octo | f8ead23747c576fd37cd59e06dd779fae75da1928018652b905cc1761c4fdd9c

Analysis

max time kernel
4s
max time network
155s
platform
android_x64
resource
android-x64-20240624-en
resource tags

androidarch:x64arch:x86image:android-x64-20240624-enlocale:en-usos:android-10-x64system
submitted
12-10-2024 02:03

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

f8ead23747c576fd37cd59e06dd779fae75da1928018652b905cc1761c4fdd9c.apk
Size

4.8MB
MD5

f73e4e6a1e6177d91ac114acb5b4419d
SHA1

a97aa335672b5223f99c5806ec545e145158a298
SHA256

f8ead23747c576fd37cd59e06dd779fae75da1928018652b905cc1761c4fdd9c
SHA512

db388c15c689e4355d4c6e139ca9bf661a21393c61f87d14536b2be87b00e3cc148c686a624349490e9fc3dd437f4f760b916e70e28a54c78d8af9716f648270
SSDEEP

49152:ARsEXrBtKsQ3XpY45iS7xrGAzzMSRjjVKSczUM1VTvOsqt8QTND+b49twT:ARs2tRQ3Xj5iSRGGfVKt1osI8mD+89tU

Score

10^/10

octo banker discovery evasion infostealer rat trojan

Malware Config

Signatures

Octo
Octo is a banking malware with remote access capabilities first seen in April 2022.
banker trojan infostealer rat octo

Octo payload 1 IoCs

resource	yara_rule
behavioral2/memory/4971-0.dex	family_octo

Loads dropped Dex/Jar 1 TTPs 1 IoCs

Runs executable file dropped to the device during analysis.

evasion

Download New Code at Runtime

T1407

ioc	pid	Process
/data/user/0/com.gmcapture_role0/[email protected]	4971	com.gmcapture_role0

Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
banker discovery

Security Software Discovery
T1418.001
Queries the phone number (MSISDN for GSM devices) 1 TTPs
discovery

System Network Configuration Discovery
T1422

Queries the mobile country code (MCC) 1 TTPs 1 IoCs

discovery

System Network Configuration Discovery

T1422

description	ioc	Process
Framework service call	com.android.internal.telephony.ITelephony.getNetworkCountryIsoForPhone	com.gmcapture_role0

com.gmcapture_role0
1⤵
- Loads dropped Dex/Jar
- Queries the mobile country code (MCC)
PID:4971

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Download New Code at Runtime

T1407

Credential Access

Discovery

Software Discovery

T1418

Security Software Discovery

T1418.001

System Network Configuration Discovery

T1422

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

/data/data/com.gmcapture_role0/.global.com.gmcapture_role0

Filesize
48B

MD5
046a414913add6f5bb60072c7db819b6

SHA1
451ee4f6809260aec622d772fd329c7d0297a842

SHA256
b66c1320cb063a1d391c94273572ea6edae76c8c8b0a07f8d75c88686f0df72a

SHA512
4e6355f3051ed5e811ab030abde1f5be7f5e1cf33be99cd08477e9b6c015deb1d8bd75a09fb9c7176b8511c5ad0a67abc0902a3531e97564ccb6afc57496a47c

Download Submit
/data/data/com.gmcapture_role0/files/.l

Filesize
322KB

MD5
77dc50489b9323274732d27dc8a4e803

SHA1
0e02a3595b62489d0739d771881da8604d117c65

SHA256
c5684e792d1ebefea6aac09fed45911703fd58c899f8a08133d49dd91429a820

SHA512
0684a92f3e9c525384cfa53f531afba61e5930e1c27032a7e27e3315f72761b62e122dc34768d8162ba08f9bed53d148aa8dc034b46456bdd211f230637eba58

Download Submit
/data/data/com.gmcapture_role0/oat/x86_64/[email protected]

Filesize
162B

MD5
39d3671ce0888c3466383f1ede188ee5

SHA1
fc199d60137ba74a2ae77beecda0a30114c8c4c8

SHA256
d80fe3ce83a885e4459231e86e43e32892184d4cb7a5d20293d9297a170b0ca0

SHA512
06b3c5a2c1de7af766aed4a6d7f4007c9bafab0c04a619a647d7609345b34325e7f8b319183f4ba0f0b290c2e539ca0ffb7a302b8fa9060e62ef2c80020ad873

Download Submit
/data/user/0/com.gmcapture_role0/[email protected]

Filesize
525KB

MD5
c45475ec8097a214aef7214c04b6987b

SHA1
268bec0b8e720d105dd25406b3e98955278bb28a

SHA256
d498ea81118b4dbec30b8fef365f7c5af022e19e5b6bb98b91b839115d3fb8d4

SHA512
2a6af261c07ff480eddabd61fa3b508eca41561e2968cc32b3223ad6580ae8496f8dc46bc1ce09d77a85bea8bdef3eac41532a7cc050d8a28fe6c55630f63a96

Download Submit