiMTg0NTAwOTY5/

https://otorisotomakineleri.xyz/MzhiMTg0NTAwOTY5/

https://otorisototarihiyolu.xyz/MzhiMTg0NTAwOTY5/

https://otorisotoinsani.xyz/MzhiMTg0NTAwOTY5/

https://otorisotogucoyunu.xyz/MzhiMTg0NTAwOTY5/

https://otorisotopaylasim.xyz/MzhiMTg0NTAwOTY5/

https://otorisototeknoloji.xyz/MzhiMTg0NTAwOTY5/

https://otorisotomakinasanati.xyz/MzhiMTg0NTAwOTY5/

https://otorisotoplatform.xyz/MzhiMTg0NTAwOTY5/

https://otorisotomucadelesan.xyz/MzhiMTg0NTAwOTY5/

https://otorisotoarastirmasi.xyz/MzhiMTg0NTAwOTY5/

https://otorisotounutulmaz.xyz/MzhiMTg0NTAwOTY5/

rc4.plain

Extracted

Family

octo

https://otorisotobuyukisyan.xyz/MzhiMTg0NTAwOTY5/

https://otorisotomakineler.xyz/MzhiMTg0NTAwOTY5/

https://otorisotoyukselishik.xyz/MzhiMTg0NTAwOTY5/

https://otorisotokontrol.xyz/MzhiMTg0NTAwOTY5/

https://otorisotomucadele.xyz/MzhiMTg0NTAwOTY5/

https://otorisotodunyasiyasi.xyz/MzhiMTg0NTAwOTY5/

https://otorisotogelecek.xyz/MzhiMTg0NTAwOTY5/

https://otorisotoveintikam.xyz/MzhiMTg0NTAwOTY5/

https://otorisotouyanisi.xyz/MzhiMTg0NTAwOTY5/

https://otorisotomakineleri.xyz/MzhiMTg0NTAwOTY5/

https://otorisototarihiyolu.xyz/MzhiMTg0NTAwOTY5/

https://otorisotoinsani.xyz/MzhiMTg0NTAwOTY5/

https://otorisotogucoyunu.xyz/MzhiMTg0NTAwOTY5/

https://otorisotopaylasim.xyz/MzhiMTg0NTAwOTY5/

https://otorisototeknoloji.xyz/MzhiMTg0NTAwOTY5/

https://otorisotomakinasanati.xyz/MzhiMTg0NTAwOTY5/

https://otorisotoplatform.xyz/MzhiMTg0NTAwOTY5/

https://otorisotomucadelesan.xyz/MzhiMTg0NTAwOTY5/

https://otorisotoarastirmasi.xyz/MzhiMTg0NTAwOTY5/

https://otorisotounutulmaz.xyz/MzhiMTg0NTAwOTY5/

AES_key

Signatures

Octo
Octo is a banking malware with remote access capabilities first seen in April 2022.
banker trojan infostealer rat octo
Octo family
octo

Octo payload 1 IoCs

resource	yara_rule
behavioral2/memory/4771-0.dex	family_octo

Loads dropped Dex/Jar 1 TTPs 1 IoCs

Runs executable file dropped to the device during analysis.

evasion

Download New Code at Runtime

T1407

ioc	pid	Process
/data/user/0/jp.neoscorp.android.valuewallet.sole/app_meadow/HmGq.json	4771	jp.neoscorp.android.valuewallet.sole

Makes use of the framework's Accessibility service 4 TTPs 2 IoCs

Retrieves information displayed on the phone screen using AccessibilityService.

collection defense_evasion credential_access

Input Injection

T1516

Screen Capture

T1513

Keylogging

T1417.001

GUI Input Capture

T1417.002

description	ioc	Process
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId	jp.neoscorp.android.valuewallet.sole
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByViewId	jp.neoscorp.android.valuewallet.sole

Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
banker discovery

Security Software Discovery
T1418.001
Queries the phone number (MSISDN for GSM devices) 1 TTPs
discovery

System Network Configuration Discovery
T1422

Acquires the wake lock 1 IoCs

description	ioc	Process
Framework service call	android.os.IPowerManager.acquireWakeLock	jp.neoscorp.android.valuewallet.sole

Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs

Application may abuse the framework's foreground service to continue running in the foreground.

defense_evasion persistence

Foreground Persistence

T1541

description	ioc	Process
Framework service call	android.app.IActivityManager.setServiceForeground	jp.neoscorp.android.valuewallet.sole

Performs UI accessibility actions on behalf of the user 1 TTPs 5 IoCs

Application may abuse the accessibility service to prevent their removal.

evasion

Prevent Application Removal

T1629.001

ioc	Process
android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction	jp.neoscorp.android.valuewallet.sole
android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction	jp.neoscorp.android.valuewallet.sole
android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction	jp.neoscorp.android.valuewallet.sole
android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction	jp.neoscorp.android.valuewallet.sole
android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction	jp.neoscorp.android.valuewallet.sole

