octo | 70669962dd62ec1c8ed8f8f96d66d7241da269be6a215b822a82d43d17e14875

Analysis

max time kernel
149s
max time network
153s
platform
android-9_x86
resource
android-x86-arm-20240910-en
resource tags

arch:armarch:x86image:android-x86-arm-20240910-enlocale:en-usos:android-9-x86system
submitted
24/03/2025, 22:08

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

70669962dd62ec1c8ed8f8f96d66d7241da269be6a215b822a82d43d17e14875.apk
Size

1.8MB
MD5

5cf0bf5916fe257db804d47400e5f07a
SHA1

23cc43b1aeffad2185ad28f52c6e6f205a0e21b5
SHA256

70669962dd62ec1c8ed8f8f96d66d7241da269be6a215b822a82d43d17e14875
SHA512

457360401d6098498f14479ed7d89203730ca24012a21239f1d122e72458671adc79de5493b8f2a62be568813a227f66bfdb64bce886811309d400f6211201dd
SSDEEP

49152:VSTNn5tnx9f5GxYki525xyqyUWK5XuZGZbmq4CiNhAE4KoS3:VST9xGCkQhYXuZQ/4gy

Score

10^/10

octo banker collection credential_access defense_evasion discovery evasion impact infostealer persistence rat stealth trojan

Malware Config

Extracted

Family

octo

https://zaglefolki1.info/MTU2OWE0NzJjNGY5/

https://passajire555.live/MTU2OWE0NzJjNGY5/

https://majestike8ca.top/MTU2OWE0NzJjNGY5/

https://jikugac818v.vip/MTU2OWE0NzJjNGY5/

https://5a9udxg6l6gd.su/MTU2OWE0NzJjNGY5/

rc4.plain

Extracted

Family

octo

https://zaglefolki1.info/MTU2OWE0NzJjNGY5/

https://passajire555.live/MTU2OWE0NzJjNGY5/

https://majestike8ca.top/MTU2OWE0NzJjNGY5/

https://jikugac818v.vip/MTU2OWE0NzJjNGY5/

https://5a9udxg6l6gd.su/MTU2OWE0NzJjNGY5/

AES_key

Signatures

Octo
Octo is a banking malware with remote access capabilities first seen in April 2022.
banker trojan infostealer rat octo
Octo family
octo

Octo payload 1 IoCs

resource	yara_rule
behavioral1/files/fstream-6.dat	family_octo

Removes its main activity from the application launcher 1 TTPs 1 IoCs

stealth trojan evasion

Suppress Application Icon

T1628.001

pid	Process
4414	com.completebe0

Loads dropped Dex/Jar 1 TTPs 4 IoCs

Runs executable file dropped to the device during analysis.

evasion

Download New Code at Runtime

T1407

ioc	pid	Process
/data/user/0/com.completebe0/app_DynamicOptDex/ATutCXu.json	4440	/system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.completebe0/app_DynamicOptDex/ATutCXu.json --output-vdex-fd=41 --oat-fd=42 --oat-location=/data/user/0/com.completebe0/app_DynamicOptDex/oat/x86/ATutCXu.odex --compiler-filter=quicken --class-loader-context=&
/data/user/0/com.completebe0/app_DynamicOptDex/ATutCXu.json	4414	com.completebe0
/data/user/0/com.completebe0/cache/bhvbn	4414	com.completebe0
/data/user/0/com.completebe0/cache/bhvbn	4414	com.completebe0

Makes use of the framework's Accessibility service 4 TTPs 2 IoCs

Retrieves information displayed on the phone screen using AccessibilityService.

collection defense_evasion credential_access

Input Injection

T1516

Screen Capture

T1513

Keylogging

T1417.001

GUI Input Capture

T1417.002

description	ioc	Process
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId	com.completebe0
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByViewId	com.completebe0

Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
banker discovery

Security Software Discovery
T1418.001
Queries the phone number (MSISDN for GSM devices) 1 TTPs
discovery

System Network Configuration Discovery
T1422

Acquires the wake lock 1 IoCs

description	ioc	Process
Framework service call	android.os.IPowerManager.acquireWakeLock	com.completebe0

Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs

Application may abuse the framework's foreground service to continue running in the foreground.

defense_evasion persistence

Foreground Persistence

T1541

description	ioc	Process
Framework service call	android.app.IActivityManager.setServiceForeground	com.completebe0

Performs UI accessibility actions on behalf of the user 1 TTPs 2 IoCs

Application may abuse the accessibility service to prevent their removal.

evasion

Prevent Application Removal

T1629.001

ioc	Process
android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction	com.completebe0
android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction	com.completebe0

Queries the mobile country code (MCC) 1 TTPs 1 IoCs

discovery

System Network Configuration Discovery

T1422

description	ioc	Process
Framework service call	com.android.internal.telephony.ITelephony.getNetworkCountryIsoForPhone	com.completebe0

Queries the unique device ID (IMEI, MEID, IMSI) 1 TTPs
discovery

System Network Configuration Discovery
T1422
Reads information about phone network operator. 1 TTPs
discovery

System Network Configuration Discovery
T1422

Requests accessing notifications (often used to intercept notifications before users become aware). 1 TTPs 1 IoCs

collection credential_access

Access Notifications

T1517

description	ioc	Process
Intent action	android.settings.ACTION_NOTIFICATION_LISTENER_SETTINGS	com.completebe0

Requests disabling of battery optimizations (often used to enable hiding in the background). 1 TTPs 1 IoCs

defense_evasion

User Evasion

T1628.002

description	ioc	Process
Intent action	android.settings.REQUEST_IGNORE_BATTERY_OPTIMIZATIONS	com.completebe0

Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs

persistence

Broadcast Receivers

T1624.001

description	ioc	Process
Framework service call	android.app.IActivityManager.registerReceiver	com.completebe0

Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs

impact

Data Encrypted for Impact

T1471

description	ioc	Process
Framework API call	javax.crypto.Cipher.doFinal	com.completebe0

Checks CPU information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/cpuinfo	com.completebe0

Checks memory information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/meminfo	com.completebe0

com.completebe0
1⤵
- Removes its main activity from the application launcher
- Loads dropped Dex/Jar
- Makes use of the framework's Accessibility service
- Acquires the wake lock
- Makes use of the framework's foreground persistence service
- Performs UI accessibility actions on behalf of the user
- Queries the mobile country code (MCC)
- Requests accessing notifications (often used to intercept notifications before users become aware).
- Requests disabling of battery optimizations (often used to enable hiding in the background).
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Uses Crypto APIs (Might try to encrypt user data)
- Checks CPU information
- Checks memory information
PID:4414
- /system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.completebe0/app_DynamicOptDex/ATutCXu.json --output-vdex-fd=41 --oat-fd=42 --oat-location=/data/user/0/com.completebe0/app_DynamicOptDex/oat/x86/ATutCXu.odex --compiler-filter=quicken --class-loader-context=&
  2⤵
  - Loads dropped Dex/Jar
  PID:4440

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Event Triggered Execution

T1624

Broadcast Receivers

T1624.001

Foreground Persistence

T1541

Privilege Escalation

Defense Evasion

Download New Code at Runtime

T1407

Foreground Persistence

T1541

Hide Artifacts

T1628

Suppress Application Icon

T1628.001

User Evasion

T1628.002

Impair Defenses

T1629

Prevent Application Removal

T1629.001

Input Injection

T1516

Virtualization/Sandbox Evasion

T1633

System Checks

T1633.001

Credential Access

Access Notifications

T1517

Input Capture

T1417

GUI Input Capture

T1417.002

Keylogging

T1417.001

Discovery

Software Discovery

T1418

Security Software Discovery

T1418.001

System Information Discovery

T1426

System Network Configuration Discovery

T1422

Lateral Movement

Collection

Access Notifications

T1517

Input Capture

T1417

GUI Input Capture

T1417.002

Keylogging

T1417.001

Screen Capture

T1513

Command and Control

Exfiltration

Impact

Data Encrypted for Impact

T1471

Input Injection

T1516

Replay Monitor

Loading Replay Monitor...

Downloads

/data/data/com.completebe0/app_DynamicOptDex/ATutCXu.json

Filesize
2KB

MD5
282daf6d8dd89839388965b639a83580

SHA1
543c268eca52e61887d2e4ebe6605668c5f48b49

SHA256
0a17bf7125a0752e5158922b896de9db8ffff37d0d70297ec639a4431191baf2

SHA512
38caee51a4fdef59d5692f0317a999d55ddffdfdcb711de68950dfe5ea8031d016cb43c3afab71ba58aa5b1871801e5de6fc0f5257ee24bca424961968b0b6cc

Download Submit
/data/data/com.completebe0/app_DynamicOptDex/ATutCXu.json

Filesize
2KB

MD5
e7337c316b76e83e1b64f50a1fffc166

SHA1
a1c2dbbf1592dc9bee1d22d0ed64486fd1f7dd67

SHA256
c8861eb75f9e8398dd6d9451120d5653a99e5318810ca20fb212a512f7c24489

SHA512
76cc12b8053a1845d447703989517bd0beaa353832c09e187479e78539e574e1ea99a42e8ba7977383f4328b1e6d1d10135f79d79eba6e169a3c6e7dd83234c6

Download Submit
/data/data/com.completebe0/cache/bhvbn

Filesize
457KB

MD5
0f298b4d05ac13449acd725c06fa6115

SHA1
da53ed2eb6952b54799328a33fd5275e60a0fcc9

SHA256
773a283d03ea5440eebcbb72b3f98988dc66342f0a8ab6415d9a01346aa407ac

SHA512
5d12aad043cf6a5b879a8285896c9eb73ff96c4ca29de6170db77937e83edf26ebe6aae3ebbd1f8208830f7886e8ce1d64f9fa4c4eccf75f6c86e4ae99b086a5

Download Submit
/data/data/com.completebe0/cache/oat/bhvbn.cur.prof

Filesize
483B

MD5
d0d2de2debc48a5e72fa05fcb5138c50

SHA1
8f5609eaefe5c11f9064a8a90c0ecb3bbee81139

SHA256
e0963f7c9731c058bafa7fcc4a6e0983b2753cdca85b040bee47b82cbcb49ac6

SHA512
ab3f5bb759ea09870d83b0ad53ec61f9bee56bf59bd9da39df4c0a596d5b7bd6a43a20b575fa20acee28cd2a7dc0f4d9c8d2bf75f608055e9c44993f374491d7

Download Submit
/data/data/com.completebe0/kl.txt

Filesize
28B

MD5
6311c3fd15588bb5c126e6c28ff5fffe

SHA1
ce81d136fce31779f4dd62e20bdaf99c91e2fc57

SHA256
8b82f6032e29a2b5c96031a3630fb6173d12ff0295bc20bb21b877d08f0812d8

SHA512
2975fe2e94b6a8adc9cfc1a865ad113772b54572883a537b02a16dd2d029c0f7d9cca3b154fd849bdfe978e18b396bcf9fa6e67e7c61f92bdc089a29a9c355c6

Download Submit
/data/data/com.completebe0/kl.txt

Filesize
230B

MD5
4e6546d1a8c6dcd9949ec49b5713cf6f

SHA1
b9e23056fa56c0dbe8599df968d609b82f8d99be

SHA256
0caaee40109fa4a1ef888539553c137a61cebb3061385a0cdff5812d126cb5b5

SHA512
2e80adf085de8e8e53f79734f6ec54bd08db8b640008fd1ec563651098f062e2a3575e5c366ed9b46dc49e8b3c885fc751c579c05b6710bf78aff86731ca6fa5

Download Submit
/data/data/com.completebe0/kl.txt

Filesize
54B

MD5
cc4f4bab3b6e0369040cc7dae8cea82a

SHA1
477d4b2bc664e21963e7e9f53d43aa417a9c56b5

SHA256
0fc93ee6a8a913efd3233ae0678cd5f746058bdf77c050916e0f25720bc4e1ab

SHA512
5a4641f5e9b56fbe1b84c262de787485249a51c07d4a330e924e179d6361b2dff99a3dea7fd5884d2c9089697fe18c04d6a2117b59d1bad7b7cf969e705ba0b1

Download Submit
/data/data/com.completebe0/kl.txt

Filesize
63B

MD5
8ba0b088cb175222db588a1bbe762112

SHA1
ff83d8cc60fb1b7611a6443f6a12a293241590c2

SHA256
a7d5ffe46628c166d133d698926ace6728fe8842a62b34404c1b98d03c8a2753

SHA512
e26dbd028db814976c359d7164be2ebea20279e2e310da18cb244970f5e0438ae0dfd06d0e8b050c7f04631c79cae285aa7ba988e66bf88f35dc1fc0b751857d

Download Submit
/data/data/com.completebe0/kl.txt

Filesize
423B

MD5
91c2b92a5e285188199280b43995e0a1

SHA1
50a4136bfe7b12cf8ed0b83c3f802730beb03b6b

SHA256
64966f3084c51d2d2c06b71ad0cb65f6b8a6608274f17fe7ff58660c3ba00bb1

SHA512
698f273014cb53248d727368bc7fc03d44a4e3ca4804f4c569fa7710c9078385edbac9e82c1d6d023dda83447598d9712d8c1cc9ae434bedf5bb44cbcbbbc9c8

Download Submit
/data/user/0/com.completebe0/app_DynamicOptDex/ATutCXu.json

Filesize
6KB

MD5
0fb583646f5b47949f86d01282ca0435

SHA1
671034886dd68896d4f57c25a51b724aa0f324cb

SHA256
5521e7fdacd279fb031f57c6adf255cc788c86f9ee1e6709b969735d50c2dc84

SHA512
e9226ff0a2ffc2ce0df05b3b247f4f5e2798942fa894ac035d6965d393675a359c5419aa7ac14e09da56763b68787652ad1839aa64e912c377c542b556211e42

Download Submit
/data/user/0/com.completebe0/app_DynamicOptDex/ATutCXu.json

Filesize
6KB

MD5
8e4612b5633c2f3f03aad82512e10946

SHA1
1ed04da4b21489501338b57999f858d775ff0579

SHA256
863d543d469a91d30fbf78676c5f014496fa2f36f8beda1c6f04a94fa22d6b88

SHA512
f0930dded69c9328957a170df5f78f10668aefd2e7168f6e17214169202750f7e9760dc2f6e6c0dffc593e49ee132fcbecf7597871b57dc71a8ffe958f587312

Download Submit

Analysis

Sharing

General

Malware Config

Extracted

Extracted

Signatures

Processes

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads