octo | 1aae1e81737161f4db26824a61d8570b775dc882b4d30ecf428452810b63853f

Analysis

max time kernel
29s
max time network
25s
platform
android-9_x86
resource
android-x86-arm-20240910-en
resource tags

arch:armarch:x86image:android-x86-arm-20240910-enlocale:en-usos:android-9-x86system
submitted
21/03/2025, 17:17

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

base.apk
Size

1.6MB
MD5

871ad2475ababea9dc67fa3396662753
SHA1

65702d5bc3e5f6e342a46102f780f7f12eb023e7
SHA256

2ab2c7af22028d3e7bd62de16d787f1b6718d1cf49955cba0844d9280b15ae2d
SHA512

5c2880e153077751db5156cdb8088c2e236aacd1a7ae19b43cfd2983581d76af8edc87c1878f52de6ed48d6681c97b6561947917732d021ff6d0cb36fd9deb38
SSDEEP

24576:U4LQL0ewuycOF0fMTYFxxnJg7viCZFPrQbbpEPLVnbhKYSlX/p4dQMqSoxtRQAxh:RRhYF5g7viShrMSjRhKYRdQMqSoHXz

Score

10^/10

octo banker collection credential_access defense_evasion discovery evasion impact infostealer persistence rat stealth trojan

Malware Config

Extracted

Family

octo

https://emonifados.quest/YWFiM2VkMmFmNWFh/

https://emonifados000.net/YWFiM2VkMmFmNWFh/

rc4.plain

Extracted

Family

octo

https://emonifados.quest/YWFiM2VkMmFmNWFh/

https://emonifados000.net/YWFiM2VkMmFmNWFh/

AES_key

Signatures

Octo
Octo is a banking malware with remote access capabilities first seen in April 2022.
banker trojan infostealer rat octo
Octo family
octo

Octo payload 1 IoCs

resource	yara_rule
behavioral4/files/fstream-6.dat	family_octo

Removes its main activity from the application launcher 1 TTPs 1 IoCs

stealth trojan evasion

Suppress Application Icon

T1628.001

pid	Process
4315	com.morewouldyk

Loads dropped Dex/Jar 1 TTPs 4 IoCs

Runs executable file dropped to the device during analysis.

evasion

Download New Code at Runtime

T1407

ioc	pid	Process
/data/user/0/com.morewouldyk/app_DynamicOptDex/iKxZiyk.json	4340	/system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.morewouldyk/app_DynamicOptDex/iKxZiyk.json --output-vdex-fd=41 --oat-fd=42 --oat-location=/data/user/0/com.morewouldyk/app_DynamicOptDex/oat/x86/iKxZiyk.odex --compiler-filter=quicken --class-loader-context=&
/data/user/0/com.morewouldyk/app_DynamicOptDex/iKxZiyk.json	4315	com.morewouldyk
/data/user/0/com.morewouldyk/cache/esimuzfui	4315	com.morewouldyk
/data/user/0/com.morewouldyk/cache/esimuzfui	4315	com.morewouldyk

Makes use of the framework's Accessibility service 4 TTPs 2 IoCs

Retrieves information displayed on the phone screen using AccessibilityService.

collection defense_evasion credential_access

Input Injection

T1516

Screen Capture

T1513

Keylogging

T1417.001

GUI Input Capture

T1417.002

description	ioc	Process
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByViewId	com.morewouldyk
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId	com.morewouldyk

Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
banker discovery

Security Software Discovery
T1418.001
Queries the phone number (MSISDN for GSM devices) 1 TTPs
discovery

System Network Configuration Discovery
T1422

Acquires the wake lock 1 IoCs

description	ioc	Process
Framework service call	android.os.IPowerManager.acquireWakeLock	com.morewouldyk

Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs

Application may abuse the framework's foreground service to continue running in the foreground.

defense_evasion persistence

Foreground Persistence

T1541

description	ioc	Process
Framework service call	android.app.IActivityManager.setServiceForeground	com.morewouldyk

Performs UI accessibility actions on behalf of the user 1 TTPs 2 IoCs

Application may abuse the accessibility service to prevent their removal.

evasion

Prevent Application Removal

T1629.001

ioc	Process
android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction	com.morewouldyk
android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction	com.morewouldyk

Queries the mobile country code (MCC) 1 TTPs 1 IoCs

discovery

System Network Configuration Discovery

T1422

description	ioc	Process
Framework service call	com.android.internal.telephony.ITelephony.getNetworkCountryIsoForPhone	com.morewouldyk

Queries the unique device ID (IMEI, MEID, IMSI) 1 TTPs
discovery

System Network Configuration Discovery
T1422

Requests accessing notifications (often used to intercept notifications before users become aware). 1 TTPs 1 IoCs

collection credential_access

Access Notifications

T1517

description	ioc	Process
Intent action	android.settings.ACTION_NOTIFICATION_LISTENER_SETTINGS	com.morewouldyk

Requests disabling of battery optimizations (often used to enable hiding in the background). 1 TTPs 1 IoCs

defense_evasion

User Evasion

T1628.002

description	ioc	Process
Intent action	android.settings.REQUEST_IGNORE_BATTERY_OPTIMIZATIONS	com.morewouldyk

Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs

persistence

Broadcast Receivers

T1624.001

description	ioc	Process
Framework service call	android.app.IActivityManager.registerReceiver	com.morewouldyk

Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs

impact

Data Encrypted for Impact

T1471

description	ioc	Process
Framework API call	javax.crypto.Cipher.doFinal	com.morewouldyk

Checks CPU information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/cpuinfo	com.morewouldyk

Checks memory information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/meminfo	com.morewouldyk

com.morewouldyk
1⤵
- Removes its main activity from the application launcher
- Loads dropped Dex/Jar
- Makes use of the framework's Accessibility service
- Acquires the wake lock
- Makes use of the framework's foreground persistence service
- Performs UI accessibility actions on behalf of the user
- Queries the mobile country code (MCC)
- Requests accessing notifications (often used to intercept notifications before users become aware).
- Requests disabling of battery optimizations (often used to enable hiding in the background).
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Uses Crypto APIs (Might try to encrypt user data)
- Checks CPU information
- Checks memory information
PID:4315
- /system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.morewouldyk/app_DynamicOptDex/iKxZiyk.json --output-vdex-fd=41 --oat-fd=42 --oat-location=/data/user/0/com.morewouldyk/app_DynamicOptDex/oat/x86/iKxZiyk.odex --compiler-filter=quicken --class-loader-context=&
  2⤵
  - Loads dropped Dex/Jar
  PID:4340

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Event Triggered Execution

T1624

Broadcast Receivers

T1624.001

Foreground Persistence

T1541

Privilege Escalation

Defense Evasion

Download New Code at Runtime

T1407

Foreground Persistence

T1541

Hide Artifacts

T1628

Suppress Application Icon

T1628.001

User Evasion

T1628.002

Impair Defenses

T1629

Prevent Application Removal

T1629.001

Input Injection

T1516

Virtualization/Sandbox Evasion

T1633

System Checks

T1633.001

Credential Access

Access Notifications

T1517

Input Capture

T1417

GUI Input Capture

T1417.002

Keylogging

T1417.001

Discovery

Software Discovery

T1418

Security Software Discovery

T1418.001

System Information Discovery

T1426

System Network Configuration Discovery

T1422

Lateral Movement

Collection

Access Notifications

T1517

Input Capture

T1417

GUI Input Capture

T1417.002

Keylogging

T1417.001

Screen Capture

T1513

Command and Control

Exfiltration

Impact

Data Encrypted for Impact

T1471

Input Injection

T1516

Replay Monitor

Loading Replay Monitor...

Downloads

/data/data/com.morewouldyk/app_DynamicOptDex/iKxZiyk.json

Filesize
1KB

MD5
8315b013bb2d1857c89581519ae372af

SHA1
3bba2882abe325bc6692d10a22e1080349aa88f4

SHA256
6171939881cac7e87612b72974fe9d8d33c4ee7d8e9a1c9719f8a92fbce91fc8

SHA512
c519ae909ef6a9b604250804e15243902b1951a28564568435670089a02361746682b6aaf69f42b13571a84ec155b771fa2601c9b153e925c1e73075360978e6

Download Submit
/data/data/com.morewouldyk/app_DynamicOptDex/iKxZiyk.json

Filesize
1KB

MD5
8eca4b52bc7e3f5c7a737ec7fffd29cb

SHA1
98513cae27b04562101cbdfd7479cdab5630e3e7

SHA256
6b15970cae8db20c37647df6e93fd62384701676b31bb5e55d5078b6a50c525f

SHA512
02fc8ed55dab3a28cb7bc34b1812f30c165d37cde1f775cdd45fbaa481778520225702c6f603954a8f73a8ff13caf4a32fc5b7de8557405d0b99f37157bef8a2

