octo | 0d06dfbe7bc873a6037fa6398bbb0f7d9aec4da52491553b4e8a4e4de3920e30

Analysis

max time kernel
16s
max time network
30s
platform
android-10_x64
resource
android-x64-20240910-en
resource tags

arch:x64arch:x86image:android-x64-20240910-enlocale:en-usos:android-10-x64system
submitted
09-01-2025 17:28

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

0d06dfbe7bc873a6037fa6398bbb0f7d9aec4da52491553b4e8a4e4de3920e30.apk
Size

9.4MB
MD5

254702b67d41f8fdb330cc3bd71619cc
SHA1

0374b6e57038a5666273e6ab94013ff83c10f8e8
SHA256

0d06dfbe7bc873a6037fa6398bbb0f7d9aec4da52491553b4e8a4e4de3920e30
SHA512

d5935ed3e67c03344f4dd293284fd8e3a8083f54a5e088e8122ce91a1750ec1cff61ca8d20a79646aa89d705dcc7e0667e8b8d48909630cb160999bbc51836b1
SSDEEP

196608:NR857ej7ZRKUhrADpTGmhcgNa2dscgwdW:NR855ArKp6wcgNa2xgIW

Score

10^/10

octo banker collection credential_access discovery evasion impact infostealer persistence rat trojan

Malware Config

Extracted

Family

octo

AES_key

Signatures

Octo
Octo is a banking malware with remote access capabilities first seen in April 2022.
banker trojan infostealer rat octo
Octo family
octo

Octo payload 1 IoCs

resource	yara_rule
behavioral2/memory/5068-1.dex	family_octo

Loads dropped Dex/Jar 1 TTPs 2 IoCs

Runs executable file dropped to the device during analysis.

evasion

Download New Code at Runtime

T1407

ioc	pid	Process
/data/user/0/com.ipservicepush_provider81/app_veteran/lseRux.json	5068	com.ipservicepush_provider81
/data/user/0/com.ipservicepush_provider81/[email protected]	5068	com.ipservicepush_provider81

Makes use of the framework's Accessibility service 4 TTPs 2 IoCs

Retrieves information displayed on the phone screen using AccessibilityService.

collection evasion credential_access

Input Injection

T1516

Screen Capture

T1513

Keylogging

T1417.001

GUI Input Capture

T1417.002

description	ioc	Process
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId	com.ipservicepush_provider81
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByViewId	com.ipservicepush_provider81

Obtains sensitive information copied to the device clipboard 2 TTPs 1 IoCs

Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.

collection credential_access impact

Clipboard Data

T1414

Transmitted Data Manipulation

T1641.001

description	ioc	Process
Framework service call	android.content.IClipboard.addPrimaryClipChangedListener	com.ipservicepush_provider81

Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
banker discovery

Security Software Discovery
T1418.001
Queries the phone number (MSISDN for GSM devices) 1 TTPs
discovery

System Network Configuration Discovery
T1422

Acquires the wake lock 1 IoCs

description	ioc	Process
Framework service call	android.os.IPowerManager.acquireWakeLock	com.ipservicepush_provider81

Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs

Application may abuse the framework's foreground service to continue running in the foreground.

evasion persistence

Foreground Persistence

T1541

description	ioc	Process
Framework service call	android.app.IActivityManager.setServiceForeground	com.ipservicepush_provider81

Queries the mobile country code (MCC) 1 TTPs 1 IoCs

discovery

System Network Configuration Discovery

T1422

description	ioc	Process
Framework service call	com.android.internal.telephony.ITelephony.getNetworkCountryIsoForPhone	com.ipservicepush_provider81

Reads information about phone network operator. 1 TTPs
discovery

System Network Configuration Discovery
T1422

Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs

persistence

Broadcast Receivers

T1624.001

description	ioc	Process
Framework service call	android.app.IActivityManager.registerReceiver	com.ipservicepush_provider81

Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs

impact

Data Encrypted for Impact

T1471

description	ioc	Process
Framework API call	javax.crypto.Cipher.doFinal	com.ipservicepush_provider81

Checks CPU information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/cpuinfo	com.ipservicepush_provider81

Checks memory information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/meminfo	com.ipservicepush_provider81

com.ipservicepush_provider81
1⤵
- Loads dropped Dex/Jar
- Makes use of the framework's Accessibility service
- Obtains sensitive information copied to the device clipboard
- Acquires the wake lock
- Makes use of the framework's foreground persistence service
- Queries the mobile country code (MCC)
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Uses Crypto APIs (Might try to encrypt user data)
- Checks CPU information
- Checks memory information
PID:5068

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Event Triggered Execution

T1624

Broadcast Receivers

T1624.001

Foreground Persistence

T1541

Privilege Escalation

Defense Evasion

Download New Code at Runtime

T1407

Foreground Persistence

T1541

Input Injection

T1516

Virtualization/Sandbox Evasion

T1633

System Checks

T1633.001

Credential Access

Clipboard Data

T1414

Input Capture

T1417

GUI Input Capture

T1417.002

Keylogging

T1417.001

Discovery

Software Discovery

T1418

Security Software Discovery

T1418.001

System Information Discovery

T1426

System Network Configuration Discovery

T1422

Lateral Movement

Collection

Clipboard Data

T1414

Input Capture

T1417

GUI Input Capture

T1417.002

Keylogging

T1417.001

Screen Capture

T1513

Command and Control

Exfiltration

Impact

Data Encrypted for Impact

T1471

Data Manipulation

T1641

Transmitted Data Manipulation

T1641.001

Input Injection

T1516

Replay Monitor

Loading Replay Monitor...

Downloads

/data/data/com.ipservicepush_provider81/.global.com.ipservicepush_provider81

Filesize
48B

MD5
046a414913add6f5bb60072c7db819b6

SHA1
451ee4f6809260aec622d772fd329c7d0297a842

SHA256
b66c1320cb063a1d391c94273572ea6edae76c8c8b0a07f8d75c88686f0df72a

SHA512
4e6355f3051ed5e811ab030abde1f5be7f5e1cf33be99cd08477e9b6c015deb1d8bd75a09fb9c7176b8511c5ad0a67abc0902a3531e97564ccb6afc57496a47c

Download Submit
/data/data/com.ipservicepush_provider81/app_veteran/lseRux.json

Filesize
1021B

MD5
07427a5795d6b775334706bf0297d548

SHA1
0d071478c68581145c3030c70755a6d9cfe9a574

SHA256
224f20269e9fdfd3544c1abc7d92f3b066be2129eed7e7d95e6bd85b74006132

SHA512
355b4d8a1c9914fc2f3fccb513edda10d747db9bf155cf1f70c5daf8bde942d2d0a184033d981fcfdee53eb52ef06d9a4fbe8fbd2cf66c84121504331a07ff57

Download Submit
/data/data/com.ipservicepush_provider81/app_veteran/lseRux.json

Filesize
1021B

MD5
11ebf0d2660e1a7f2610f20b4b30c037

SHA1
7a0dee3217f4f49ea7d72d4fd3075b94c8459055

SHA256
20fc8cae69a65b8827e2eda8ace84a86719af14c13e9637555705bafc3d15502

SHA512
823d209d1e0e08f52045c1fc5310afdcfb437e421f5aea96071e39f73a6545f4336137bf0b1db0aa0f357f0714c81e7bd1c4ca5989e17353455235854d5bfef3

Download Submit
/data/data/com.ipservicepush_provider81/files/.l

Filesize
322KB

MD5
77dc50489b9323274732d27dc8a4e803

SHA1
0e02a3595b62489d0739d771881da8604d117c65

SHA256
c5684e792d1ebefea6aac09fed45911703fd58c899f8a08133d49dd91429a820

SHA512
0684a92f3e9c525384cfa53f531afba61e5930e1c27032a7e27e3315f72761b62e122dc34768d8162ba08f9bed53d148aa8dc034b46456bdd211f230637eba58

Download Submit
/data/data/com.ipservicepush_provider81/oat/x86_64/[email protected]

Filesize
309B

MD5
f3e0d9882689d0f67f16a1fa778a7b3d

SHA1
215c5fac11476c49b1893f8aedcaaa3761e15053

SHA256
9cfe389b6e6306f7976cb95b0a080acb03f7dadf224d19cd881148ede025bb5b

SHA512
aed419a1be0a17ead5e6b9209be1026ff30f0d2e26f1416be7e9f72f74b1eacb5384550f95bb6baa9667cae5bb84ddfe571cd682b8206830e7907d7d0e4e725e

Download Submit
/data/user/0/com.ipservicepush_provider81/[email protected]

Filesize
526KB

MD5
a89d7a0ec6e1f9c519b21d59c26301d2

SHA1
46907771e52fb16c9fa8b8bb192ca8a54b10e32d

SHA256
3f62c5568a0977c4f15eff4a853283ed6f02d500eab6df67b3399346343e145c

SHA512
01daa56000d23f0b981e46c6ce9ff8deb4e907ca5d26f8bfa440f767f5b62304cf483d39aa360ebc445f743bf74766038a5867bee45fceeedf8912df4e438d2c

Download Submit
/data/user/0/com.ipservicepush_provider81/app_veteran/lseRux.json

Filesize
1KB

MD5
8b80ea491a41063dea42fbdcaf757c9c

SHA1
73c492dcf2453e69e04a2a5544f1dac6bc27347d

SHA256
a04f29d104331c639f78ac01e1c6a92213102c035fa07b24e26b27cdedd6740f

SHA512
fedefa3792eb49b2e13b22fc84cc7d08676e3707c93f19ef74807cf92e0783dd775317fc69999e79681749128c4aab947b02240d603edc37c4d193a78bd4227d

Download Submit

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads