octo | 12e59558e8746ac670b2c2d25729bf5d2d9f87792984f7e3a9f31fa3eda1a4f7

Analysis

max time kernel
7s
max time network
158s
platform
android_x64
resource
android-x64-20240624-en
resource tags

androidarch:x64arch:x86image:android-x64-20240624-enlocale:en-usos:android-10-x64system
submitted
18-11-2024 22:02

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

12e59558e8746ac670b2c2d25729bf5d2d9f87792984f7e3a9f31fa3eda1a4f7.apk
Size

3.0MB
MD5

ae29ea66c2a2a1cecf87cf230bcbf27f
SHA1

d5fcab6ebc2812fb5f7c7822f92a425ad534637d
SHA256

12e59558e8746ac670b2c2d25729bf5d2d9f87792984f7e3a9f31fa3eda1a4f7
SHA512

e3b74a448a35158b4cabb0211aa1fe50e6a6810bc7261a62ce230ee7dc325c24f514755fecf4f98f1f4ae3bb934017e85adbb4e6335468623608c41093d2cc1f
SSDEEP

49152:RH6A77Rexx8T6Dfuc1Jy5LbQFBUXwjpHC/aP0q8YW7FrwRxuZYZ06SwCWwwl/nVd:RJR6rE9EFBUXwVR0qyFrXYZ0NwcwJVOQ

Score

10^/10

octo banker discovery evasion infostealer rat trojan

Malware Config

Extracted

Family

octo

https://populeryabancianimaserver.xyz/MDQ2MTZjMDhlZDQy/

https://eglencelikahramanlaranimas.xyz/MDQ2MTZjMDhlZDQy/

https://cizgifilmtutkunlarianim.xyz/MDQ2MTZjMDhlZDQy/

https://renklidunyavekarakterler.xyz/MDQ2MTZjMDhlZDQy/

https://animasyonvekulturhikayeleri.xyz/MDQ2MTZjMDhlZDQy/

https://yabancisanatcizgiustalari.xyz/MDQ2MTZjMDhlZDQy/

https://cocukvesinemaoyuncular.xyz/MDQ2MTZjMDhlZDQy/

https://cizgidunyasindakiyabanci.xyz/MDQ2MTZjMDhlZDQy/

https://animasyontavsiyeveyorumlar.xyz/MDQ2MTZjMDhlZDQy/

https://sevimlicanlilarhikarakat.xyz/MDQ2MTZjMDhlZDQy/

https://yabancianimasinemaustalari.xyz/MDQ2MTZjMDhlZDQy/

https://cizgianimasanatyaraticilik.xyz/MDQ2MTZjMDhlZDQy/

https://populeranimaserverkaliteleri.xyz/MDQ2MTZjMDhlZDQy/

https://kulturelanimasyonvesanat.xyz/MDQ2MTZjMDhlZDQy/

https://yabancicizgianimasanatyolu.xyz/MDQ2MTZjMDhlZDQy/

https://eglencevesanatcizgihikaye.xyz/MDQ2MTZjMDhlZDQy/

https://yabanciveklasikanimasyon.xyz/MDQ2MTZjMDhlZDQy/

https://populeranimaserverdunyasi.xyz/MDQ2MTZjMDhlZDQy/

https://cizgianimasanatkonusmasi.xyz/MDQ2MTZjMDhlZDQy/

rc4.plain

Signatures

Octo
Octo is a banking malware with remote access capabilities first seen in April 2022.
banker trojan infostealer rat octo
Octo family
octo

Octo payload 1 IoCs

Processes:

resource	yara_rule
/data/user/0/com.source.fabric/app_method/lr.json	family_octo

Loads dropped Dex/Jar 1 TTPs 1 IoCs
Runs executable file dropped to the device during analysis.
evasion

Download New Code at Runtime
T1407

Processes:

com.source.fabric

ioc pid process

/data/user/0/com.source.fabric/app_method/lr.json 4926 com.source.fabric
Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
banker discovery

Security Software Discovery
T1418.001

ioc	pid	process
/data/user/0/com.source.fabric/app_method/lr.json	4926	com.source.fabric

com.source.fabric
1⤵
- Loads dropped Dex/Jar
PID:4926

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Download New Code at Runtime

T1407

Credential Access

Discovery

Software Discovery

T1418

Security Software Discovery

T1418.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

/data/data/com.source.fabric/app_method/lr.json

Filesize
153KB

MD5
7531ad870b88ad104cc1dc0e6a9bed22

SHA1
8956a58eb2ac403b8e055e437b3ecb5a8568ebf4

SHA256
d6d22dbf43327acce659c6c77d8e8981f682060f43c7352ac6fa1ec4ae0956c3

SHA512
c4ca19d04dc2ce8ddcaf16813078dc2bdc3c7fe41cb39d1e1a96521ba0d7dad97272942beba53eeac0d94f2eac578c5c64256d74475d0065ad1e441c86f75c4d

Download Submit
/data/data/com.source.fabric/app_method/lr.json

Filesize
153KB

MD5
cced5691fbe455ad2980a0ca35da0bb6

SHA1
2eeb4284f7e5448d9592e18626a38827ed164107

SHA256
7296679681382e5f7864d40ded2acbee88b4aa649816f448c9d11a4a08958156

SHA512
3170e46e0408f9f471a2e8fd3dd8846057b701949ee62d62a88f41cf317908568986992dfa507d7af34f8bd55c2cfb94de54bea0631b60d21ae3ea5132ec80d2

Download Submit
/data/user/0/com.source.fabric/app_method/lr.json

Filesize
450KB

MD5
b826aaf96ec766a41fc4174fef0ec962

SHA1
8b8655d1d11f96969574087bad6221e14d4ec3c6

SHA256
1d68c322b0c910368174d5c2ff8204ed0e9bdb15bac40098f6ebe66c0921e3b1

SHA512
6bf3626ce6a697c67e13c4c5cc852d1b0d1a338907c3fadb5eca14854462c4682615d11af3b8ffac0ce6e264cffa7cc8538ced1463d4ead0162d9513910aeb65

Download Submit