Octo2 Banking Trojan Targets European Users with Improved Remote Access and Evasion
Summary
ThreatFabric reports Octo2 campaigns in Italy, Poland, Moldova, and Hungary. The Android banking trojan uses Zombinder for installation and adds more stable remote access, advanced obfuscation, and a date-based DGA for C2 domains.
Key points
- ThreatFabric attributes Octo2 to the original Octo threat actor and links it to the ExobotCompact malware family.
- The first observed Octo2 samples were in Italy, Poland, Moldova, and Hungary, disguised as Google Chrome, NordVPN, and Enterprise Europe Network apps.
- Campaigns used Zombinder to prompt installation of an additional plugin that was Octo2, bypassing Android 13+ installation restrictions.
- Octo2 improves remote-session stability by reducing transmitted screenshot data, including through grayscale capture and lower image quality.
- The malware uses multi-step code obfuscation and dynamically loads a native library to decrypt payloads and generate encryption keys and C2 domains.
- A date-based DGA generates C2 domain names, while a new key is generated for each C2 request.
- ThreatFabric says Octo source-code leaks led to competing forks; Octo2’s developers released the new variant with enhanced capabilities.
Article Details
- Attack Vectors
- Octo2 was distributed in campaigns using Zombinder as the first stage; it prompts victims to install an additional plugin that is Octo2, bypassing Android 13+ installation restrictions.
- Campaign samples masqueraded as Google Chrome, NordVPN, and Enterprise Europe Network applications.
- Octo2 intercepts push notifications from applications listed in its C2-provided block_push_apps setting.
- Octo2 conducts device takeover through remote sessions, including sending screenshots to its C2.
- Defensive Notes
- The article advises users and financial institutions to adopt stringent security measures and continuously update defenses; it provides no specific defensive procedures.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| SHA256 | 117aa133d19ea84a4de87128f16384ae0477f3ee9dd3e43037e102d7039c79d9 | SHA-256 hash listed in the article's IOC appendix for an Octo2 campaign sample masquerading as Google Chrome. |
| SHA256 | 6cd0fbfb088a95b239e42d139e27354abeb08c6788b6083962943522a870cb98 | SHA-256 hash listed in the article's IOC appendix for an Octo2 campaign sample named Europe Enterprise. |
| SHA256 | 83eea636c3f04ff1b46963680eb4bac7177e77bbc40b0d3426f5cf66a0c647ae | SHA-256 hash listed in the article's IOC appendix for an Octo2 campaign sample masquerading as NordVPN. |
MITRE ATT&CK
T1027 · Obfuscated Files or InformationThe article describes Octo2 obfuscating malicious code and decrypting its payload through native code.T1113 · Screen CaptureDuring remote sessions, Octo2 captures screenshots and sends them to its C2.T1568.002 · Domain Generation AlgorithmsOcto2 uses a date-based domain generation algorithm to generate the C2 server name.
Threat Actors
Malware
CoperSome AV vendors dubbed it “Coper”; however, ThreatFabric analysts were able to track and prove the connection with the original ExobotCompact.ExobotFrom Exobot to Octo2: A Brief History of the FamilyExobotCompactOcto (ExobotCompact) is a notable malware family on the current mobile threat landscape.OctoOcto (ExobotCompact) is a notable malware family on the current mobile threat landscape.Octo2In light of this, the discovery of a new version, named “Octo2” by its creator, could potentially shift the threat landscape and the Modus Operandi of the actors behind it.
Products
Androidrequest the installation of an additional “plugin” which is, in fact, Octo2, thus successfully bypassing Android 13+ restrictions.Google ChromeThese samples from the first campaigns observed were masquerading as Google Chrome, NordVPN, and “Enterprise Europe Network” applications.NordVPNThese samples from the first campaigns observed were masquerading as Google Chrome, NordVPN, and “Enterprise Europe Network” applications.
Tools
Countries
AustraliaThe "customers" of Octo Malware-as-a-Service were seen running campaigns targeting Europe, the USA, Canada, the Middle East, Singapore, and Australia.CanadaThe "customers" of Octo Malware-as-a-Service were seen running campaigns targeting Europe, the USA, Canada, the Middle East, Singapore, and Australia.HungaryOur Threat Intelligence shows that the first samples of Octo2 discovered in the wild were seen in Italy, Poland, Moldova, and Hungary.ItalyOur Threat Intelligence shows that the first samples of Octo2 discovered in the wild were seen in Italy, Poland, Moldova, and Hungary.MoldovaOur Threat Intelligence shows that the first samples of Octo2 discovered in the wild were seen in Italy, Poland, Moldova, and Hungary.PolandOur Threat Intelligence shows that the first samples of Octo2 discovered in the wild were seen in Italy, Poland, Moldova, and Hungary.SingaporeThe "customers" of Octo Malware-as-a-Service were seen running campaigns targeting Europe, the USA, Canada, the Middle East, Singapore, and Australia.USAThe "customers" of Octo Malware-as-a-Service were seen running campaigns targeting Europe, the USA, Canada, the Middle East, Singapore, and Australia.