octo | 70669962dd62ec1c8ed8f8f96d66d7241da269be6a215b822a82d43d17e14875

Analysis

max time kernel
149s
max time network
151s
platform
android-11_x64
resource
android-x64-arm64-20240910-en
resource tags

arch:armarch:arm64arch:x64arch:x86image:android-x64-arm64-20240910-enlocale:en-usos:android-11-x64system
submitted
24/03/2025, 22:08

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

70669962dd62ec1c8ed8f8f96d66d7241da269be6a215b822a82d43d17e14875.apk
Size

1.8MB
MD5

5cf0bf5916fe257db804d47400e5f07a
SHA1

23cc43b1aeffad2185ad28f52c6e6f205a0e21b5
SHA256

70669962dd62ec1c8ed8f8f96d66d7241da269be6a215b822a82d43d17e14875
SHA512

457360401d6098498f14479ed7d89203730ca24012a21239f1d122e72458671adc79de5493b8f2a62be568813a227f66bfdb64bce886811309d400f6211201dd
SSDEEP

49152:VSTNn5tnx9f5GxYki525xyqyUWK5XuZGZbmq4CiNhAE4KoS3:VST9xGCkQhYXuZQ/4gy

Score

10^/10

octo banker collection credential_access defense_evasion discovery evasion impact infostealer persistence rat trojan

Malware Config

Extracted

Family

octo

https://zaglefolki1.info/MTU2OWE0NzJjNGY5/

https://passajire555.live/MTU2OWE0NzJjNGY5/

https://majestike8ca.top/MTU2OWE0NzJjNGY5/

https://jikugac818v.vip/MTU2OWE0NzJjNGY5/

https://5a9udxg6l6gd.su/MTU2OWE0NzJjNGY5/

rc4.plain

Extracted

Family

octo

https://zaglefolki1.info/MTU2OWE0NzJjNGY5/

https://passajire555.live/MTU2OWE0NzJjNGY5/

https://majestike8ca.top/MTU2OWE0NzJjNGY5/

https://jikugac818v.vip/MTU2OWE0NzJjNGY5/

https://5a9udxg6l6gd.su/MTU2OWE0NzJjNGY5/

AES_key

Signatures

Octo
Octo is a banking malware with remote access capabilities first seen in April 2022.
banker trojan infostealer rat octo
Octo family
octo

Octo payload 1 IoCs

resource	yara_rule
behavioral2/files/fstream-3.dat	family_octo

Loads dropped Dex/Jar 1 TTPs 3 IoCs

Runs executable file dropped to the device during analysis.

evasion

Download New Code at Runtime

T1407

ioc	pid	Process
/data/user/0/com.completebe0/app_DynamicOptDex/ATutCXu.json	4605	com.completebe0
/data/user/0/com.completebe0/cache/bhvbn	4605	com.completebe0
/data/user/0/com.completebe0/cache/bhvbn	4605	com.completebe0

Makes use of the framework's Accessibility service 4 TTPs 2 IoCs

Retrieves information displayed on the phone screen using AccessibilityService.

collection defense_evasion credential_access

Input Injection

T1516

Screen Capture

T1513

Keylogging

T1417.001

GUI Input Capture

T1417.002

description	ioc	Process
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId	com.completebe0
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByViewId	com.completebe0

Obtains sensitive information copied to the device clipboard 2 TTPs 1 IoCs

Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.

collection credential_access impact

Clipboard Data

T1414

Transmitted Data Manipulation

T1641.001

description	ioc	Process
Framework service call	android.content.IClipboard.addPrimaryClipChangedListener	com.completebe0

Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
banker discovery

Security Software Discovery
T1418.001
Queries the phone number (MSISDN for GSM devices) 1 TTPs
discovery

System Network Configuration Discovery
T1422

Acquires the wake lock 1 IoCs

description	ioc	Process
Framework service call	android.os.IPowerManager.acquireWakeLock	com.completebe0

Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs

Application may abuse the framework's foreground service to continue running in the foreground.

defense_evasion persistence

Foreground Persistence

T1541

description	ioc	Process
Framework service call	android.app.IActivityManager.setServiceForeground	com.completebe0

Performs UI accessibility actions on behalf of the user 1 TTPs 3 IoCs

Application may abuse the accessibility service to prevent their removal.

evasion

Prevent Application Removal

T1629.001

ioc	Process
android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction	com.completebe0
android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction	com.completebe0
android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction	com.completebe0

Queries the mobile country code (MCC) 1 TTPs 1 IoCs

discovery

System Network Configuration Discovery

T1422

description	ioc	Process
Framework service call	com.android.internal.telephony.ITelephony.getNetworkCountryIsoForPhone	com.completebe0

Reads information about phone network operator. 1 TTPs
discovery

System Network Configuration Discovery
T1422

Requests accessing notifications (often used to intercept notifications before users become aware). 1 TTPs 1 IoCs

collection credential_access

Access Notifications

T1517

description	ioc	Process
Intent action	android.settings.ACTION_NOTIFICATION_LISTENER_SETTINGS	com.completebe0

Requests disabling of battery optimizations (often used to enable hiding in the background). 1 TTPs 1 IoCs

defense_evasion

User Evasion

T1628.002

description	ioc	Process
Intent action	android.settings.REQUEST_IGNORE_BATTERY_OPTIMIZATIONS	com.completebe0

Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs

impact

Data Encrypted for Impact

T1471

description	ioc	Process
Framework API call	javax.crypto.Cipher.doFinal	com.completebe0

Checks CPU information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/cpuinfo	com.completebe0

Checks memory information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/meminfo	com.completebe0

com.completebe0
1⤵
- Loads dropped Dex/Jar
- Makes use of the framework's Accessibility service
- Obtains sensitive information copied to the device clipboard
- Acquires the wake lock
- Makes use of the framework's foreground persistence service
- Performs UI accessibility actions on behalf of the user
- Queries the mobile country code (MCC)
- Requests accessing notifications (often used to intercept notifications before users become aware).
- Requests disabling of battery optimizations (often used to enable hiding in the background).
- Uses Crypto APIs (Might try to encrypt user data)
- Checks CPU information
- Checks memory information
PID:4605

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Foreground Persistence

T1541

Privilege Escalation

Defense Evasion

Download New Code at Runtime

T1407

Foreground Persistence

T1541

Hide Artifacts

T1628

User Evasion

T1628.002

Impair Defenses

T1629

Prevent Application Removal

T1629.001

Input Injection

T1516

Virtualization/Sandbox Evasion

T1633

System Checks

T1633.001

Credential Access

Access Notifications

T1517

Clipboard Data

T1414

Input Capture

T1417

GUI Input Capture

T1417.002

Keylogging

T1417.001

Discovery

Software Discovery

T1418

Security Software Discovery

T1418.001

System Information Discovery

T1426

System Network Configuration Discovery

T1422

Lateral Movement

Collection

Access Notifications

T1517

Clipboard Data

T1414

Input Capture

T1417

GUI Input Capture

T1417.002

Keylogging

T1417.001

Screen Capture

T1513

Command and Control

Exfiltration

Impact

Data Encrypted for Impact

T1471

Data Manipulation

T1641

Transmitted Data Manipulation

T1641.001

Input Injection

T1516

Replay Monitor

Loading Replay Monitor...

Downloads

/data/user/0/com.completebe0/app_DynamicOptDex/ATutCXu.json

Filesize
2KB

MD5
282daf6d8dd89839388965b639a83580

SHA1
543c268eca52e61887d2e4ebe6605668c5f48b49

SHA256
0a17bf7125a0752e5158922b896de9db8ffff37d0d70297ec639a4431191baf2

SHA512
38caee51a4fdef59d5692f0317a999d55ddffdfdcb711de68950dfe5ea8031d016cb43c3afab71ba58aa5b1871801e5de6fc0f5257ee24bca424961968b0b6cc

Download Submit
/data/user/0/com.completebe0/app_DynamicOptDex/ATutCXu.json

Filesize
2KB

MD5
e7337c316b76e83e1b64f50a1fffc166

SHA1
a1c2dbbf1592dc9bee1d22d0ed64486fd1f7dd67

SHA256
c8861eb75f9e8398dd6d9451120d5653a99e5318810ca20fb212a512f7c24489

SHA512
76cc12b8053a1845d447703989517bd0beaa353832c09e187479e78539e574e1ea99a42e8ba7977383f4328b1e6d1d10135f79d79eba6e169a3c6e7dd83234c6

Download Submit
/data/user/0/com.completebe0/app_DynamicOptDex/ATutCXu.json

Filesize
6KB

MD5
8e4612b5633c2f3f03aad82512e10946

SHA1
1ed04da4b21489501338b57999f858d775ff0579

SHA256
863d543d469a91d30fbf78676c5f014496fa2f36f8beda1c6f04a94fa22d6b88

SHA512
f0930dded69c9328957a170df5f78f10668aefd2e7168f6e17214169202750f7e9760dc2f6e6c0dffc593e49ee132fcbecf7597871b57dc71a8ffe958f587312

Download Submit
/data/user/0/com.completebe0/cache/bhvbn

Filesize
457KB

MD5
0f298b4d05ac13449acd725c06fa6115

SHA1
da53ed2eb6952b54799328a33fd5275e60a0fcc9

SHA256
773a283d03ea5440eebcbb72b3f98988dc66342f0a8ab6415d9a01346aa407ac

SHA512
5d12aad043cf6a5b879a8285896c9eb73ff96c4ca29de6170db77937e83edf26ebe6aae3ebbd1f8208830f7886e8ce1d64f9fa4c4eccf75f6c86e4ae99b086a5

Download Submit
/data/user/0/com.completebe0/cache/oat/bhvbn.cur.prof

Filesize
331B

MD5
91a7e6ec87c00d1a46d41039d5815ed4

SHA1
94f3108651456c3a6bea61ec24c48cfa8e5aa414

SHA256
2743f53533ec1332b261dcfbc9a8407263ad897131379f314bb8f41ad13043c0

SHA512
50db84c045f44fbc18a2a465bb7e305442053573541291eaefb43acfbfedea4139ba44be98d85fb77372c17bb5eba4bae3f1c1a5e5b9e14a5d389732012dc325

Download Submit
/data/user/0/com.completebe0/kl.txt

Filesize
466B

MD5
e4dc0f8bef755b73fe01cb9a5eb6664c

SHA1
a39b0c6b828490ff3a9f045d86574097c132aef7

SHA256
8b185de97e05bd4ea8d0f26a9a015132efb36e2f932920e4284228fe1e61aee6

SHA512
43a4926161ec9fab70d2e9a1fe33a09e6661de5ec5aa4cb75f2b255a769f7f8a23dce141fa541dcbce37b50c0a1a27265e369743ef9422c124436924e68dec43

Download Submit
/data/user/0/com.completebe0/kl.txt

Filesize
28B

MD5
6311c3fd15588bb5c126e6c28ff5fffe

SHA1
ce81d136fce31779f4dd62e20bdaf99c91e2fc57

SHA256
8b82f6032e29a2b5c96031a3630fb6173d12ff0295bc20bb21b877d08f0812d8

SHA512
2975fe2e94b6a8adc9cfc1a865ad113772b54572883a537b02a16dd2d029c0f7d9cca3b154fd849bdfe978e18b396bcf9fa6e67e7c61f92bdc089a29a9c355c6

Download Submit
/data/user/0/com.completebe0/kl.txt

Filesize
230B

MD5
3364d33216b97e0c7a121bbed53a6c4c

SHA1
0ee756459cea736038f4e78c433eb914574d04d8

SHA256
daf1d6f153287ace8060cf1c788e9d85c025b6e767e7ea7f922965e288c3bd01

SHA512
df35e0f1ad283110aa4a96efe5c1e13f3ae1ffba5844789eff41a3bdb575d0d97f977de3383dad10674a9c7d2f101254d4443e898a4445c8e290493c162f2a12

Download Submit
/data/user/0/com.completebe0/kl.txt

Filesize
64B

MD5
7abfbf057119a7c18e66d80d24060368

SHA1
74408330745b67294efa5239e207a6b2c921adb5

SHA256
d07aae5ed4b9346615e750c32e22b014d7a3ae8e36ce740f8d92a2df60c30dee

SHA512
2fab5a69e97281b2da09c1f01d83a24c26d7522ff5da3bbc5fe66b66a8c833400ad2ffd7e62530df56af566dd421645e6192f26a2e7b586ad931a75cd31396ce

Download Submit
/data/user/0/com.completebe0/kl.txt

Filesize
54B

MD5
74582c58ec263043ccb209be55d3d8b0

SHA1
0f566ed48fea7fa55c166c1480efb88cc2bebae2

SHA256
8d1e0a7912f803ee1802074be1654e0ab4171a285829ddda4d2c3be85f1a2de4

SHA512
7cf7f06afaeec60649881afdec26572d1d9bb31d7875a04ac16e97925c754ecd904bc0ad65e3e14f9c8a18cd5e2314e95357ff7e3a6302cbc32a57516ce669bb

Download Submit

Analysis

Sharing

General

Malware Config

Extracted

Extracted

Signatures

Processes

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads