octo | e46ad693c8b7d1e91b49fe185b82385e509a656832969914db649525ff28aa1c

Analysis

max time kernel
22s
max time network
30s
platform
android-13_x64
resource
android-33-x64-arm64-20240910-en
resource tags

arch:arm64arch:x64arch:x86image:android-33-x64-arm64-20240910-enlocale:en-usos:android-13-x64system
submitted
14/04/2025, 21:07

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

e46ad693c8b7d1e91b49fe185b82385e509a656832969914db649525ff28aa1c.apk
Size

6.7MB
MD5

026ee90b2144a9b52b3b46385e1a9d22
SHA1

2f6b748bc64a09021a13410a667f0340be1fb556
SHA256

e46ad693c8b7d1e91b49fe185b82385e509a656832969914db649525ff28aa1c
SHA512

15e834320486e0214b8c179e4965e14c3ca12cd6562c8e4d15342d3956e48802f82fddbf70c569942ef3fcd702cc0a44c1f4ed0b49f89f9fe65b89466d1841a1
SSDEEP

98304:De5iSRGyMVKvOYEi8dhj7URshpRxUc1xVyza:KrcUWYEi87j7URc3t8a

Score

10^/10

octo banker collection credential_access defense_evasion discovery evasion impact infostealer persistence rat trojan

Malware Config

Extracted

Family

octo

AES_key

Signatures

Octo
Octo is a banking malware with remote access capabilities first seen in April 2022.
banker trojan infostealer rat octo
Octo family
octo

Octo payload 1 IoCs

resource	yara_rule
behavioral1/memory/4491-1.dex	family_octo

Loads dropped Dex/Jar 1 TTPs 2 IoCs

Runs executable file dropped to the device during analysis.

evasion

Download New Code at Runtime

T1407

ioc	pid	Process
/data/user/0/com.robotovebgm_people7/app_fantasy/GydL.json	4491	com.robotovebgm_people7
/data/user/0/com.robotovebgm_people7/[email protected]	4491	com.robotovebgm_people7

Makes use of the framework's Accessibility service 4 TTPs 2 IoCs

Retrieves information displayed on the phone screen using AccessibilityService.

collection defense_evasion credential_access

Input Injection

T1516

Screen Capture

T1513

Keylogging

T1417.001

GUI Input Capture

T1417.002

description	ioc	Process
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId	com.robotovebgm_people7
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByViewId	com.robotovebgm_people7

Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
banker discovery

Security Software Discovery
T1418.001
Queries the phone number (MSISDN for GSM devices) 1 TTPs
discovery

System Network Configuration Discovery
T1422

Acquires the wake lock 1 IoCs

description	ioc	Process
Framework service call	android.os.IPowerManager.acquireWakeLock	com.robotovebgm_people7

Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs

Application may abuse the framework's foreground service to continue running in the foreground.

defense_evasion persistence

Foreground Persistence

T1541

description	ioc	Process
Framework service call	android.app.IActivityManager.setServiceForeground	com.robotovebgm_people7

Queries the mobile country code (MCC) 1 TTPs 1 IoCs

discovery

System Network Configuration Discovery

T1422

description	ioc	Process
Framework service call	com.android.internal.telephony.ITelephony.getNetworkCountryIsoForPhone	com.robotovebgm_people7

Reads information about phone network operator. 1 TTPs
discovery

System Network Configuration Discovery
T1422

Requests enabling of the accessibility settings. 1 IoCs

description	ioc	Process
Intent action	android.settings.ACCESSIBILITY_SETTINGS	com.robotovebgm_people7

Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs

impact

Data Encrypted for Impact

T1471

description	ioc	Process
Framework API call	javax.crypto.Cipher.doFinal	com.robotovebgm_people7

com.robotovebgm_people7
1⤵
- Loads dropped Dex/Jar
- Makes use of the framework's Accessibility service
- Acquires the wake lock
- Makes use of the framework's foreground persistence service
- Queries the mobile country code (MCC)
- Requests enabling of the accessibility settings.
- Uses Crypto APIs (Might try to encrypt user data)
PID:4491

Network

MITRE ATT&CK Mobile v16

Initial Access

Execution

Persistence

Foreground Persistence

T1541

Privilege Escalation

Defense Evasion

Download New Code at Runtime

T1407

Foreground Persistence

T1541

Input Injection

T1516

Credential Access

Input Capture

T1417

GUI Input Capture

T1417.002

Keylogging

T1417.001

Discovery

Software Discovery

T1418

Security Software Discovery

T1418.001

System Network Configuration Discovery

T1422

Lateral Movement

Collection

Input Capture

T1417

GUI Input Capture

T1417.002

Keylogging

T1417.001

Screen Capture

T1513

Command and Control

Exfiltration

Impact

Data Encrypted for Impact

T1471

Input Injection

T1516

Replay Monitor

Loading Replay Monitor...

Downloads

/data/data/com.robotovebgm_people7/.global.com.robotovebgm_people7

Filesize
48B

MD5
046a414913add6f5bb60072c7db819b6

SHA1
451ee4f6809260aec622d772fd329c7d0297a842

SHA256
b66c1320cb063a1d391c94273572ea6edae76c8c8b0a07f8d75c88686f0df72a

SHA512
4e6355f3051ed5e811ab030abde1f5be7f5e1cf33be99cd08477e9b6c015deb1d8bd75a09fb9c7176b8511c5ad0a67abc0902a3531e97564ccb6afc57496a47c

Download Submit
/data/data/com.robotovebgm_people7/app_fantasy/GydL.json

Filesize
1017B

MD5
f2462b7e05fa192c5dfd549007fd40c4

SHA1
344b63493d4a1af6bfdf0cb26932c0ab36577486

SHA256
50f518e29d61ac5c6c2bcafed8cc514fc6c1ed9ed44c1f4192e7fdb40debbed2

SHA512
2acbe36245bee1b8995b1d55204d7913d4e5b36ca7c7fea0266c76844b5f3a415681fcacf4e1a57d28bd067dc8bfcb8037ab6280ca04f006430a7c77755ede94

Download Submit
/data/data/com.robotovebgm_people7/app_fantasy/GydL.json

Filesize
1017B

MD5
06fab2f1ff93753da8e4503cbddaf2b9

SHA1
efda554936c8f474bba980d981beaae3e522d1eb

SHA256
586df08955b494a5bc77f8af57579cb6f44c1ac725f4812cea645a77001b47e7

SHA512
072e1ecfef062ea02705596c214df770fab587b37175719e4d8ca71a77662dfa550cc7888fa733edae3866526a9909f51d5cc8dc497598f51fdd149ea3ae5d39

Download Submit
/data/data/com.robotovebgm_people7/files/.i

Filesize
322KB

MD5
77dc50489b9323274732d27dc8a4e803

SHA1
0e02a3595b62489d0739d771881da8604d117c65

SHA256
c5684e792d1ebefea6aac09fed45911703fd58c899f8a08133d49dd91429a820

SHA512
0684a92f3e9c525384cfa53f531afba61e5930e1c27032a7e27e3315f72761b62e122dc34768d8162ba08f9bed53d148aa8dc034b46456bdd211f230637eba58

Download Submit
/data/data/com.robotovebgm_people7/oat/x86_64/[email protected]

Filesize
13KB

MD5
01b61222366767ca3338c913d1f99cf5

SHA1
bfc555c0ca623bef974f91d79f3b191580977444

SHA256
4394113f60af87012aee519ccd207487cedda40e38fe737ecae268f08dac90d8

SHA512
97417bc8a307ac199e1f25db30d87d30b2c5879b452d2c42bcf37fb7d65e128d1a080536740cc68a3ec8b0228bd59751ad6255a22b68602ec8eb2c23f67a60fa

Download Submit
/data/user/0/com.robotovebgm_people7/[email protected]

Filesize
528KB

MD5
369cc7abde8ae2b4d4d2f773baa958af

SHA1
fb68383018c863963d79d76df04263e699d68be7

SHA256
735ce7c7561a690889c3b064a4040bdbaa15831948112fc8089aa640625f6161

SHA512
25de5d4a61c2187bd9eac5b0c89bcf46d39c2ca9f873fa0e5cfb507b18e7c09fefc04a105eda30d3ca36d4cb8f0d10617d200253a6251e281296bd5a59697cce

Download Submit
/data/user/0/com.robotovebgm_people7/app_fantasy/GydL.json

Filesize
1KB

MD5
223fdf2261e78e58980643d4a101ca33

SHA1
c98967342f197223d22903702c6baf33ea088bc0

SHA256
03b697dc752f90514b99d447b91c8a14069163c21daf292cc069c38a36178dbe

SHA512
90ec5ab5e909b779ac12bf30764aebf7628cedb8fa83c5dcbd242e731499ae01ed355827e6575498afd236cdabe37cb4d198f4a8d2c5d61dd4293b15130ca46c

Download Submit

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Mobile v16

Replay Monitor

Loading Replay Monitor...

Downloads