octo | 9efcff3fe9fb791d44b3b346867063f259f4b94725d0d2d147fa44d277b1f9e3

Analysis

max time kernel
12s
max time network
148s
platform
android_x64
resource
android-x64-20240624-en
resource tags

androidarch:x64arch:x86image:android-x64-20240624-enlocale:en-usos:android-10-x64system
submitted
05-11-2024 22:08

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

9efcff3fe9fb791d44b3b346867063f259f4b94725d0d2d147fa44d277b1f9e3.apk
Size

2.4MB
MD5

bf980373065ed8a74c24d470c0857bc7
SHA1

8362bf969bad426f23e1c3de616971ac6a265275
SHA256

9efcff3fe9fb791d44b3b346867063f259f4b94725d0d2d147fa44d277b1f9e3
SHA512

a7b2f7c4efc8d4be6d2d8c59decbca8557750ceefd5195d9a18689f46abeb5342e5a0045c8733d45516ee985754a68903879ab8ef803ff53af55a4c87111ba80
SSDEEP

49152:1eZsELdb4/HvHEwIL/6QqXxRRAIt/krDkBrROPXzBzVjg+NNq:EPds/HvHEwI7jqpA8/krAhRgVzVjgmq

Score

10^/10

octo banker discovery evasion infostealer rat trojan

Malware Config

Extracted

Family

octo

https://4bb139030b74564533981d0595033c23.com/YmZiMzU0OTU5NGIz/

https://4bb1332453233981d0595033c23.com/YmZiMzU0OTU5NGIz/

https://9bb1332453233981d0595033c23.com/YmZiMzU0OTU5NGIz/

https://5bb1332453233981d0595033c23.com/YmZiMzU0OTU5NGIz/

https://7bb13903074567453981d0595033c23.com/YmZiMzU0OTU5NGIz/

https://4bb13903074567453981d0595033c23.com/YmZiMzU0OTU5NGIz/

https://4b6413903074567453981d0595033c23.com/YmZiMzU0OTU5NGIz/

rc4.plain

Signatures

Octo
Octo is a banking malware with remote access capabilities first seen in April 2022.
banker trojan infostealer rat octo
Octo family
octo

Octo payload 1 IoCs

resource	yara_rule
behavioral2/files/fstream-1.dat	family_octo

Loads dropped Dex/Jar 1 TTPs 2 IoCs

Runs executable file dropped to the device during analysis.

evasion

Download New Code at Runtime

T1407

ioc	pid	Process
/data/user/0/com.greensecondms/cache/cfwzxyhj	4976	com.greensecondms
/data/user/0/com.greensecondms/cache/cfwzxyhj	4976	com.greensecondms

Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
banker discovery

Security Software Discovery
T1418.001
Queries the phone number (MSISDN for GSM devices) 1 TTPs
discovery

System Network Configuration Discovery
T1422

Queries the mobile country code (MCC) 1 TTPs 1 IoCs

discovery

System Network Configuration Discovery

T1422

description	ioc	Process
Framework service call	com.android.internal.telephony.ITelephony.getNetworkCountryIsoForPhone	com.greensecondms

Reads information about phone network operator. 1 TTPs
discovery

System Network Configuration Discovery
T1422

com.greensecondms
1⤵
- Loads dropped Dex/Jar
- Queries the mobile country code (MCC)
PID:4976

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Download New Code at Runtime

T1407

Credential Access

Discovery

Software Discovery

T1418

Security Software Discovery

T1418.001

System Network Configuration Discovery

T1422

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

/data/data/com.greensecondms/cache/cfwzxyhj

Filesize
2.3MB

MD5
78ba8492eb4e72b18a962d6b036d69cc

SHA1
feded8a830cd7e3607335ef0bbecd90dad22f78a

SHA256
4831105261cf822d513123b623004a27b3f4672db770f7aff8c33cce788987d1

SHA512
a3e4c00abd347bd7af1529ce3499c9a6e7533b56d1edb7c7fec94ab26b416058448a4aec69b370db0f1d7163460f7126cbaea0a9fe577bb27ab9b4d5562bf7ce

Download Submit