octo | 9efdf8bdb16a5df0b45c21b88c07d1f611ed13c7abc0f3062e94da742d570553

Analysis

max time kernel
6s
max time network
151s
platform
android_x64
resource
android-x64-20240624-en
resource tags

androidarch:x64arch:x86image:android-x64-20240624-enlocale:en-usos:android-10-x64system
submitted
11-10-2024 09:15

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

9efdf8bdb16a5df0b45c21b88c07d1f611ed13c7abc0f3062e94da742d570553.apk
Size

4.8MB
MD5

04539df0be9356b1594aa1816a170d43
SHA1

d145d9dcf5b0ff5bc95dc0ca412bddae1fd75419
SHA256

9efdf8bdb16a5df0b45c21b88c07d1f611ed13c7abc0f3062e94da742d570553
SHA512

2a60895df7e9ceea36840e272f4ab35745f306ef8beb1b536851528d4a21a9ba0101e4f4740905e77db8a0c210dc34d5b5035b12b2f7d3ccc271761e1763894a
SSDEEP

49152:ErRsEXqf+RKHu3X3g45iS7xrG+zIA5nQjVKScb5nRxnnEBYx1XlYK6WT:WRsB+iu3XJ5iSRGEOVKtbCCxT

Score

10^/10

octo banker discovery evasion infostealer rat trojan

Malware Config

Signatures

Octo
Octo is a banking malware with remote access capabilities first seen in April 2022.
banker trojan infostealer rat octo

Octo payload 1 IoCs

resource	yara_rule
behavioral2/memory/4967-0.dex	family_octo

Loads dropped Dex/Jar 1 TTPs 1 IoCs

Runs executable file dropped to the device during analysis.

evasion

Download New Code at Runtime

T1407

ioc	pid	Process
/data/user/0/com.source_livep01/[email protected]	4967	com.source_livep01

Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
banker discovery

Security Software Discovery
T1418.001
Queries the phone number (MSISDN for GSM devices) 1 TTPs
discovery

System Network Configuration Discovery
T1422

Queries the mobile country code (MCC) 1 TTPs 1 IoCs

discovery

System Network Configuration Discovery

T1422

description	ioc	Process
Framework service call	com.android.internal.telephony.ITelephony.getNetworkCountryIsoForPhone	com.source_livep01

com.source_livep01
1⤵
- Loads dropped Dex/Jar
- Queries the mobile country code (MCC)
PID:4967

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Download New Code at Runtime

T1407

Credential Access

Discovery

Software Discovery

T1418

Security Software Discovery

T1418.001

System Network Configuration Discovery

T1422

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

/data/data/com.source_livep01/.global.com.source_livep01

Filesize
48B

MD5
046a414913add6f5bb60072c7db819b6

SHA1
451ee4f6809260aec622d772fd329c7d0297a842

SHA256
b66c1320cb063a1d391c94273572ea6edae76c8c8b0a07f8d75c88686f0df72a

SHA512
4e6355f3051ed5e811ab030abde1f5be7f5e1cf33be99cd08477e9b6c015deb1d8bd75a09fb9c7176b8511c5ad0a67abc0902a3531e97564ccb6afc57496a47c

Download Submit
/data/data/com.source_livep01/files/.i

Filesize
322KB

MD5
77dc50489b9323274732d27dc8a4e803

SHA1
0e02a3595b62489d0739d771881da8604d117c65

SHA256
c5684e792d1ebefea6aac09fed45911703fd58c899f8a08133d49dd91429a820

SHA512
0684a92f3e9c525384cfa53f531afba61e5930e1c27032a7e27e3315f72761b62e122dc34768d8162ba08f9bed53d148aa8dc034b46456bdd211f230637eba58

Download Submit
/data/data/com.source_livep01/oat/x86_64/[email protected]

Filesize
161B

MD5
1c8f6156d8236f902bed363862f2017f

SHA1
4182096ed2369f5ca26ef9027756d6b6665237e3

SHA256
197957d98325ad9a2f7ba1639dac293bbd37f75278a47e39869611e8ab6c2008

SHA512
e02bb06efc2144f343fe8d2cb70fca6a9dfbfb238d683f7139a22882753e236184a73be71bd56b1a2ec79dcc8d0ccd0829d2d3f5bf27492f2d2c7aebe4c0ce5b

Download Submit
/data/user/0/com.source_livep01/[email protected]

Filesize
525KB

MD5
88746dd59197fe853eae66ebc345d94d

SHA1
c3d82c8ea837c077c4387fd7c4b22311aba06288

SHA256
25fc46686398709b118eed7e71dc1deccf57538ebeaf1c6559f81b433062fe8b

SHA512
e6c0c7822c6e06913cfc4be1c5354aebd32a2b8cfa207456f9399bdb99001fa1fc3b4ed34285cf11184d9a4d7dc60807870f1c4b0ca667baee2c726d493204ca

Download Submit