octo | 3bb977572649e33b2e76c19bd6cda558d48c68b6cf718219345e97bbbcf672be

Analysis

max time kernel
11s
max time network
156s
platform
android_x64
resource
android-x64-20240624-en
resource tags

androidarch:x64arch:x86image:android-x64-20240624-enlocale:en-usos:android-10-x64system
submitted
14-11-2024 22:01

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

3bb977572649e33b2e76c19bd6cda558d48c68b6cf718219345e97bbbcf672be.apk
Size

605KB
MD5

456336381fb676ab40cd61c825140195
SHA1

cd413d867c6f20b733fcb175ec8a17389b6a8a85
SHA256

3bb977572649e33b2e76c19bd6cda558d48c68b6cf718219345e97bbbcf672be
SHA512

311398b7f1900a9cc90c353ec3bb4b65aa4af6c031d58dad62ff5596a0589bb7a73e73e82e8746a4883bd4cdc81b1148bd719a740e2e490ee6a277846ed3500d
SSDEEP

12288:MTHDN+gS0QHiw4yiSnIF6BphqEINUvo+q3p+IphY//NscHzKys4hDLrMhdRTn:avSH34yirwBphMmvohwlRTKysIzgdRn

Score

10^/10

octo banker discovery evasion infostealer rat trojan

Malware Config

Extracted

Family

octo

DES_key

Signatures

Octo
Octo is a banking malware with remote access capabilities first seen in April 2022.
banker trojan infostealer rat octo
Octo family
octo

Octo payload 1 IoCs

resource	yara_rule
behavioral2/files/fstream-3.dat	family_octo

Loads dropped Dex/Jar 1 TTPs 2 IoCs

Runs executable file dropped to the device during analysis.

evasion

Download New Code at Runtime

T1407

ioc	pid	Process
/data/user/0/com.makethewf/code_cache/secondary-dexes/1731621711161_classes.dex	4973	com.makethewf
/data/user/0/com.makethewf/code_cache/secondary-dexes/1731621711161_classes.dex	4973	com.makethewf

Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
banker discovery

Security Software Discovery
T1418.001

com.makethewf
1⤵
- Loads dropped Dex/Jar
PID:4973

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Download New Code at Runtime

T1407

Credential Access

Discovery

Software Discovery

T1418

Security Software Discovery

T1418.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

/data/data/com.makethewf/cache/classes.dex

Filesize
446KB

MD5
01f6fed89a97a1e39432a603ffe63975

SHA1
604740d9a5a86c4bceb941235c3f85c6079913e4

SHA256
d5522c6b6b2f7ab7ab9e308cd1d3a840a76427c37247d440e7e7f81f50311c53

SHA512
e9b5b4b83c855756355424878e1424a2b5ca6102068da888f4ce0e221526520042af8cce7b23456fd82bef2cc3b0ce1f11b2fa2f881a73486f2656618058cc3e

Download Submit
/data/data/com.makethewf/code_cache/secondary-dexes/1731621711161_classes.dex

Filesize
1.1MB

MD5
6a360f83c4740ebe81669374cc3ea8dd

SHA1
fa6a35efd9e07d6219f4c2cb9fcbcaa35bddef73

SHA256
21908aa9f33ba304c396844ebfadb8509db79c95f6eb57925c16435756e96f67

SHA512
5d446977219560df2d12782708af96c7b9d90585a079622cead0bcb9255aa3d64d3240a7954f0080f5eaa406813e6e5bffa64d020daf099b1c85005c88664cea

Download Submit
/data/data/com.makethewf/no_backup/androidx.work.workdb

Filesize
4KB

MD5
f2b4b0190b9f384ca885f0c8c9b14700

SHA1
934ff2646757b5b6e7f20f6a0aa76c7f995d9361

SHA256
0a8ffb6b327963558716e87db8946016d143e39f895fa1b43e95ba7032ce2514

SHA512
ec12685fc0d60526eed4d38820aad95611f3e93ae372be5a57142d8e8a1ba17e6e5dfe381a4e1365dddc0b363c9c40daaffdc1245bd515fddac69bf1abacd7f1

Download Submit
/data/data/com.makethewf/no_backup/androidx.work.workdb-journal

Filesize
512B

MD5
047cd4fd8b8698231516a802537a32a0

SHA1
aecfc4155d86471172a64fdd369d2b86facf561b

SHA256
aca9632dda483ba93dba42d2383abc08e4661974eccf06a7f2879e0db38f4217

SHA512
fb2dfc5bc8d0a85bb437486d2ee8118797941e4ce65be28e6db93b4d4bb971fab1d5b4671711729f9254d5ba7b96b7774608580344a8f52cb597d92bf0a81742

Download Submit
/data/data/com.makethewf/no_backup/androidx.work.workdb-shm

Filesize
32KB

MD5
bb7df04e1b0a2570657527a7e108ae23

SHA1
5188431849b4613152fd7bdba6a3ff0a4fd6424b

SHA256
c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479

SHA512
768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012

Download Submit
/data/data/com.makethewf/no_backup/androidx.work.workdb-wal

Filesize
16KB

MD5
02d4635c6b292c8b5e7c91a1f482abd2

SHA1
aef52d85bdf914c5cadeec2ec02894df39640661

SHA256
dc52065b0332cde07168da9bdb2a27003205877a9c35f11c334fac0725ba6d65

SHA512
f9ddc3dbd5918a964ae78b3e122f894221c5a569caf55ffc6893af1b1c0927daad8498487f257c3951336b5f9bb792f91da12046c06f5d4d54cf67f5b2634fb3

Download Submit