Malware

Octopus Scanner

For your environment

Hunt this family in your stack

Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.

Start free trial

MITRE ATT&CK

Techniques & procedures

13 distinct techniques documented for this family, organized by ATT&CK tactic.

Initial Access

3 techniques

T1195Supply Chain CompromiseEvidence1

we uncovered something that we had not seen before on our platform: malware designed to enumerate and backdoor NetBeans projects, and which uses the build process and its resulting artifacts to spread itself.

T1195.001Compromise Software Dependencies and Development ToolsEvidence2

malware designed to enumerate and backdoor NetBeans projects, and which uses the build process and its resulting artifacts to spread itself.

T1195.002Compromise Software Supply ChainEvidence1

Software supply chain compromises alter a supplier’s software or otherwise leverage a supplier’s trusted relationships to introduce a vulnerability or deploy malware on their ultimate target, the purchaser or user of the software.

Execution

5 techniques

T1053Scheduled Task/JobEvidence1

Runs schtasks /create /tn LogsProvider /tr javaw -jar $TEMP/../Microsoft/Cache134.dat /sc MINUTE /f to schedule a task

T1053.005Scheduled TaskEvidence1

Runs schtasks /create /tn ExplorerSync /tr "javaw -jar %temp%\..\Microsoft\ExplorerSync.db" /sc MINUTE /f

T1059.003Windows Command ShellEvidence1

Runs schtasks /run /tn LogsProvider to actually spawn the scheduled task

T1059.004Unix ShellEvidence1

Exec =/bin/sh -c "java -jar $HOME/.local/share/octo"

T1574Hijack Execution FlowEvidence1

modifying /nbproject/build-impl.xml in such a way that cache.dat will get executed as part of the build process itself.

Persistence

4 techniques

T1053Scheduled Task/JobEvidence1

Runs schtasks /create /tn LogsProvider /tr javaw -jar $TEMP/../Microsoft/Cache134.dat /sc MINUTE /f to schedule a task

T1053.005Scheduled TaskEvidence1

Runs schtasks /create /tn ExplorerSync /tr "javaw -jar %temp%\..\Microsoft\ExplorerSync.db" /sc MINUTE /f

T1543.001Launch AgentEvidence1

$HOME/Library/LaunchAgents/AutoUpdater.plist This auto-launcher runs the AutoUpdater.dat dropper

T1547Boot or Logon Autostart ExecutionEvidence1

create $HOME/.config/autostart/octo.desktop with the following contents

Privilege Escalation

4 techniques

T1053Scheduled Task/JobEvidence1

Runs schtasks /create /tn LogsProvider /tr javaw -jar $TEMP/../Microsoft/Cache134.dat /sc MINUTE /f to schedule a task

T1053.005Scheduled TaskEvidence1

Runs schtasks /create /tn ExplorerSync /tr "javaw -jar %temp%\..\Microsoft\ExplorerSync.db" /sc MINUTE /f

T1543.001Launch AgentEvidence1

$HOME/Library/LaunchAgents/AutoUpdater.plist This auto-launcher runs the AutoUpdater.dat dropper

T1547Boot or Logon Autostart ExecutionEvidence1

create $HOME/.config/autostart/octo.desktop with the following contents

Stealth

1 technique

T1574Hijack Execution FlowEvidence1

modifying /nbproject/build-impl.xml in such a way that cache.dat will get executed as part of the build process itself.

Command and Control

3 techniques

T1071Application Layer ProtocolEvidence1

would subsequently spawn a Remote Administration Tool (RAT), which connects to a set of C2 servers.

T1105Ingress Tool TransferEvidence1

downloads and installs a RAT-like tool from http://ecc.freeddns.org/data.txt and http://san.strangled.net/stat

T1219Remote Access ToolsEvidence2

When executed, the dropper payload ensured local system persistence and would subsequently spawn a Remote Administration Tool (RAT), which connects to a set of C2 servers.

INDICATORS OF COMPROMISE

IOCs tracked for this family

16 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.

View more in app

Network

3 tracked

IPs, domains, and DNS infrastructure linked to this family.

Hashes

10 tracked

File hashes (MD5, SHA-1, SHA-256) from samples and reports.

Other

3 tracked

Other indicator types observed in public reporting.

TypeValueLatest sighting

hash.md5●●●●●●●●●●●●View more in app6 years ago

hash.sha256●●●●●●●●●●●●View more in app6 years ago

uri●●●●●●●●●●●●View more in app6 years ago

hash.md5●●●●●●●●●●●●View more in app6 years ago

ACTIVITY FEED

Recent activity

2 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

2 SOURCESView more in app

ca ccsNews

Nov 28, 2022

The cyber threat from supply chains - Canadian Centre for Cyber Security

Malware found in infected GitHub repositories that scanned systems for NetBeans and, if present, installed a malware dropper that downloaded a remote access trojan.

github security lab blogNews

May 28, 2020

The Octopus Scanner Malware: Attacking the open source supply chain - The GitHub Blog

Java-based open source supply-chain malware that targets NetBeans projects, modifies build files, drops cache.dat into nbproject directories, infects built JARs and dependencies, establishes persistence on Linux and Windows, and ultimately spawns a remote administration tool via C2 infrastructure.

What this page doesn’t show

The version that knows your environment.

This page is what’s public. Mallory adds the parts that aren’t: which of your assets match these IOCs, which detections are missing, which campaigns to expect next, and what to do in the next 30 minutes.

Start free trial

IOC matching16

Match every observed IP, domain, and hash against your live telemetry.

Threat actor attribution

Named campaigns wielding this family, with evidence pinned to each claim.

Exploited vulnerabilities

CVEs this family uses for access and lateral movement.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

MITRE ATT&CK mapping13

Every documented technique, ranked by evidence weight.

Researcher chatter

Reddit, Mastodon, and CTI community discussion around this family.

Back to malware

Malware

Octopus Scanner

For your environment

Hunt this family in your stack

Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.

Start free trial

MITRE ATT&CK

Techniques & procedures

13 distinct techniques documented for this family, organized by ATT&CK tactic.

Initial Access

3 techniques

T1195Supply Chain CompromiseEvidence1

T1195.001Compromise Software Dependencies and Development ToolsEvidence2

malware designed to enumerate and backdoor NetBeans projects, and which uses the build process and its resulting artifacts to spread itself.

T1195.002Compromise Software Supply ChainEvidence1

Execution

5 techniques

T1053Scheduled Task/JobEvidence1

Runs schtasks /create /tn LogsProvider /tr javaw -jar $TEMP/../Microsoft/Cache134.dat /sc MINUTE /f to schedule a task

T1053.005Scheduled TaskEvidence1

Runs schtasks /create /tn ExplorerSync /tr "javaw -jar %temp%\..\Microsoft\ExplorerSync.db" /sc MINUTE /f

T1059.003Windows Command ShellEvidence1

Runs schtasks /run /tn LogsProvider to actually spawn the scheduled task

T1059.004Unix ShellEvidence1

Exec =/bin/sh -c "java -jar $HOME/.local/share/octo"

T1574Hijack Execution FlowEvidence1

modifying /nbproject/build-impl.xml in such a way that cache.dat will get executed as part of the build process itself.

Persistence

4 techniques

T1053Scheduled Task/JobEvidence1

Runs schtasks /create /tn LogsProvider /tr javaw -jar $TEMP/../Microsoft/Cache134.dat /sc MINUTE /f to schedule a task

T1053.005Scheduled TaskEvidence1

Runs schtasks /create /tn ExplorerSync /tr "javaw -jar %temp%\..\Microsoft\ExplorerSync.db" /sc MINUTE /f

T1543.001Launch AgentEvidence1

$HOME/Library/LaunchAgents/AutoUpdater.plist This auto-launcher runs the AutoUpdater.dat dropper

T1547Boot or Logon Autostart ExecutionEvidence1

create $HOME/.config/autostart/octo.desktop with the following contents

Privilege Escalation

4 techniques

T1053Scheduled Task/JobEvidence1

Runs schtasks /create /tn LogsProvider /tr javaw -jar $TEMP/../Microsoft/Cache134.dat /sc MINUTE /f to schedule a task

T1053.005Scheduled TaskEvidence1

Runs schtasks /create /tn ExplorerSync /tr "javaw -jar %temp%\..\Microsoft\ExplorerSync.db" /sc MINUTE /f

T1543.001Launch AgentEvidence1

$HOME/Library/LaunchAgents/AutoUpdater.plist This auto-launcher runs the AutoUpdater.dat dropper

T1547Boot or Logon Autostart ExecutionEvidence1

create $HOME/.config/autostart/octo.desktop with the following contents

Stealth

1 technique

T1574Hijack Execution FlowEvidence1

modifying /nbproject/build-impl.xml in such a way that cache.dat will get executed as part of the build process itself.

Command and Control

3 techniques

T1071Application Layer ProtocolEvidence1

would subsequently spawn a Remote Administration Tool (RAT), which connects to a set of C2 servers.

T1105Ingress Tool TransferEvidence1

downloads and installs a RAT-like tool from http://ecc.freeddns.org/data.txt and http://san.strangled.net/stat

T1219Remote Access ToolsEvidence2

When executed, the dropper payload ensured local system persistence and would subsequently spawn a Remote Administration Tool (RAT), which connects to a set of C2 servers.

INDICATORS OF COMPROMISE

IOCs tracked for this family

16 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.

View more in app

Network

3 tracked

IPs, domains, and DNS infrastructure linked to this family.

Hashes

10 tracked

File hashes (MD5, SHA-1, SHA-256) from samples and reports.

Other

3 tracked

Other indicator types observed in public reporting.

TypeValueLatest sighting

hash.md5●●●●●●●●●●●●View more in app6 years ago

hash.sha256●●●●●●●●●●●●View more in app6 years ago

uri●●●●●●●●●●●●View more in app6 years ago

hash.md5●●●●●●●●●●●●View more in app6 years ago

ACTIVITY FEED

Recent activity

2 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

2 SOURCESView more in app

ca ccsNews

Nov 28, 2022

The cyber threat from supply chains - Canadian Centre for Cyber Security

Malware found in infected GitHub repositories that scanned systems for NetBeans and, if present, installed a malware dropper that downloaded a remote access trojan.

github security lab blogNews

May 28, 2020

The Octopus Scanner Malware: Attacking the open source supply chain - The GitHub Blog

What this page doesn’t show

The version that knows your environment.

Start free trial

IOC matching16

Match every observed IP, domain, and hash against your live telemetry.

Threat actor attribution

Named campaigns wielding this family, with evidence pinned to each claim.

Exploited vulnerabilities

CVEs this family uses for access and lateral movement.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

MITRE ATT&CK mapping13

Every documented technique, ranked by evidence weight.

Researcher chatter

Reddit, Mastodon, and CTI community discussion around this family.