octo | 117aa133d19ea84a4de87128f16384ae0477f3ee9dd3e43037e102d7039c79d9

Analysis

max time kernel
149s
max time network
152s
platform
android-13_x64
resource
android-33-x64-arm64-20240910-en
resource tags

arch:arm64arch:x64arch:x86image:android-33-x64-arm64-20240910-enlocale:en-usos:android-13-x64system
submitted
08-10-2024 06:04

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

117aa133d19ea84a4de87128f16384ae0477f3ee9dd3e43037e102d7039c79d9.apk
Size

8.5MB
MD5

11cb1b221952268fcd6000e563752d79
SHA1

d4a85997999a975848b60fd52597538baf652daf
SHA256

117aa133d19ea84a4de87128f16384ae0477f3ee9dd3e43037e102d7039c79d9
SHA512

906aad7d4aed6a17a11e2cf6908df2613cfc45afc9671736f9cfc1747901006de0048b60f9adba4ea2d57da4738ba7f8950a4f2b1fa4c8959053f2f7d1321178
SSDEEP

98304:P/8A04qRspndZknU+bU5iSRGAMVK15Gy3XQME7+Sz01FtrJQwwCfl:3X0NR1U+wrKUTv3XWDg1T9Q5W

Score

10^/10

octo banker collection credential_access discovery evasion impact infostealer persistence rat trojan

Malware Config

Extracted

Family

octo

https://e8009e84c92eeeb6f2cd34622a9bda07.com

AES_key

Signatures

Octo
Octo is a banking malware with remote access capabilities first seen in April 2022.
banker trojan infostealer rat octo

Octo payload 1 IoCs

resource	yara_rule
behavioral2/memory/4444-1.dex	family_octo

Loads dropped Dex/Jar 1 TTPs 2 IoCs

Runs executable file dropped to the device during analysis.

evasion

Download New Code at Runtime

T1407

ioc	pid	Process
/data/user/0/com.havirtual06numberresources/app_grief/RCuU.json	4444	com.havirtual06numberresources
/data/user/0/com.havirtual06numberresources/[email protected]	4444	com.havirtual06numberresources

Makes use of the framework's Accessibility service 4 TTPs 1 IoCs

Retrieves information displayed on the phone screen using AccessibilityService.

collection evasion credential_access

Input Injection

T1516

Screen Capture

T1513

Keylogging

T1417.001

GUI Input Capture

T1417.002

description	ioc	Process
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId	com.havirtual06numberresources

Obtains sensitive information copied to the device clipboard 2 TTPs 1 IoCs

Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.

collection credential_access impact

Clipboard Data

T1414

Transmitted Data Manipulation

T1641.001

description	ioc	Process
Framework service call	android.content.IClipboard.addPrimaryClipChangedListener	com.havirtual06numberresources

Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
banker discovery

Security Software Discovery
T1418.001
Queries the phone number (MSISDN for GSM devices) 1 TTPs
discovery

System Network Configuration Discovery
T1422

Acquires the wake lock 1 IoCs

description	ioc	Process
Framework service call	android.os.IPowerManager.acquireWakeLock	com.havirtual06numberresources

Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs

Application may abuse the framework's foreground service to continue running in the foreground.

evasion persistence

Foreground Persistence

T1541

description	ioc	Process
Framework service call	android.app.IActivityManager.setServiceForeground	com.havirtual06numberresources

Queries the mobile country code (MCC) 1 TTPs 1 IoCs

discovery

System Network Configuration Discovery

T1422

description	ioc	Process
Framework service call	com.android.internal.telephony.ITelephony.getNetworkCountryIsoForPhone	com.havirtual06numberresources

Reads information about phone network operator. 1 TTPs
discovery

System Network Configuration Discovery
T1422

Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs

impact

Data Encrypted for Impact

T1471

description	ioc	Process
Framework API call	javax.crypto.Cipher.doFinal	com.havirtual06numberresources

Checks CPU information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/cpuinfo	com.havirtual06numberresources

Checks memory information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/meminfo	com.havirtual06numberresources

com.havirtual06numberresources
1⤵
- Loads dropped Dex/Jar
- Makes use of the framework's Accessibility service
- Obtains sensitive information copied to the device clipboard
- Acquires the wake lock
- Makes use of the framework's foreground persistence service
- Queries the mobile country code (MCC)
- Uses Crypto APIs (Might try to encrypt user data)
- Checks CPU information
- Checks memory information
PID:4444

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Foreground Persistence

T1541

Privilege Escalation

Defense Evasion

Download New Code at Runtime

T1407

Foreground Persistence

T1541

Input Injection

T1516

Virtualization/Sandbox Evasion

T1633

System Checks

T1633.001

Credential Access

Clipboard Data

T1414

Input Capture

T1417

GUI Input Capture

T1417.002

Keylogging

T1417.001

Discovery

Software Discovery

T1418

Security Software Discovery

T1418.001

System Information Discovery

T1426

System Network Configuration Discovery

T1422

Lateral Movement

Collection

Clipboard Data

T1414

Input Capture

T1417

GUI Input Capture

T1417.002

Keylogging

T1417.001

Screen Capture

T1513

Command and Control

Exfiltration

Impact

Data Encrypted for Impact

T1471

Data Manipulation

T1641

Transmitted Data Manipulation

T1641.001

Input Injection

T1516

Replay Monitor

Loading Replay Monitor...

Downloads

/data/data/com.havirtual06numberresources/.global.com.havirtual06numberresources

Filesize
48B

MD5
046a414913add6f5bb60072c7db819b6

SHA1
451ee4f6809260aec622d772fd329c7d0297a842

SHA256
b66c1320cb063a1d391c94273572ea6edae76c8c8b0a07f8d75c88686f0df72a

SHA512
4e6355f3051ed5e811ab030abde1f5be7f5e1cf33be99cd08477e9b6c015deb1d8bd75a09fb9c7176b8511c5ad0a67abc0902a3531e97564ccb6afc57496a47c

Download Submit
/data/data/com.havirtual06numberresources/app_grief/RCuU.json

Filesize
1014B

MD5
2b4a6eb0a1719f02cecf4563aaa5070d

SHA1
1e5e725fc40d6735b06b8114b5c5b48c73391181

SHA256
9ed98f9021810d3dc5a8ca93dca8c829823ce5a83ab6e8a7cbe8448724e66fe6

SHA512
249864c391f9882f6882089cbd54c5a64a9d19e0a1f61e7cb8ed8c998c6e1a9cfdbf98da3b58e2d0dbe22d66ff9a8039e8ca231b502ad55d00ed8f92800ae2fe

Download Submit
/data/data/com.havirtual06numberresources/app_grief/RCuU.json

Filesize
1014B

MD5
43be16055dc04e405461fc92e40d4d11

SHA1
4e23c62a04059e1e3f37260a00fb10a75082d509

SHA256
bbd3308bcf682b66ee90d629aeb8963839cc384fae60161f6fa646c56c96c1c4

SHA512
409071e68b832df178ff955f20173392c187bf349925fc058c4d4bed0f794dff31cf2c8b205a5f6a1e29ad3768db3e4f0929db302310e1ce947476a24cb63b9f

Download Submit
/data/data/com.havirtual06numberresources/files/.m

Filesize
322KB

MD5
77dc50489b9323274732d27dc8a4e803

SHA1
0e02a3595b62489d0739d771881da8604d117c65

SHA256
c5684e792d1ebefea6aac09fed45911703fd58c899f8a08133d49dd91429a820

SHA512
0684a92f3e9c525384cfa53f531afba61e5930e1c27032a7e27e3315f72761b62e122dc34768d8162ba08f9bed53d148aa8dc034b46456bdd211f230637eba58

Download Submit
/data/data/com.havirtual06numberresources/oat/x86_64/[email protected]

Filesize
13KB

MD5
a3983cafceb97ae82ef57d972b97a1c4

SHA1
0c64f60c7344431b0914cbb20c481e613541794e

SHA256
26a097ec646ec4b4f7e807863422520cf58e6a3b1c5e3642536f51207bfa5abf

SHA512
e6b2d600dafcfb14112d9b7c782f1d96185a6bab66e5c48e52a6010e11a9b4993d9e9b0ec823d7e43ebe348b205b52457b8bb9bddb59d644d8b325aaf4fe06d9

Download Submit
/data/user/0/com.havirtual06numberresources/[email protected]

Filesize
526KB

MD5
d17831549854eb9d9637597889753982

SHA1
22bac7522f364e73d3568c69df11f6d95de4e633

SHA256
8bf9fb71831d54fea3daa77c57707651b82fffd7e555fca7c8116ffd1cc43bbb

SHA512
48289bdf8c38ee310771abaa1ed1b7bf8e634ae6c9199be9e2a443aeef26cd5f21667276ec0bd56bec5ef6d2ad9a6c0fb16df4866ae927aab2c6c608782b1e34

Download Submit
/data/user/0/com.havirtual06numberresources/app_grief/RCuU.json

Filesize
1KB

MD5
15db352a166a7fd6e1a6e5e2c5e59b58

SHA1
db31b6a5144949565327b5c94f6e150217213c49

SHA256
9f244aad458cf24dcaf683d102014b7f739595ecffa7dd8c9c4ae0faa9755e3c

SHA512
824f2540878909bc00b0328ee9388fc6cafae0da72bc37c32b5dc0e435602473bf5138b0115d637088da51078225795458148233680abfb8d6014eb01a75d2b2

Download Submit

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads