octo | d6dc77858e5d37cb36b5c6b088a1fde81933b2a405555c7808aae64ef4708dfa

Analysis

max time kernel
144s
max time network
150s
platform
android-13_x64
resource
android-33-x64-arm64-20240910-en
resource tags

arch:arm64arch:x64arch:x86image:android-33-x64-arm64-20240910-enlocale:en-usos:android-13-x64system
submitted
09/04/2025, 09:33

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

d6dc77858e5d37cb36b5c6b088a1fde81933b2a405555c7808aae64ef4708dfa.apk
Size

6.5MB
MD5

fbd8d85760dab75c3b39a430e2ea8e5b
SHA1

aa4ca473c7ba07925a177b3e9839ecda59c4f0b0
SHA256

d6dc77858e5d37cb36b5c6b088a1fde81933b2a405555c7808aae64ef4708dfa
SHA512

2dbb1cee0648056e01378ba520f278131e402d1e829e050c3ab60d5cc38ef501ee08924cf8f8ce75915d268a8f2fe83b0c224c332dcbbc34535061a299bb872f
SSDEEP

98304:qjBXE/2g5iSRGexRso+VKrug53XZxLZiMv5KpgK3bTK:5+gr9R8Ui23XZxLZ1luK

Score

10^/10

octo banker collection credential_access defense_evasion discovery evasion impact infostealer persistence rat trojan

Malware Config

Extracted

Family

octo

AES_key

Signatures

Octo
Octo is a banking malware with remote access capabilities first seen in April 2022.
banker trojan infostealer rat octo
Octo family
octo

Octo payload 1 IoCs

resource	yara_rule
behavioral2/memory/4490-1.dex	family_octo

Loads dropped Dex/Jar 1 TTPs 2 IoCs

Runs executable file dropped to the device during analysis.

evasion

Download New Code at Runtime

T1407

ioc	pid	Process
/data/user/0/com.lwwizard_turbow/app_struggle/NQJd.json	4490	com.lwwizard_turbow
/data/user/0/com.lwwizard_turbow/[email protected]	4490	com.lwwizard_turbow

Makes use of the framework's Accessibility service 4 TTPs 2 IoCs

Retrieves information displayed on the phone screen using AccessibilityService.

collection defense_evasion credential_access

Input Injection

T1516

Screen Capture

T1513

Keylogging

T1417.001

GUI Input Capture

T1417.002

description	ioc	Process
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId	com.lwwizard_turbow
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByViewId	com.lwwizard_turbow

Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
banker discovery

Security Software Discovery
T1418.001
Queries the phone number (MSISDN for GSM devices) 1 TTPs
discovery

System Network Configuration Discovery
T1422

Acquires the wake lock 1 IoCs

description	ioc	Process
Framework service call	android.os.IPowerManager.acquireWakeLock	com.lwwizard_turbow

Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs

Application may abuse the framework's foreground service to continue running in the foreground.

defense_evasion persistence

Foreground Persistence

T1541

description	ioc	Process
Framework service call	android.app.IActivityManager.setServiceForeground	com.lwwizard_turbow

Queries the mobile country code (MCC) 1 TTPs 1 IoCs

discovery

System Network Configuration Discovery

T1422

description	ioc	Process
Framework service call	com.android.internal.telephony.ITelephony.getNetworkCountryIsoForPhone	com.lwwizard_turbow

Reads information about phone network operator. 1 TTPs
discovery

System Network Configuration Discovery
T1422

Requests enabling of the accessibility settings. 1 IoCs

description	ioc	Process
Intent action	android.settings.ACCESSIBILITY_SETTINGS	com.lwwizard_turbow

Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs

impact

Data Encrypted for Impact

T1471

description	ioc	Process
Framework API call	javax.crypto.Cipher.doFinal	com.lwwizard_turbow

com.lwwizard_turbow
1⤵
- Loads dropped Dex/Jar
- Makes use of the framework's Accessibility service
- Acquires the wake lock
- Makes use of the framework's foreground persistence service
- Queries the mobile country code (MCC)
- Requests enabling of the accessibility settings.
- Uses Crypto APIs (Might try to encrypt user data)
PID:4490

Network

MITRE ATT&CK Mobile v16

Initial Access

Execution

Persistence

Foreground Persistence

T1541

Privilege Escalation

Defense Evasion

Download New Code at Runtime

T1407

Foreground Persistence

T1541

Input Injection

T1516

Credential Access

Input Capture

T1417

GUI Input Capture

T1417.002

Keylogging

T1417.001

Discovery

Software Discovery

T1418

Security Software Discovery

T1418.001

System Network Configuration Discovery

T1422

Lateral Movement

Collection

Input Capture

T1417

GUI Input Capture

T1417.002

Keylogging

T1417.001

Screen Capture

T1513

Command and Control

Exfiltration

Impact

Data Encrypted for Impact

T1471

Input Injection

T1516

Replay Monitor

Loading Replay Monitor...

Downloads

/data/data/com.lwwizard_turbow/.global.com.lwwizard_turbow

Filesize
48B

MD5
046a414913add6f5bb60072c7db819b6

SHA1
451ee4f6809260aec622d772fd329c7d0297a842

SHA256
b66c1320cb063a1d391c94273572ea6edae76c8c8b0a07f8d75c88686f0df72a

SHA512
4e6355f3051ed5e811ab030abde1f5be7f5e1cf33be99cd08477e9b6c015deb1d8bd75a09fb9c7176b8511c5ad0a67abc0902a3531e97564ccb6afc57496a47c

Download Submit
/data/data/com.lwwizard_turbow/app_struggle/NQJd.json

Filesize
1015B

MD5
4c271a709b280ab3ce13f00ac5b1ef83

SHA1
0a707bd3064c19a3cebf9402f21c767118e27b0d

SHA256
975564a469063266ecd6c64724292f14405beb458e7186aa87310d42e6723966

SHA512
2a0fdc3317927e00d6908fcd2b63572771cf10bf1984203aa3f62bad33e7b4bf1ac4e3b13408815a8cde033b4095db275959f665641afd7863ff850ac307dd69

Download Submit
/data/data/com.lwwizard_turbow/app_struggle/NQJd.json

Filesize
1015B

MD5
936602d96f746f22e5a16160a10990a0

SHA1
f6e02db1afbfe6228a6e5e355b3c998592db91d9

SHA256
f4ca2ce56377584567d2d059d12b60e49b35c38aa88a76431cc13509b152acaf

SHA512
eaac4d940870f9d32ea281e4d2cc693a57011a5bcba9f718f93da28372b3dcb47937e6e4e17317acad369a00549f1e6d48b3e4ab04dc5f349f499af8b0865a61

Download Submit
/data/data/com.lwwizard_turbow/files/.l

Filesize
322KB

MD5
77dc50489b9323274732d27dc8a4e803

SHA1
0e02a3595b62489d0739d771881da8604d117c65

SHA256
c5684e792d1ebefea6aac09fed45911703fd58c899f8a08133d49dd91429a820

SHA512
0684a92f3e9c525384cfa53f531afba61e5930e1c27032a7e27e3315f72761b62e122dc34768d8162ba08f9bed53d148aa8dc034b46456bdd211f230637eba58

Download Submit
/data/data/com.lwwizard_turbow/oat/x86_64/[email protected]

Filesize
13KB

MD5
2b39c1f4a92ef800368fff203d39f688

SHA1
a913e3e051838a1d1ee6424e4a4e1818d0a66089

SHA256
2b8f3af966849f04b2658ba839d40d3ed598e633b53abd93c8c6f9c120a8e7c9

SHA512
86cd85d8ddab150a443cb69cdcca09b5e9e207f18589dfd4f0c57ce54fa1ad1b6b01ef16698863c36d8147205efa8d87fc191e10285365f95acbe3e7be573052

Download Submit
/data/user/0/com.lwwizard_turbow/[email protected]

Filesize
528KB

MD5
2b88a6ef6852956782d25ea92ae9897d

SHA1
d2e197b2cdce0cf184a0136d97cc6ae46fbd86f0

SHA256
6c43f49a8aaf2372ae3021bb60a2dce5e4b5ad81940024229fc580fbc2dd120b

SHA512
8fa3e9e2f91ca15a15e66edf8b6eb7dbc6b0fe90fa14022d087665d1cd4bce1c5d9655704cca1365d1dbdcde9b4cd61a734e56aafa403125e2275511b973ffe5

Download Submit
/data/user/0/com.lwwizard_turbow/app_struggle/NQJd.json

Filesize
1KB

MD5
a86fc19a645bd73c6a6c370f47f104d2

SHA1
bef28cc0e31fd5f57bed53b8229cb8fc38858fe7

SHA256
1f88a669f5941e34169d7668845209b0e6f87630486423a002cdb639472d22fd

SHA512
87e4328c6a734fa72da9afee00a39eeb6fc69a1226c3d0b5f05409ce36b04d85fbea283f5c7addd9826860d8a1f2cc80f14655d0a3721b46b5d7baa0d84695d4

Download Submit

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Mobile v16

Replay Monitor

Loading Replay Monitor...

Downloads