octo | e22acc55fae78672d55e57cb891a76ae2e0ddea898d9f4c2fd9c7d35430c3a25

Analysis

max time kernel
7s
max time network
144s
platform
android-10_x64
resource
android-x64-20240910-en
resource tags

arch:x64arch:x86image:android-x64-20240910-enlocale:en-usos:android-10-x64system
submitted
22-12-2024 22:05

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

e22acc55fae78672d55e57cb891a76ae2e0ddea898d9f4c2fd9c7d35430c3a25.apk
Size

4.8MB
MD5

3014a65963f6a2d3fe8c0b3f4e5638b3
SHA1

72340a4431de6e354e4a7c0fb534f647d3aed2d6
SHA256

e22acc55fae78672d55e57cb891a76ae2e0ddea898d9f4c2fd9c7d35430c3a25
SHA512

88486356dcd86cefa69f3f3cd1e3293de084f6d21617d36c5352c7adb8984a3f61ae7b56a6bf5ff3bdc46cc155d5b1f773b0f22ac8cd8071027f6484e62019bf
SSDEEP

49152:ZRsEXLxdKuvj7k45iS7xrGdvh8R8+jVKSci18fJYXztOr9GVqHn7E1r++D3D:ZRsidbvj7N5iSRG5YVK0NkOK7mrjDz

Score

10^/10

octo banker discovery evasion infostealer rat trojan

Malware Config

Signatures

Octo
Octo is a banking malware with remote access capabilities first seen in April 2022.
banker trojan infostealer rat octo
Octo family
octo

Octo payload 1 IoCs

resource	yara_rule
behavioral2/memory/5146-0.dex	family_octo

Loads dropped Dex/Jar 1 TTPs 1 IoCs

Runs executable file dropped to the device during analysis.

evasion

Download New Code at Runtime

T1407

ioc	pid	Process
/data/user/0/com.gparser_webapp9/[email protected]	5146	com.gparser_webapp9

Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
banker discovery

Security Software Discovery
T1418.001
Queries the phone number (MSISDN for GSM devices) 1 TTPs
discovery

System Network Configuration Discovery
T1422

Queries the mobile country code (MCC) 1 TTPs 1 IoCs

discovery

System Network Configuration Discovery

T1422

description	ioc	Process
Framework service call	com.android.internal.telephony.ITelephony.getNetworkCountryIsoForPhone	com.gparser_webapp9

com.gparser_webapp9
1⤵
- Loads dropped Dex/Jar
- Queries the mobile country code (MCC)
PID:5146

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Download New Code at Runtime

T1407

Credential Access

Discovery

Software Discovery

T1418

Security Software Discovery

T1418.001

System Network Configuration Discovery

T1422

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

/data/data/com.gparser_webapp9/.global.com.gparser_webapp9

Filesize
48B

MD5
046a414913add6f5bb60072c7db819b6

SHA1
451ee4f6809260aec622d772fd329c7d0297a842

SHA256
b66c1320cb063a1d391c94273572ea6edae76c8c8b0a07f8d75c88686f0df72a

SHA512
4e6355f3051ed5e811ab030abde1f5be7f5e1cf33be99cd08477e9b6c015deb1d8bd75a09fb9c7176b8511c5ad0a67abc0902a3531e97564ccb6afc57496a47c

Download Submit
/data/data/com.gparser_webapp9/files/.l

Filesize
322KB

MD5
77dc50489b9323274732d27dc8a4e803

SHA1
0e02a3595b62489d0739d771881da8604d117c65

SHA256
c5684e792d1ebefea6aac09fed45911703fd58c899f8a08133d49dd91429a820

SHA512
0684a92f3e9c525384cfa53f531afba61e5930e1c27032a7e27e3315f72761b62e122dc34768d8162ba08f9bed53d148aa8dc034b46456bdd211f230637eba58

Download Submit
/data/data/com.gparser_webapp9/oat/x86_64/[email protected]

Filesize
162B

MD5
c50375564122c3c14f1b47830557798a

SHA1
000060a1edf0d87d54c48dac507d0d22b48ec65e

SHA256
d34de0c553d96c32d91a667a9cc00d80071d071e76023a31f8dca948216b1372

SHA512
f4df5165c5fd260587d47bb8f3955b68a0698cf284587efc27dd6f21b8926cd64c0fc80bca109f9f3e88078694bb93ebd6a294c823c0eaea0c5f8cc0fbb54119

Download Submit
/data/user/0/com.gparser_webapp9/[email protected]

Filesize
526KB

MD5
f9133b419816d4492f2bf1c78a94a7f1

SHA1
ce9a63b1715f34b7651806aa65eda9ee5bb255e1

SHA256
9d71ddb9813ff31ca936fc5788fd2ceb19112a57952435285efebb04a2bb1f62

SHA512
55116f31d2b6b82e5d33a38b5855982c6787b6ea9472b4c411ea54e8b93951f6ccfd8a6502c820bb497e38333cdd43c0e3ccf5863f2fb251b7fb3ab17616cd6e

Download Submit