octo | 39f9909c5fea2161be1701cba709b6a65b2080f43262195d8ac745b8852c9ff8

Analysis

max time kernel
12s
max time network
128s
platform
android_x86
resource
android-x86-arm-20240624-en
resource tags

androidarch:armarch:x86image:android-x86-arm-20240624-enlocale:en-usos:android-9-x86system
submitted
09-11-2024 23:09

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

39f9909c5fea2161be1701cba709b6a65b2080f43262195d8ac745b8852c9ff8.apk
Size

2.4MB
MD5

a657e00e66b955d93808e2581ec72f14
SHA1

9a00f4676098b8777b66429e993fa39d7a2028ab
SHA256

39f9909c5fea2161be1701cba709b6a65b2080f43262195d8ac745b8852c9ff8
SHA512

c352c2cfa296b44c7dff28367f0f0ca93ee5833cfac29a42ef00b8546639712192909549187fc3d1f18cf10335c17554dbe2ba9c5d415cecb3cc706d6c6dd357
SSDEEP

49152:sK9mM3ry+5jHTfnUNlQp4ivdrzIMzylppQ0qvKdngeYfaWr1IkGqEK3ZGll:TV2+5nfolQqiFrcnpTKRdNEK3ZGll

Score

10^/10

octo banker evasion infostealer rat trojan

Malware Config

Extracted

Family

octo

https://5bb1332453233981d0595033c23.com/YmZiMzU0OTU5NGIz/

https://7bb13903074567453981d0595033c23.com/YmZiMzU0OTU5NGIz/

https://4bb13903074567453981d0595033c23.com/YmZiMzU0OTU5NGIz/

https://4b6413903074567453981d0595033c23.com/YmZiMzU0OTU5NGIz/

rc4.plain

Signatures

Octo
Octo is a banking malware with remote access capabilities first seen in April 2022.
banker trojan infostealer rat octo
Octo family
octo

Octo payload 1 IoCs

resource	yara_rule
behavioral1/files/fstream-1.dat	family_octo

Loads dropped Dex/Jar 1 TTPs 2 IoCs

Runs executable file dropped to the device during analysis.

evasion

Download New Code at Runtime

T1407

ioc	pid	Process
/data/user/0/com.himhereszy/cache/tsyuobmdh	4250	com.himhereszy
/data/user/0/com.himhereszy/cache/tsyuobmdh	4250	com.himhereszy

com.himhereszy
1⤵
- Loads dropped Dex/Jar
PID:4250

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Download New Code at Runtime

T1407

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

/data/data/com.himhereszy/cache/tsyuobmdh

Filesize
2.3MB

MD5
3d323acaada1f43fdf981d5b59568cec

SHA1
7bef31abfda572459f9dc629705f34ba75ec3e6c

SHA256
6fef99ecd588afb46d46057e996cfaa8bac7fb3bbc72b1f9e3343336a3deb7b6

SHA512
823bbb5bd2d4b690555b83d534b0868c829bf94e64821013968eb7b1d0f7628669fdd4a9d9c9270789f9b86bd69142f8305d2eaf17e6a60da9d196f1c6cb4969

Download Submit