octo | 262e9f1869d0d6fe50cc00f734d001da9aa49d1f082de9940239e5540df22a0f

Analysis

max time kernel
5s
max time network
145s
platform
android_x64
resource
android-x64-20240624-en
resource tags

androidarch:x64arch:x86image:android-x64-20240624-enlocale:en-usos:android-10-x64system
submitted
10/11/2024, 22:01

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

262e9f1869d0d6fe50cc00f734d001da9aa49d1f082de9940239e5540df22a0f.apk
Size

2.1MB
MD5

f751e35a993f518f7cc91a25f8aaed32
SHA1

cc9f65cf123466e2652a346e4154f92533bc2428
SHA256

262e9f1869d0d6fe50cc00f734d001da9aa49d1f082de9940239e5540df22a0f
SHA512

9b43e106fc4eeab44965b9e222379d8fc8edc634779e5d98bd48abc6663796352b79b3ea76381bde0f413e025d0753640a155d59ce1b68ecff39f7727f9f1698
SSDEEP

49152:LDr/13rOwDJ4/UWivNFcFdTfIemjfLGe0HXwrAGfez4/gdv+25pJR+j+umzplT:LDDFqw2/sNyFqhCe0HXErez4Iddty+rL

Score

10^/10

octo banker discovery evasion infostealer persistence rat trojan

Malware Config

Extracted

Family

octo

https://brunchxy.top/YTZhZjliODdlYTI4/

https://sporkly.top/YTZhZjliODdlYTI4/

https://glampingaz.top/YTZhZjliODdlYTI4/

https://frenemyq.top/YTZhZjliODdlYTI4/

https://chillaxio.top/YTZhZjliODdlYTI4/

https://ginormusj.top/YTZhZjliODdlYTI4/

https://workaholkc.top/YTZhZjliODdlYTI4/

https://hangryv.top/YTZhZjliODdlYTI4/

https://spanglix.top/YTZhZjliODdlYTI4/

https://blogosphze.top/YTZhZjliODdlYTI4/

https://smoggyu.top/YTZhZjliODdlYTI4/

https://edutainmt.top/YTZhZjliODdlYTI4/

https://mockumnt.top/YTZhZjliODdlYTI4/

https://fleekyp.top/YTZhZjliODdlYTI4/

https://infoglo.top/YTZhZjliODdlYTI4/

https://staycatzu.top/YTZhZjliODdlYTI4/

https://mansplainu.top/YTZhZjliODdlYTI4/

https://spaghettom.top/YTZhZjliODdlYTI4/

https://gluttonyd.top/YTZhZjliODdlYTI4/

https://electrohu.top/YTZhZjliODdlYTI4/

rc4.plain

Signatures

Octo
Octo is a banking malware with remote access capabilities first seen in April 2022.
banker trojan infostealer rat octo
Octo family
octo

Octo payload 1 IoCs

resource	yara_rule
behavioral2/memory/4970-0.dex	family_octo

Loads dropped Dex/Jar 1 TTPs 1 IoCs

Runs executable file dropped to the device during analysis.

evasion

Download New Code at Runtime

T1407

ioc	pid	Process
/data/user/0/com.sgakagak.agakagabs/app_zone/JPK.json	4970	com.sgakagak.agakagabs

Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
banker discovery

Security Software Discovery
T1418.001
Queries the phone number (MSISDN for GSM devices) 1 TTPs
discovery

System Network Configuration Discovery
T1422

Queries the mobile country code (MCC) 1 TTPs 1 IoCs

discovery

System Network Configuration Discovery

T1422

description	ioc	Process
Framework service call	com.android.internal.telephony.ITelephony.getNetworkCountryIsoForPhone	com.sgakagak.agakagabs

Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs

persistence

Broadcast Receivers

T1624.001

description	ioc	Process
Framework service call	android.app.IActivityManager.registerReceiver	com.sgakagak.agakagabs

com.sgakagak.agakagabs
1⤵
- Loads dropped Dex/Jar
- Queries the mobile country code (MCC)
- Registers a broadcast receiver at runtime (usually for listening for system events)
PID:4970

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Event Triggered Execution

T1624

Broadcast Receivers

T1624.001

Privilege Escalation

Defense Evasion

Download New Code at Runtime

T1407

Credential Access

Discovery

Software Discovery

T1418

Security Software Discovery

T1418.001

System Network Configuration Discovery

T1422

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

/data/data/com.sgakagak.agakagabs/app_zone/JPK.json

Filesize
152KB

MD5
f55a28f2ea7107b919925c33fd1b1717

SHA1
4df4e4b5d9bffe8bc888228c036f80e2097d6260

SHA256
9ce86f20a51b0b84b6bfb818d0361bb6ca3475a007503160cb836cf5f93731c1

SHA512
65801d5e32b5e0fa19f42238988778c0bf5434eb7822ccfc84db5c8741305400da8ddfa6e79af784b12fca2051c692298aea31320e39ae238b9432176d8a356a

Download Submit
/data/data/com.sgakagak.agakagabs/app_zone/JPK.json

Filesize
152KB

MD5
c1c1e6df83f9be1a65b986c6df2dae7b

SHA1
e0f57e09d42d3ff8b7a68e3b227c019d3aa00470

SHA256
d3a397a6129d3a193940e479fc7f2a82a0eb83c695eccca7248d71b7ff9cf094

SHA512
eee3ba1f6013165bf2d4d98339b2911d61394df52d4b17bb332c73ef13b442141f2c3a77817fe776cf0734fc3602ac594e2f505dac1f0b89cb76120b81cffbd8

Download Submit
/data/user/0/com.sgakagak.agakagabs/app_zone/JPK.json

Filesize
450KB

MD5
28d86e9a302f9c26fca2cab84b4d09bb

SHA1
860b78585ebdbb7ba58f511ba8916f9cffe73c97

SHA256
b407a26a00764ea0dee34546a34dff11076ea21dd62963b6ce3fc720d5461977

SHA512
5108a176bf72d1651a0176a6c8ec5113567f39cfd3ae039eb06fe21bc1a711f88735a9ab3b5f4bd67b8bacc96a9c1ab35645484ad07339149e029661c83fc26d

Download Submit