Download Submit
/data/data/com.morewouldyk/cache/esimuzfui

Filesize
448KB

MD5
f7e557fe086242872e8fc5915dce08d5

SHA1
7b72bcb8eadc2f90373c3e8b411e993a9b68fa9c

SHA256
6ea1092caff8c9893d7bd54527bc4416bb9177ac85ae7f9acd3cc5c20b54ec5c

SHA512
8ad1cad799d43dac083d4fce2b5644782c3113f2a1dd616a1d38c2097f1bf4946c2cfbc5e11dc2084df0bb2b0a4bd4c6e1079edfdffb1648bb17df7940fa2de0

Download Submit
/data/data/com.morewouldyk/kl.txt

Filesize
28B

MD5
6311c3fd15588bb5c126e6c28ff5fffe

SHA1
ce81d136fce31779f4dd62e20bdaf99c91e2fc57

SHA256
8b82f6032e29a2b5c96031a3630fb6173d12ff0295bc20bb21b877d08f0812d8

SHA512
2975fe2e94b6a8adc9cfc1a865ad113772b54572883a537b02a16dd2d029c0f7d9cca3b154fd849bdfe978e18b396bcf9fa6e67e7c61f92bdc089a29a9c355c6

Download Submit
/data/data/com.morewouldyk/kl.txt

Filesize
237B

MD5
4589fa97360bb4200f1ec0bf5ea5ea79

SHA1
8f08ef1ba2ce924ae8c9eee29448413d44d32067

SHA256
18b9037a8d2a2c119f8454581f77b5728675c94d96577badd4aaa7c9a7ba1bee

SHA512
5c3093a9cd3277711bd59304bb471018051622b14a6a9dc5c0771922bd283b24eeec805dad0ba2b84bed71a2071769444751c9bdba6be5dc91ade5c6684a1153

Download Submit
/data/data/com.morewouldyk/kl.txt

Filesize
54B

MD5
7d1e770061f22d5942c2759fa48c3270

SHA1
e7fa108c5fa1b380c8aa6f9f4c3ef2027e3de8ef

SHA256
e8bf0630c124124f3217407a287566c651942eab4e32629cb72cfea1161257a1

SHA512
f99272532894dc0c2fa63ac1e72c3f809f2893c660a214980db353975c48320e8355333720287cb859f85c5bc0cdc6c2e32e4130b8d0d6faf898e8784f407df2

Download Submit
/data/data/com.morewouldyk/kl.txt

Filesize
63B

MD5
2316c78e9a4e4f0673a8a513df634862

SHA1
851ed0d5a7faa151400c517d47b12d238e249a73

SHA256
d18b72428e8a5d91f8891ace761d317d89fe11ad3d2f4cbe45de3014075431b5

SHA512
6ff7039e4213485eaab9962d6b025a1cb1b740a03a7a92ef058446fc174ccce1f41c1413ab4fce6b9265432965b03df9a661c0dd9c7479307c0d729972353574

Download Submit
/data/data/com.morewouldyk/kl.txt

Filesize
437B

MD5
23046aeeb0d079d725cf49cc87012126

SHA1
44d2e86f4d86bb0ca3bf742b49298a99851dfda2

SHA256
a1d209b05f169ac2f6e604f2734872d8d5d3997899cf88434ffc94b4db888bae

SHA512
6829cb40bf5724edd59df2e996efd743e1ddb0b6da64c064f259409914cd762364126bdefba02860a64bc47d6590b01a14440b81721ec77e6ffb054f95a7307d

Download Submit
/data/user/0/com.morewouldyk/app_DynamicOptDex/iKxZiyk.json

Filesize
2KB

MD5
487609d4fede3a87feb3429b23e4ce47

SHA1
770dc382d88d609718810640a4706355d8939382

SHA256
9565c673239b891bad2217cfa049acb33a4d603b2cf7b6dc83a1c0033b687f83

SHA512
2c3e4a3fca1ebb57403fb30b7a7f9c6e3a7020e6fbc7bdcf16c661f4adf621429334449c4ccd3ba11ea87d208719344d5a274d792d090efd525ab5e5442a7b76

Download Submit
/data/user/0/com.morewouldyk/app_DynamicOptDex/iKxZiyk.json

Filesize
2KB

MD5
a4a876d786f88020b099d40a084ff860

SHA1
d6ce42b1d4666ecee698ed2e2e2cfd748f4a76e2

SHA256
e711d7900e1d40d1f0d8a454f62788f43d21a294645cf6081ac94dad653ed8b6

SHA512
079dc738c276d11640923e4c5d5ea78483d7b8339e740d0510da7a8266bb6457589e64bc0d90d13f9a869a80c0672dcc054c6a352e7ea930a27480311dd1e81f

Download Submit

Analysis

Sharing

General

Malware Config

Extracted

Extracted

Signatures

Processes

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads