octo | bbbc3b12289133b4c00db74c42e3eb7b7e6e21f6673f93b9d188d9e59ee49b92

Analysis

max time kernel
10s
max time network
188s
platform
android_x64
resource
android-x64-20240624-en
resource tags

androidarch:x64arch:x86image:android-x64-20240624-enlocale:en-usos:android-10-x64system
submitted
10/07/2024, 22:00

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
bbbc3b12289133b4c00db74c42e3eb7b7e6e21f6673f93b9d188d9e59ee49b92.apk
Size 509KB
Sample240710-1w181asdkn
SHA256 bbbc3b12289133b4c00db74c42e3eb7b7e6e21f6673f93b9d188d9e59ee49b92
MD5 39d98d888c75c2324ce068d3f056c8f6
SHA1 07a0693f61bcdab60850c33cc2bb7911faf20c78
SHA512 343d921b12d926eee9078e6fbc8e0392fc474b726c66d58cd195dddfbf171286bb68984d60b3c4143dd29b44d7b2c5404194527b1c1b5e23e1294de5b52105e4
SSDEEP 12288:Jv764H0dRSqj2E3eV/09CVcUtkhvpTUxX2/nj:BvUdRS3FTcUahvpYdsnj
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

octo banker discovery evasion infostealer rat trojan

Malware Config

Signatures

Octo
Octo is a banking malware with remote access capabilities first seen in April 2022.
banker trojan infostealer rat octo

Octo payload 1 IoCs

resource	yara_rule
behavioral2/files/fstream-1.dat	family_octo

Loads dropped Dex/Jar 1 TTPs 2 IoCs

Runs executable file dropped to the device during analysis.

evasion

Download New Code at Runtime

T1407

ioc	pid	Process
/data/user/0/com.oncewondert/cache/fugxlsozrqrnob	4947	com.oncewondert
/data/user/0/com.oncewondert/cache/fugxlsozrqrnob	4947	com.oncewondert

Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
banker discovery

Security Software Discovery
T1418.001

com.oncewondert
1⤵
- Loads dropped Dex/Jar
PID:4947

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Download New Code at Runtime

T1407

Credential Access

Discovery

Software Discovery

T1418

Security Software Discovery

T1418.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

fugxlsozrqrnob

Path /data/data/com.oncewondert/cache/fugxlsozrqrnob
Size 448KB
SHA256 0eb5bf8444fe63724c2ee3c960a5b4ad445f30d79860420c987564318db28e73
MD5 bfdaec96d93ff5f2169b07113f481db9
SHA1 d6588e20fa3e50f58f46bfef11d26cbc6f83b487
SHA512 24d7506aa33d1734ae5633dc2880ba6aca7f720f1ea4b33cf84b72f056502d24b277ac2a4e94486001333d9ec1916d2908d2517c31fd824f2018feee63c631b1
SSDEEP 12288:FNEQGsW9e4yaXwbi7UOs3N2p52+gvfU3ykhiEi:dBGp52tfU3ykhiEi
MD5 SHA1 SHA512 SSDEEP

Submit Download