octo | 34a484d7074c2c39ce240140ebb51147736fa32acd44159a3d838addafea595b

Analysis

max time kernel
12s
max time network
150s
platform
android_x64
resource
android-x64-20240624-en
resource tags

androidarch:x64arch:x86image:android-x64-20240624-enlocale:en-usos:android-10-x64system
submitted
09-11-2024 22:00

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

34a484d7074c2c39ce240140ebb51147736fa32acd44159a3d838addafea595b.apk
Size

2.4MB
MD5

bd5ae0c9148293717200ec19ba0f1a35
SHA1

26327388afd3fad0af2c881efee13f0f4f36e3e3
SHA256

34a484d7074c2c39ce240140ebb51147736fa32acd44159a3d838addafea595b
SHA512

eec7d97f99717fa7acbf49aab0933e716d829b45137890b84fcc1d408d574ba904f888f3a60feaf386641226636c160386028b5ee0784091e60ab0270c179ea1
SSDEEP

49152:0cOvnyNMMh+Gt4X3Q2gHLsIYYkutMm798dGeL+MIPkg4KgOCpZpHTCp0OzuZ/KQ+:qgaGcUHf1M69Q5bg43npHT2W/q

Score

10^/10

octo banker discovery evasion infostealer rat trojan

Malware Config

Extracted

Family

octo

https://4bb139030b74564533981d0595033c23.com/YmZiMzU0OTU5NGIz/

https://4bb1332453233981d0595033c23.com/YmZiMzU0OTU5NGIz/

https://9bb1332453233981d0595033c23.com/YmZiMzU0OTU5NGIz/

https://5bb1332453233981d0595033c23.com/YmZiMzU0OTU5NGIz/

https://7bb13903074567453981d0595033c23.com/YmZiMzU0OTU5NGIz/

https://4bb13903074567453981d0595033c23.com/YmZiMzU0OTU5NGIz/

https://4b6413903074567453981d0595033c23.com/YmZiMzU0OTU5NGIz/

rc4.plain

Signatures

Octo
Octo is a banking malware with remote access capabilities first seen in April 2022.
banker trojan infostealer rat octo
Octo family
octo

Octo payload 1 IoCs

resource	yara_rule
behavioral2/files/fstream-1.dat	family_octo

Loads dropped Dex/Jar 1 TTPs 2 IoCs

Runs executable file dropped to the device during analysis.

evasion

Download New Code at Runtime

T1407

ioc	pid	Process
/data/user/0/com.betterhighr/cache/cjzxqgwb	4975	com.betterhighr
/data/user/0/com.betterhighr/cache/cjzxqgwb	4975	com.betterhighr

Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
banker discovery

Security Software Discovery
T1418.001
Queries the phone number (MSISDN for GSM devices) 1 TTPs
discovery

System Network Configuration Discovery
T1422

Queries the mobile country code (MCC) 1 TTPs 1 IoCs

discovery

System Network Configuration Discovery

T1422

description	ioc	Process
Framework service call	com.android.internal.telephony.ITelephony.getNetworkCountryIsoForPhone	com.betterhighr

Reads information about phone network operator. 1 TTPs
discovery

System Network Configuration Discovery
T1422

com.betterhighr
1⤵
- Loads dropped Dex/Jar
- Queries the mobile country code (MCC)
PID:4975

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Download New Code at Runtime

T1407

Credential Access

Discovery

Software Discovery

T1418

Security Software Discovery

T1418.001

System Network Configuration Discovery

T1422

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

/data/data/com.betterhighr/cache/cjzxqgwb

Filesize
2.3MB

MD5
0b664c9256947e816d7258865a867cb6

SHA1
b5dcd07f17e846602b7b7a7b2a51e140d4b45790

SHA256
6975fdc3994adb8b9daa057e86ac1572d809c3e560f9e557c10061c7e18e8c36

SHA512
aee3181cebfdad0ed8871c48c1c06746bfac825444e2b8a010ac27095307330663a5763c6ee0164f802253daf9bc93c306c81947ed367d9298a1d2c287e4ec2a

Download Submit