octo | 55d3744f534d53e99a024a5146e59dd00b513fec0f4793ed4ec02f5a7c1a0f3b

Analysis

max time kernel
6s
max time network
157s
platform
android_x64
resource
android-x64-20240624-en
resource tags

androidarch:x64arch:x86image:android-x64-20240624-enlocale:en-usos:android-10-x64system
submitted
20-10-2024 22:03

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

55d3744f534d53e99a024a5146e59dd00b513fec0f4793ed4ec02f5a7c1a0f3b.apk
Size

4.8MB
MD5

a9c143e201d95cee37f66a9b19948884
SHA1

50c6227eaed15e1f7d7bfd41f43995c805cdce99
SHA256

55d3744f534d53e99a024a5146e59dd00b513fec0f4793ed4ec02f5a7c1a0f3b
SHA512

55a4bbcead28adb40a4e426dc25c42049ee6cd836825bf9d8f2744b1f0dad8a9c99ba3dcfe5ae7834e0aaca5dcd371190007b40cc10d314154bde5233cc56064
SSDEEP

49152:tRsEXz3NKE0j7U45iS7xrGr/xYvPejVKScnxK5vZWduhohAh:tRsQdd0j7d5iSRG+4VK2i8Ph

Score

10^/10

octo banker discovery evasion infostealer rat trojan

Malware Config

Signatures

Octo
Octo is a banking malware with remote access capabilities first seen in April 2022.
banker trojan infostealer rat octo

Octo payload 1 IoCs

resource	yara_rule
behavioral2/memory/4966-0.dex	family_octo

Loads dropped Dex/Jar 1 TTPs 1 IoCs

Runs executable file dropped to the device during analysis.

evasion

Download New Code at Runtime

T1407

ioc	pid	Process
/data/user/0/com.mms_headn9/[email protected]	4966	com.mms_headn9

Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
banker discovery

Security Software Discovery
T1418.001
Queries the phone number (MSISDN for GSM devices) 1 TTPs
discovery

System Network Configuration Discovery
T1422

Queries the mobile country code (MCC) 1 TTPs 1 IoCs

discovery

System Network Configuration Discovery

T1422

description	ioc	Process
Framework service call	com.android.internal.telephony.ITelephony.getNetworkCountryIsoForPhone	com.mms_headn9

com.mms_headn9
1⤵
- Loads dropped Dex/Jar
- Queries the mobile country code (MCC)
PID:4966

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Download New Code at Runtime

T1407

Credential Access

Discovery

Software Discovery

T1418

Security Software Discovery

T1418.001

System Network Configuration Discovery

T1422

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

/data/data/com.mms_headn9/.global.com.mms_headn9

Filesize
48B

MD5
046a414913add6f5bb60072c7db819b6

SHA1
451ee4f6809260aec622d772fd329c7d0297a842

SHA256
b66c1320cb063a1d391c94273572ea6edae76c8c8b0a07f8d75c88686f0df72a

SHA512
4e6355f3051ed5e811ab030abde1f5be7f5e1cf33be99cd08477e9b6c015deb1d8bd75a09fb9c7176b8511c5ad0a67abc0902a3531e97564ccb6afc57496a47c

Download Submit
/data/data/com.mms_headn9/files/.p

Filesize
322KB

MD5
77dc50489b9323274732d27dc8a4e803

SHA1
0e02a3595b62489d0739d771881da8604d117c65

SHA256
c5684e792d1ebefea6aac09fed45911703fd58c899f8a08133d49dd91429a820

SHA512
0684a92f3e9c525384cfa53f531afba61e5930e1c27032a7e27e3315f72761b62e122dc34768d8162ba08f9bed53d148aa8dc034b46456bdd211f230637eba58

Download Submit
/data/data/com.mms_headn9/oat/x86_64/[email protected]

Filesize
156B

MD5
673062464bd4c55cba94018bdcd733d7

SHA1
abf3f84138ee5f9da18096f94b5b3f416fa6d9c6

SHA256
41886a3e824e46bd5059cb97c5b6016e1219aa3a63a0ce9cd1475286bd3098a0

SHA512
dbdd0d815a82abc68e6826cf9b2a22eb329d3e18851afbe5c3ede04ef44614bcb175d5dd50557dbe8f9948b8dbb9168cbea8d7e969101e33bce876d5b773aed0

Download Submit
/data/user/0/com.mms_headn9/[email protected]

Filesize
525KB

MD5
2dea0ca77ba955eeb61eb64c446ed5e4

SHA1
60737540b15e6b87d9fce38a4fe81f3cede18901

SHA256
1282491510bdc0e7fdb965a8db69a8d03fba88b1986d1d24a0ca99377846c6c6

SHA512
8748dc57709b446790bdd28efe590c3b5555294689c9316bf1e41f5313b6ed5b71803c24ef754f3c43e4e29201f4d04919cdcdaaaed793f8bcf309fa5ef31e32

Download Submit