octo | b7b60b806acdefe08a6ee3e1429abe1bf0fc615cfa0eb3e26e0fcd8db40ea5b2

Resubmissions

28-10-2024 10:08

241028-l6fygsxanm 10

01-10-2024 22:09

241001-127yqsshjn 10

Analysis

max time kernel
2s
max time network
35s
platform
android_x64
resource
android-x64-20240624-en
resource tags

androidarch:x64arch:x86image:android-x64-20240624-enlocale:en-usos:android-10-x64system
submitted
28-10-2024 10:08

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

b7b60b806acdefe08a6ee3e1429abe1bf0fc615cfa0eb3e26e0fcd8db40ea5b2.apk
Size

4.8MB
MD5

f8803e10a0c287963227ee12bf47ccdc
SHA1

29289d93968413a7329403271904bb20ac428028
SHA256

b7b60b806acdefe08a6ee3e1429abe1bf0fc615cfa0eb3e26e0fcd8db40ea5b2
SHA512

c83ecd35908a644fe6eb5d0849f30c3d67280dfd88c82f7f3191917cb3a0c320ad2e7eed2709eb4f5fcb6cdeb02cbcf0d3a4ab00f47dc60432f04dc7a6fa9e5b
SSDEEP

49152:mRsEXhxb0rKRmj7945iS7xrGXrMuoGyjVKScXlMAbit/YI8lLLGYTCk/FgPj:mRswwrEmj7+5iSRGhMVKUJ/7yG4CegPj

Score

10^/10

octo banker discovery evasion infostealer rat trojan

Malware Config

Signatures

Octo
Octo is a banking malware with remote access capabilities first seen in April 2022.
banker trojan infostealer rat octo
Octo family
octo

Octo payload 1 IoCs

resource	yara_rule
behavioral2/memory/4965-0.dex	family_octo

Loads dropped Dex/Jar 1 TTPs 1 IoCs

Runs executable file dropped to the device during analysis.

evasion

Download New Code at Runtime

T1407

ioc	pid	Process
/data/user/0/com.dmanualcapturen/[email protected]	4965	com.dmanualcapturen

Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
banker discovery

Security Software Discovery
T1418.001
Queries the phone number (MSISDN for GSM devices) 1 TTPs
discovery

System Network Configuration Discovery
T1422

Queries the mobile country code (MCC) 1 TTPs 1 IoCs

discovery

System Network Configuration Discovery

T1422

description	ioc	Process
Framework service call	com.android.internal.telephony.ITelephony.getNetworkCountryIsoForPhone	com.dmanualcapturen

com.dmanualcapturen
1⤵
- Loads dropped Dex/Jar
- Queries the mobile country code (MCC)
PID:4965

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Download New Code at Runtime

T1407

Credential Access

Discovery

Software Discovery

T1418

Security Software Discovery

T1418.001

System Network Configuration Discovery

T1422

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

/data/data/com.dmanualcapturen/.global.com.dmanualcapturen

Filesize
48B

MD5
046a414913add6f5bb60072c7db819b6

SHA1
451ee4f6809260aec622d772fd329c7d0297a842

SHA256
b66c1320cb063a1d391c94273572ea6edae76c8c8b0a07f8d75c88686f0df72a

SHA512
4e6355f3051ed5e811ab030abde1f5be7f5e1cf33be99cd08477e9b6c015deb1d8bd75a09fb9c7176b8511c5ad0a67abc0902a3531e97564ccb6afc57496a47c

Download Submit
/data/data/com.dmanualcapturen/files/.x

Filesize
322KB

MD5
77dc50489b9323274732d27dc8a4e803

SHA1
0e02a3595b62489d0739d771881da8604d117c65

SHA256
c5684e792d1ebefea6aac09fed45911703fd58c899f8a08133d49dd91429a820

SHA512
0684a92f3e9c525384cfa53f531afba61e5930e1c27032a7e27e3315f72761b62e122dc34768d8162ba08f9bed53d148aa8dc034b46456bdd211f230637eba58

Download Submit
/data/data/com.dmanualcapturen/oat/x86_64/[email protected]

Filesize
162B

MD5
27c307f836a22e81c30aaf4782f2d6ce

SHA1
2dc62d657d4a9623303ceb70f294ecc3552ec463

SHA256
32ef847ddb6b2e906c727935639062843a2e50a9c90447e5aacd98ccf560389e

SHA512
7cb09b2b90f74cbf231005577fa194967534d190af1539002b973f5746d729b4b1e80d1c36e1b3cfbdae272e994362b17332e970b14c4878e406b0e757d824a6

Download Submit
/data/user/0/com.dmanualcapturen/[email protected]

Filesize
525KB

MD5
4204f12a7d613f480012522c0986db9a

SHA1
12c902c5cad599260a7d1828aaa81f0967bfdcf5

SHA256
3908b3c3416d43c1d3b3e0b9c80c9dd9ebff610702b2d4a0520e267fe6554858

SHA512
1598f6555c3d1e88368c13c2f84acc9173964afc667222ea99d33390f96127d6979309fc772194b039e1b0bcc0cbc3b7bdd5f742c73c88fd526192b0a4831090

Download Submit