octo | cfd13962829901068562d55a62007e59a04533ef37e683c18f668f4b9b631681

Resubmissions

04/02/2025, 06:10

250204-gxhy9sxrcz 10

15/01/2025, 12:52

250115-p37htasrfs 10

Analysis

max time kernel
147s
max time network
157s
platform
android_x64
resource
android-x64-20240624-en
resource tags

androidarch:x64arch:x86image:android-x64-20240624-enlocale:en-usos:android-10-x64system
submitted
04/02/2025, 06:10

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

cfd13962829901068562d55a62007e59a04533ef37e683c18f668f4b9b631681.apk
Size

7.6MB
MD5

b7761d4018845e498ef5346fe7df5046
SHA1

8ee9f8d38a8346285ab4620ab62eb1682b2b51f7
SHA256

cfd13962829901068562d55a62007e59a04533ef37e683c18f668f4b9b631681
SHA512

2bfffb7148d72eb04410aea19ddb2d7c43822da1a7d25e6631c1b0a7fbdf10b0d5892bffa82630798da8625c1e9a2c4c1defe03f068ce10da86b81543506a399
SSDEEP

98304:01l5iSRGOiEOs1ZTH5G0RsaNSt8j70VKLxSiAvQdlyD:01lrHT5G0R7guj70U0iEQo

Score

10^/10

octo banker collection credential_access defense_evasion discovery evasion impact infostealer persistence rat trojan

Malware Config

Extracted

Family

octo

https://b2d15224225548484ecbeb5d3b7870fd.eu

https://3b1ddc0387d98eadecd75dbd5d20cda9.monster

AES_key

Signatures

Octo
Octo is a banking malware with remote access capabilities first seen in April 2022.
banker trojan infostealer rat octo
Octo family
octo

Octo payload 1 IoCs

resource	yara_rule
behavioral1/memory/5050-1.dex	family_octo

Loads dropped Dex/Jar 1 TTPs 2 IoCs

Runs executable file dropped to the device during analysis.

evasion

Download New Code at Runtime

T1407

ioc	pid	Process
/data/user/0/com.xaapplication_notesi/app_invest/ys.json	5050	com.xaapplication_notesi
/data/user/0/com.xaapplication_notesi/[email protected]	5050	com.xaapplication_notesi

Makes use of the framework's Accessibility service 4 TTPs 2 IoCs

Retrieves information displayed on the phone screen using AccessibilityService.

collection defense_evasion credential_access

Input Injection

T1516

Screen Capture

T1513

Keylogging

T1417.001

GUI Input Capture

T1417.002

description	ioc	Process
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId	com.xaapplication_notesi
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByViewId	com.xaapplication_notesi

Obtains sensitive information copied to the device clipboard 2 TTPs 1 IoCs

Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.

collection credential_access impact

Clipboard Data

T1414

Transmitted Data Manipulation

T1641.001

description	ioc	Process
Framework service call	android.content.IClipboard.addPrimaryClipChangedListener	com.xaapplication_notesi

Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
banker discovery

Security Software Discovery
T1418.001
Queries the phone number (MSISDN for GSM devices) 1 TTPs
discovery

System Network Configuration Discovery
T1422

Acquires the wake lock 1 IoCs

description	ioc	Process
Framework service call	android.os.IPowerManager.acquireWakeLock	com.xaapplication_notesi

Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs

Application may abuse the framework's foreground service to continue running in the foreground.

defense_evasion persistence

Foreground Persistence

T1541

description	ioc	Process
Framework service call	android.app.IActivityManager.setServiceForeground	com.xaapplication_notesi

Queries the mobile country code (MCC) 1 TTPs 1 IoCs

discovery

System Network Configuration Discovery

T1422

description	ioc	Process
Framework service call	com.android.internal.telephony.ITelephony.getNetworkCountryIsoForPhone	com.xaapplication_notesi

Reads information about phone network operator. 1 TTPs
discovery

System Network Configuration Discovery
T1422

Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs

persistence

Broadcast Receivers

T1624.001

description	ioc	Process
Framework service call	android.app.IActivityManager.registerReceiver	com.xaapplication_notesi

Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs

impact

Data Encrypted for Impact

T1471

description	ioc	Process
Framework API call	javax.crypto.Cipher.doFinal	com.xaapplication_notesi

Checks CPU information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/cpuinfo	com.xaapplication_notesi

Checks memory information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/meminfo	com.xaapplication_notesi

com.xaapplication_notesi
1⤵
- Loads dropped Dex/Jar
- Makes use of the framework's Accessibility service
- Obtains sensitive information copied to the device clipboard
- Acquires the wake lock
- Makes use of the framework's foreground persistence service
- Queries the mobile country code (MCC)
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Uses Crypto APIs (Might try to encrypt user data)
- Checks CPU information
- Checks memory information
PID:5050

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Event Triggered Execution

T1624

Broadcast Receivers

T1624.001

Foreground Persistence

T1541

Privilege Escalation

Defense Evasion

Download New Code at Runtime

T1407

Foreground Persistence

T1541

Input Injection

T1516

Virtualization/Sandbox Evasion

T1633

System Checks

T1633.001

Credential Access

Clipboard Data

T1414

Input Capture

T1417

GUI Input Capture

T1417.002

Keylogging

T1417.001

Discovery

Software Discovery

T1418

Security Software Discovery

T1418.001

System Information Discovery

T1426

System Network Configuration Discovery

T1422

Lateral Movement

Collection

Clipboard Data

T1414

Input Capture

T1417

GUI Input Capture

T1417.002

Keylogging

T1417.001

Screen Capture

T1513

Command and Control

Exfiltration

Impact

Data Encrypted for Impact

T1471

Data Manipulation

T1641

Transmitted Data Manipulation

T1641.001

Input Injection

T1516

Replay Monitor

Loading Replay Monitor...

Downloads

/data/data/com.xaapplication_notesi/.global.com.xaapplication_notesi

Filesize
48B

MD5
046a414913add6f5bb60072c7db819b6

SHA1
451ee4f6809260aec622d772fd329c7d0297a842

SHA256
b66c1320cb063a1d391c94273572ea6edae76c8c8b0a07f8d75c88686f0df72a

SHA512
4e6355f3051ed5e811ab030abde1f5be7f5e1cf33be99cd08477e9b6c015deb1d8bd75a09fb9c7176b8511c5ad0a67abc0902a3531e97564ccb6afc57496a47c

Download Submit
/data/data/com.xaapplication_notesi/app_invest/ys.json

Filesize
1014B

MD5
085e66d584e5ca8217a4184de9c19a06

SHA1
3efd05de59acfef78494801c2ba40572953cc72f

SHA256
94db9f1ee6370b276ec68468faee14cf92f0603bbe6ccede4afbdceb3bc0e4c8

SHA512
76e60c74a03dc4246b3d3e074baceb92ae20b24306193cb510446696274981cf095d0c77b3b85af656ea8ce5ac98334b65784f29b2e7669f6eb80528769147b3

Download Submit
/data/data/com.xaapplication_notesi/app_invest/ys.json

Filesize
1014B

MD5
bebc6a4f7577054d43e698f91df61391

SHA1
6f3eb27b0940d14e2718f7eda4d35146ed006004

SHA256
9f8efcb2281bb94015e8f5a733630c82dfed6585f07a1a4df1f15b19289094a6

SHA512
83ba7c68f5abbab15f04fb95e9ea0b5439317496e3ce954c8d677a8f97f00d55eff9c6cbea6c44d10890f9706fc28ca75057d980691ac9daaa8be9b0e8aef388

Download Submit
/data/data/com.xaapplication_notesi/files/.o

Filesize
322KB

MD5
77dc50489b9323274732d27dc8a4e803

SHA1
0e02a3595b62489d0739d771881da8604d117c65

SHA256
c5684e792d1ebefea6aac09fed45911703fd58c899f8a08133d49dd91429a820

SHA512
0684a92f3e9c525384cfa53f531afba61e5930e1c27032a7e27e3315f72761b62e122dc34768d8162ba08f9bed53d148aa8dc034b46456bdd211f230637eba58

Download Submit
/data/data/com.xaapplication_notesi/oat/x86_64/[email protected]

Filesize
297B

MD5
3f7f92d31ca9cb9730fa3577d551a64a

SHA1
460c0b48a0786d6134ec4befec312e07cda6a4c4

SHA256
059265a3ec331cad90740fd7459dde7bd7a28efc48f819e7e4ccd1ce3b7b3706

SHA512
e4776e1f799d890fa9b6e03dbfc77cc0c534f8067ad81e6c0a60181583c6ef4c85f5aff3f4d44b94506d698963b215c6c1ca901e29ac6f70650fda696fd0922f

Download Submit
/data/user/0/com.xaapplication_notesi/[email protected]

Filesize
526KB

MD5
b3fadd7baa42de427c805f7077fb2270

SHA1
ada8b158bdf2a2a8713471dc265cc4e1a5edcce6

SHA256
ecbaf4fd33d364493df749f76310dc21ad4ab5f39a0564e2c7f90b470d5daad3

SHA512
7f6e48a11ac67e1c47a8f9905754e13b4dffc0435a87f504480be31c52d44fdec47d6cb87148fae3b13f7944a5fd1fcc7eec9dae1c4dd1d1dfe2ceb1633dde1a

Download Submit
/data/user/0/com.xaapplication_notesi/app_invest/ys.json

Filesize
1KB

MD5
c4aeb5264ecb325e767555218239fb6a

SHA1
1140439aa33a609e98cf2daed071dfc784cab5df

SHA256
9970e7f998f05b076c13d3bf68c53331e2aa9e91adcc489cb07abdb26b9be83d

SHA512
b61341f9dfc62b16f36d025a985e53f65c8e30c030e7102ad1d1292d29e4dc8ab4379c015a198a4d3fd80cdee7eb8a9f16902a467d4bb67c9d596b8b5b07b7ae

Download Submit

Resubmissions

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads