octo | 89e4dd013e4573f80d418f29c6334cadb9ee260a4c5aadf466222d4df4e6f910

Analysis

max time kernel
7s
max time network
71s
platform
android_x64
resource
android-x64-20240624-en
resource tags

androidarch:x64arch:x86image:android-x64-20240624-enlocale:en-usos:android-10-x64system
submitted
05/07/2024, 10:53

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
89198e78d1b86dbf25e078023cc583fc.apk
Size 509KB
Sample240705-mza94azblg
SHA256 89e4dd013e4573f80d418f29c6334cadb9ee260a4c5aadf466222d4df4e6f910
MD5 89198e78d1b86dbf25e078023cc583fc
SHA1 75ea3a46ec4ca27fcd2b4a7eedb988ed3797b51f
SHA512 1736dcdcdb97acd77783aabb193366e57a89cec0c01c9bb52bca1781046261a242c177bc4d0998ffbf785860a5b1d86bf248d40218771e7024908df6d4304d83
SSDEEP 12288:CtpQX2sOA4c4EXoICIp6/nkbd5h7BH8Dnw/rln6:Ctp0UA4sYLIp6/wd5h7VNn6
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

octo banker discovery evasion infostealer rat trojan

Malware Config

Signatures

Octo
Octo is a banking malware with remote access capabilities first seen in April 2022.
banker trojan infostealer rat octo

Octo payload 1 IoCs

resource	yara_rule
behavioral2/files/fstream-1.dat	family_octo

Loads dropped Dex/Jar 1 TTPs 2 IoCs

Runs executable file dropped to the device during analysis.

evasion

Download New Code at Runtime

T1407

ioc	pid	Process
/data/user/0/com.slowshel/cache/cedzzialvsni	4974	com.slowshel
/data/user/0/com.slowshel/cache/cedzzialvsni	4974	com.slowshel

Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
banker discovery

Security Software Discovery
T1418.001

com.slowshel
1⤵
- Loads dropped Dex/Jar
PID:4974

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Download New Code at Runtime

T1407

Credential Access

Discovery

Software Discovery

T1418

Security Software Discovery

T1418.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

cedzzialvsni

Path /data/data/com.slowshel/cache/cedzzialvsni
Size 448KB
SHA256 aac193050bee17d91817a743dc17fa95b4e32f6dd8dc09a36669d4beb56bc113
MD5 d2e9bee71e1b1d930a57571a43ea9d52
SHA1 816ba2a8e769871b069b4b95e915f7c2590961e1
SHA512 943ca0d549e162bb582487471ede2c8cacb549719f94e645a1dc67f9bd7e3abf2414a64c4195073f2c0f7e20557acbeb7d39f5083b50e2c9361ca4a10d2e10dc
SSDEEP 12288:CjB0U5pwJqXVnTNWDLoaLzEyFWtJrYBQNEQGcW9e4yaOwbi7UOs3N2p52+gvfU3b:CIYIGp52tfU3Xkhi1j
MD5 SHA1 SHA512 SSDEEP

Submit Download