octo | 40c5293dbb149bacff7f896976b6dee553fbd44edcc492b6ef11d3990a3c4012

Analysis

max time kernel
896s
max time network
901s
platform
android-13_x64
resource
android-33-x64-arm64-20240910-en
resource tags

arch:arm64arch:x64arch:x86image:android-33-x64-arm64-20240910-enlocale:en-usos:android-13-x64system
submitted
14/04/2025, 22:49

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

b04d82b4b9438101_0.apk
Size

990KB
MD5

7ed29fcfe969eaca3f4a6263011c62f5
SHA1

c98bdc237963b0b790ef9b55adbaa75617e33f5d
SHA256

40c5293dbb149bacff7f896976b6dee553fbd44edcc492b6ef11d3990a3c4012
SHA512

29e58220a9da5092ccf2fb41701fb1b5a68f4d735393dd0f6b8190bb13ae2d06f4d8f6660d3a9871de149e20c5e35ca0ea52ffb4846a87c7d158cbe9ccc79e95
SSDEEP

12288:dMuq+CoqedaTWwXK1EUwwSIE3CA2zOH61MH25FHySfDQ/OBunD3++UjwuDrhL0di:tM325Fzfe/UjwuDw0eW

Score

10^/10

octo banker collection credential_access defense_evasion discovery evasion impact infostealer persistence rat trojan

Malware Config

Extracted

Family

octo

https://shadowhaven.xyz/MjFjNzk4ZGQ1MDYz/

https://emberisle.xyz/MjFjNzk4ZGQ1MDYz/

https://velvetstorm.xyz/MjFjNzk4ZGQ1MDYz/

https://celestialglow.xyz/MjFjNzk4ZGQ1MDYz/

https://serenebreeze.xyz/MjFjNzk4ZGQ1MDYz/

https://gildedridge.xyz/MjFjNzk4ZGQ1MDYz/

https://midnightcascade.xyz/MjFjNzk4ZGQ1MDYz/

https://auroravale.xyz/MjFjNzk4ZGQ1MDYz/

https://lunarhaven.xyz/MjFjNzk4ZGQ1MDYz/

https://solsticewave.xyz/MjFjNzk4ZGQ1MDYz/

https://eclipsemist.xyz/MjFjNzk4ZGQ1MDYz/

https://radiantbay.xyz/MjFjNzk4ZGQ1MDYz/

https://silvergrove.xyz/MjFjNzk4ZGQ1MDYz/

AES_key

Signatures

Octo
Octo is a banking malware with remote access capabilities first seen in April 2022.
banker trojan infostealer rat octo
Octo family
octo

Makes use of the framework's Accessibility service 4 TTPs 2 IoCs

Retrieves information displayed on the phone screen using AccessibilityService.

collection defense_evasion credential_access

Input Injection

T1516

Screen Capture

T1513

Keylogging

T1417.001

GUI Input Capture

T1417.002

description	ioc	Process
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId	com.sgakagak.agakagabs
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByViewId	com.sgakagak.agakagabs

Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
banker discovery

Security Software Discovery
T1418.001
Queries the phone number (MSISDN for GSM devices) 1 TTPs
discovery

System Network Configuration Discovery
T1422

Acquires the wake lock 1 IoCs

description	ioc	Process
Framework service call	android.os.IPowerManager.acquireWakeLock	com.sgakagak.agakagabs

Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs

Application may abuse the framework's foreground service to continue running in the foreground.

defense_evasion persistence

Foreground Persistence

T1541

description	ioc	Process
Framework service call	android.app.IActivityManager.setServiceForeground	com.sgakagak.agakagabs

Performs UI accessibility actions on behalf of the user 1 TTPs 5 IoCs

Application may abuse the accessibility service to prevent their removal.

evasion

Prevent Application Removal

T1629.001

ioc	Process
android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction	com.sgakagak.agakagabs
android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction	com.sgakagak.agakagabs
android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction	com.sgakagak.agakagabs
android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction	com.sgakagak.agakagabs
android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction	com.sgakagak.agakagabs

Queries the mobile country code (MCC) 1 TTPs 1 IoCs

discovery

System Network Configuration Discovery

T1422

description	ioc	Process
Framework service call	com.android.internal.telephony.ITelephony.getNetworkCountryIsoForPhone	com.sgakagak.agakagabs

Reads information about phone network operator. 1 TTPs
discovery

System Network Configuration Discovery
T1422

Requests accessing notifications (often used to intercept notifications before users become aware). 1 TTPs 1 IoCs

collection credential_access

Access Notifications

T1517

description	ioc	Process
Intent action	android.settings.ACTION_NOTIFICATION_LISTENER_SETTINGS	com.sgakagak.agakagabs

Requests disabling of battery optimizations (often used to enable hiding in the background). 1 TTPs 1 IoCs

defense_evasion

User Evasion

T1628.002

description	ioc	Process
Intent action	android.settings.REQUEST_IGNORE_BATTERY_OPTIMIZATIONS	com.sgakagak.agakagabs

Requests modifying system settings. 1 IoCs

defense_evasion

description	ioc	Process
Intent action	android.settings.action.MANAGE_WRITE_SETTINGS	com.sgakagak.agakagabs

Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs

impact

Data Encrypted for Impact

T1471

description	ioc	Process
Framework API call	javax.crypto.Cipher.doFinal	com.sgakagak.agakagabs

com.sgakagak.agakagabs
1⤵
- Makes use of the framework's Accessibility service
- Acquires the wake lock
- Makes use of the framework's foreground persistence service
- Performs UI accessibility actions on behalf of the user
- Queries the mobile country code (MCC)
- Requests accessing notifications (often used to intercept notifications before users become aware).
- Requests disabling of battery optimizations (often used to enable hiding in the background).
- Requests modifying system settings.
- Uses Crypto APIs (Might try to encrypt user data)
PID:4528