octo | 22349843965d0f9d0edd67efa07e2526f2935fb50cc1dc08b8ce7ab0939f6b8d

Analysis

max time kernel
8s
max time network
150s
platform
android_x64
resource
android-x64-20240624-en
resource tags

androidarch:x64arch:x86image:android-x64-20240624-enlocale:en-usos:android-10-x64system
submitted
07-10-2024 22:24

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

22349843965d0f9d0edd67efa07e2526f2935fb50cc1dc08b8ce7ab0939f6b8d.apk
Size

4.8MB
MD5

59a71e0b1018ca1b236440acb6ca5522
SHA1

131732aaf402d6675a22a712d73a79dce5f86b79
SHA256

22349843965d0f9d0edd67efa07e2526f2935fb50cc1dc08b8ce7ab0939f6b8d
SHA512

29c4de07bfe86249b4483786fe13bf36b5e121014fb91efa37ee576c87688a57bd5f2d3d015984b0f345cab7e4646cbd5cf1272658ed73679ffe95bbae54e40d
SSDEEP

49152:5RsEXS7hKUt3XKBc45iS7xrG1v7gLv35jVKScZxlKh1IRPZeG5NEZp:5RsphBt3X415iSRGmRVKNmwPZeXp

Score

10^/10

octo banker discovery evasion infostealer rat trojan

Malware Config

Signatures

Octo
Octo is a banking malware with remote access capabilities first seen in April 2022.
banker trojan infostealer rat octo

Octo payload 1 IoCs

resource	yara_rule
behavioral2/memory/4963-0.dex	family_octo

Loads dropped Dex/Jar 1 TTPs 1 IoCs

Runs executable file dropped to the device during analysis.

evasion

Download New Code at Runtime

T1407

ioc	pid	Process
/data/user/0/com.wcloud87rubinmenu/[email protected]	4963	com.wcloud87rubinmenu

Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
banker discovery

Security Software Discovery
T1418.001
Queries the phone number (MSISDN for GSM devices) 1 TTPs
discovery

System Network Configuration Discovery
T1422

Queries the mobile country code (MCC) 1 TTPs 1 IoCs

discovery

System Network Configuration Discovery

T1422

description	ioc	Process
Framework service call	com.android.internal.telephony.ITelephony.getNetworkCountryIsoForPhone	com.wcloud87rubinmenu

com.wcloud87rubinmenu
1⤵
- Loads dropped Dex/Jar
- Queries the mobile country code (MCC)
PID:4963

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Download New Code at Runtime

T1407

Credential Access

Discovery

Software Discovery

T1418

Security Software Discovery

T1418.001

System Network Configuration Discovery

T1422

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

/data/data/com.wcloud87rubinmenu/.global.com.wcloud87rubinmenu

Filesize
48B

MD5
046a414913add6f5bb60072c7db819b6

SHA1
451ee4f6809260aec622d772fd329c7d0297a842

SHA256
b66c1320cb063a1d391c94273572ea6edae76c8c8b0a07f8d75c88686f0df72a

SHA512
4e6355f3051ed5e811ab030abde1f5be7f5e1cf33be99cd08477e9b6c015deb1d8bd75a09fb9c7176b8511c5ad0a67abc0902a3531e97564ccb6afc57496a47c

Download Submit
/data/data/com.wcloud87rubinmenu/files/.y

Filesize
322KB

MD5
77dc50489b9323274732d27dc8a4e803

SHA1
0e02a3595b62489d0739d771881da8604d117c65

SHA256
c5684e792d1ebefea6aac09fed45911703fd58c899f8a08133d49dd91429a820

SHA512
0684a92f3e9c525384cfa53f531afba61e5930e1c27032a7e27e3315f72761b62e122dc34768d8162ba08f9bed53d148aa8dc034b46456bdd211f230637eba58

Download Submit
/data/data/com.wcloud87rubinmenu/oat/x86_64/[email protected]

Filesize
163B

MD5
9369d24665f91f79795811a3be29458a

SHA1
80c699dfb269961f876a2eb014f5ec79dd903b12

SHA256
b45a0fd61f3eb96923980b63b0f45163db488405fc4ce7d96385380bc060b3c8

SHA512
94f888d52e4ea2757a3d826b8b553f264e2f3f1941e23717ecee9a4ec181b5e7c488876f1c0918aa58ea8201ca7f0b4dcffbc22a66f153901316aaf8016b7b7e

Download Submit
/data/user/0/com.wcloud87rubinmenu/[email protected]

Filesize
526KB

MD5
5ea76df591d6524958643129803e6655

SHA1
f87f2dae7cd3781064404f0467eced55d792735b

SHA256
0dc54c007f6d29f4fecaf7ed6a5a7ae39d18a9ba9da63e8613183b3ec038a703

SHA512
344b68b498eccd9bc3076b9482915f9519513c5abf1e84e8afecae9242af29884694f39eb42ef0fa3991b0c97736068c3e52c728fb8fea1f9af3665768b9b867

Download Submit