octo | ecdd49645b5e8ae87b298df3ef45e5445aaad0465b7cd9d7acb8a8ee74d5e851

Resubmissions

11-01-2025 14:22

250111-rpxgsstmdq 10

11-01-2025 14:13

250111-rjsxestlel 10

Analysis

max time kernel
4s
max time network
907s
platform
android_x64
resource
android-x64-20240624-en
resource tags

androidarch:x64arch:x86image:android-x64-20240624-enlocale:en-usos:android-10-x64system
submitted
11-01-2025 14:22

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ecdd49645b5e8ae87b298df3ef45e5445aaad0465b7cd9d7acb8a8ee74d5e851.apk
Size

9.5MB
MD5

a3ab8ac48bfd2b7f61d77d31f21f4f9c
SHA1

3320b8b33474e060d6e7c268ba406900ade0bb3a
SHA256

ecdd49645b5e8ae87b298df3ef45e5445aaad0465b7cd9d7acb8a8ee74d5e851
SHA512

158957e472dd67ffd77cda26a5a382d80d19d71c27f34c079c865b58e754c0f6296cdb03ac5656d619da45e7d14de410256355dc9616473f257fe72c907432af
SSDEEP

196608:pMTsR9aZkdCXZgtgS8Y8d1BrZrTU+L3XgDKZ5wvf:pMuukoZgtgSEBNrT0Gw

Score

10^/10

octo banker discovery evasion infostealer rat trojan

Malware Config

Signatures

Octo
Octo is a banking malware with remote access capabilities first seen in April 2022.
banker trojan infostealer rat octo
Octo family
octo

Octo payload 1 IoCs

resource	yara_rule
behavioral2/memory/4968-1.dex	family_octo

Loads dropped Dex/Jar 1 TTPs 2 IoCs

Runs executable file dropped to the device during analysis.

evasion

Download New Code at Runtime

T1407

ioc	pid	Process
/data/user/0/com.modevolume_tools3/app_ladder/gFNNaoj.json	4968	com.modevolume_tools3
/data/user/0/com.modevolume_tools3/[email protected]	4968	com.modevolume_tools3

Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
banker discovery

Security Software Discovery
T1418.001
Queries the phone number (MSISDN for GSM devices) 1 TTPs
discovery

System Network Configuration Discovery
T1422

Queries the mobile country code (MCC) 1 TTPs 1 IoCs

discovery

System Network Configuration Discovery

T1422

description	ioc	Process
Framework service call	com.android.internal.telephony.ITelephony.getNetworkCountryIsoForPhone	com.modevolume_tools3

com.modevolume_tools3
1⤵
- Loads dropped Dex/Jar
- Queries the mobile country code (MCC)
PID:4968

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Download New Code at Runtime

T1407

Credential Access

Discovery

Software Discovery

T1418

Security Software Discovery

T1418.001

System Network Configuration Discovery

T1422

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

/data/data/com.modevolume_tools3/.global.com.modevolume_tools3

Filesize
48B

MD5
046a414913add6f5bb60072c7db819b6

SHA1
451ee4f6809260aec622d772fd329c7d0297a842

SHA256
b66c1320cb063a1d391c94273572ea6edae76c8c8b0a07f8d75c88686f0df72a

SHA512
4e6355f3051ed5e811ab030abde1f5be7f5e1cf33be99cd08477e9b6c015deb1d8bd75a09fb9c7176b8511c5ad0a67abc0902a3531e97564ccb6afc57496a47c

Download Submit
/data/data/com.modevolume_tools3/app_ladder/gFNNaoj.json

Filesize
1007B

MD5
432f7930f8d6a900a90655548fadf79c

SHA1
decfacf018484a956bf0fe6bd9e39476e509191f

SHA256
2a04035947d5d214c1ed26fcd8841f826b663c8e63bb56991f07b289a116d568

SHA512
fbd11b77d5d6e7e4609db8b41371a65180b2b69aed398dfc9b18423fa5e341db438e99ff3d24c4e4c43d9c810899016ea6b458d37d93b122631174db7492954f

Download Submit
/data/data/com.modevolume_tools3/app_ladder/gFNNaoj.json

Filesize
1007B

MD5
05019910152140c0ca647660862a21fd

SHA1
223a4f7100d40d3b10dca1cd1de781ccde335bed

SHA256
6d18d2339d8fa48d21361e0b8b80b5e3a179266b3e5360cdabbcff0ed02e2ccb

SHA512
f98d4b515dd881ad9e9da54f5416d42a5eaeb5c15980a23f82319d4b2a78183cc8f6022b25d455dda222f5da5b9e954fe0609fe543eb267872c20bcecc925042

Download Submit
/data/data/com.modevolume_tools3/files/.e

Filesize
322KB

MD5
77dc50489b9323274732d27dc8a4e803

SHA1
0e02a3595b62489d0739d771881da8604d117c65

SHA256
c5684e792d1ebefea6aac09fed45911703fd58c899f8a08133d49dd91429a820

SHA512
0684a92f3e9c525384cfa53f531afba61e5930e1c27032a7e27e3315f72761b62e122dc34768d8162ba08f9bed53d148aa8dc034b46456bdd211f230637eba58

Download Submit
/data/data/com.modevolume_tools3/oat/x86_64/[email protected]

Filesize
295B

MD5
d97cd76cbccf7c06d6010b5979269eba

SHA1
1c4b67a193c69d2721982f515275a611822f2146

SHA256
303d32fe9d88e317049b92a50146e49eb5628c0cff6bdae743fc11f0771f38d1

SHA512
bca194cda15be0e8511a2d08be13917c5641a8c61da62498bd6cae3bcc64702bec856ad758fe6b1227f9d5920b870c7e2cf1f067445957998b7bbf4c5051d032

Download Submit
/data/user/0/com.modevolume_tools3/[email protected]

Filesize
525KB

MD5
722984946cc879125dda4ab36403431d

SHA1
99505a0821edc83893fb8feb75c7d6ed4bc7da2f

SHA256
5169696fb4f51f879ab8f9192dcc8af79277740bd04d2aec06b8c164508eb42a

SHA512
aeee71434181e69b457bc0e03d14db03b9d9b3979a482c83338f136bd54d59c740c1fdaab474d78ffb079f98784922db0a77da5e7b269795792a4394dac3a37a

Download Submit
/data/user/0/com.modevolume_tools3/app_ladder/gFNNaoj.json

Filesize
1KB

MD5
1c1e168882a6a727636e6ef34304d6aa

SHA1
925c2f21f1123b4483d1acaf3e6ea2a0a2f2a3af

SHA256
a534496e0f30157b9f33b12c6d0f971375c7116eea3d920ab930c07948aeb9b7

SHA512
0f2445a06f3753bbb666400785c92b1dfbd51def49f825855202d1fc317c9fad8dddbf965d6fae1c513e488693a4c9c01e02fd80b0b04f2a5bdd16ffe5e51cf3

Download Submit