octo | 3a4c78e18105327c3b9af0beda2524fea74550c38ffbc575fde2c6c0d634b10a

Analysis

max time kernel
149s
max time network
155s
platform
android_x64
resource
android-33-x64-arm64-20240624-en
resource tags

androidarch:arm64arch:x64image:android-33-x64-arm64-20240624-enlocale:en-usos:android-13-x64system
submitted
09-10-2024 08:04

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

3a4c78e18105327c3b9af0beda2524fea74550c38ffbc575fde2c6c0d634b10a.apk
Size

7.5MB
MD5

e6223fa4918b8751f1776d6266a151cf
SHA1

e97df448289904998275602a188288033631aa18
SHA256

3a4c78e18105327c3b9af0beda2524fea74550c38ffbc575fde2c6c0d634b10a
SHA512

5a2238dc243b8907b35cd9bcaa0ee9a825681df050960ea0100b11e81a9bff4ac86a5625306ce92dd0e6ea0723585b7ca2e77df7bb55c6995a91ca492a651e58
SSDEEP

98304:Lu4Yj7WRsk5iSRG7UVKlBJWpGBXuu8H8oXxXmwmWypvh:Lunj7WRnrJUf0AFh8coQwAvh

Score

10^/10

octo banker collection credential_access discovery evasion impact infostealer persistence rat trojan

Malware Config

Extracted

Family

octo

https://e8009e84c92eeeb6f2cd34622a9bda07.com

AES_key

Signatures

Octo
Octo is a banking malware with remote access capabilities first seen in April 2022.
banker trojan infostealer rat octo

Octo payload 1 IoCs

resource	yara_rule
behavioral2/memory/4312-1.dex	family_octo

Loads dropped Dex/Jar 1 TTPs 2 IoCs

Runs executable file dropped to the device during analysis.

evasion

Download New Code at Runtime

T1407

ioc	pid	Process
/data/user/0/com.saandroid96market/app_quit/rMA.json	4312	com.saandroid96market
/data/user/0/com.saandroid96market/[email protected]	4312	com.saandroid96market

Makes use of the framework's Accessibility service 4 TTPs 1 IoCs

Retrieves information displayed on the phone screen using AccessibilityService.

collection evasion credential_access

Input Injection

T1516

Screen Capture

T1513

Keylogging

T1417.001

GUI Input Capture

T1417.002

description	ioc	Process
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId	com.saandroid96market

Obtains sensitive information copied to the device clipboard 2 TTPs 1 IoCs

Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.

collection credential_access impact

Clipboard Data

T1414

Transmitted Data Manipulation

T1641.001

description	ioc	Process
Framework service call	android.content.IClipboard.addPrimaryClipChangedListener	com.saandroid96market

Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
banker discovery

Security Software Discovery
T1418.001
Queries the phone number (MSISDN for GSM devices) 1 TTPs
discovery

System Network Configuration Discovery
T1422

Acquires the wake lock 1 IoCs

description	ioc	Process
Framework service call	android.os.IPowerManager.acquireWakeLock	com.saandroid96market

Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs

Application may abuse the framework's foreground service to continue running in the foreground.

evasion persistence

Foreground Persistence

T1541

description	ioc	Process
Framework service call	android.app.IActivityManager.setServiceForeground	com.saandroid96market

Queries the mobile country code (MCC) 1 TTPs 1 IoCs

discovery

System Network Configuration Discovery

T1422

description	ioc	Process
Framework service call	com.android.internal.telephony.ITelephony.getNetworkCountryIsoForPhone	com.saandroid96market

Reads information about phone network operator. 1 TTPs
discovery

System Network Configuration Discovery
T1422

Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs

impact

Data Encrypted for Impact

T1471

description	ioc	Process
Framework API call	javax.crypto.Cipher.doFinal	com.saandroid96market

Checks CPU information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/cpuinfo	com.saandroid96market

Checks memory information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/meminfo	com.saandroid96market

com.saandroid96market
1⤵
- Loads dropped Dex/Jar
- Makes use of the framework's Accessibility service
- Obtains sensitive information copied to the device clipboard
- Acquires the wake lock
- Makes use of the framework's foreground persistence service
- Queries the mobile country code (MCC)
- Uses Crypto APIs (Might try to encrypt user data)
- Checks CPU information
- Checks memory information
PID:4312

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Foreground Persistence

T1541

Privilege Escalation

Defense Evasion

Download New Code at Runtime

T1407

Foreground Persistence

T1541

Input Injection

T1516

Virtualization/Sandbox Evasion

T1633

System Checks

T1633.001

Credential Access

Clipboard Data

T1414

Input Capture

T1417

GUI Input Capture

T1417.002

Keylogging

T1417.001

Discovery

Software Discovery

T1418

Security Software Discovery

T1418.001

System Information Discovery

T1426

System Network Configuration Discovery

T1422

Lateral Movement

Collection

Clipboard Data

T1414

Input Capture

T1417

GUI Input Capture

T1417.002

Keylogging

T1417.001

Screen Capture

T1513

Command and Control

Exfiltration

Impact

Data Encrypted for Impact

T1471

Data Manipulation

T1641

Transmitted Data Manipulation

T1641.001

Input Injection

T1516

Replay Monitor

Loading Replay Monitor...

Downloads

/data/data/com.saandroid96market/.global.com.saandroid96market

Filesize
48B

MD5
046a414913add6f5bb60072c7db819b6

SHA1
451ee4f6809260aec622d772fd329c7d0297a842

SHA256
b66c1320cb063a1d391c94273572ea6edae76c8c8b0a07f8d75c88686f0df72a

SHA512
4e6355f3051ed5e811ab030abde1f5be7f5e1cf33be99cd08477e9b6c015deb1d8bd75a09fb9c7176b8511c5ad0a67abc0902a3531e97564ccb6afc57496a47c

Download Submit
/data/data/com.saandroid96market/app_quit/rMA.json

Filesize
995B

MD5
df13846630366484650c11923e35f083

SHA1
8a51c38d7985100455ab80f4f5346de421212fa8

SHA256
ec472fbdef340789986280fab95d7c389230c8b3770826d519fa3e5528dcb740

SHA512
a466293ff7559179dbb1b30a1abab10edb4aad5dd8edf38c4ca5b16319b39eb320069451f62fb862c962e42b36883f49205dee7e6bf2b56aae8b3e762ec49ac2

Download Submit
/data/data/com.saandroid96market/app_quit/rMA.json

Filesize
995B

MD5
7e20ade6abbbcbef1f84844aab429d0b

SHA1
a762383654b47d7ac22cbb695d33f0bee03db81d

SHA256
55cce23e7cc09210fbf61defceb5dc8d04d81112e4128ecf87301d0abd1f5904

SHA512
231a75614570b1e4c6206ceed0853e730980b1b69d8841951de3df5b53fe55378a50fd08f9f7bc67fc8c0fcc31886d91bd67c752b26b8d05dd396a7ca391025d

Download Submit
/data/data/com.saandroid96market/files/.b

Filesize
322KB

MD5
77dc50489b9323274732d27dc8a4e803

SHA1
0e02a3595b62489d0739d771881da8604d117c65

SHA256
c5684e792d1ebefea6aac09fed45911703fd58c899f8a08133d49dd91429a820

SHA512
0684a92f3e9c525384cfa53f531afba61e5930e1c27032a7e27e3315f72761b62e122dc34768d8162ba08f9bed53d148aa8dc034b46456bdd211f230637eba58

Download Submit
/data/data/com.saandroid96market/oat/x86_64/[email protected]

Filesize
13KB

MD5
60bae9855893997c59b31cf49749f9fa

SHA1
d19e7ee8f1859fe27f8ab596296ccfe0a8f1e8e7

SHA256
22b69fe17bbd162610b6e54190b9ddd9374134e653b9356ee01ba8629ab0ca28

SHA512
bd60937bf72fcac35e8fb5be6c061c7f2919c2274fabef7a1d770558e983166c09b5e131f17b19785683ef78d0db7d09d723bcac83d0854e12c24635b2871c41

Download Submit
/data/user/0/com.saandroid96market/[email protected]

Filesize
525KB

MD5
086ed8b6d02ce6ad3d8bb5c9d0d3a6d2

SHA1
8285b4d69f3fd09dd3c6af4f01a7ef194faccd7f

SHA256
057f8ce5b94888c7577bc670c631884c309e5aa4f3364f05d0ecfa29c2366856

SHA512
76048ea26f2f3e2d608842303d29c697effb1f0ecef05b5b0e758deb80b186e3230099ea603bd691cbf99bf100ffa95e718768c5e99cc192ff4f394f43fd584e

Download Submit
/data/user/0/com.saandroid96market/app_quit/rMA.json

Filesize
1KB

MD5
96cde5d0eaea0d116c725a5726cbf9d5

SHA1
382a9126a30a286257cb90129b16a7f070a9d427

SHA256
95b07cd8a3a69e8a7c604e5f4ac31e7002a3a03ed41c1911edfbbaa5a05a9142

SHA512
531d15db5fbaff010eb6064d8b65c34703c55b760361ff6c8564638800c62a2b15551eda3ff1681dddb05a3b86124898d3081cdf9416848aed27eab1cc21678b

Download Submit

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads