octo | 2d940a54b2dae557560129a98e7e17f221fad5bf1000eacbf9f15212cd1d6fd3

Analysis

max time kernel
9s
max time network
157s
platform
android_x64
resource
android-x64-20240624-en
resource tags

androidarch:x64arch:x86image:android-x64-20240624-enlocale:en-usos:android-10-x64system
submitted
16-11-2024 22:02

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2d940a54b2dae557560129a98e7e17f221fad5bf1000eacbf9f15212cd1d6fd3.apk
Size

605KB
MD5

39e58f7eb8fff109c37a2a3159eb16a5
SHA1

8eb22ff428f0c1ec1060c6d03f62312f70b9df99
SHA256

2d940a54b2dae557560129a98e7e17f221fad5bf1000eacbf9f15212cd1d6fd3
SHA512

8ed6b2aa9c4ec9ce1876809b4f4f2e580eee6ec4ad88c9e3b2b578f6b0489cc085b1b3b4269bd572bd83d9f53955a2b2fa3d11ed9f892288c4d60682b18e4bb3
SSDEEP

12288:6xcTSduysIZWgd8ZymOtxwXmtV0L5Lw46xWra4EGg4xhqMOSk1D5s4hDLrMhdHN:6xcEhsI0gd8Ym6zS8xxWm4JgiwSUD5sz

Score

10^/10

octo banker discovery evasion infostealer rat trojan

Malware Config

Extracted

Family

octo

DES_key

Signatures

Octo
Octo is a banking malware with remote access capabilities first seen in April 2022.
banker trojan infostealer rat octo
Octo family
octo

Octo payload 1 IoCs

resource	yara_rule
behavioral2/files/fstream-3.dat	family_octo

Loads dropped Dex/Jar 1 TTPs 2 IoCs

Runs executable file dropped to the device during analysis.

evasion

Download New Code at Runtime

T1407

ioc	pid	Process
/data/user/0/com.shouldfivejf/code_cache/secondary-dexes/1731794538470_classes.dex	4974	com.shouldfivejf
/data/user/0/com.shouldfivejf/code_cache/secondary-dexes/1731794538470_classes.dex	4974	com.shouldfivejf

Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
banker discovery

Security Software Discovery
T1418.001

com.shouldfivejf
1⤵
- Loads dropped Dex/Jar
PID:4974

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Download New Code at Runtime

T1407

Credential Access

Discovery

Software Discovery

T1418

Security Software Discovery

T1418.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

/data/data/com.shouldfivejf/cache/classes.dex

Filesize
447KB

MD5
be59c2b34d906da0cea68197e682e383

SHA1
dff831bdd0a10c94958d898b8ab60bf0288bad8e

SHA256
8876b62f7429a43b0608248ec58025fb3024ca5cc4f777002e9a1f1b9d5a442b

SHA512
1ab97f380b4ec6b243a7fbad55ded0e01e8fa075096ffd691acd20c072fe8a2db20215617d22f390cd2bbbcc5b4ea8b9573f92afa2ef10f993fdb3359fdda7ed

Download Submit
/data/data/com.shouldfivejf/code_cache/secondary-dexes/1731794538470_classes.dex

Filesize
1.1MB

MD5
3076ef16ae272e6bb2cbd7e0a340f409

SHA1
0f729f031ac9d388a950b8394a98792e287d7cb7

SHA256
9301b29b21a2da963c40ed5a4e215f4645808ec5b834347ed26e1090e415afc8

SHA512
56757f31045c71743e6011728ec212e3e798c1cda5200448ae2b7fee84694285ec71bc192d434c132ec979be516b26c386b48ee70afc6f93ec015199341b4994

Download Submit
/data/data/com.shouldfivejf/no_backup/androidx.work.workdb

Filesize
4KB

MD5
f2b4b0190b9f384ca885f0c8c9b14700

SHA1
934ff2646757b5b6e7f20f6a0aa76c7f995d9361

SHA256
0a8ffb6b327963558716e87db8946016d143e39f895fa1b43e95ba7032ce2514

SHA512
ec12685fc0d60526eed4d38820aad95611f3e93ae372be5a57142d8e8a1ba17e6e5dfe381a4e1365dddc0b363c9c40daaffdc1245bd515fddac69bf1abacd7f1

Download Submit
/data/data/com.shouldfivejf/no_backup/androidx.work.workdb-journal

Filesize
512B

MD5
d402a1d94d50b50a9f37a681ab2ff823

SHA1
248b5c455c47104e95588aabfa7d12756117c4b3

SHA256
40db6f68a52b3dbc8c66a608fad7ab3069a37a3d3462036efe079e1035be9032

SHA512
9390ff7204e7aa044df1447489afbd03a1226c30b5cfc19ed821edb58b7b4b9217c471f07481bb9f136ec3c196faad80770741afcf509807718568ccb585b557

Download Submit
/data/data/com.shouldfivejf/no_backup/androidx.work.workdb-shm

Filesize
32KB

MD5
bb7df04e1b0a2570657527a7e108ae23

SHA1
5188431849b4613152fd7bdba6a3ff0a4fd6424b

SHA256
c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479

SHA512
768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012

Download Submit
/data/data/com.shouldfivejf/no_backup/androidx.work.workdb-wal

Filesize
16KB

MD5
d24570d2aad1cc6d9e711ba6248315aa

SHA1
9a10f3464f5f8bd02c72d2b6e37f6d1429043409

SHA256
269f4682b9ed0b7a9f5bc85659ce896ea42c68cbc4a2056d51792309720dc978

SHA512
b74751e336261587d61ac3750b40817def1f485ecf54c234682d21eae7a6f2420fe2e14a7d3ad6ca9d1a7db0032e314826fe746b8181e9441a2a5e27cd90cd08

Download Submit