octo | 751e36d86f2f903206e38392a760387e091265118d39a256428cae4b312fb0cf

Resubmissions

30/09/2024, 09:53

240930-lwmy2stbje 10

23/09/2024, 16:05

240923-tjz2vasalk 10

Analysis

max time kernel
2s
max time network
307s
platform
android_x64
resource
android-x64-20240624-en
resource tags

androidarch:x64arch:x86image:android-x64-20240624-enlocale:en-usos:android-10-x64system
submitted
30/09/2024, 09:53

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

751E36D86F2F903206E38392A760387E091265118D39A256428CAE4B312FB0CF.apk
Size

8.3MB
MD5

32c0bf4fcff08cc439754ed4e79d54f7
SHA1

77556c54dcca1995747d1ca58d4edaf5ea5aefb6
SHA256

751e36d86f2f903206e38392a760387e091265118d39a256428cae4b312fb0cf
SHA512

bd50ef51d75fe6d6f8f35e961668a9f2adb1ba1fc798cc4023a878d66cff3a97c843346928e31bacbc91e26aa00043d19c7064c1f5a226b7c6634bbd0400c93e
SSDEEP

98304:FhBlNYEzf6wj7KRspPDnQmkJZDb5iSRGZ2VK/G4JKJCkC:zBomfdj7KR0DQmkJJbr9UOqmpC

Score

10^/10

octo banker discovery evasion infostealer rat trojan

Malware Config

Signatures

Octo
Octo is a banking malware with remote access capabilities first seen in April 2022.
banker trojan infostealer rat octo

Octo payload 1 IoCs

resource	yara_rule
behavioral1/memory/4970-1.dex	family_octo

Loads dropped Dex/Jar 1 TTPs 2 IoCs

Runs executable file dropped to the device during analysis.

evasion

Download New Code at Runtime

T1407

ioc	pid	Process
/data/user/0/com.dcell_volume42/app_that/ljuwim.json	4970	com.dcell_volume42
/data/user/0/com.dcell_volume42/[email protected]	4970	com.dcell_volume42

Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
banker discovery

Security Software Discovery
T1418.001
Queries the phone number (MSISDN for GSM devices) 1 TTPs
discovery

System Network Configuration Discovery
T1422

Queries the mobile country code (MCC) 1 TTPs 1 IoCs

discovery

System Network Configuration Discovery

T1422

description	ioc	Process
Framework service call	com.android.internal.telephony.ITelephony.getNetworkCountryIsoForPhone	com.dcell_volume42

com.dcell_volume42
1⤵
- Loads dropped Dex/Jar
- Queries the mobile country code (MCC)
PID:4970

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Download New Code at Runtime

T1407

Credential Access

Discovery

Software Discovery

T1418

Security Software Discovery

T1418.001

System Network Configuration Discovery

T1422

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

/data/data/com.dcell_volume42/.global.com.dcell_volume42

Filesize
48B

MD5
046a414913add6f5bb60072c7db819b6

SHA1
451ee4f6809260aec622d772fd329c7d0297a842

SHA256
b66c1320cb063a1d391c94273572ea6edae76c8c8b0a07f8d75c88686f0df72a

SHA512
4e6355f3051ed5e811ab030abde1f5be7f5e1cf33be99cd08477e9b6c015deb1d8bd75a09fb9c7176b8511c5ad0a67abc0902a3531e97564ccb6afc57496a47c

Download Submit
/data/data/com.dcell_volume42/app_that/ljuwim.json

Filesize
1012B

MD5
32095d309c495c91e88e334739ed2ce4

SHA1
f50a573cd48612fe56fd03dc84c8473ba56ee3ca

SHA256
fb09025c513eeb9dc57e51e9b068d5ad83c9ea6963fa24bacfd3b5b263a679fc

SHA512
a4c2e21d0dda6bd058a1eba38fa3ab6ac13a65498250ba8f8408a3f398963bd92739076be1a42ba956481b63f93d73d62271bb03b70e6edb4903a2f42b9fe54c

Download Submit
/data/data/com.dcell_volume42/app_that/ljuwim.json

Filesize
1012B

MD5
f468a01c5add684e9b7780a2f11c569a

SHA1
d4172c518cc9883ae92fd5bcc3999f72f31eef7a

SHA256
6859893e71ab36c05e5709e0d5134e224055b818d88fa4257c521bf3e4d8ff2f

SHA512
6c11f27852de2ddec3df66709ff50f637da7f8e2b0817f31caede3d32cbd3709525d5490febbc3f207589bb93f8074bab6f76b09fcfb40b4e3bf1891f759fef0

Download Submit
/data/data/com.dcell_volume42/files/.p

Filesize
322KB

MD5
77dc50489b9323274732d27dc8a4e803

SHA1
0e02a3595b62489d0739d771881da8604d117c65

SHA256
c5684e792d1ebefea6aac09fed45911703fd58c899f8a08133d49dd91429a820

SHA512
0684a92f3e9c525384cfa53f531afba61e5930e1c27032a7e27e3315f72761b62e122dc34768d8162ba08f9bed53d148aa8dc034b46456bdd211f230637eba58

Download Submit
/data/data/com.dcell_volume42/oat/x86_64/[email protected]

Filesize
287B

MD5
3480d01e7b2ff383e055d8ed03fc915e

SHA1
b4c95cb86abb45bd719a43743f95cb2e83e63ddf

SHA256
11e2cf0a2e498b9a832895989b6d9307897431caf7eab2c0646dce3758d3ed40

SHA512
35319e19a19201567dec1239b89f59cc4932389adbc9c471b90049cf88b26c6a6efaba88e67086a398de3c0d6d3f48743e70a1ae5f5b444a9d8d5a2a17c05f0d

Download Submit
/data/user/0/com.dcell_volume42/[email protected]

Filesize
525KB

MD5
87579306477288e8bdfda7c30138ace0

SHA1
f1d51485f9f95c57ff362ef7d2afcb333cbd1b31

SHA256
fb1be6ea55e2744d049b7c5bde71314b51e0926e859b64ad0dd4d2990e4bc7c7

SHA512
27347feb6274d1707d925599d72106a9e5ac1e62725b97df8f692b9d4aada2cdc0577136fab07d5607ad4f972dbbca3a3f4d748eeed39c97a2cfafefce6f9bdb

Download Submit
/data/user/0/com.dcell_volume42/app_that/ljuwim.json

Filesize
1KB

MD5
009e24530882f2f739ff7d772d1cb240

SHA1
cb2cb8a5a92b7d63306eb2d00bc01bef68fd9da6

SHA256
62b6d21b8c914a006ff007aeb817304693488549bf74cb90a57e930b09f45917

SHA512
7c06e2f65122c3f453d7a3d68345d28b7c1c6c3e0ab102f3fa05d7f9a52c9a7f08b4710ff65e5f13fe98fc37a3aa988d6edddaadb78feea4ac056d90a3e838fe

Download Submit