octo | 4be5fe4e9ba7f4e5fc123dc732e13732f11b4f4aa3d24c8248384de34ef19825

Analysis

max time kernel
4s
max time network
150s
platform
android_x64
resource
android-x64-20240624-en
resource tags

androidarch:x64arch:x86image:android-x64-20240624-enlocale:en-usos:android-10-x64system
submitted
20/01/2025, 13:27

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

file.apk
Size

10.7MB
MD5

ca143be592cbc2276c29aff6f3bfc2ef
SHA1

08ed41083e8ebe5705a272a477c4d0a7b288163c
SHA256

4be5fe4e9ba7f4e5fc123dc732e13732f11b4f4aa3d24c8248384de34ef19825
SHA512

d121bbc50702d9a768004f108ad110a3ba55d727af86f91432fd8ce98a0464ff4db33ae66c18185e1b37da34da98411dd86f0f65d47fa6965a475197b37f3eb2
SSDEEP

98304:nCO7zVKCJuewj7Y5iSRGJARs4jLoxigyHM+pSDw04aNpFJdBO:nCcUCgxj7YrhRVjLo4gys7k04aDNBO

Score

10^/10

octo banker discovery evasion infostealer rat trojan

Malware Config

Signatures

Octo
Octo is a banking malware with remote access capabilities first seen in April 2022.
banker trojan infostealer rat octo
Octo family
octo

Octo payload 1 IoCs

resource	yara_rule
behavioral2/memory/4970-1.dex	family_octo

Loads dropped Dex/Jar 1 TTPs 2 IoCs

Runs executable file dropped to the device during analysis.

evasion

Download New Code at Runtime

T1407

ioc	pid	Process
/data/user/0/com.tnetwork3_audio/app_sniff/hdSnM.json	4970	com.tnetwork3_audio
/data/user/0/com.tnetwork3_audio/[email protected]	4970	com.tnetwork3_audio

Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
banker discovery

Security Software Discovery
T1418.001
Queries the phone number (MSISDN for GSM devices) 1 TTPs
discovery

System Network Configuration Discovery
T1422

Queries the mobile country code (MCC) 1 TTPs 1 IoCs

discovery

System Network Configuration Discovery

T1422

description	ioc	Process
Framework service call	com.android.internal.telephony.ITelephony.getNetworkCountryIsoForPhone	com.tnetwork3_audio

com.tnetwork3_audio
1⤵
- Loads dropped Dex/Jar
- Queries the mobile country code (MCC)
PID:4970

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Download New Code at Runtime

T1407

Credential Access

Discovery

Software Discovery

T1418

Security Software Discovery

T1418.001

System Network Configuration Discovery

T1422

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

/data/data/com.tnetwork3_audio/.global.com.tnetwork3_audio

Filesize
48B

MD5
046a414913add6f5bb60072c7db819b6

SHA1
451ee4f6809260aec622d772fd329c7d0297a842

SHA256
b66c1320cb063a1d391c94273572ea6edae76c8c8b0a07f8d75c88686f0df72a

SHA512
4e6355f3051ed5e811ab030abde1f5be7f5e1cf33be99cd08477e9b6c015deb1d8bd75a09fb9c7176b8511c5ad0a67abc0902a3531e97564ccb6afc57496a47c

Download Submit
/data/data/com.tnetwork3_audio/app_sniff/hdSnM.json

Filesize
1004B

MD5
1812f0ed7ebbc83cf6d9fd164093eecc

SHA1
51647928185f91ae53152f68bc83514466a344b9

SHA256
a791f64d0e269630bee803aa168824b9ac3587fb0172a7ccd0009caff3ae061a

SHA512
2b830beb993972f944244839ad214c533bf0437d6863e64534772578d7e9323cc3a67def6c27a0f2267424605f47eb8c8c79db6d4fadb7eab13fac614f0f9752

Download Submit
/data/data/com.tnetwork3_audio/app_sniff/hdSnM.json

Filesize
1004B

MD5
7cf0feb79fe1667523fe12e4f08f9a62

SHA1
19ea1f13b05b1c14cf9be2ed96bd0bc29babb6b3

SHA256
368853470400ec839441b958052002a1e4939621b6d64d477349aa04c995417c

SHA512
d5c1bdff74bcd37551ac05f62ea77ac6f20d4515f865fe0a86ca0da2140018d5f99846ca0c66906704c4257038bd8aba86fb7cd1948ae0a4e93833be4efa7f1c

Download Submit
/data/data/com.tnetwork3_audio/files/.w

Filesize
322KB

MD5
77dc50489b9323274732d27dc8a4e803

SHA1
0e02a3595b62489d0739d771881da8604d117c65

SHA256
c5684e792d1ebefea6aac09fed45911703fd58c899f8a08133d49dd91429a820

SHA512
0684a92f3e9c525384cfa53f531afba61e5930e1c27032a7e27e3315f72761b62e122dc34768d8162ba08f9bed53d148aa8dc034b46456bdd211f230637eba58

Download Submit
/data/data/com.tnetwork3_audio/oat/x86_64/[email protected]

Filesize
289B

MD5
32aa35318237b9cea27ec21c40784cd0

SHA1
c9d9cdd5fa19d249b634953d8194d6bff207737b

SHA256
b3a2bbc568ac47c49dd97bfc8858cec7c5f89374ce9ed9011df05baa4579a258

SHA512
ba8f76ecaf56a5ad51751e9449af97aeaae42a98209ae3f1f4478277da10ea0edea3fc826c67a39adcf7acfe0f2f423374442571f2a83455e1c971f10af9eca1

Download Submit
/data/user/0/com.tnetwork3_audio/[email protected]

Filesize
525KB

MD5
6bf941ccece61918e9d635de22673cbf

SHA1
e09cbe014f073a5ab66074a4f182eee488002ce2

SHA256
2363b211c2a6c08ea3c4f8b15f1ccf1240ef46a740ef832635f93e8716f43793

SHA512
1db74b439be85b1b83e6557240ed77974264828d8f0a876b70f3f54c618b12efbebe3c39749b3996068858a9206773b9f86d44ce994798034fc7f14ff456b922

Download Submit
/data/user/0/com.tnetwork3_audio/app_sniff/hdSnM.json

Filesize
1KB

MD5
ddbc1cf7d499d4671cd5ea597f36ea7d

SHA1
73e67edbb93f8485d94a3ebb540db482576d2ff7

SHA256
1fd701b16484de30a66e27b01a585e3af64dae59c44a94185e552bc1e8227f83

SHA512
9b63730c74e1a7a432dfa44a721fe204e16fd6f65da24a8d0d668f57f34b4c3f28d30e6b2d7ea53aa9340288f0ae600c080a38a01e66ef36bce705aad02d5e97

Download Submit