octo | 19605d10876e75e584278116e31b97832c6348054c2505ae9a2aa77a3135aef6

Analysis

max time kernel
149s
max time network
155s
platform
android_x64
resource
android-33-x64-arm64-20240624-en
resource tags

androidarch:arm64arch:x64image:android-33-x64-arm64-20240624-enlocale:en-usos:android-13-x64system
submitted
27-11-2024 23:23

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

base.apk
Size

7.2MB
MD5

29ee1a7d83cdc7067a78f810e7b91b2c
SHA1

b26b7f39d151fe1ef62591934f3024e326dc81e4
SHA256

d7c65afe1247656d7c75adae815b13bd0adbca536321729651ccbcdc6a3df511
SHA512

31ecc151c44c68616024c0ac029ec1f3c71a1466b637033dbc531027b29fe3abc457e83f119865806574d7297d051cb8ba08448d0b30042f57847658ccfc3acf
SSDEEP

98304:oxPK78Kj7URsLyTuIeNeBKV25iSRGsEVK37ozxhh:sS7Bj7URTTu09r6Urozx

Score

10^/10

octo banker collection credential_access discovery evasion impact infostealer persistence rat trojan

Malware Config

Extracted

Family

octo

https://156350786312d7feba2b1c9b7577097b.com

AES_key

Signatures

Octo
Octo is a banking malware with remote access capabilities first seen in April 2022.
banker trojan infostealer rat octo
Octo family
octo

Octo payload 1 IoCs

resource	yara_rule
behavioral5/memory/4331-1.dex	family_octo

Loads dropped Dex/Jar 1 TTPs 2 IoCs

Runs executable file dropped to the device during analysis.

evasion

Download New Code at Runtime

T1407

ioc	pid	Process
/data/user/0/com.zreceiver96soundcontacts/app_latin/EJEX.json	4331	com.zreceiver96soundcontacts
/data/user/0/com.zreceiver96soundcontacts/[email protected]	4331	com.zreceiver96soundcontacts

Makes use of the framework's Accessibility service 4 TTPs 1 IoCs

Retrieves information displayed on the phone screen using AccessibilityService.

collection evasion credential_access

Input Injection

T1516

Screen Capture

T1513

Keylogging

T1417.001

GUI Input Capture

T1417.002

description	ioc	Process
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId	com.zreceiver96soundcontacts

Obtains sensitive information copied to the device clipboard 2 TTPs 1 IoCs

Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.

collection credential_access impact

Clipboard Data

T1414

Transmitted Data Manipulation

T1641.001

description	ioc	Process
Framework service call	android.content.IClipboard.addPrimaryClipChangedListener	com.zreceiver96soundcontacts

Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
banker discovery

Security Software Discovery
T1418.001
Queries the phone number (MSISDN for GSM devices) 1 TTPs
discovery

System Network Configuration Discovery
T1422

Acquires the wake lock 1 IoCs

description	ioc	Process
Framework service call	android.os.IPowerManager.acquireWakeLock	com.zreceiver96soundcontacts

Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs

Application may abuse the framework's foreground service to continue running in the foreground.

evasion persistence

Foreground Persistence

T1541

description	ioc	Process
Framework service call	android.app.IActivityManager.setServiceForeground	com.zreceiver96soundcontacts

Queries the mobile country code (MCC) 1 TTPs 1 IoCs

discovery

System Network Configuration Discovery

T1422

description	ioc	Process
Framework service call	com.android.internal.telephony.ITelephony.getNetworkCountryIsoForPhone	com.zreceiver96soundcontacts

Reads information about phone network operator. 1 TTPs
discovery

System Network Configuration Discovery
T1422

Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs

impact

Data Encrypted for Impact

T1471

description	ioc	Process
Framework API call	javax.crypto.Cipher.doFinal	com.zreceiver96soundcontacts

Checks CPU information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/cpuinfo	com.zreceiver96soundcontacts

Checks memory information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/meminfo	com.zreceiver96soundcontacts

com.zreceiver96soundcontacts
1⤵
- Loads dropped Dex/Jar
- Makes use of the framework's Accessibility service
- Obtains sensitive information copied to the device clipboard
- Acquires the wake lock
- Makes use of the framework's foreground persistence service
- Queries the mobile country code (MCC)
- Uses Crypto APIs (Might try to encrypt user data)
- Checks CPU information
- Checks memory information
PID:4331

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Foreground Persistence

T1541

Privilege Escalation

Defense Evasion

Download New Code at Runtime

T1407

Foreground Persistence

T1541

Input Injection

T1516

Virtualization/Sandbox Evasion

T1633

System Checks

T1633.001

Credential Access

Clipboard Data

T1414

Input Capture

T1417

GUI Input Capture

T1417.002

Keylogging

T1417.001

Discovery

Software Discovery

T1418

Security Software Discovery

T1418.001

System Information Discovery

T1426

System Network Configuration Discovery

T1422

Lateral Movement

Collection

Clipboard Data

T1414

Input Capture

T1417

GUI Input Capture

T1417.002

Keylogging

T1417.001

Screen Capture

T1513

Command and Control

Exfiltration

Impact

Data Encrypted for Impact

T1471

Data Manipulation

T1641

Transmitted Data Manipulation

T1641.001

Input Injection

T1516

Replay Monitor

Loading Replay Monitor...

Downloads

/data/data/com.zreceiver96soundcontacts/.global.com.zreceiver96soundcontacts

Filesize
48B

MD5
046a414913add6f5bb60072c7db819b6

SHA1
451ee4f6809260aec622d772fd329c7d0297a842

SHA256
b66c1320cb063a1d391c94273572ea6edae76c8c8b0a07f8d75c88686f0df72a

SHA512
4e6355f3051ed5e811ab030abde1f5be7f5e1cf33be99cd08477e9b6c015deb1d8bd75a09fb9c7176b8511c5ad0a67abc0902a3531e97564ccb6afc57496a47c

Download Submit
/data/data/com.zreceiver96soundcontacts/app_latin/EJEX.json

Filesize
1013B

MD5
d832a074f0c18189b8ad22fc38ed9ecb

SHA1
0a2a8aadd27593ced29b5f0dca95d3b892eb077b

SHA256
9cb827430b98aa72322c7ee02360dba91c26ad89d188e11cc65af3a7b48759d8

SHA512
1e28a3656ce9c813e2e6d9412adb9d5c66168af73f4d9f0313d1db41c502998802654075a8a50083cd4b77eee5fc4a8cd99a0f3112fb6e6db75f42e11ce7105e

Download Submit
/data/data/com.zreceiver96soundcontacts/app_latin/EJEX.json

Filesize
1013B

MD5
6e5cc4086ff2dad1000d89c97b6eb58c

SHA1
f297ebba898bc0ec9ce7d4f253cda35e98e76147

SHA256
d2bf4c155beea24c0b99dc8cca14bd0eb2c3ae90bad48499e76c8787c7b4f7be

SHA512
7f182ccca5b7ffa0fc2fbfc156ab9a34aa1366b3aae66508cb531f27cec13570c61046f395f77d9164d7a7204166e59a7bfbf8b48bdb8d5dd177c6ca746147b9

Download Submit
/data/data/com.zreceiver96soundcontacts/files/.n

Filesize
322KB

MD5
77dc50489b9323274732d27dc8a4e803

SHA1
0e02a3595b62489d0739d771881da8604d117c65

SHA256
c5684e792d1ebefea6aac09fed45911703fd58c899f8a08133d49dd91429a820

SHA512
0684a92f3e9c525384cfa53f531afba61e5930e1c27032a7e27e3315f72761b62e122dc34768d8162ba08f9bed53d148aa8dc034b46456bdd211f230637eba58

Download Submit
/data/data/com.zreceiver96soundcontacts/oat/x86_64/[email protected]

Filesize
13KB

MD5
29373ce8d64ccc3f48062afb063f8241

SHA1
bc167bf72f4445a75a458a066bff2b58e94f06dc

SHA256
760a50eb208c59b3b9af7ce8ce4004720ce906bc31ef00c334ec9635637d9e78

SHA512
6b635e81618442c3ae9f453c65effd2e820c1fc70a79a7b8f9cbbb00611511ea134654196b06e7aba5ee62901bf3093f239f000a311bbdd5ac3fa80f465e557c

Download Submit
/data/user/0/com.zreceiver96soundcontacts/[email protected]

Filesize
526KB

MD5
f7dc9528a65c9692d9c0cd1d8495cfb1

SHA1
94b04526df4a11244a07bb7eb2e43382a099954e

SHA256
ee0e5da53f5f387eff24587225a48ab1bcfc86c05d05006fe67c0929b6391be5

SHA512
73134e0124f74850ce1a369dcb6cd88f6bcd5f4ded5ddd22a0b7e7c782e8788d5f572c4ae3dc99815045f125d50898a45c152a25a55173ba6cacda8a3687f080

Download Submit
/data/user/0/com.zreceiver96soundcontacts/app_latin/EJEX.json

Filesize
1KB

MD5
8b851ae922999f19e421de87a22b6ac9

SHA1
9198fff2b4bdd9d7844492736c1e1a7d0de4666a

SHA256
8c10e7ea546ccefb5b0bd71b8ee69ce362a528d71e7aeba809c7b05b9673bb6a

SHA512
46b7e78c28b3b991898a318a921fddf5615d5497759bf25810b7de5896d62ed0818751c390e5501000ceea2b0704ed153b347cf3ec948c4dbc03e0d52ff7193e

Download Submit

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads