octo | c1b532a4aa0b92509e257a8a4fb40b02c2f49d5a29dd190ca4ec2b778b97df75

Analysis

max time kernel
21s
max time network
35s
platform
android_x64
resource
android-x64-20240624-en
resource tags

androidarch:x64arch:x86image:android-x64-20240624-enlocale:en-usos:android-10-x64system
submitted
14/10/2024, 17:31

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

92569006d7dac7c2cebb9f7d5ce3a81505392e1364fb4061d011053a7e1967c3.apk
Size

7.9MB
MD5

ec978ef8018157e2d02538ce72df2028
SHA1

303f59e8250840f95ea0ac0fad825bb12b0648a9
SHA256

92569006d7dac7c2cebb9f7d5ce3a81505392e1364fb4061d011053a7e1967c3
SHA512

be1ef6d188cec13333c28e563589c87f231bbe4f3357ddf230177441628f8996075b0c8de46db10b9804680513c3c6af20f42fc3ddbb9aabf8522117a54f9f1d
SSDEEP

98304:RWzCG+71mj7ARs8R86qbiYmSgU+Tg1tYN/4WfoI55iSRG17VKekxpW4:aCPkj7ARn8JiYgUv1G/4U5rcUD7

Score

10^/10

octo banker collection credential_access discovery evasion impact infostealer persistence rat trojan

Malware Config

Extracted

Family

octo

AES_key

Signatures

Octo
Octo is a banking malware with remote access capabilities first seen in April 2022.
banker trojan infostealer rat octo

Octo payload 1 IoCs

resource	yara_rule
behavioral1/memory/5054-1.dex	family_octo

Loads dropped Dex/Jar 1 TTPs 2 IoCs

Runs executable file dropped to the device during analysis.

evasion

Download New Code at Runtime

T1407

ioc	pid	Process
/data/user/0/com.eui_connectivity3/app_shoot/Lw.json	5054	com.eui_connectivity3
/data/user/0/com.eui_connectivity3/[email protected]	5054	com.eui_connectivity3

Makes use of the framework's Accessibility service 4 TTPs 2 IoCs

Retrieves information displayed on the phone screen using AccessibilityService.

collection evasion credential_access

Input Injection

T1516

Screen Capture

T1513

Keylogging

T1417.001

GUI Input Capture

T1417.002

description	ioc	Process
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId	com.eui_connectivity3
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByViewId	com.eui_connectivity3

Obtains sensitive information copied to the device clipboard 2 TTPs 1 IoCs

Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.

collection credential_access impact

Clipboard Data

T1414

Transmitted Data Manipulation

T1641.001

description	ioc	Process
Framework service call	android.content.IClipboard.addPrimaryClipChangedListener	com.eui_connectivity3

Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
banker discovery

Security Software Discovery
T1418.001
Queries the phone number (MSISDN for GSM devices) 1 TTPs
discovery

System Network Configuration Discovery
T1422

Acquires the wake lock 1 IoCs

description	ioc	Process
Framework service call	android.os.IPowerManager.acquireWakeLock	com.eui_connectivity3

Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs

Application may abuse the framework's foreground service to continue running in the foreground.

evasion persistence

Foreground Persistence

T1541

description	ioc	Process
Framework service call	android.app.IActivityManager.setServiceForeground	com.eui_connectivity3

Queries the mobile country code (MCC) 1 TTPs 1 IoCs

discovery

System Network Configuration Discovery

T1422

description	ioc	Process
Framework service call	com.android.internal.telephony.ITelephony.getNetworkCountryIsoForPhone	com.eui_connectivity3

Reads information about phone network operator. 1 TTPs
discovery

System Network Configuration Discovery
T1422

Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs

persistence

Broadcast Receivers

T1624.001

description	ioc	Process
Framework service call	android.app.IActivityManager.registerReceiver	com.eui_connectivity3

Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs

impact

Data Encrypted for Impact

T1471

description	ioc	Process
Framework API call	javax.crypto.Cipher.doFinal	com.eui_connectivity3

Checks CPU information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/cpuinfo	com.eui_connectivity3

Checks memory information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/meminfo	com.eui_connectivity3

com.eui_connectivity3
1⤵
- Loads dropped Dex/Jar
- Makes use of the framework's Accessibility service
- Obtains sensitive information copied to the device clipboard
- Acquires the wake lock
- Makes use of the framework's foreground persistence service
- Queries the mobile country code (MCC)
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Uses Crypto APIs (Might try to encrypt user data)
- Checks CPU information
- Checks memory information
PID:5054

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Event Triggered Execution

T1624

Broadcast Receivers

T1624.001

Foreground Persistence

T1541

Privilege Escalation

Defense Evasion

Download New Code at Runtime

T1407

Foreground Persistence

T1541

Input Injection

T1516

Virtualization/Sandbox Evasion

T1633

System Checks

T1633.001

Credential Access

Clipboard Data

T1414

Input Capture

T1417

GUI Input Capture

T1417.002

Keylogging

T1417.001

Discovery

Software Discovery

T1418

Security Software Discovery

T1418.001

System Information Discovery

T1426

System Network Configuration Discovery

T1422

Lateral Movement

Collection

Clipboard Data

T1414

Input Capture

T1417

GUI Input Capture

T1417.002

Keylogging

T1417.001

Screen Capture

T1513

Command and Control

Exfiltration

Impact

Data Encrypted for Impact

T1471

Data Manipulation

T1641

Transmitted Data Manipulation

T1641.001

Input Injection

T1516

Replay Monitor

Loading Replay Monitor...

Downloads

/data/data/com.eui_connectivity3/.global.com.eui_connectivity3

Filesize
48B

MD5
046a414913add6f5bb60072c7db819b6

SHA1
451ee4f6809260aec622d772fd329c7d0297a842

SHA256
b66c1320cb063a1d391c94273572ea6edae76c8c8b0a07f8d75c88686f0df72a

SHA512
4e6355f3051ed5e811ab030abde1f5be7f5e1cf33be99cd08477e9b6c015deb1d8bd75a09fb9c7176b8511c5ad0a67abc0902a3531e97564ccb6afc57496a47c

Download Submit
/data/data/com.eui_connectivity3/app_shoot/Lw.json

Filesize
1005B

MD5
321dd7ea18c0aa0d65b75bc927784a8f

SHA1
1e9e6a71936a067d9f105b130b5b2e66c8aacee4

SHA256
c2713f7532318a80a96f84c55c1de324c84a9294086fbce9f4e8b449620e8cab

SHA512
471e555122ad08aebcc3c392c2886c75c0e2f3f4e0b76b4336e19439179fafdc707e803a91b94a26d185f6d079734dfa1e62b5d9b662b7aea06c52136b9ead43

Download Submit
/data/data/com.eui_connectivity3/app_shoot/Lw.json

Filesize
1005B

MD5
63ebd4d8daf125697412029e92a32cce

SHA1
0e2c3b8d6322845bf3dbb05481d02b0f320291fd

SHA256
a7f016cd0e241fbe4be42098c9ce87988093f9f46c42fe10291c83bc89648d79

SHA512
3faf99d0051cce94b3f3cf820d792af8598a82420ead13bec77a9f123f3a1436d01ffb6d0812385c6152ef2923d22d6eb0de9321ed2efcddcf2f0ca021aa43f6

Download Submit
/data/data/com.eui_connectivity3/files/.x

Filesize
322KB

MD5
77dc50489b9323274732d27dc8a4e803

SHA1
0e02a3595b62489d0739d771881da8604d117c65

SHA256
c5684e792d1ebefea6aac09fed45911703fd58c899f8a08133d49dd91429a820

SHA512
0684a92f3e9c525384cfa53f531afba61e5930e1c27032a7e27e3315f72761b62e122dc34768d8162ba08f9bed53d148aa8dc034b46456bdd211f230637eba58

Download Submit
/data/data/com.eui_connectivity3/oat/x86_64/[email protected]

Filesize
289B

MD5
d41cd9bbd616c0a6009560a745f9a3c4

SHA1
4118a24619a4608777348095df9e28f7ff1b22bc

SHA256
034b9ce724775ffacaeff054f018aec8b11c179cbd68f17a78d309ecc3ee9d55

SHA512
b64d6c8db2efa271360527becbead5446a6eb96228a3c6caf5a32c08bfc3c7bca68d899a5fe36bc6fc07c256ce1642704b3c7a2b8ba0791eeaf711e44d442fd4

Download Submit
/data/user/0/com.eui_connectivity3/[email protected]

Filesize
525KB

MD5
efa97f02f98a44d1be43a89171697100

SHA1
02e6956b620706e2d7a4fcfb29e741e8e13e9743

SHA256
35e45bc9e9f39382a94eebb50edbc834f4f3783adb4fcc56e81d889c4b436a23

SHA512
d6f6b73f34590f1add4143f43eaf2f2c6ebf175fe2c3b99d49a9df6b8c7491ee707142ccfd4c7c2594274ee497407071ee3f1219cdf6f0bdef1e2bda79d6ca46

Download Submit
/data/user/0/com.eui_connectivity3/app_shoot/Lw.json

Filesize
1KB

MD5
a6e5211329a42774b7cf03cd734d22d7

SHA1
ee7c103429b4c51d1a8823ab73cb6c0ee0621f8c

SHA256
d82cd294c3403b0df37def2a826f28df28dad17283a9267fb660dbb013ffefd1

SHA512
e028c421ee24200c2a20fded2650c02576bab97254dd282efd46ef87b5b03d1578f7340ce26c568353aced2c3cbd10a8990ef12c0e773f82c230679f554f0b09

Download Submit

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads