octo | ec87c72f7ea02ff44e32010ed019365c5836688743cfdaf758317eb84d0f9e59

Analysis

max time kernel
5s
max time network
145s
platform
android_x64
resource
android-x64-20240624-en
resource tags

androidarch:x64arch:x86image:android-x64-20240624-enlocale:en-usos:android-10-x64system
submitted
05-11-2024 22:11

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ec87c72f7ea02ff44e32010ed019365c5836688743cfdaf758317eb84d0f9e59.apk
Size

2.1MB
MD5

32a8f77e3a625c319a61907c9a187caf
SHA1

1b399854255f7bbad7193e5a74cd5e46b55fa807
SHA256

ec87c72f7ea02ff44e32010ed019365c5836688743cfdaf758317eb84d0f9e59
SHA512

ccbab8c4dfe022687eb566c89974b2b78bd561c853202e35ca3f3cd80f39263a2fb47961f549cdeecd514a7ab6f3ecf147968da64f2c4ae27b1e59ad6d358bd2
SSDEEP

49152:cO9Uue2Gs/vrTNme6+JdNZBOR4LJFkoHxr3dDzbsMzGP6OcZyPtDoCU0MArtSif:/mXgT6aI6JFkoHJt3wMaiZg2ArMK

Score

10^/10

octo banker discovery evasion infostealer rat trojan

Malware Config

Extracted

Family

octo

https://uzaykesifveteknolojigelecegimizinharitasi.xyz/MDQ2MTZjMDhlZDQy/

https://yapayzekailegezegentasimaprojesi.xyz/MDQ2MTZjMDhlZDQy/

https://yildizlararasihikayelerveuzaygemileri.xyz/MDQ2MTZjMDhlZDQy/

https://bilimkurgukesifvedonusumharitasi.xyz/MDQ2MTZjMDhlZDQy/

https://paralelgezegenlerveyapaysavaslar.xyz/MDQ2MTZjMDhlZDQy/

https://galaksilerarasiseyahatsanatyolculugu.xyz/MDQ2MTZjMDhlZDQy/

https://sibernetikveevrenselakilliyonetimi.xyz/MDQ2MTZjMDhlZDQy/

https://gelecektekiuzaykolonilerindeyasam.xyz/MDQ2MTZjMDhlZDQy/

https://robotveinsanbirlesmesimacerasi.xyz/MDQ2MTZjMDhlZDQy/

https://bilimkurguvetoplananveridunyasi.xyz/MDQ2MTZjMDhlZDQy/

https://galaksilerarasiiletisimveanliksistemler.xyz/MDQ2MTZjMDhlZDQy/

https://gelecekuzaygemisifantezivegercek.xyz/MDQ2MTZjMDhlZDQy/

https://uzayzamankapsamivedonusumkalkani.xyz/MDQ2MTZjMDhlZDQy/

https://zamanmakinesivemultievrenselgeziler.xyz/MDQ2MTZjMDhlZDQy/

https://paralelboyutlarvedijitalruhtasarimi.xyz/MDQ2MTZjMDhlZDQy/

https://galaktikekonomiuzaycagelecekyolu.xyz/MDQ2MTZjMDhlZDQy/

https://bilimkurguvedonusumolasilikharitasi.xyz/MDQ2MTZjMDhlZDQy/

https://yildizlarveteknolojikmedeniyetler.xyz/MDQ2MTZjMDhlZDQy/

https://karadeliksiralariuzayarastirmalari.xyz/MDQ2MTZjMDhlZDQy/

https://galaksikarasivakumbilgeliksistemi.xyz/MDQ2MTZjMDhlZDQy/

rc4.plain

Signatures

Octo
Octo is a banking malware with remote access capabilities first seen in April 2022.
banker trojan infostealer rat octo
Octo family
octo

Octo payload 1 IoCs

resource	yara_rule
behavioral2/memory/4962-0.dex	family_octo

Loads dropped Dex/Jar 1 TTPs 1 IoCs

Runs executable file dropped to the device during analysis.

evasion

Download New Code at Runtime

T1407

ioc	pid	Process
/data/user/0/com.episode.change/app_draft/NXXPLUZ.json	4962	com.episode.change

Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
banker discovery

Security Software Discovery
T1418.001

com.episode.change
1⤵
- Loads dropped Dex/Jar
PID:4962

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Download New Code at Runtime

T1407

Credential Access

Discovery

Software Discovery

T1418

Security Software Discovery

T1418.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

/data/data/com.episode.change/app_draft/NXXPLUZ.json

Filesize
153KB

MD5
c05dd75e5404c9b3f07e5c81fd7ec295

SHA1
3d97fb2c4168e6d2302cd3f6754e52576eac9427

SHA256
343ab52709395c125f42ce6dca20f9c6dba79c2211ebc3498dcbf040b2ad6dc6

SHA512
7ac6a7fc9fd68c2ad6abaf987f9c10793af1de8fcda506a8a5c2a0a5b8c58ca866d2783bb4f5b7fb9d0802abccece9412522eafe621860b8ab0ab17e91345f5d

Download Submit
/data/data/com.episode.change/app_draft/NXXPLUZ.json

Filesize
153KB

MD5
242bca21360e64dce302a2fe5a013445

SHA1
9e94c5fb06322008f349026c72142d28a790e510

SHA256
e2ed010e8d4ef3372930e44b65a88c09d2ad37ceb09f237399f92638573713d8

SHA512
8f552a7b304f4f1acaa2b1acfdd3dcc46318226015e6cd002f7ab4e6d308256a1133fdf91b844b7b144bf3dd9399d422e1e903df8e1f9c504b7adca8338dc7f1

Download Submit
/data/user/0/com.episode.change/app_draft/NXXPLUZ.json

Filesize
451KB

MD5
61b3a29c9e05cad3e9a1d99c0dee05bb

SHA1
6276a6f0bc5f077cfbde902b3c16ba8ef7e855c6

SHA256
0189349678def02c979a8af3ac72a3e502937915877982efbe426d76746bd3a3

SHA512
6a67b4d1e3003c1601615ecd1b71d939e0b94563c0b21c878691b96aa0df2366cb4af2b9d440cc22d95223cb1bcdab316a21cc9968283a49e75b17ce40264de4

Download Submit