octo | e87873ddf3177fee45b3c93c561aa99bf169ae3689bec87995919f4cf8eb586b

Analysis

max time kernel
3s
max time network
153s
platform
android_x64
resource
android-x64-20240624-en
resource tags

androidarch:x64arch:x86image:android-x64-20240624-enlocale:en-usos:android-10-x64system
submitted
25-11-2024 22:10

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

e87873ddf3177fee45b3c93c561aa99bf169ae3689bec87995919f4cf8eb586b.apk
Size

4.8MB
MD5

a180452343c5be4ebe36708a37c6d1b4
SHA1

f2b39ec2d67b43c283925808bbb93e07a210903a
SHA256

e87873ddf3177fee45b3c93c561aa99bf169ae3689bec87995919f4cf8eb586b
SHA512

b5ef1b79a44ca7598d752faebe45bb8b7ffb468c4f4f29ba8c80b888ecff233dc4eefffe1f309f4e3025c2f4618339f19db29f6df90663928c9e859f73f163c9
SSDEEP

49152:ORsEXz0Y1SKl4j7E45iS7xrGzrjOsvzjVKSc+N+vZ7XMhgm99LvdtdhQz:ORsoj1SY4j7t5iSRG1PVKY0FyCz

Score

10^/10

octo banker discovery evasion infostealer rat trojan

Malware Config

Signatures

Octo
Octo is a banking malware with remote access capabilities first seen in April 2022.
banker trojan infostealer rat octo
Octo family
octo

Octo payload 1 IoCs

resource	yara_rule
behavioral2/memory/4960-0.dex	family_octo

Loads dropped Dex/Jar 1 TTPs 1 IoCs

Runs executable file dropped to the device during analysis.

evasion

Download New Code at Runtime

T1407

ioc	pid	Process
/data/user/0/com.adecrease_widgetc/[email protected]	4960	com.adecrease_widgetc

Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
banker discovery

Security Software Discovery
T1418.001
Queries the phone number (MSISDN for GSM devices) 1 TTPs
discovery

System Network Configuration Discovery
T1422

Queries the mobile country code (MCC) 1 TTPs 1 IoCs

discovery

System Network Configuration Discovery

T1422

description	ioc	Process
Framework service call	com.android.internal.telephony.ITelephony.getNetworkCountryIsoForPhone	com.adecrease_widgetc

Reads information about phone network operator. 1 TTPs
discovery

System Network Configuration Discovery
T1422

com.adecrease_widgetc
1⤵
- Loads dropped Dex/Jar
- Queries the mobile country code (MCC)
PID:4960

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Download New Code at Runtime

T1407

Credential Access

Discovery

Software Discovery

T1418

Security Software Discovery

T1418.001

System Network Configuration Discovery

T1422

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

/data/data/com.adecrease_widgetc/.global.com.adecrease_widgetc

Filesize
48B

MD5
046a414913add6f5bb60072c7db819b6

SHA1
451ee4f6809260aec622d772fd329c7d0297a842

SHA256
b66c1320cb063a1d391c94273572ea6edae76c8c8b0a07f8d75c88686f0df72a

SHA512
4e6355f3051ed5e811ab030abde1f5be7f5e1cf33be99cd08477e9b6c015deb1d8bd75a09fb9c7176b8511c5ad0a67abc0902a3531e97564ccb6afc57496a47c

Download Submit
/data/data/com.adecrease_widgetc/files/.t

Filesize
322KB

MD5
77dc50489b9323274732d27dc8a4e803

SHA1
0e02a3595b62489d0739d771881da8604d117c65

SHA256
c5684e792d1ebefea6aac09fed45911703fd58c899f8a08133d49dd91429a820

SHA512
0684a92f3e9c525384cfa53f531afba61e5930e1c27032a7e27e3315f72761b62e122dc34768d8162ba08f9bed53d148aa8dc034b46456bdd211f230637eba58

Download Submit
/data/data/com.adecrease_widgetc/oat/x86_64/[email protected]

Filesize
164B

MD5
255b032c892e0132f8b6c3eb67250700

SHA1
1a6eb39ddab713df60621d20a6e93d623cf3c656

SHA256
6510c2c5dfc9237218e32ec5e2651a5e0e5c5d4543ebeb9d1096a23af37c1382

SHA512
3105564e39d3be077df69562f1a6c989b8a493d3f90140f8be6c1556deb941e73f1f54d39903f199f4705bfd87f9962f2d0374e8a9b24971bb30a74b349903ca

Download Submit
/data/user/0/com.adecrease_widgetc/[email protected]

Filesize
526KB

MD5
7a8a51d54dfbe5ab37c438d5717e8249

SHA1
09d6e57d9961be982b16f2d91bc10c063fcb9823

SHA256
5c56c3be351c90de0552da4e85449f026cfe23bc00130218e1d18950338fab1c

SHA512
fd01d939007fe9fee9bc8ad0b21e371ac79b8c9a2ec852777ead5e70a362386aaebac84e96c04f6f305f8879e235d0b76fa6ceaa8b7723cba8f3b34e587eb2cf

Download Submit