octo | 5af6262485b899f7e7f6420364c89a3f580d11ae5be5f7ce0ec1d2be7b53e87a

Analysis

max time kernel
4s
max time network
151s
platform
android_x64
resource
android-x64-20240624-en
resource tags

androidarch:x64arch:x86image:android-x64-20240624-enlocale:en-usos:android-10-x64system
submitted
21/01/2025, 05:30

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

file.apk
Size

4.8MB
MD5

347376b6702556943398de1a88015787
SHA1

89f07c34c265414491c4a0a38c46052b9afd8510
SHA256

5af6262485b899f7e7f6420364c89a3f580d11ae5be5f7ce0ec1d2be7b53e87a
SHA512

915bd6ffc2dab6b593359fbd7235206c3a0b5afe7494456aeb25e097ce3536848db59e152f0c36845d7a3f06542ae7675e1c13ebd113fca6657faec05c218487
SSDEEP

49152:23aRsEXhIEKAPj7R45iS7xrGCvvYeqHjVKScsKhsZ0csJ734F6fLsv:xRsLERPj7S5iSRGTDVKZJlj4eIv

Score

10^/10

octo banker discovery evasion infostealer rat trojan

Malware Config

Signatures

Octo
Octo is a banking malware with remote access capabilities first seen in April 2022.
banker trojan infostealer rat octo
Octo family
octo

Octo payload 1 IoCs

resource	yara_rule
behavioral2/memory/5007-0.dex	family_octo

Loads dropped Dex/Jar 1 TTPs 1 IoCs

Runs executable file dropped to the device during analysis.

evasion

Download New Code at Runtime

T1407

ioc	pid	Process
/data/user/0/com.xflive42_pair/[email protected]	5007	com.xflive42_pair

Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
banker discovery

Security Software Discovery
T1418.001
Queries the phone number (MSISDN for GSM devices) 1 TTPs
discovery

System Network Configuration Discovery
T1422

Queries the mobile country code (MCC) 1 TTPs 1 IoCs

discovery

System Network Configuration Discovery

T1422

description	ioc	Process
Framework service call	com.android.internal.telephony.ITelephony.getNetworkCountryIsoForPhone	com.xflive42_pair

com.xflive42_pair
1⤵
- Loads dropped Dex/Jar
- Queries the mobile country code (MCC)
PID:5007

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Download New Code at Runtime

T1407

Credential Access

Discovery

Software Discovery

T1418

Security Software Discovery

T1418.001

System Network Configuration Discovery

T1422

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

/data/data/com.xflive42_pair/.global.com.xflive42_pair

Filesize
48B

MD5
046a414913add6f5bb60072c7db819b6

SHA1
451ee4f6809260aec622d772fd329c7d0297a842

SHA256
b66c1320cb063a1d391c94273572ea6edae76c8c8b0a07f8d75c88686f0df72a

SHA512
4e6355f3051ed5e811ab030abde1f5be7f5e1cf33be99cd08477e9b6c015deb1d8bd75a09fb9c7176b8511c5ad0a67abc0902a3531e97564ccb6afc57496a47c

Download Submit
/data/data/com.xflive42_pair/files/.w

Filesize
322KB

MD5
77dc50489b9323274732d27dc8a4e803

SHA1
0e02a3595b62489d0739d771881da8604d117c65

SHA256
c5684e792d1ebefea6aac09fed45911703fd58c899f8a08133d49dd91429a820

SHA512
0684a92f3e9c525384cfa53f531afba61e5930e1c27032a7e27e3315f72761b62e122dc34768d8162ba08f9bed53d148aa8dc034b46456bdd211f230637eba58

Download Submit
/data/data/com.xflive42_pair/oat/x86_64/[email protected]

Filesize
160B

MD5
1164ca63f548d6de8974faf72da55a8f

SHA1
49014435fed0799902e5b3b993d9d30e1f1e3645

SHA256
c054b89d9e43554d50ee97da3c108d748d21fd817d3980cb5d4c3310852a451d

SHA512
7f7967442f6a1c8f19d232ed8df052ca20ef711f203babd54f2e778e0e37dd2262ffe539e98c187d872d0fa742b12eb065f978c3988ac7f3e20b31852953b89d

Download Submit
/data/user/0/com.xflive42_pair/[email protected]

Filesize
525KB

MD5
6eed94ef92df4a279f617e38704b0758

SHA1
d3bc4fbef2743361f266510234cdcb8df02d7cf5

SHA256
07d8411721895d1f78d40163167f65c7e13d6be260740638b7a87663cbef1e1d

SHA512
69a21748e239b715130bb6018d942cf911c1e755833185e1c80a32536ee3a6a22b82c311aafa17aecc8f2822b679a9a14eca620a0d100726da78423b9cfe744a

Download Submit