octo | 9750e65181634a0e420e02d070a986febeaf9e4bbfec2c0eb97adccee117b297

Analysis

max time kernel
149s
max time network
164s
platform
android_x64
resource
android-x64-arm64-20240624-en
resource tags

androidarch:armarch:arm64arch:x64arch:x86image:android-x64-arm64-20240624-enlocale:en-usos:android-11-x64system
submitted
21-01-2025 05:30

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

file.apk
Size

8.5MB
MD5

b07a6494e91bd310d92f1dcfbf1e5541
SHA1

d21322c9376889710996c4ce712c7f70833b4fa8
SHA256

9750e65181634a0e420e02d070a986febeaf9e4bbfec2c0eb97adccee117b297
SHA512

44a32d6b6ca50af1ebd3d9d7d71f6e2dce12527d80e55774d5ffd87ec72bac44ba49e9e311179c20c4411f5d8bb4c409a0131966458ab20fb7ff400f8b1732d8
SSDEEP

98304:jU4iYMZfmISrQZbMhbULwKbKKFVKdE1Uj7j5iSRGCi3vlWVd6bLta4RsuRjuIPBV:gAbKFU6uj7jra3d2iRdRd4osNtm

Score

10^/10

octo banker collection credential_access defense_evasion discovery evasion impact infostealer persistence rat trojan

Malware Config

Extracted

Family

octo

https://ea32b25512c7349c7e4525411ebad268.quest

AES_key

Signatures

Octo
Octo is a banking malware with remote access capabilities first seen in April 2022.
banker trojan infostealer rat octo
Octo family
octo

Octo payload 1 IoCs

resource	yara_rule
behavioral2/memory/4519-1.dex	family_octo

Loads dropped Dex/Jar 1 TTPs 2 IoCs

Runs executable file dropped to the device during analysis.

evasion

Download New Code at Runtime

T1407

ioc	pid	Process
/data/user/0/com.icalendar_knox39/app_birth/uEt.json	4519	com.icalendar_knox39
/data/user/0/com.icalendar_knox39/[email protected]	4519	com.icalendar_knox39

Makes use of the framework's Accessibility service 4 TTPs 2 IoCs

Retrieves information displayed on the phone screen using AccessibilityService.

collection defense_evasion credential_access

Input Injection

T1516

Screen Capture

T1513

Keylogging

T1417.001

GUI Input Capture

T1417.002

description	ioc	Process
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId	com.icalendar_knox39
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByViewId	com.icalendar_knox39

Obtains sensitive information copied to the device clipboard 2 TTPs 1 IoCs

Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.

collection credential_access impact

Clipboard Data

T1414

Transmitted Data Manipulation

T1641.001

description	ioc	Process
Framework service call	android.content.IClipboard.addPrimaryClipChangedListener	com.icalendar_knox39

Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
banker discovery

Security Software Discovery
T1418.001
Queries the phone number (MSISDN for GSM devices) 1 TTPs
discovery

System Network Configuration Discovery
T1422

Acquires the wake lock 1 IoCs

description	ioc	Process
Framework service call	android.os.IPowerManager.acquireWakeLock	com.icalendar_knox39

Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs

Application may abuse the framework's foreground service to continue running in the foreground.

defense_evasion persistence

Foreground Persistence

T1541

description	ioc	Process
Framework service call	android.app.IActivityManager.setServiceForeground	com.icalendar_knox39

Queries the mobile country code (MCC) 1 TTPs 1 IoCs

discovery

System Network Configuration Discovery

T1422

description	ioc	Process
Framework service call	com.android.internal.telephony.ITelephony.getNetworkCountryIsoForPhone	com.icalendar_knox39

Reads information about phone network operator. 1 TTPs
discovery

System Network Configuration Discovery
T1422

Requests disabling of battery optimizations (often used to enable hiding in the background). 1 TTPs 1 IoCs

defense_evasion

User Evasion

T1628.002

description	ioc	Process
Intent action	android.settings.REQUEST_IGNORE_BATTERY_OPTIMIZATIONS	com.icalendar_knox39

Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs

impact

Data Encrypted for Impact

T1471

description	ioc	Process
Framework API call	javax.crypto.Cipher.doFinal	com.icalendar_knox39

Checks CPU information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/cpuinfo	com.icalendar_knox39

Checks memory information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/meminfo	com.icalendar_knox39

com.icalendar_knox39
1⤵
- Loads dropped Dex/Jar
- Makes use of the framework's Accessibility service
- Obtains sensitive information copied to the device clipboard
- Acquires the wake lock
- Makes use of the framework's foreground persistence service
- Queries the mobile country code (MCC)
- Requests disabling of battery optimizations (often used to enable hiding in the background).
- Uses Crypto APIs (Might try to encrypt user data)
- Checks CPU information
- Checks memory information
PID:4519

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Foreground Persistence

T1541

Privilege Escalation

Defense Evasion

Download New Code at Runtime

T1407

Foreground Persistence

T1541

Hide Artifacts

T1628

User Evasion

T1628.002

Input Injection

T1516

Virtualization/Sandbox Evasion

T1633

System Checks

T1633.001

Credential Access

Clipboard Data

T1414

Input Capture

T1417

GUI Input Capture

T1417.002

Keylogging

T1417.001

Discovery

Software Discovery

T1418

Security Software Discovery

T1418.001

System Information Discovery

T1426

System Network Configuration Discovery

T1422

Lateral Movement

Collection

Clipboard Data

T1414

Input Capture

T1417

GUI Input Capture

T1417.002

Keylogging

T1417.001

Screen Capture

T1513

Command and Control

Exfiltration

Impact

Data Encrypted for Impact

T1471

Data Manipulation

T1641

Transmitted Data Manipulation

T1641.001

Input Injection

T1516

Replay Monitor

Loading Replay Monitor...

Downloads

/data/data/com.icalendar_knox39/.global.com.icalendar_knox39

Filesize
48B

MD5
046a414913add6f5bb60072c7db819b6

SHA1
451ee4f6809260aec622d772fd329c7d0297a842

SHA256
b66c1320cb063a1d391c94273572ea6edae76c8c8b0a07f8d75c88686f0df72a

SHA512
4e6355f3051ed5e811ab030abde1f5be7f5e1cf33be99cd08477e9b6c015deb1d8bd75a09fb9c7176b8511c5ad0a67abc0902a3531e97564ccb6afc57496a47c

Download Submit
/data/data/com.icalendar_knox39/app_birth/uEt.json

Filesize
1014B

MD5
20941d078c01a18589675ca21cae6b68

SHA1
d851f20f976d0b0542a4d89c590bd05119b72d7c

SHA256
1cdde219e08a04a0b652aa30edb017df97466b8d0b0f756a5aa8d959c38a6ec4

SHA512
7b54ef626ab47af2947f30e5b0b0be6fa86fdfc3fcf295f98521450c18734509d7e9404121c48164e831a3beebb75329f56429525a2dc2dccb00975b26dc703b

Download Submit
/data/data/com.icalendar_knox39/app_birth/uEt.json

Filesize
1014B

MD5
06b5f3a993f8feb5a6fe6a774505148a

SHA1
e3343b11aa86d218b3b571fc53780bf5a09f3e6a

SHA256
21a1e5df27910e6aed9d85c5691223debbf15ef26f3e728f2c16271cc5dadb1a

SHA512
434e466b812f0375c3d63ab1c401a92621f6b24c398c18d721f064c337f846cfcd1cba60908d22dd84015f58dad980895c8733ee8a81b16be5c6879d9c1c6752

Download Submit
/data/data/com.icalendar_knox39/files/.h

Filesize
322KB

MD5
77dc50489b9323274732d27dc8a4e803

SHA1
0e02a3595b62489d0739d771881da8604d117c65

SHA256
c5684e792d1ebefea6aac09fed45911703fd58c899f8a08133d49dd91429a820

SHA512
0684a92f3e9c525384cfa53f531afba61e5930e1c27032a7e27e3315f72761b62e122dc34768d8162ba08f9bed53d148aa8dc034b46456bdd211f230637eba58

Download Submit
/data/data/com.icalendar_knox39/oat/x86_64/[email protected]

Filesize
475B

MD5
1525b9bec0e6453cc337840f2ba0f2f0

SHA1
afffeec2be5442e143e792a55f38739e6b683441

SHA256
c9f81824c4b50cd9921f7fb160f53a55ca19f8b66890360263c2b5d8c004f089

SHA512
4dc5699a468a97908c06dc1ad35ea15fe0b832a4479dc9f78171983cb3bf18658b3c7c76073c6839cb794d3bacbd03b50c64d9577892ac04d8ec498e9dc59a9c

Download Submit
/data/user/0/com.icalendar_knox39/[email protected]

Filesize
526KB

MD5
9f0f7297a715dc172ac5581e8ef2c578

SHA1
58f9f04e9f1bf2246d1b8e83ef20e5fcacc74b2e

SHA256
01c31ff04d4fcf25c4259efa57c5d3fdf705ea31b0e6676627632036217e8556

SHA512
49c69ccc8660e7604c9b3b14255e1696a7f678edf45235536227e14a6f0eff921f86b14290af3946c1ed3174648b729df3ce9f71349356b37f10314e1cd2ca29

Download Submit
/data/user/0/com.icalendar_knox39/app_birth/uEt.json

Filesize
1KB

MD5
57c65370ba89d57eb4852b60a9021a3c

SHA1
c3043cdbc7cef8e495cc1b721f86e8e0945bfac4

SHA256
efa83223ce8b68046c9c67437ba9cdd1e76ddd33f6d08f147ce29367788aad0a

SHA512
5bd737035f3ebcdfcafbc01867e2d110945f8be7255848ce6ef055fc053a07765e0df388ddfbd8159e70fe6bc166c4ba3acfe44252923f2728139ed3b84f09c0

Download Submit

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads