octo | c37094e73d5cc3afce87d3e062e9beec336d78ab5442f2f0494fb27d2384c3e3

Analysis

max time kernel
21s
max time network
24s
platform
android-13_x64
resource
android-33-x64-arm64-20240910-en
resource tags

arch:arm64arch:x64arch:x86image:android-33-x64-arm64-20240910-enlocale:en-usos:android-13-x64system
submitted
21/03/2025, 19:29

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

base.apk
Size

7.2MB
MD5

17a9ed52eee6e341186113e7e3d58555
SHA1

afa0bb602aa87ac73018859557d7f94ab971a880
SHA256

c37094e73d5cc3afce87d3e062e9beec336d78ab5442f2f0494fb27d2384c3e3
SHA512

69e7c4ff458e47e5754206a2b441910866679cb2a40b12b0d9039ed5ef1c716d4e0f7ba146c0473f5fe71c9d2b39ae05da1c6a99865414b819680ed0942986a9
SSDEEP

98304:uS+rSSETRRMQ3XnRsz4EkVKX95iSRGP36Lec3GqehlipqH8xDF:urxYr3XnRyjkUtr3ec3GqehlE

Score

10^/10

octo banker collection credential_access defense_evasion discovery evasion impact infostealer persistence rat trojan

Malware Config

Extracted

Family

octo

AES_key

Signatures

Octo
Octo is a banking malware with remote access capabilities first seen in April 2022.
banker trojan infostealer rat octo
Octo family
octo

Octo payload 1 IoCs

resource	yara_rule
behavioral1/memory/4449-1.dex	family_octo

Loads dropped Dex/Jar 1 TTPs 2 IoCs

Runs executable file dropped to the device during analysis.

evasion

Download New Code at Runtime

T1407

ioc	pid	Process
/data/user/0/com.cdmanual_multi49/app_drive/dJc.json	4449	com.cdmanual_multi49
/data/user/0/com.cdmanual_multi49/[email protected]	4449	com.cdmanual_multi49

Makes use of the framework's Accessibility service 4 TTPs 1 IoCs

Retrieves information displayed on the phone screen using AccessibilityService.

collection defense_evasion credential_access

Input Injection

T1516

Screen Capture

T1513

Keylogging

T1417.001

GUI Input Capture

T1417.002

description	ioc	Process
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId	com.cdmanual_multi49

Obtains sensitive information copied to the device clipboard 2 TTPs 1 IoCs

Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.

collection credential_access impact

Clipboard Data

T1414

Transmitted Data Manipulation

T1641.001

description	ioc	Process
Framework service call	android.content.IClipboard.addPrimaryClipChangedListener	com.cdmanual_multi49

Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
banker discovery

Security Software Discovery
T1418.001
Queries the phone number (MSISDN for GSM devices) 1 TTPs
discovery

System Network Configuration Discovery
T1422

Acquires the wake lock 1 IoCs

description	ioc	Process
Framework service call	android.os.IPowerManager.acquireWakeLock	com.cdmanual_multi49

Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs

Application may abuse the framework's foreground service to continue running in the foreground.

defense_evasion persistence

Foreground Persistence

T1541

description	ioc	Process
Framework service call	android.app.IActivityManager.setServiceForeground	com.cdmanual_multi49

Queries the mobile country code (MCC) 1 TTPs 1 IoCs

discovery

System Network Configuration Discovery

T1422

description	ioc	Process
Framework service call	com.android.internal.telephony.ITelephony.getNetworkCountryIsoForPhone	com.cdmanual_multi49

Reads information about phone network operator. 1 TTPs
discovery

System Network Configuration Discovery
T1422

Requests disabling of battery optimizations (often used to enable hiding in the background). 1 TTPs 1 IoCs

defense_evasion

User Evasion

T1628.002

description	ioc	Process
Intent action	android.settings.REQUEST_IGNORE_BATTERY_OPTIMIZATIONS	com.cdmanual_multi49

Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs

impact

Data Encrypted for Impact

T1471

description	ioc	Process
Framework API call	javax.crypto.Cipher.doFinal	com.cdmanual_multi49

Checks CPU information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/cpuinfo	com.cdmanual_multi49

Checks memory information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/meminfo	com.cdmanual_multi49

com.cdmanual_multi49
1⤵
- Loads dropped Dex/Jar
- Makes use of the framework's Accessibility service
- Obtains sensitive information copied to the device clipboard
- Acquires the wake lock
- Makes use of the framework's foreground persistence service
- Queries the mobile country code (MCC)
- Requests disabling of battery optimizations (often used to enable hiding in the background).
- Uses Crypto APIs (Might try to encrypt user data)
- Checks CPU information
- Checks memory information
PID:4449

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Foreground Persistence

T1541

Privilege Escalation

Defense Evasion

Download New Code at Runtime

T1407

Foreground Persistence

T1541

Hide Artifacts

T1628

User Evasion

T1628.002

Input Injection

T1516

Virtualization/Sandbox Evasion

T1633

System Checks

T1633.001

Credential Access

Clipboard Data

T1414

Input Capture

T1417

GUI Input Capture

T1417.002

Keylogging

T1417.001

Discovery

Software Discovery

T1418

Security Software Discovery

T1418.001

System Information Discovery

T1426

System Network Configuration Discovery

T1422

Lateral Movement

Collection

Clipboard Data

T1414

Input Capture

T1417

GUI Input Capture

T1417.002

Keylogging

T1417.001

Screen Capture

T1513

Command and Control

Exfiltration

Impact

Data Encrypted for Impact

T1471

Data Manipulation

T1641

Transmitted Data Manipulation

T1641.001

Input Injection

T1516

Replay Monitor

Loading Replay Monitor...

Downloads

/data/data/com.cdmanual_multi49/.global.com.cdmanual_multi49

Filesize
48B

MD5
046a414913add6f5bb60072c7db819b6

SHA1
451ee4f6809260aec622d772fd329c7d0297a842

SHA256
b66c1320cb063a1d391c94273572ea6edae76c8c8b0a07f8d75c88686f0df72a

SHA512
4e6355f3051ed5e811ab030abde1f5be7f5e1cf33be99cd08477e9b6c015deb1d8bd75a09fb9c7176b8511c5ad0a67abc0902a3531e97564ccb6afc57496a47c

Download Submit
/data/data/com.cdmanual_multi49/app_drive/dJc.json

Filesize
1003B

MD5
41dcc20d99346367b44245adb2b617e3

SHA1
989e053b1c523138209358d48ca693d0572b51d9

SHA256
2bb7b53c37f2e40b5d15a10cfa4c9609c2730ab85872e925ec85e4646362573a

SHA512
c9fc63e5a4292cef938a147818b3c12802492d2cbaa025117bc2cfd73b4552a394102df45c18570b62570832cc0945f2a513caedb768b0a4599d26e78ced02c2

Download Submit
/data/data/com.cdmanual_multi49/app_drive/dJc.json

Filesize
1003B

MD5
da1f687d1d5cd86fabe7129660627460

SHA1
583dbcc025a3bf69f9386b3a1f144c279ef3221e

SHA256
0692b3496bcb9b03e3335c209ee1e8af3b0ce8c6438831f47b1f2bf342d948c9

SHA512
ef3be527a096685e407d9e1ed1703b98f5000202bdaf81930e402dcbce63e13d693aed75a13b8c2be0c8d39d9c62131689f86e0046a59a21beef704f49a81c2d

Download Submit
/data/data/com.cdmanual_multi49/files/.y

Filesize
322KB

MD5
77dc50489b9323274732d27dc8a4e803

SHA1
0e02a3595b62489d0739d771881da8604d117c65

SHA256
c5684e792d1ebefea6aac09fed45911703fd58c899f8a08133d49dd91429a820

SHA512
0684a92f3e9c525384cfa53f531afba61e5930e1c27032a7e27e3315f72761b62e122dc34768d8162ba08f9bed53d148aa8dc034b46456bdd211f230637eba58

Download Submit
/data/data/com.cdmanual_multi49/oat/x86_64/[email protected]

Filesize
13KB

MD5
dba3ecba3cc6ee1f1af1172e29529bc6

SHA1
0a067871552267a0877ceb65d50cd8e03faf0884

SHA256
12bef3546fcf3ed25eb9892872608343e1fe963d0420cae6d641f45536157708

SHA512
1a81e01636585bbbd227fd56b6370867f257eb2e63de4cf294458a43966fedf434d0d97121049b2afcbdfbbc41320359d62cfb56f56bfdb1f8aa7a78508621ba

Download Submit
/data/user/0/com.cdmanual_multi49/[email protected]

Filesize
528KB

MD5
103c179828a0e2dd63f9914f7030e041

SHA1
e3396837c89f60474b4a11d0388c477240d6598c

SHA256
687be957dd5f9cfe8aa61e50a70db9e1ec73e9fe9ae94c033b5dd4b5f0eab171

SHA512
6f320258ec0be9f50f767db4a18ce1915d883117590f37992eea4cc2d35799fd222cb182194805dde01633fe29572ceb8bb678afc6d269e93e2a022e77f123c3

Download Submit
/data/user/0/com.cdmanual_multi49/app_drive/dJc.json

Filesize
1KB

MD5
1e7dddc013ae20746eef20845a80e1e2

SHA1
78bf31ff2a283ca135fe0de061890aced33a661f

SHA256
d8972aa3554258c89355ed98058cd9e84ec5ed675deab4d1af0ab6c7862c64d9

SHA512
9ccef5140cdd916789ae48038edf72ac4559722b5a94c83262b6fe5e9242fbf14fe11c2a2e381e06d861c347c89776e0c726888a79ff0a02fde3609776054e7f

Download Submit

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads