octo | 30802f5d98d4d241d1da9424e6ec07529fec37602791cb2684d2b1b6efec6548

Analysis

max time kernel
149s
max time network
154s
platform
android_x64
resource
android-x64-arm64-20240624-en
resource tags

androidarch:armarch:arm64arch:x64arch:x86image:android-x64-arm64-20240624-enlocale:en-usos:android-11-x64system
submitted
08-10-2024 16:36

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

30802f5d98d4d241d1da9424e6ec07529fec37602791cb2684d2b1b6efec6548.apk
Size

7.1MB
MD5

64657b166373cc88ce27b95c99ed5345
SHA1

9298c6aa67d463ebc6df931988d70fe9e5f9b17f
SHA256

30802f5d98d4d241d1da9424e6ec07529fec37602791cb2684d2b1b6efec6548
SHA512

bd87fa3deb84cf73ae35d00f43d1acee023f75a3dc9cc64df4eaf9fc2da30146823469eb3ad965fba9abec4778df09879fa9d635b435f58078a4df34502bdec4
SSDEEP

98304:QXLVKyp+qqj7T5iSRG6tssRs3my/eNe4o:mLU/Hj7TrZRmHp

Score

10^/10

octo banker collection credential_access discovery evasion impact infostealer persistence rat trojan

Malware Config

Extracted

Family

octo

https://e1a2dafd233510ff2e2338baea4cf677.xyz

https://e8009e84c92eeeb6f2cd34622a9bda07.com

AES_key

Signatures

Octo
Octo is a banking malware with remote access capabilities first seen in April 2022.
banker trojan infostealer rat octo

Octo payload 1 IoCs

resource	yara_rule
behavioral2/memory/4478-1.dex	family_octo

Loads dropped Dex/Jar 1 TTPs 2 IoCs

Runs executable file dropped to the device during analysis.

evasion

Download New Code at Runtime

T1407

ioc	pid	Process
/data/user/0/com.jecommon_camera63/app_image/TO.json	4478	com.jecommon_camera63
/data/user/0/com.jecommon_camera63/[email protected]	4478	com.jecommon_camera63

Makes use of the framework's Accessibility service 4 TTPs 2 IoCs

Retrieves information displayed on the phone screen using AccessibilityService.

collection evasion credential_access

Input Injection

T1516

Screen Capture

T1513

Keylogging

T1417.001

GUI Input Capture

T1417.002

description	ioc	Process
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId	com.jecommon_camera63
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByViewId	com.jecommon_camera63

Obtains sensitive information copied to the device clipboard 2 TTPs 1 IoCs

Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.

collection credential_access impact

Clipboard Data

T1414

Transmitted Data Manipulation

T1641.001

description	ioc	Process
Framework service call	android.content.IClipboard.addPrimaryClipChangedListener	com.jecommon_camera63

Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
banker discovery

Security Software Discovery
T1418.001
Queries the phone number (MSISDN for GSM devices) 1 TTPs
discovery

System Network Configuration Discovery
T1422

Acquires the wake lock 1 IoCs

description	ioc	Process
Framework service call	android.os.IPowerManager.acquireWakeLock	com.jecommon_camera63

Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs

Application may abuse the framework's foreground service to continue running in the foreground.

evasion persistence

Foreground Persistence

T1541

description	ioc	Process
Framework service call	android.app.IActivityManager.setServiceForeground	com.jecommon_camera63

Queries the mobile country code (MCC) 1 TTPs 1 IoCs

discovery

System Network Configuration Discovery

T1422

description	ioc	Process
Framework service call	com.android.internal.telephony.ITelephony.getNetworkCountryIsoForPhone	com.jecommon_camera63

Reads information about phone network operator. 1 TTPs
discovery

System Network Configuration Discovery
T1422

Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs

impact

Data Encrypted for Impact

T1471

description	ioc	Process
Framework API call	javax.crypto.Cipher.doFinal	com.jecommon_camera63

Checks CPU information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/cpuinfo	com.jecommon_camera63

Checks memory information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/meminfo	com.jecommon_camera63

com.jecommon_camera63
1⤵
- Loads dropped Dex/Jar
- Makes use of the framework's Accessibility service
- Obtains sensitive information copied to the device clipboard
- Acquires the wake lock
- Makes use of the framework's foreground persistence service
- Queries the mobile country code (MCC)
- Uses Crypto APIs (Might try to encrypt user data)
- Checks CPU information
- Checks memory information
PID:4478

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Foreground Persistence

T1541

Privilege Escalation

Defense Evasion

Download New Code at Runtime

T1407

Foreground Persistence

T1541

Input Injection

T1516

Virtualization/Sandbox Evasion

T1633

System Checks

T1633.001

Credential Access

Clipboard Data

T1414

Input Capture

T1417

GUI Input Capture

T1417.002

Keylogging

T1417.001

Discovery

Software Discovery

T1418

Security Software Discovery

T1418.001

System Information Discovery

T1426

System Network Configuration Discovery

T1422

Lateral Movement

Collection

Clipboard Data

T1414

Input Capture

T1417

GUI Input Capture

T1417.002

Keylogging

T1417.001

Screen Capture

T1513

Command and Control

Exfiltration

Impact

Data Encrypted for Impact

T1471

Data Manipulation

T1641

Transmitted Data Manipulation

T1641.001

Input Injection

T1516

Replay Monitor

Loading Replay Monitor...

Downloads

/data/data/com.jecommon_camera63/.global.com.jecommon_camera63

Filesize
48B

MD5
046a414913add6f5bb60072c7db819b6

SHA1
451ee4f6809260aec622d772fd329c7d0297a842

SHA256
b66c1320cb063a1d391c94273572ea6edae76c8c8b0a07f8d75c88686f0df72a

SHA512
4e6355f3051ed5e811ab030abde1f5be7f5e1cf33be99cd08477e9b6c015deb1d8bd75a09fb9c7176b8511c5ad0a67abc0902a3531e97564ccb6afc57496a47c

Download Submit
/data/data/com.jecommon_camera63/app_image/TO.json

Filesize
1021B

MD5
4a6ee0ce0fbcba39d0d1cadb98434ba9

SHA1
78ed1c3f9cd755f89a07f94a2b6e8c79335a8970

SHA256
102b9f7ce9482393f44ece9af8f9c1c4fd00f123d87921b01fa70e2e8ec8e537

SHA512
87d4cd9fd103fd5893da8517864fba6cc3f95a042de4f1c21145cb2b3f887914a1a479c618c7cfdb76b27dbefd0c89bae86947580f385314fe662de17d64b8d4

Download Submit
/data/data/com.jecommon_camera63/app_image/TO.json

Filesize
1021B

MD5
d995a3a317593f5e104edae45a299819

SHA1
3daed535ba2873cba436a4f74207e8565326063a

SHA256
205e92c295af0b35089c2211e5cf09d7097d28407b3f600d9a822b56e9cb4a4d

SHA512
5d9fb91baaafb1877efd888656be0682ed4f3e9fc8690ec2cd534baf1381d14fd30eb295024a958d9205c988bd4ae519510ebe3ba5e899e7242e56921c946fa9

Download Submit
/data/data/com.jecommon_camera63/files/.m

Filesize
322KB

MD5
77dc50489b9323274732d27dc8a4e803

SHA1
0e02a3595b62489d0739d771881da8604d117c65

SHA256
c5684e792d1ebefea6aac09fed45911703fd58c899f8a08133d49dd91429a820

SHA512
0684a92f3e9c525384cfa53f531afba61e5930e1c27032a7e27e3315f72761b62e122dc34768d8162ba08f9bed53d148aa8dc034b46456bdd211f230637eba58

Download Submit
/data/data/com.jecommon_camera63/oat/x86_64/[email protected]

Filesize
476B

MD5
c569123065681e748450539383b54757

SHA1
ebe1328077085b706c86eb7a6e82e50e49f81720

SHA256
3d80f547445808364d599f9b55a4c1eac0902f667b4c0bd61acde2d15cbf598e

SHA512
56b5f1d8e603797c94723e273fe68f0e38e259afd61212432e7d3d2e904808d587239a2f1a14adef14a5a6c095fc508843190ccb48f7d9a2783d9d2b19b7c6d1

Download Submit
/data/user/0/com.jecommon_camera63/[email protected]

Filesize
526KB

MD5
ca384c80ea33aaee9f291fe0b99632ea

SHA1
080a90207e1e385113c1ab07463d191c3d49690f

SHA256
407075a93a8eb13bb0e55c40dad32765e2cae7f3524c747451c6819637a4d7b6

SHA512
fb4a4647ce56e0fb22a4d9594e34d445bc8e58c014d24f203ba4a425d88faac36a3444b968d2a15535fd9aa9607429657b0719f2a2d8c919345494012b6cceeb

Download Submit
/data/user/0/com.jecommon_camera63/app_image/TO.json

Filesize
1KB

MD5
bac9b8f4bba0b46383c6d02d167ecfd0

SHA1
f41c37f485957120777267e0baf124f5fd2ef330

SHA256
cea18f81b6280d5fc6cd7310a468785ce0a5796bcbdc168841437574ecfeba6e

SHA512
5c7a36aff2f57d94cce15321b732786dee7c0109d6f4222c40cb6a9de796f0fae609f3b234162b0b09fc3dc80b31a5c69f0e2f4343ea47b2db6ca7d578e5e51a

Download Submit

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads