octo | 965e4250719cdd8a88a9b37bd3783c41f182e32b515d3275ec9b929869dc5cd0

Analysis

max time kernel
22s
max time network
35s
platform
android_x64
resource
android-x64-20240624-en
resource tags

androidarch:x64arch:x86image:android-x64-20240624-enlocale:en-usos:android-10-x64system
submitted
09-10-2024 08:04

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

965e4250719cdd8a88a9b37bd3783c41f182e32b515d3275ec9b929869dc5cd0.apk
Size

7.6MB
MD5

4665c99ed56dd72c3e010c0c47925fd2
SHA1

e1254d0c52f2b56d1253618d7f7b09838f1cc2ec
SHA256

965e4250719cdd8a88a9b37bd3783c41f182e32b515d3275ec9b929869dc5cd0
SHA512

39590b693e26e0da16908e20e46fd01c8af5a1a9196e7ab0f62f9e29382993f35d9a7f1213df7e967b6acbc8cbaee4df8c368c76e94687075cbbf1fc5373f1cb
SSDEEP

98304:GwwCfwTE05iSRGcoOnWVKXLeNeUctxjQRsp5iroj7l:G5NrrmOnWUmujQR8isj7l

Score

10^/10

octo banker collection credential_access discovery evasion impact infostealer persistence rat trojan

Malware Config

Extracted

Family

octo

AES_key

Signatures

Octo
Octo is a banking malware with remote access capabilities first seen in April 2022.
banker trojan infostealer rat octo

Octo payload 1 IoCs

resource	yara_rule
behavioral1/memory/4929-1.dex	family_octo

Loads dropped Dex/Jar 1 TTPs 2 IoCs

Runs executable file dropped to the device during analysis.

evasion

Download New Code at Runtime

T1407

ioc	pid	Process
/data/user/0/com.hbmaps88packmover/app_strong/mAaPfy.json	4929	com.hbmaps88packmover
/data/user/0/com.hbmaps88packmover/[email protected]	4929	com.hbmaps88packmover

Makes use of the framework's Accessibility service 4 TTPs 2 IoCs

Retrieves information displayed on the phone screen using AccessibilityService.

collection evasion credential_access

Input Injection

T1516

Screen Capture

T1513

Keylogging

T1417.001

GUI Input Capture

T1417.002

description	ioc	Process
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId	com.hbmaps88packmover
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByViewId	com.hbmaps88packmover

Obtains sensitive information copied to the device clipboard 2 TTPs 1 IoCs

Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.

collection credential_access impact

Clipboard Data

T1414

Transmitted Data Manipulation

T1641.001

description	ioc	Process
Framework service call	android.content.IClipboard.addPrimaryClipChangedListener	com.hbmaps88packmover

Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
banker discovery

Security Software Discovery
T1418.001
Queries the phone number (MSISDN for GSM devices) 1 TTPs
discovery

System Network Configuration Discovery
T1422

Acquires the wake lock 1 IoCs

description	ioc	Process
Framework service call	android.os.IPowerManager.acquireWakeLock	com.hbmaps88packmover

Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs

Application may abuse the framework's foreground service to continue running in the foreground.

evasion persistence

Foreground Persistence

T1541

description	ioc	Process
Framework service call	android.app.IActivityManager.setServiceForeground	com.hbmaps88packmover

Queries the mobile country code (MCC) 1 TTPs 1 IoCs

discovery

System Network Configuration Discovery

T1422

description	ioc	Process
Framework service call	com.android.internal.telephony.ITelephony.getNetworkCountryIsoForPhone	com.hbmaps88packmover

Reads information about phone network operator. 1 TTPs
discovery

System Network Configuration Discovery
T1422

Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs

persistence

Broadcast Receivers

T1624.001

description	ioc	Process
Framework service call	android.app.IActivityManager.registerReceiver	com.hbmaps88packmover

Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs

impact

Data Encrypted for Impact

T1471

description	ioc	Process
Framework API call	javax.crypto.Cipher.doFinal	com.hbmaps88packmover

Checks CPU information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/cpuinfo	com.hbmaps88packmover

Checks memory information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/meminfo	com.hbmaps88packmover

com.hbmaps88packmover
1⤵
- Loads dropped Dex/Jar
- Makes use of the framework's Accessibility service
- Obtains sensitive information copied to the device clipboard
- Acquires the wake lock
- Makes use of the framework's foreground persistence service
- Queries the mobile country code (MCC)
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Uses Crypto APIs (Might try to encrypt user data)
- Checks CPU information
- Checks memory information
PID:4929

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Event Triggered Execution

T1624

Broadcast Receivers

T1624.001

Foreground Persistence

T1541

Privilege Escalation

Defense Evasion

Download New Code at Runtime

T1407

Foreground Persistence

T1541

Input Injection

T1516

Virtualization/Sandbox Evasion

T1633

System Checks

T1633.001

Credential Access

Clipboard Data

T1414

Input Capture

T1417

GUI Input Capture

T1417.002

Keylogging

T1417.001

Discovery

Software Discovery

T1418

Security Software Discovery

T1418.001

System Information Discovery

T1426

System Network Configuration Discovery

T1422

Lateral Movement

Collection

Clipboard Data

T1414

Input Capture

T1417

GUI Input Capture

T1417.002

Keylogging

T1417.001

Screen Capture

T1513

Command and Control

Exfiltration

Impact

Data Encrypted for Impact

T1471

Data Manipulation

T1641

Transmitted Data Manipulation

T1641.001

Input Injection

T1516

Replay Monitor

Loading Replay Monitor...

Downloads

/data/data/com.hbmaps88packmover/.global.com.hbmaps88packmover

Filesize
48B

MD5
046a414913add6f5bb60072c7db819b6

SHA1
451ee4f6809260aec622d772fd329c7d0297a842

SHA256
b66c1320cb063a1d391c94273572ea6edae76c8c8b0a07f8d75c88686f0df72a

SHA512
4e6355f3051ed5e811ab030abde1f5be7f5e1cf33be99cd08477e9b6c015deb1d8bd75a09fb9c7176b8511c5ad0a67abc0902a3531e97564ccb6afc57496a47c

Download Submit
/data/data/com.hbmaps88packmover/app_strong/mAaPfy.json

Filesize
1007B

MD5
974eaa66376cf693b05234d59c93c2c4

SHA1
128cd32c9321f71bf87421aa2280547c31a56c13

SHA256
5faabc0bee18b3525ec9d56e3f32610c5fdacf4ac83aa174ef85f987bf7c0237

SHA512
afebd65f93b81a7920400ee22d2cff5c762b3a8237ad8e463fd06b39702206fe392ef702238b115053b317dcb133a31aa7438f6d8e28b97c20fa1c865af06137

Download Submit
/data/data/com.hbmaps88packmover/app_strong/mAaPfy.json

Filesize
1007B

MD5
7a87069432f7e0b4f75e6f9d0a86eb57

SHA1
f814314127652c3110652923c4be431faf562c9e

SHA256
4a0d6b9856beb99a721519756ccc7bd2b88caa766943a59018896e1f07c8a08c

SHA512
98ed5bbffae094f71a137bd94cee3473c9ac5b770277f0db7f2a45c9db97c7d80c8ad8f6b3ef0b9a88fd3c738d0916a17585c12d088b08cd7a9268d927aada53

Download Submit
/data/data/com.hbmaps88packmover/files/.c

Filesize
322KB

MD5
77dc50489b9323274732d27dc8a4e803

SHA1
0e02a3595b62489d0739d771881da8604d117c65

SHA256
c5684e792d1ebefea6aac09fed45911703fd58c899f8a08133d49dd91429a820

SHA512
0684a92f3e9c525384cfa53f531afba61e5930e1c27032a7e27e3315f72761b62e122dc34768d8162ba08f9bed53d148aa8dc034b46456bdd211f230637eba58

Download Submit
/data/data/com.hbmaps88packmover/oat/x86_64/[email protected]

Filesize
292B

MD5
ee03644619091f8b69b493b859f7f502

SHA1
bda28e6f1fe2ba9f49c8478722b314f15bd3d69f

SHA256
38485b6f2dd3db9297a6d134ad65181b703377e6c062604120ae335d85390509

SHA512
23809372ee216c94509c7d9400bd105a4440b7fccfd9b1c3add57d5a21e82a053775227800693462f1803a34bc291882f6cb1a3c0e608eb5d202c236a66cfddc

Download Submit
/data/user/0/com.hbmaps88packmover/[email protected]

Filesize
525KB

MD5
9916beb062e9473852f43576c7cafd8f

SHA1
261e7c55721187265f28d13cc8bdbb346934b14c

SHA256
591664a81cd3a6838a702b23fe6c0711fe4b70ff3ff7866b93dbecec40ba7f4d

SHA512
133c08479ecd2720e00d76294a36be9d48b9dd5278d2f1347634404231e639c9158dc834d331fb98e71e50d0e6294e6ef36842a10b8d75dd645c76f09f21d014

Download Submit
/data/user/0/com.hbmaps88packmover/app_strong/mAaPfy.json

Filesize
1KB

MD5
04580cbe2d048802207716c88eeda633

SHA1
3415772ea51c08199b850a654505509ff5bdbdd6

SHA256
1b0574c97e38c91e65b056453300392577edd7a7a7b6d31017568ee294ca70b4

SHA512
0ed0c82fba9e991f963784f091c837f771ad28a4b0d4456c799868e357a6fbd08ac3fde01ff241ef21c03ffc2254ed5b01e4b13b9205fbe8cb216a24ab1f60e2

Download Submit

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads