octo | 42a8dea16ec47151bfcc111cdd984f60c3ed438c76e9121ea112969bd8cf5ecf

Analysis

max time kernel
7s
max time network
129s
platform
android_x64
resource
android-x64-20240514-en
resource tags

androidarch:x64arch:x86image:android-x64-20240514-enlocale:en-usos:android-10-x64system
submitted
21-05-2024 22:02

Target

42a8dea16ec47151bfcc111cdd984f60c3ed438c76e9121ea112969bd8cf5ecf.apk
Size

545KB
MD5

f8350366b9cb176b03eb686328e90508
SHA1

39e0be4b5f303bc061c738ea0145783c2ff44374
SHA256

42a8dea16ec47151bfcc111cdd984f60c3ed438c76e9121ea112969bd8cf5ecf
SHA512

52267491fb27413b41b73878d1a28136e632fb7cc687cf95e39365ae49dab94f27bab86ea4842480afb0ebde1d131c0166bb98aca2e6e308427b3f8d894006f9
SSDEEP

12288:Nm+Npukki1dzHzjr9Zn0XtTETnSwYQ150mqTTm54idADchJ:s+iNi1lHzjxZwtTcSw52bHidAwJ

Score

10^/10

Octo
Octo is a banking malware with remote access capabilities first seen in April 2022.
banker trojan infostealer rat octo

Octo payload 1 IoCs

Processes:

resource	yara_rule
/data/data/com.nighthouse56/cache/jalacdiw	family_octo

Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
banker discovery

T1418.001
Loads dropped Dex/Jar 1 TTPs 2 IoCs
Runs executable file dropped to the device during analysis.
evasion

T1407

Processes:

com.nighthouse56

ioc pid process

/data/user/0/com.nighthouse56/cache/jalacdiw 5162 com.nighthouse56
/data/user/0/com.nighthouse56/cache/jalacdiw 5162 com.nighthouse56

ioc	pid	process
/data/user/0/com.nighthouse56/cache/jalacdiw	5162	com.nighthouse56
/data/user/0/com.nighthouse56/cache/jalacdiw	5162	com.nighthouse56

/data/data/com.nighthouse56/cache/jalacdiw
Filesize
448KB

MD5
57158cbf2ce3ea7076e42141d8d650fd

SHA1
aa2971fffb6aa885cb72a4db25042a92243e41a0

SHA256
fe8b083a23a092a5dd0a926e5018c73344e794d7aec837ad563c80b970b84c58

SHA512
d85dfe18676189f4279c92c63dbdc37cce66a1b9d1617dd204d91bf73dce2bb86bca7c992dd91d693b8b41497cd6076ec91fd0b051fc7b04f7af9c5fc0f606b5

Download Submit