octo | 02f831cc5796b464bbf72faeafcf5bb4883c84e65619b51c3056729196cc25fa

Analysis

max time kernel
149s
max time network
152s
platform
android-13_x64
resource
android-33-x64-arm64-20240910-en
resource tags

arch:arm64arch:x64arch:x86image:android-33-x64-arm64-20240910-enlocale:en-usos:android-13-x64system
submitted
28-10-2024 15:41

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

02f831cc5796b464bbf72faeafcf5bb4883c84e65619b51c3056729196cc25fa.apk
Size

8.2MB
MD5

9a589df78f128d3fab2f0dae7af9fc35
SHA1

a72a1c0ce8783f233dff9532e1f50dd956458eac
SHA256

02f831cc5796b464bbf72faeafcf5bb4883c84e65619b51c3056729196cc25fa
SHA512

dd759de8688bdad62f214698d401dd4aacb7fe4afba0fc11c98eae13415aad805210fdfea601fd79a5481c240c5fc7f4397a98ac8a2dcb6f1c0bf1c3f568d467
SSDEEP

98304:9Qq+Nj7YRsLaTu83j+bfUG3kA4uwpNR5iSRGmnVKwqY5ZpqI1wZTS6gW:9fsj7YRmaT874uwp3rTUgpq3

Score

10^/10

octo banker collection credential_access discovery evasion impact infostealer persistence rat trojan

Malware Config

Extracted

Family

octo

https://de4771224a3fd26999ce5bb1aa857080.xyz

AES_key

Signatures

Octo
Octo is a banking malware with remote access capabilities first seen in April 2022.
banker trojan infostealer rat octo
Octo family
octo

Octo payload 1 IoCs

resource	yara_rule
behavioral2/memory/4513-1.dex	family_octo

Loads dropped Dex/Jar 1 TTPs 2 IoCs

Runs executable file dropped to the device during analysis.

evasion

Download New Code at Runtime

T1407

ioc	pid	Process
/data/user/0/com.health_keyh70/app_trap/sDk.json	4513	com.health_keyh70
/data/user/0/com.health_keyh70/[email protected]	4513	com.health_keyh70

Makes use of the framework's Accessibility service 4 TTPs 2 IoCs

Retrieves information displayed on the phone screen using AccessibilityService.

collection evasion credential_access

Input Injection

T1516

Screen Capture

T1513

Keylogging

T1417.001

GUI Input Capture

T1417.002

description	ioc	Process
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId	com.health_keyh70
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByViewId	com.health_keyh70

Obtains sensitive information copied to the device clipboard 2 TTPs 1 IoCs

Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.

collection credential_access impact

Clipboard Data

T1414

Transmitted Data Manipulation

T1641.001

description	ioc	Process
Framework service call	android.content.IClipboard.addPrimaryClipChangedListener	com.health_keyh70

Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
banker discovery

Security Software Discovery
T1418.001
Queries the phone number (MSISDN for GSM devices) 1 TTPs
discovery

System Network Configuration Discovery
T1422

Acquires the wake lock 1 IoCs

description	ioc	Process
Framework service call	android.os.IPowerManager.acquireWakeLock	com.health_keyh70

Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs

Application may abuse the framework's foreground service to continue running in the foreground.

evasion persistence

Foreground Persistence

T1541

description	ioc	Process
Framework service call	android.app.IActivityManager.setServiceForeground	com.health_keyh70

Queries the mobile country code (MCC) 1 TTPs 1 IoCs

discovery

System Network Configuration Discovery

T1422

description	ioc	Process
Framework service call	com.android.internal.telephony.ITelephony.getNetworkCountryIsoForPhone	com.health_keyh70

Reads information about phone network operator. 1 TTPs
discovery

System Network Configuration Discovery
T1422

Requests disabling of battery optimizations (often used to enable hiding in the background). 1 TTPs 1 IoCs

evasion

User Evasion

T1628.002

description	ioc	Process
Intent action	android.settings.REQUEST_IGNORE_BATTERY_OPTIMIZATIONS	com.health_keyh70

Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs

impact

Data Encrypted for Impact

T1471

description	ioc	Process
Framework API call	javax.crypto.Cipher.doFinal	com.health_keyh70

Checks CPU information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/cpuinfo	com.health_keyh70

Checks memory information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/meminfo	com.health_keyh70

com.health_keyh70
1⤵
- Loads dropped Dex/Jar
- Makes use of the framework's Accessibility service
- Obtains sensitive information copied to the device clipboard
- Acquires the wake lock
- Makes use of the framework's foreground persistence service
- Queries the mobile country code (MCC)
- Requests disabling of battery optimizations (often used to enable hiding in the background).
- Uses Crypto APIs (Might try to encrypt user data)
- Checks CPU information
- Checks memory information
PID:4513

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Foreground Persistence

T1541

Privilege Escalation

Defense Evasion

Download New Code at Runtime

T1407

Foreground Persistence

T1541

Hide Artifacts

T1628

User Evasion

T1628.002

Input Injection

T1516

Virtualization/Sandbox Evasion

T1633

System Checks

T1633.001

Credential Access

Clipboard Data

T1414

Input Capture

T1417

GUI Input Capture

T1417.002

Keylogging

T1417.001

Discovery

Software Discovery

T1418

Security Software Discovery

T1418.001

System Information Discovery

T1426

System Network Configuration Discovery

T1422

Lateral Movement

Collection

Clipboard Data

T1414

Input Capture

T1417

GUI Input Capture

T1417.002

Keylogging

T1417.001

Screen Capture

T1513

Command and Control

Exfiltration

Impact

Data Encrypted for Impact

T1471

Data Manipulation

T1641

Transmitted Data Manipulation

T1641.001

Input Injection

T1516

Replay Monitor

Loading Replay Monitor...

Downloads

/data/data/com.health_keyh70/.global.com.health_keyh70

Filesize
48B

MD5
046a414913add6f5bb60072c7db819b6

SHA1
451ee4f6809260aec622d772fd329c7d0297a842

SHA256
b66c1320cb063a1d391c94273572ea6edae76c8c8b0a07f8d75c88686f0df72a

SHA512
4e6355f3051ed5e811ab030abde1f5be7f5e1cf33be99cd08477e9b6c015deb1d8bd75a09fb9c7176b8511c5ad0a67abc0902a3531e97564ccb6afc57496a47c

Download Submit
/data/data/com.health_keyh70/app_trap/sDk.json

Filesize
1004B

MD5
f20488ddf65be79ffb462b0adda4c495

SHA1
5bb4cd64b787b6f100e57b869d9fc1369a157af2

SHA256
e93f9422468283f91e22d4390bf35fdfeeaa8c5d55c4c25ce6fb81c94a67bdd3

SHA512
603e794af120114e15692de567d405177de9c6f69e0160b2e8f3850138973bc1f66c6972800687c0a398ee752fa20e204fc42c328b5d50f11e58ff108baec68e

Download Submit
/data/data/com.health_keyh70/app_trap/sDk.json

Filesize
1004B

MD5
19ecaafcb1b0449298aae4f927acaa7f

SHA1
0b73fcd2b74111d83150be21c3a05728ddf6898d

SHA256
4f25944e286b563c7276fbfedb84abd98ac434d25443306a98d65c4449fee524

SHA512
d0d8c4b02ebfb1474f96a33bf45a141ad524ef3744ea8e21442b4b731cc50a029506d0564ba4581022fa928b9d45669879926e963846eada5617ed94d128a6ac

Download Submit
/data/data/com.health_keyh70/files/.u

Filesize
322KB

MD5
77dc50489b9323274732d27dc8a4e803

SHA1
0e02a3595b62489d0739d771881da8604d117c65

SHA256
c5684e792d1ebefea6aac09fed45911703fd58c899f8a08133d49dd91429a820

SHA512
0684a92f3e9c525384cfa53f531afba61e5930e1c27032a7e27e3315f72761b62e122dc34768d8162ba08f9bed53d148aa8dc034b46456bdd211f230637eba58

Download Submit
/data/data/com.health_keyh70/oat/x86_64/[email protected]

Filesize
13KB

MD5
e42be84c064650bf0a82bd802dd5ba1d

SHA1
bbb6d7efe29e8137386f022be535fc2a4a58c48a

SHA256
215c633df1df9539748fe39562f37af31b58adea8665e84fe9629c6ec143648d

SHA512
bec7bca5e8cb424aeef05dad8970d03fe90e2cd456eb9308fdecc8530d9fe8ae1e322f01e37348e398107234b6b579948c6c3353df3d83d1a5e63c9bfb2532c2

Download Submit
/data/user/0/com.health_keyh70/[email protected]

Filesize
525KB

MD5
ca729502dc8f544c301702fa07f596bc

SHA1
d0fd3472f7749ba311315c42c51afa7a515b6721

SHA256
72d4d71326389418a82bedd758dd631f38d52ae7a59a41eeb8cc45d3f681c219

SHA512
e27f9b131aa5cb3d228189ed072b007bc688f3e4d45ea83f8cb00c6f3f4feb31265dac152689012f7a8d0bc87eff64178af791ff26e1d367963e8cd260d0a1dd

Download Submit
/data/user/0/com.health_keyh70/app_trap/sDk.json

Filesize
1KB

MD5
a7e250b81a371f3a2942bbbbb7a3ee4c

SHA1
a1e5e43f560fb7b907773a3fa8f5f49ee10ce615

SHA256
b0db6b82158593f505402fd73e37f055e56e72162007ed5599ea523c78171ce3

SHA512
a80b1738584208b03cf12d5b9b208dc9497ffea7f4241947aaa92a75cdcf07c4e34ea7ceeff8995f3779953a250efa42f91c79379ba9c5faa1f50242fafb4c27

Download Submit

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads