Analysis Details Coper/Octo Android Malware-as-a-Service Operation

Mar 6, 2024 · Original article ↗

Summary

Team Cymru's analysis describes Coper/Octo, an Exobot-derived Android malware-as-a-service, detailing its credential-theft injects, keylogging, SMS interception, VNC control, encrypted command-and-control, and geographic and device filters.

Key points

The article links Coper/Octo to the Exobot family and describes its evolution into a malware-as-a-service operation distributed through regionally tailored app impersonations.
Operators can configure targeted apps, keylogging, SMS interception, push-notification blocking, app removal, and remote commands through the bot's configuration and control panel.
Fake login overlays and other injects capture credentials and device unlock information; VNC enables remote interaction and screen capture after Accessibility Services permissions are granted.
During registration, the malware collects device details including IMEI, model, Android version, and uptime; it filters out specified countries and languages, as well as emulators and virtual machines.
C2 communications are AES-encrypted and Base64-encoded, while the article reports that the malware's Dex classes are encrypted using a hardcoded RC4 key.
Payload analysis identified impersonations of Facebook, Chrome, and poker apps, alongside targeted banking apps; C2 analysis noted victim concentrations in Portugal, Spain, Turkey, and the United States.

Article Details

Attack Vectors: Coper/Octo was distributed as fake applications impersonating legitimate apps, including Bancolombia’s Personas application and banking apps, to deceive Android users into installing the malware.
An inject displays instructions that socially engineer victims into enabling Accessibility Services, which the malware requires for remote device interactions.
When a targeted app is accessed, injects can display fake login forms, authentication pages, or unlock-pattern screens to capture credentials, patterns, and PINs.
Operators can use VNC to remotely interact with infected devices, capture screenshots, and enter information using the virtual keyboard.
The malware can log keystrokes and intercept SMS messages and push notifications. It can also send SMS messages from compromised devices, which the article says might be used to persuade recipients to download a malicious app.

Indicators of compromise

Type	Indicator	Context
IPV4	`94[.]156[.]68[.]191`	C2 server observed in communications captured from a Coper/Octo payload.

MITRE ATT&CK

T1132.001 · Standard EncodingC2 communications are Base64 encoded in addition to being encrypted.T1406Dex classes associated with Coper/Octo are encrypted using a hardcoded RC4 key.T1412The malware intercepts and reads SMS messages on infected devices.T1417.001Coper/Octo logs keystrokes entered on the infected device, including passwords, PINs, and patterns.T1417.002Fake login and unlock-pattern screens capture victim input when targeted applications are accessed.T1426During bot registration, the malware collects device information including IMEI, phone model, Android version, and uptime.T1453The malware requires Accessibility Services for remote interactions; an inject encourages victims to enable the service.T1513Coper/Octo can use VNC functionality to capture screenshots of the infected device.T1573.001 · Symmetric CryptographyCoper/Octo encrypts communications with its C2 infrastructure using AES.

Malware

CoperCoper, a descendant of the Exobot malware family, was first observed in the wild in July 2021, targeting Colombian Android users.ExobotCoper, a descendant of the Exobot malware family, was first observed in the wild in July 2021, targeting Colombian Android users.ExobotCompactTheir analysis of this post established a direct link to ExobotCompact, a ‚Äúlite‚Äù version of the aforementioned Exobot, which had been updated and rebranded as Octo.OctoTheir analysis of this post established a direct link to ExobotCompact, a ‚Äúlite‚Äù version of the aforementioned Exobot, which had been updated and rebranded as Octo.

Products

AndroidAnalysis of an Android Malware-as-a-Service Operation FacebookIn this case, the payload is impersonating the Facebook application.GmailGmail, pattern, pin are the inject payloads, followed by the path (denoted by the %FIELD_ value)Google ChromeIn addition to Facebook, we have seen recent campaigns impersonating Google Chrome, as well as a number of Poker applications.

Tools

CyberChefUsing CyberChef, we can input encrypted strings as follows, with the output being the decrypted string in plain text.TriageWe will use the public sandbox from Triage for our analysis, as they have developed a configuration extractor for Coper/Octo, which makes all our lives easier (thanks for that!).WiresharkThe communications captured during the sandbox run can be downloaded in PCAP format, which can be analyzed further using a tool such as Wireshark.

Countries