octo | fecf5e353ee27ea6d62f78088a61775a3b5914de37338570786ba74a29541b69

Analysis

max time kernel
5s
max time network
156s
platform
android_x64
resource
android-x64-20240624-en
resource tags

androidarch:x64arch:x86image:android-x64-20240624-enlocale:en-usos:android-10-x64system
submitted
11-10-2024 22:09

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

fecf5e353ee27ea6d62f78088a61775a3b5914de37338570786ba74a29541b69.apk
Size

2.3MB
MD5

5bdf3a22c8e782f762d400574e83baa4
SHA1

2e88222a03629452093d3826a4c191028fb594bf
SHA256

fecf5e353ee27ea6d62f78088a61775a3b5914de37338570786ba74a29541b69
SHA512

d80dc04003a903454268667e2a66b18e20e3508f4d8d70038c3dee9c3bae463945124e45d51163b38fdcadf8a43d7dd598e8cfc096ad5de666f828da52e28064
SSDEEP

49152:PANBLpzsPCrPMeH2RIT8e8aoGKZJWwqqLkQswExn+qbBgefqf73ayygubp3Sj0/1:PALpzsPCwDTGxqgQswEZI2qfDCSjkHV

Score

10^/10

octo banker discovery evasion infostealer rat trojan

Malware Config

Extracted

Family

octo

https://teknolojideyeniliklervesontrendler.xyz/YjdkMWRjNTllNzZi/

https://dogalyasamvetatilonerileriniz.xyz/YjdkMWRjNTllNzZi/

https://sanatkulturvesosyalyasantavsiyeleri.xyz/YjdkMWRjNTllNzZi/

https://gezginlerinyenikesifvedeneyimleri.xyz/YjdkMWRjNTllNzZi/

https://oyunvedijitaldunyayakesfet.xyz/YjdkMWRjNTllNzZi/

https://yemektariflerivedogalbeslenme.xyz/YjdkMWRjNTllNzZi/

https://bilimveteknolojiprojelerehberi.xyz/YjdkMWRjNTllNzZi/

https://fotografvesanatcilaryolculugu.xyz/YjdkMWRjNTllNzZi/

https://modavesanatdunyasindakiyenilikler.xyz/YjdkMWRjNTllNzZi/

https://egitimvesosyalgelisimklavuzu.xyz/YjdkMWRjNTllNzZi/

https://yogavesporkocluguprogramlari.xyz/YjdkMWRjNTllNzZi/

https://bilgisayarveoyunseverlertavsiyeleri.xyz/YjdkMWRjNTllNzZi/

https://fotografvegezisoylesileriplatformu.xyz/YjdkMWRjNTllNzZi/

https://yarisvedigitalgelisimprojeleri.xyz/YjdkMWRjNTllNzZi/

https://yenifikirlervegirisimcilikplatformu.xyz/YjdkMWRjNTllNzZi/

https://sosyalmedyayonetimivegirisim.xyz/YjdkMWRjNTllNzZi/

https://sanatvetasarimdunyasiyenilikler.xyz/YjdkMWRjNTllNzZi/

https://bilimvegirisimcilikrotasinda.xyz/YjdkMWRjNTllNzZi/

https://dogadoganlaricinyasamtavsiyeleri.xyz/YjdkMWRjNTllNzZi/

https://gencgirisimcilericevirimdunyasi.xyz/YjdkMWRjNTllNzZi/

rc4.plain

Signatures

Octo
Octo is a banking malware with remote access capabilities first seen in April 2022.
banker trojan infostealer rat octo

Octo payload 1 IoCs

resource	yara_rule
behavioral2/memory/4972-0.dex	family_octo

Loads dropped Dex/Jar 1 TTPs 1 IoCs

Runs executable file dropped to the device during analysis.

evasion

Download New Code at Runtime

T1407

ioc	pid	Process
/data/user/0/com.spider.case/app_ring/Uwdn.json	4972	com.spider.case

Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
banker discovery

Security Software Discovery
T1418.001

com.spider.case
1⤵
- Loads dropped Dex/Jar
PID:4972

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Download New Code at Runtime

T1407

Credential Access

Discovery

Software Discovery

T1418

Security Software Discovery

T1418.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

/data/data/com.spider.case/app_ring/Uwdn.json

Filesize
153KB

MD5
c1b614a3333b85565d4b37c44016e4e0

SHA1
67908105b917841ed8814d2618835028314e45a0

SHA256
b0bf07016c2228ce0b54948f42d10ee10c2b79cb94c23610f6a0037edeefb744

SHA512
11353f60d28e3b5b985295963fd1c4109acbc7d88dc35561a57c78822795d1abbec344d4923965e5e0fd8f3c8db8b18707ba7b59afc6efbecb721b6c423a6cb7

Download Submit
/data/data/com.spider.case/app_ring/Uwdn.json

Filesize
153KB

MD5
747234ee8fce5eca1ce4bf486cc6e6f2

SHA1
8314ebee42584bb3b7ad0f03118cbf476098f31a

SHA256
5050458b528bb3c67d33cf382eb138d26759788f260cdd04ade549a165150aac

SHA512
c7e53c887806e3bbc0f09044bdc5dda98fecdac0148b46312664efddf9c8880c1ddd1b9cf253355d03dc2242221a098c612df8e6fc272f49aef1804125d8c339

Download Submit
/data/user/0/com.spider.case/app_ring/Uwdn.json

Filesize
451KB

MD5
95158a6ce608170fef7b69c102b2bd03

SHA1
a388322b48ab4259fa7a28fcd56e1031bbc73015

SHA256
fa2b60cc0b4bc961b79a6028aca3f6bcfac3d0bda38a0cdff71b7acfacb913dd

SHA512
905fcb46811def295ea7f989cbd8fddd304d76f893652fb7aa208ba8d6cf60b58bc52f1674c58a7222b431fa06f7ff09f7765345cc4c18802ef8ec5b64bbc3ff

Download Submit