octo | e86028ad4f998dde48a11ffb204d38de2c53e6ab8d82dbfba71a24a3230fc8a6

Analysis

max time kernel
2s
max time network
147s
platform
android_x64
resource
android-x64-20240624-en
resource tags

androidarch:x64arch:x86image:android-x64-20240624-enlocale:en-usos:android-10-x64system
submitted
06-01-2025 14:44

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

e86028ad4f998dde48a11ffb204d38de2c53e6ab8d82dbfba71a24a3230fc8a6.apk
Size

4.9MB
MD5

c644ecba3e5855cd76c25a650900a57d
SHA1

5691275ad80929637511944877a969ff0d66f196
SHA256

e86028ad4f998dde48a11ffb204d38de2c53e6ab8d82dbfba71a24a3230fc8a6
SHA512

1b90838a37cf857db21729621de1731eb3173a048c6dec73d847f6fee04f987f77e339dba4e0f7221ee856804035dce790a6333be1254c2e7f887c256a17dbad
SSDEEP

49152:KRsEXr3tKXH3XYB45iS7xrGprZiMeZjVKScK5KTFMeNUahWC8zdIcMR:KRsUtGH3Xd5iSRGUhVKYfeyahf6daR

Score

10^/10

octo banker discovery evasion infostealer rat trojan

Malware Config

Signatures

Octo
Octo is a banking malware with remote access capabilities first seen in April 2022.
banker trojan infostealer rat octo
Octo family
octo

Octo payload 1 IoCs

resource	yara_rule
behavioral2/memory/4925-0.dex	family_octo

Loads dropped Dex/Jar 1 TTPs 1 IoCs

Runs executable file dropped to the device during analysis.

evasion

Download New Code at Runtime

T1407

ioc	pid	Process
/data/user/0/com.posp6widefunction/[email protected]	4925	com.posp6widefunction

Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
banker discovery

Security Software Discovery
T1418.001
Queries the phone number (MSISDN for GSM devices) 1 TTPs
discovery

System Network Configuration Discovery
T1422

Queries the mobile country code (MCC) 1 TTPs 1 IoCs

discovery

System Network Configuration Discovery

T1422

description	ioc	Process
Framework service call	com.android.internal.telephony.ITelephony.getNetworkCountryIsoForPhone	com.posp6widefunction

com.posp6widefunction
1⤵
- Loads dropped Dex/Jar
- Queries the mobile country code (MCC)
PID:4925

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Download New Code at Runtime

T1407

Credential Access

Discovery

Software Discovery

T1418

Security Software Discovery

T1418.001

System Network Configuration Discovery

T1422

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

/data/data/com.posp6widefunction/.global.com.posp6widefunction

Filesize
48B

MD5
046a414913add6f5bb60072c7db819b6

SHA1
451ee4f6809260aec622d772fd329c7d0297a842

SHA256
b66c1320cb063a1d391c94273572ea6edae76c8c8b0a07f8d75c88686f0df72a

SHA512
4e6355f3051ed5e811ab030abde1f5be7f5e1cf33be99cd08477e9b6c015deb1d8bd75a09fb9c7176b8511c5ad0a67abc0902a3531e97564ccb6afc57496a47c

Download Submit
/data/data/com.posp6widefunction/files/.h

Filesize
322KB

MD5
77dc50489b9323274732d27dc8a4e803

SHA1
0e02a3595b62489d0739d771881da8604d117c65

SHA256
c5684e792d1ebefea6aac09fed45911703fd58c899f8a08133d49dd91429a820

SHA512
0684a92f3e9c525384cfa53f531afba61e5930e1c27032a7e27e3315f72761b62e122dc34768d8162ba08f9bed53d148aa8dc034b46456bdd211f230637eba58

Download Submit
/data/data/com.posp6widefunction/oat/x86_64/[email protected]

Filesize
164B

MD5
d74c207148be6dd1da91c2b6d96e14d7

SHA1
1df0144b4229ef7f4047e928dcbd3fd6c083379a

SHA256
3ec6b2807f188e7722699374128cdff4170361f04d42c7943416357b5220ef43

SHA512
47cbd25326ba4934c56aa1c437c4bbd4ae2dc011bb59455c3802ea744e0851215390b502607f9b50b13a3a98d77a6e78c7817f9b2e23bb48bdaec391639841c3

Download Submit
/data/user/0/com.posp6widefunction/[email protected]

Filesize
526KB

MD5
40047fa37914752ca906e703497f6f81

SHA1
287f943d282574e999a3dc283454db572ca5ee29

SHA256
9b619deb2fc9b16367cbc0db8be3173680f4c4217e573596252ed49a2d9ef098

SHA512
67c04d1c7b227001481a6890f012603cb90559e8a91e1df80132c76f6c9c1dc9b8f80ce80cdd88453a847344c79c4653f906699c861d32206eecce08e0873c30

Download Submit