Queries the mobile country code (MCC) 1 TTPs 1 IoCs

discovery

System Network Configuration Discovery

T1422

description	ioc	Process
Framework service call	com.android.internal.telephony.ITelephony.getNetworkCountryIsoForPhone	jp.neoscorp.android.valuewallet.sole

Reads information about phone network operator. 1 TTPs
discovery

System Network Configuration Discovery
T1422

Requests accessing notifications (often used to intercept notifications before users become aware). 1 TTPs 1 IoCs

collection credential_access

Access Notifications

T1517

description	ioc	Process
Intent action	android.settings.ACTION_NOTIFICATION_LISTENER_SETTINGS	jp.neoscorp.android.valuewallet.sole

Requests disabling of battery optimizations (often used to enable hiding in the background). 1 TTPs 1 IoCs

defense_evasion

User Evasion

T1628.002

description	ioc	Process
Intent action	android.settings.REQUEST_IGNORE_BATTERY_OPTIMIZATIONS	jp.neoscorp.android.valuewallet.sole

Requests modifying system settings. 1 IoCs

defense_evasion

description	ioc	Process
Intent action	android.settings.action.MANAGE_WRITE_SETTINGS	jp.neoscorp.android.valuewallet.sole

Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs

impact

Data Encrypted for Impact

T1471

description	ioc	Process
Framework API call	javax.crypto.Cipher.doFinal	jp.neoscorp.android.valuewallet.sole

jp.neoscorp.android.valuewallet.sole
1⤵
- Loads dropped Dex/Jar
- Makes use of the framework's Accessibility service
- Acquires the wake lock
- Makes use of the framework's foreground persistence service
- Performs UI accessibility actions on behalf of the user
- Queries the mobile country code (MCC)
- Requests accessing notifications (often used to intercept notifications before users become aware).
- Requests disabling of battery optimizations (often used to enable hiding in the background).
- Requests modifying system settings.
- Uses Crypto APIs (Might try to encrypt user data)
PID:4771

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Foreground Persistence

T1541

Privilege Escalation

Defense Evasion

Download New Code at Runtime

T1407

Foreground Persistence

T1541

Hide Artifacts

T1628

User Evasion

T1628.002

Impair Defenses

T1629

Prevent Application Removal

T1629.001

Input Injection

T1516

Credential Access

Access Notifications

T1517

Input Capture

T1417

GUI Input Capture

T1417.002

Keylogging

T1417.001

Discovery

Software Discovery

T1418

Security Software Discovery

T1418.001

System Network Configuration Discovery

T1422

Lateral Movement

Collection

Access Notifications

T1517

Input Capture

T1417

GUI Input Capture

T1417.002

Keylogging

T1417.001

Screen Capture

T1513

Command and Control

Exfiltration

Impact

Data Encrypted for Impact

T1471

Input Injection

T1516

Replay Monitor

Loading Replay Monitor...

Downloads

/data/user/0/jp.neoscorp.android.valuewallet.sole/app_meadow/HmGq.json

Filesize
153KB

MD5
803ccf1c7a854aa90ad9afe41e3ef049

SHA1
05f4ee8cd2dfc48e0344cea222c6784efda16631

SHA256
f059ac79bc4a9d6646a12b2a32de427b67ad2de8671925d92fd384336e98aac4

SHA512
fa6955ec52f658a1914b9a825cd53643f8eeced5b17c8ad3db969e13582947b1ec142420a707b9fa1255b02f90ad7b0f46aae1ec982b99da40398284cfca7be2

Download Submit
/data/user/0/jp.neoscorp.android.valuewallet.sole/app_meadow/HmGq.json

Filesize
153KB

MD5
63638318b9194c0a2b780f909de9228a

SHA1
633217ea7a2f6de95e177e46125e69145d2f7e34

SHA256
29755e17fa7f5c3b7e2aaad6717c7d1d4ff036feefa01663e4ea0f4a30b225e5

SHA512
8209ebadb228c5aeb51b52440847f6b9acfb865381d667d2adde3a2428ffa7630761453934b5ba61fbc39d1482e482f310e4e969981fba623a32ebb39c57a8db

Download Submit
/data/user/0/jp.neoscorp.android.valuewallet.sole/app_meadow/HmGq.json

Filesize
450KB

MD5
2b1a579650b99b4bae11ba1bf6cacc74

SHA1
517703dcb8e0a4ddc73e7e1e32dabf9f6dc4bfa9

SHA256
e7d9dff9205346302f6f2dc2b328dcd711eeb013f1c32fa364b7cfe30af071e1

SHA512
2329400627195904240b65d1069e10bbd5b71544b4fe8e4f040021d12396853f1d7b0cb6dace00874dde5753138f6c0260b45f4bf404db1204a367765b2c123e

Download Submit

Analysis

Sharing

General

Malware Config

Extracted

Extracted

Signatures

Processes

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads