octo | 9025c2510cf926faa631d9db53f612a774b10c78be418a0e770b82be2bac0bce

Analysis

max time kernel
22s
max time network
36s
platform
android_x64
resource
android-x64-20240624-en
resource tags

androidarch:x64arch:x86image:android-x64-20240624-enlocale:en-usos:android-10-x64system
submitted
09-10-2024 08:09

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

9025c2510cf926faa631d9db53f612a774b10c78be418a0e770b82be2bac0bce.apk
Size

7.5MB
MD5

ae17783eb957d9a7bc50090fee82e5d9
SHA1

ce4e5b58d25cf3f4262ccc84a10ad232c90b87e6
SHA256

9025c2510cf926faa631d9db53f612a774b10c78be418a0e770b82be2bac0bce
SHA512

a340e5e79fd45050cabe141b6671c13893f029c341c4b238fcbd31ab697fdf10f434fddd396c0ab1b243795be4e19ed88cfac0a80b8f09d0c3347a5a2c953a41
SSDEEP

98304:EjYx5iSRGIcVK0qeu0uETvQhkj75RsBc7fxc+wvK:EjYxrqUdefrrQCj75RowZGi

Score

10^/10

octo banker collection credential_access discovery evasion impact infostealer persistence rat trojan

Malware Config

Extracted

Family

octo

AES_key

Signatures

Octo
Octo is a banking malware with remote access capabilities first seen in April 2022.
banker trojan infostealer rat octo

Octo payload 1 IoCs

resource	yara_rule
behavioral1/memory/4933-1.dex	family_octo

Loads dropped Dex/Jar 1 TTPs 2 IoCs

Runs executable file dropped to the device during analysis.

evasion

Download New Code at Runtime

T1407

ioc	pid	Process
/data/user/0/com.cpartner_edge26/app_frequent/naw.json	4933	com.cpartner_edge26
/data/user/0/com.cpartner_edge26/[email protected]	4933	com.cpartner_edge26

Makes use of the framework's Accessibility service 4 TTPs 2 IoCs

Retrieves information displayed on the phone screen using AccessibilityService.

collection evasion credential_access

Input Injection

T1516

Screen Capture

T1513

Keylogging

T1417.001

GUI Input Capture

T1417.002

description	ioc	Process
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId	com.cpartner_edge26
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByViewId	com.cpartner_edge26

Obtains sensitive information copied to the device clipboard 2 TTPs 1 IoCs

Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.

collection credential_access impact

Clipboard Data

T1414

Transmitted Data Manipulation

T1641.001

description	ioc	Process
Framework service call	android.content.IClipboard.addPrimaryClipChangedListener	com.cpartner_edge26

Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
banker discovery

Security Software Discovery
T1418.001
Queries the phone number (MSISDN for GSM devices) 1 TTPs
discovery

System Network Configuration Discovery
T1422

Acquires the wake lock 1 IoCs

description	ioc	Process
Framework service call	android.os.IPowerManager.acquireWakeLock	com.cpartner_edge26

Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs

Application may abuse the framework's foreground service to continue running in the foreground.

evasion persistence

Foreground Persistence

T1541

description	ioc	Process
Framework service call	android.app.IActivityManager.setServiceForeground	com.cpartner_edge26

Queries the mobile country code (MCC) 1 TTPs 1 IoCs

discovery

System Network Configuration Discovery

T1422

description	ioc	Process
Framework service call	com.android.internal.telephony.ITelephony.getNetworkCountryIsoForPhone	com.cpartner_edge26

Reads information about phone network operator. 1 TTPs
discovery

System Network Configuration Discovery
T1422

Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs

persistence

Broadcast Receivers

T1624.001

description	ioc	Process
Framework service call	android.app.IActivityManager.registerReceiver	com.cpartner_edge26

Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs

impact

Data Encrypted for Impact

T1471

description	ioc	Process
Framework API call	javax.crypto.Cipher.doFinal	com.cpartner_edge26

Checks CPU information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/cpuinfo	com.cpartner_edge26

Checks memory information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/meminfo	com.cpartner_edge26

com.cpartner_edge26
1⤵
- Loads dropped Dex/Jar
- Makes use of the framework's Accessibility service
- Obtains sensitive information copied to the device clipboard
- Acquires the wake lock
- Makes use of the framework's foreground persistence service
- Queries the mobile country code (MCC)
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Uses Crypto APIs (Might try to encrypt user data)
- Checks CPU information
- Checks memory information
PID:4933

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Event Triggered Execution

T1624

Broadcast Receivers

T1624.001

Foreground Persistence

T1541

Privilege Escalation

Defense Evasion

Download New Code at Runtime

T1407

Foreground Persistence

T1541

Input Injection

T1516

Virtualization/Sandbox Evasion

T1633

System Checks

T1633.001

Credential Access

Clipboard Data

T1414

Input Capture

T1417

GUI Input Capture

T1417.002

Keylogging

T1417.001

Discovery

Software Discovery

T1418

Security Software Discovery

T1418.001

System Information Discovery

T1426

System Network Configuration Discovery

T1422

Lateral Movement

Collection

Clipboard Data

T1414

Input Capture

T1417

GUI Input Capture

T1417.002

Keylogging

T1417.001

Screen Capture

T1513

Command and Control

Exfiltration

Impact

Data Encrypted for Impact

T1471

Data Manipulation

T1641

Transmitted Data Manipulation

T1641.001

Input Injection

T1516

Replay Monitor

Loading Replay Monitor...

Downloads

/data/data/com.cpartner_edge26/.global.com.cpartner_edge26

Filesize
48B

MD5
046a414913add6f5bb60072c7db819b6

SHA1
451ee4f6809260aec622d772fd329c7d0297a842

SHA256
b66c1320cb063a1d391c94273572ea6edae76c8c8b0a07f8d75c88686f0df72a

SHA512
4e6355f3051ed5e811ab030abde1f5be7f5e1cf33be99cd08477e9b6c015deb1d8bd75a09fb9c7176b8511c5ad0a67abc0902a3531e97564ccb6afc57496a47c

Download Submit
/data/data/com.cpartner_edge26/app_frequent/naw.json

Filesize
1006B

MD5
a83d481e9a3f890b985635d1eead3636

SHA1
efb5d8e21bd8dabec60caa71f901d42cad32cbc7

SHA256
dadeb1afd80a898ed64cf4c7cfc6b1fb7610a211b96e764d1fa1f3be4696dd66

SHA512
c44e7ca8f7fa2ab8e8b5a6079fb2bb8a2aae9e1ce6229c4547038efd2626d4c1befa9064f39e9fa6706953964e34968f1df515d424de52d8dea23bd98909730f

Download Submit
/data/data/com.cpartner_edge26/app_frequent/naw.json

Filesize
1006B

MD5
f6e46493b0ed715bcce647fa8c533243

SHA1
976b48a5c7ac89a550b5d60637e50ff1328abf64

SHA256
9936aea99580f4780bc05b8ea8aff0391e8db45ce2dbb6ca573a7cdb468e20f8

SHA512
7c2f467ba59e9f33ad66311ef23ad1d6c1d5e1f92e48aa59bb67a70321f402b8d78296bfe0a8630a2bcdf0bedbcf1cc612f0d7b927caaa22ad26d13bf08c44ea

Download Submit
/data/data/com.cpartner_edge26/files/.m

Filesize
322KB

MD5
77dc50489b9323274732d27dc8a4e803

SHA1
0e02a3595b62489d0739d771881da8604d117c65

SHA256
c5684e792d1ebefea6aac09fed45911703fd58c899f8a08133d49dd91429a820

SHA512
0684a92f3e9c525384cfa53f531afba61e5930e1c27032a7e27e3315f72761b62e122dc34768d8162ba08f9bed53d148aa8dc034b46456bdd211f230637eba58

Download Submit
/data/data/com.cpartner_edge26/oat/x86_64/[email protected]

Filesize
289B

MD5
9b9cd47a48aab18abba136c28db64571

SHA1
f516da0be7dbfde2c867745debeeb193cba24a2d

SHA256
2493513826e66a74f3ce7ebde083baddfb1e55bdd842ff2a1d18d663adf73db5

SHA512
3f385cf34994ba29affd4beaf1d2362ac8157d114b7c655f0249c2f3b61846667f6dfbb54c391af5ad2cea1c9505b411b73a11af2615a1d0ad2fc0c9ac090059

Download Submit
/data/user/0/com.cpartner_edge26/[email protected]

Filesize
525KB

MD5
7ebeb6a492efb1fa0d684114edfb5a65

SHA1
9804ba5be305a4ad4ca1c2656ba90bc51b34f6bb

SHA256
e9acb574f35078bca3c65f41c06dc10ddb7aa69a3361280e7995bd187fa8efdb

SHA512
0760d17b531b0cc8e8864da28150c8a62cf0a250572c7465886d142536686752f89e0a0dea2ffc548930f3a7a5ec8dbc95b579a6bf814e1f2828c3d323e99372

Download Submit
/data/user/0/com.cpartner_edge26/app_frequent/naw.json

Filesize
1KB

MD5
96d4f24b9a6fd92782c35f89a29afdba

SHA1
b10773de5c5da6d184b64f7dc2b9711edb957371

SHA256
1e2ae8f152fa699a1062e0e0f19dbe766619910b31a2c0745edb8ada1a07cedc

SHA512
014765b4869713a3bed7da2552e1b4c878343b35d6f8e110dd35fea9aa8cc8ae0ccf98736b3a5e280caf0b896855ddffaa60f1bec633a3721a4868af682a2876

Download Submit

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads