octo | 329ecb44df0d60dd0b35ac151ba53fed792a2e6b1c2351fe1c1018795a84f61d

General

Target

329ecb44df0d60dd0b35ac151ba53fed792a2e6b1c2351fe1c1018795a84f61d.apk
Size

8.2MB
MD5

fb1baaaa69519c2e4fe75a7d357bbc5d
SHA1

b1c0c87bf3b4fedef71d9c23cc2d497969f3b84f
SHA256

329ecb44df0d60dd0b35ac151ba53fed792a2e6b1c2351fe1c1018795a84f61d
SHA512

ab86bd54cde34f74b995653eb2ad92f25571fdd9b3b64a2904411f9d376f3087f4516091a17911a84a49644981afd426125bea6fd53708d05c5a4f67fa5d5bbd
SSDEEP

98304:f4zMukWMLjQ/+A9tnksRsM3yeNeN7eur5iSRG8RVKnzjSj7TNM8VxSxg8:y/RFGr/UzWj7pe

Score

10^/10

octo banker collection credential_access discovery evasion impact infostealer persistence rat trojan

Malware Config

Extracted

Family

octo

AES_key

Signatures

Octo
Octo is a banking malware with remote access capabilities first seen in April 2022.
banker trojan infostealer rat octo
Octo family
octo

Octo payload 1 IoCs

resource	yara_rule
behavioral1/memory/4411-1.dex	family_octo

Loads dropped Dex/Jar 1 TTPs 3 IoCs

Runs executable file dropped to the device during analysis.

evasion

Download New Code at Runtime

T1407

ioc	pid	Process
/data/user/0/com.transparentmagnifier_manual17/app_thrive/chpbYU.json	4435	/system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.transparentmagnifier_manual17/app_thrive/chpbYU.json --output-vdex-fd=41 --oat-fd=42 --oat-location=/data/user/0/com.transparentmagnifier_manual17/app_thrive/oat/x86/chpbYU.odex --compiler-filter=quicken --class-loader-context=&
/data/user/0/com.transparentmagnifier_manual17/app_thrive/chpbYU.json	4411	com.transparentmagnifier_manual17
Anonymous-DexFile@0xd41f8000-0xd427bca0	4411	com.transparentmagnifier_manual17

Makes use of the framework's Accessibility service 4 TTPs 2 IoCs

Retrieves information displayed on the phone screen using AccessibilityService.

collection evasion credential_access

Input Injection

T1516

Screen Capture

T1513

Keylogging

T1417.001

GUI Input Capture

T1417.002

description	ioc	Process
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId	com.transparentmagnifier_manual17
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByViewId	com.transparentmagnifier_manual17

Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
banker discovery

Security Software Discovery
T1418.001
Queries the phone number (MSISDN for GSM devices) 1 TTPs
discovery

System Network Configuration Discovery
T1422

Acquires the wake lock 1 IoCs

description	ioc	Process
Framework service call	android.os.IPowerManager.acquireWakeLock	com.transparentmagnifier_manual17

Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs

Application may abuse the framework's foreground service to continue running in the foreground.

evasion persistence

Foreground Persistence

T1541

description	ioc	Process
Framework service call	android.app.IActivityManager.setServiceForeground	com.transparentmagnifier_manual17

Queries the mobile country code (MCC) 1 TTPs 1 IoCs

discovery

System Network Configuration Discovery

T1422

description	ioc	Process
Framework service call	com.android.internal.telephony.ITelephony.getNetworkCountryIsoForPhone	com.transparentmagnifier_manual17

Queries the unique device ID (IMEI, MEID, IMSI) 1 TTPs
discovery

System Network Configuration Discovery
T1422

Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs

persistence

Broadcast Receivers

T1624.001

description	ioc	Process
Framework service call	android.app.IActivityManager.registerReceiver	com.transparentmagnifier_manual17

Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs

impact

Data Encrypted for Impact

T1471

description	ioc	Process
Framework API call	javax.crypto.Cipher.doFinal	com.transparentmagnifier_manual17

Checks CPU information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/cpuinfo	com.transparentmagnifier_manual17

Checks memory information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/meminfo	com.transparentmagnifier_manual17

com.transparentmagnifier_manual17
1⤵
- Loads dropped Dex/Jar
- Makes use of the framework's Accessibility service
- Acquires the wake lock
- Makes use of the framework's foreground persistence service
- Queries the mobile country code (MCC)
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Uses Crypto APIs (Might try to encrypt user data)
- Checks CPU information
- Checks memory information
PID:4411
- /system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.transparentmagnifier_manual17/app_thrive/chpbYU.json --output-vdex-fd=41 --oat-fd=42 --oat-location=/data/user/0/com.transparentmagnifier_manual17/app_thrive/oat/x86/chpbYU.odex --compiler-filter=quicken --class-loader-context=&
  2⤵
  - Loads dropped Dex/Jar
  PID:4435

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Event Triggered Execution

1

T1624

Broadcast Receivers

1

T1624.001

Foreground Persistence

1

T1541

Privilege Escalation

Defense Evasion

Download New Code at Runtime

1

T1407

Foreground Persistence

Input Injection

Virtualization/Sandbox Evasion

2

T1633

System Checks

2

T1633.001

Credential Access

Input Capture

2

T1417

GUI Input Capture

1

T1417.002

Keylogging

1

T1417.001

Discovery

Software Discovery

1

T1418

Security Software Discovery

1

T1418.001

System Information Discovery

2

T1426

System Network Configuration Discovery

3

T1422

Lateral Movement

Collection

Input Capture

2

T1417

GUI Input Capture

1

T1417.002

Keylogging

Screen Capture

Command and Control

Exfiltration

Impact

Data Encrypted for Impact

Input Injection

Replay Monitor

Loading Replay Monitor...

Downloads

/data/data/com.transparentmagnifier_manual17/.global.com.transparentmagnifier_manual17

Filesize
48B

MD5
046a414913add6f5bb60072c7db819b6

SHA1
451ee4f6809260aec622d772fd329c7d0297a842

SHA256
b66c1320cb063a1d391c94273572ea6edae76c8c8b0a07f8d75c88686f0df72a

SHA512
4e6355f3051ed5e811ab030abde1f5be7f5e1cf33be99cd08477e9b6c015deb1d8bd75a09fb9c7176b8511c5ad0a67abc0902a3531e97564ccb6afc57496a47c

Download Submit
/data/data/com.transparentmagnifier_manual17/app_thrive/chpbYU.json

Filesize
1017B

MD5
2ff98efff15e58380a6492683cafc601

SHA1
7082b93d9c2ef24b50ffcf96fe1d261663ecab93

SHA256
7bf844df06b7b63401bb4b42672147fbdddef181c533db3604bee50489cf52fc

SHA512
cd949d414981293845dac7c65dd2f941fba0280d0c7e055f6d5a535fc64880f73ee2670fbaf230a2e743cf17598cf1461338c4a8e532fd17f89ef41afb390beb

Download Submit
/data/data/com.transparentmagnifier_manual17/app_thrive/chpbYU.json

Filesize
1017B

MD5
b39d1be65eb8c0af70d5ce88d785fdb3

SHA1
ef3d2a778e69a692732563a3b1c9157f1d5e6aef

SHA256
d4a7edb871d504ffd56c85e8e28deda888bb29589e5df1405be5a8f3a21c7e03

SHA512
a7e3ab6b5090dab1210d7fc8f68f7c5a676f0db818d85bbfb3edd92f5fafb8e5b8ff0058f7c4cd07e6839bc0bfa938f0278d99495b6fb9ffa74e6253f0cb3213

Download Submit
/data/data/com.transparentmagnifier_manual17/files/.j

Filesize
307KB

MD5
4e73947cabb5db3f92ca85004981b754

SHA1
6d9667fdb0280ed2dcb782b4683e422a51bdc601

SHA256
6db94232e756b90ed437f1bc87dc38cf20fb2e7c7a19a5e40c6c17254b7e234c

SHA512
be8b500a7070af1dfb53b0cf1a7b327dadc4e163a6dad905496ac228c58cd1ed87b054533917924455d35e9b300683ae33e1bcdd91935a5dbae1d693c3e13d69

Download Submit
/data/user/0/com.transparentmagnifier_manual17/app_thrive/chpbYU.json

Filesize
1KB

MD5
d4386f811eee5357f01313097f98e609

SHA1
d469065b44debae271e78e5964abf247323b2cc3

SHA256
c97603cdf8429ae324c7829013872376e7e832cf42bd3981f40ce2bd3d1ecc89

SHA512
c11cdb37fbadb0de60a7eda845b5641d8d7f44352b27ff690d2dd4a58d368df596410d3b906f9b62e05465b81e1413e441e2a259cb954c062070e5222a03e48c

Download Submit
/data/user/0/com.transparentmagnifier_manual17/app_thrive/chpbYU.json

Filesize
1KB

MD5
164e0eabd6b96c2bb181a12a13ecb2e0

SHA1
893494be5a5aeac8400eec541cc588aa98813322

SHA256
480931965f69d198a550ee43a536b626e773b544230744207d62a669b880f905

SHA512
0bc3e1ea00768a2611a47ec2c009f9bc1e477702b82d5a6b47666069e637ebd879874d70536e24b21550364a8a4aaa81d872893641f05a65202d2cc0f52d323b

Download Submit
Anonymous-DexFile@0xd41f8000-0xd427bca0

Filesize
527KB

MD5
e52213f689b051ed586601b8ab9cc9fa

SHA1
139c72156c923bc5073c25044ba640b7261c93a2

SHA256
4b6817a9277a593f9d5d4bccb400a3500bebb1a88e6b4c74fc968c889c1ba628

SHA512
4fa2c1050e1c0e28d8d017f309c8e335a49ade1a8300134cf91fedeb37273f9ec2306334fa4a79b106224db71724737ad7bf9f714eccbf2d20b976c75883eb85

Download Submit

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads