octo | f6bb4725be6b3cf9e30ae50a101bed10002c1319829554c8da10ff20baac6a3a

Analysis

max time kernel
4s
max time network
147s
platform
android_x64
resource
android-x64-20240624-en
resource tags

androidarch:x64arch:x86image:android-x64-20240624-enlocale:en-usos:android-10-x64system
submitted
16-12-2024 03:25

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

f6bb4725be6b3cf9e30ae50a101bed10002c1319829554c8da10ff20baac6a3a.apk
Size

4.9MB
MD5

3d9163f54e311ce0a42e53c5fd39d16c
SHA1

608d6fb0808596a57670d0ec00aae6ebdd4d5c59
SHA256

f6bb4725be6b3cf9e30ae50a101bed10002c1319829554c8da10ff20baac6a3a
SHA512

28baedf3f811fde5376d6059e25e48e0f5faedff62ed50c60b2ff636015251478cd847ba3236177602dc6ae6c9cfc9bf2fcf197318f506953bafcf8e2171237c
SSDEEP

49152:YRsEXnDlK4y3XzP45iS7xrGPv7Ys4WjVKSce6vfZjKxVryFNzMNxcER:YRsolpy3X05iSRG4gVKnVKrkWx7

Score

10^/10

octo banker discovery evasion infostealer rat trojan

Malware Config

Signatures

Octo
Octo is a banking malware with remote access capabilities first seen in April 2022.
banker trojan infostealer rat octo
Octo family
octo

Octo payload 1 IoCs

resource	yara_rule
behavioral2/memory/4960-0.dex	family_octo

Loads dropped Dex/Jar 1 TTPs 1 IoCs

Runs executable file dropped to the device during analysis.

evasion

Download New Code at Runtime

T1407

ioc	pid	Process
/data/user/0/com.qltable47_huawei/[email protected]	4960	com.qltable47_huawei

Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
banker discovery

Security Software Discovery
T1418.001
Queries the phone number (MSISDN for GSM devices) 1 TTPs
discovery

System Network Configuration Discovery
T1422

Queries the mobile country code (MCC) 1 TTPs 1 IoCs

discovery

System Network Configuration Discovery

T1422

description	ioc	Process
Framework service call	com.android.internal.telephony.ITelephony.getNetworkCountryIsoForPhone	com.qltable47_huawei

com.qltable47_huawei
1⤵
- Loads dropped Dex/Jar
- Queries the mobile country code (MCC)
PID:4960

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Download New Code at Runtime

T1407

Credential Access

Discovery

Software Discovery

T1418

Security Software Discovery

T1418.001

System Network Configuration Discovery

T1422

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

/data/data/com.qltable47_huawei/.global.com.qltable47_huawei

Filesize
48B

MD5
046a414913add6f5bb60072c7db819b6

SHA1
451ee4f6809260aec622d772fd329c7d0297a842

SHA256
b66c1320cb063a1d391c94273572ea6edae76c8c8b0a07f8d75c88686f0df72a

SHA512
4e6355f3051ed5e811ab030abde1f5be7f5e1cf33be99cd08477e9b6c015deb1d8bd75a09fb9c7176b8511c5ad0a67abc0902a3531e97564ccb6afc57496a47c

Download Submit
/data/data/com.qltable47_huawei/files/.w

Filesize
322KB

MD5
77dc50489b9323274732d27dc8a4e803

SHA1
0e02a3595b62489d0739d771881da8604d117c65

SHA256
c5684e792d1ebefea6aac09fed45911703fd58c899f8a08133d49dd91429a820

SHA512
0684a92f3e9c525384cfa53f531afba61e5930e1c27032a7e27e3315f72761b62e122dc34768d8162ba08f9bed53d148aa8dc034b46456bdd211f230637eba58

Download Submit
/data/data/com.qltable47_huawei/oat/x86_64/[email protected]

Filesize
163B

MD5
fc84e8065630e49bd54d03318688bb7f

SHA1
94916dba7869e7a3c2c3312c1c58abfdb27d1599

SHA256
b83d2fbe1713f24bc610cf403dceeaa6792db22ee0af7cfa54b0c97505fc8f0a

SHA512
b6cd077572f256ed3dcbbd75cc22d6f69aa5223ec523f03bd23d9a02e905093545ceb3764754633ada1ff5c60e326aa16b32cbf74d737c5ae77fbf9be069bb6b

Download Submit
/data/user/0/com.qltable47_huawei/[email protected]

Filesize
526KB

MD5
aa4571e982a83dfd974368a1054ef0eb

SHA1
32d932b27cde20f256015583ae1e42bfa048e3c0

SHA256
8ed0cbf86a3c1126bd62b3a3b81b8f54d78dd869a938e85a86c6b4cd2aee062e

SHA512
68c838092bc2e3cece4fc3f955bf6c56d97c62f1f882b135411f1f215ad4221000ed84aa9e1ffeda9693b3106b0b0e4fab9ad8cf50ee42241701edeaa7cb2768

Download Submit