octo | 4777bd6daecf665d85db5226d1caf5ba7213cd0688277564ee60a8483389f6ed

Analysis

max time kernel
8s
max time network
158s
platform
android_x64
resource
android-x64-20240221-en
resource tags

androidarch:x64arch:x86image:android-x64-20240221-enlocale:en-usos:android-10-x64system
submitted
24/02/2024, 22:02

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
4777bd6daecf665d85db5226d1caf5ba7213cd0688277564ee60a8483389f6ed.apk
Size 339KB
Sample240224-1x5mtafe52
SHA256 4777bd6daecf665d85db5226d1caf5ba7213cd0688277564ee60a8483389f6ed
MD5 94a2fd923a51bf9bd31c97324676f794
SHA1 6b14816f0ee9cd276faddeb12be809e39dcdc6ed
SHA512 47c95a98cdcbbaa4d344fc3846f3aec52f61350d5a1841dbaf58e275513bb1ea443125924ce5fcb09815f8e8b21444a9b28274ac87e49a45140cf21b1a26e865
SSDEEP 6144:D27ud88efAnd17/Ty8VMZtV0DCkXOjy/8K9moFxd0mW/vb6:DTE8XStVGvOjy3HFn03O
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

octo banker discovery infostealer rat trojan

Malware Config

Extracted

Family

octo

AES_key

Signatures

Octo
Octo is a banking malware with remote access capabilities first seen in April 2022.
banker trojan infostealer rat octo

Octo payload 1 IoCs

resource	yara_rule
behavioral2/files/fstream-1.dat	family_octo

Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs 1 IoCs

banker discovery

Security Software Discovery

T1418.001

description	ioc	Process
Framework service call	android.content.pm.IPackageManager.getInstalledApplications	com.adaxffsfzfada.zbsvxgsvbxhdgs

Loads dropped Dex/Jar 2 IoCs

Runs executable file dropped to the device during analysis.

ioc	pid	Process
/data/user/0/com.adaxffsfzfada.zbsvxgsvbxhdgs/app_ded/dPGiwRfIOGNN55BlGEGe8NwItdyQCOIM.dex	5101	com.adaxffsfzfada.zbsvxgsvbxhdgs
/data/user/0/com.adaxffsfzfada.zbsvxgsvbxhdgs/app_ded/dPGiwRfIOGNN55BlGEGe8NwItdyQCOIM.dex	5101	com.adaxffsfzfada.zbsvxgsvbxhdgs

Reads information about phone network operator. 1 TTPs
discovery

System Network Configuration Discovery
T1422

Uses Crypto APIs (Might try to encrypt user data) 1 IoCs

description	ioc	Process
Framework API call	javax.crypto.Cipher.doFinal	com.adaxffsfzfada.zbsvxgsvbxhdgs

com.adaxffsfzfada.zbsvxgsvbxhdgs
1⤵
- Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps)
- Loads dropped Dex/Jar
- Uses Crypto APIs (Might try to encrypt user data)
PID:5101

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Software Discovery

T1418

Security Software Discovery

T1418.001

System Network Configuration Discovery

T1422

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

dPGiwRfIOGNN55BlGEGe8NwItdyQCOIM.dex

Path /data/data/com.adaxffsfzfada.zbsvxgsvbxhdgs/app_ded/dPGiwRfIOGNN55BlGEGe8NwItdyQCOIM.dex
Size 448KB
SHA256 47675082cf0bdafd5f3070f3adf05b08ef4131d2f8db529c67eda0038d4a8f56
MD5 48b56275b0f60d12d025213adf01cb9c
SHA1 22bb52b8c76e5c7da8e01fbec4355ed755558799
SHA512 98e648cdb3b6a34946477374f8fbb8a0d2f6ff4842b217f51df8fb54da0f3fc05e2d80c541e6c3ce6ec68a8ed855755dda172d00a745b7b5c834f8418254e1d8
SSDEEP 12288:a/OBunD3++UjwuDrhL0d5Uelt9UbbS4xoPwuCAcFsmDiHQ95inhurdbKYG/f2Lbh:0/UjwuDBD
MD5 SHA1 SHA512 SSDEEP

Submit Download