octo | 6cd0fbfb088a95b239e42d139e27354abeb08c6788b6083962943522a870cb98

Resubmissions

07-10-2024 18:23

241007-w1xzxs1djr 10

02-10-2024 08:40

241002-klaqas1bjg 10

Analysis

max time kernel
2s
max time network
1707s
platform
android_x64
resource
android-x64-20240624-en
resource tags

androidarch:x64arch:x86image:android-x64-20240624-enlocale:en-usos:android-10-x64system
submitted
07-10-2024 18:23

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

6cd0fbfb088a95b239e42d139e27354abeb08c6788b6083962943522a870cb98.apk
Size

4.9MB
MD5

c508d432e3d521acaa6215934f609b2a
SHA1

5e44ba99e81c6673b000519755e041c2d4082ae8
SHA256

6cd0fbfb088a95b239e42d139e27354abeb08c6788b6083962943522a870cb98
SHA512

208269f5bb3ba7d1511ad492fcc6995c1a7a039fffdd5caf221dc6b64f28bc828b593ddccf1a977687ecd84d1375e95680653d82a725174560714808ba69d7bf
SSDEEP

49152:itfRsEXIJKj83XqC45iS7xrGo/pwOXkjVKSc7T/B82nwjYWf0hrNFl/J8A5n:qRs5i83XC5iSRG6SVKNFUjYhnJOA5n

Score

10^/10

octo banker discovery evasion infostealer rat trojan

Malware Config

Signatures

Octo
Octo is a banking malware with remote access capabilities first seen in April 2022.
banker trojan infostealer rat octo

Octo payload 1 IoCs

resource	yara_rule
behavioral2/memory/4960-0.dex	family_octo

Loads dropped Dex/Jar 1 TTPs 1 IoCs

Runs executable file dropped to the device during analysis.

evasion

Download New Code at Runtime

T1407

ioc	pid	Process
/data/user/0/com.xsusb_restore3/[email protected]	4960	com.xsusb_restore3

Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
banker discovery

Security Software Discovery
T1418.001
Queries the phone number (MSISDN for GSM devices) 1 TTPs
discovery

System Network Configuration Discovery
T1422

Queries the mobile country code (MCC) 1 TTPs 1 IoCs

discovery

System Network Configuration Discovery

T1422

description	ioc	Process
Framework service call	com.android.internal.telephony.ITelephony.getNetworkCountryIsoForPhone	com.xsusb_restore3

com.xsusb_restore3
1⤵
- Loads dropped Dex/Jar
- Queries the mobile country code (MCC)
PID:4960

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Download New Code at Runtime

T1407

Credential Access

Discovery

Software Discovery

T1418

Security Software Discovery

T1418.001

System Network Configuration Discovery

T1422

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

/data/data/com.xsusb_restore3/.global.com.xsusb_restore3

Filesize
48B

MD5
046a414913add6f5bb60072c7db819b6

SHA1
451ee4f6809260aec622d772fd329c7d0297a842

SHA256
b66c1320cb063a1d391c94273572ea6edae76c8c8b0a07f8d75c88686f0df72a

SHA512
4e6355f3051ed5e811ab030abde1f5be7f5e1cf33be99cd08477e9b6c015deb1d8bd75a09fb9c7176b8511c5ad0a67abc0902a3531e97564ccb6afc57496a47c

Download Submit
/data/data/com.xsusb_restore3/files/.b

Filesize
322KB

MD5
77dc50489b9323274732d27dc8a4e803

SHA1
0e02a3595b62489d0739d771881da8604d117c65

SHA256
c5684e792d1ebefea6aac09fed45911703fd58c899f8a08133d49dd91429a820

SHA512
0684a92f3e9c525384cfa53f531afba61e5930e1c27032a7e27e3315f72761b62e122dc34768d8162ba08f9bed53d148aa8dc034b46456bdd211f230637eba58

Download Submit
/data/data/com.xsusb_restore3/oat/x86_64/[email protected]

Filesize
161B

MD5
ccf05c69a7ff712f41d8365187483359

SHA1
977cbdb785110e6b730d88c1c6e2f6b77d08670d

SHA256
9caa5e630eeaac6e913f19e3ef7022f286f6f9b2eaf5fda54fe841aed4bde40a

SHA512
d214b711c835ceb1171f819a8424b8c9c048fe3ca53cc49a2361d39cb41f14aa2a5162a8266c2744fdd262d2cf8f169068cff7b0ffe78e46463709b7b2d0bd5f

Download Submit
/data/user/0/com.xsusb_restore3/[email protected]

Filesize
525KB

MD5
7cc0ad16f406df7b927e6f415ed86d3a

SHA1
2e72e284327845820d42d857cec00a6b8b762565

SHA256
3b2805560abf0047a5e8287607f5a1bb33a2a303b7bd28239782ca83893d2d38

SHA512
2b67975831cd2f6d64e3191d07db738802c3546c42fc2a72d52a32c8a5b7ed5a04a143e713be03b3042ce4918e73865fc9b144ef5c5374397faaa72260862e27

Download Submit