octo | 77f328c158d095d36ca1b1c0b2aea943bb484b46133ee2886732b8343ab99d7a

Analysis

max time kernel
7s
max time network
150s
platform
android_x64
resource
android-x64-20240624-en
resource tags

androidarch:x64arch:x86image:android-x64-20240624-enlocale:en-usos:android-10-x64system
submitted
21-01-2025 06:07

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

file.apk
Size

8.1MB
MD5

7216713f42d7a1a66ff014070b5f8778
SHA1

40117df4a0b1114bf9152ae65bfdb5e3702b32b9
SHA256

77f328c158d095d36ca1b1c0b2aea943bb484b46133ee2886732b8343ab99d7a
SHA512

b5b5594b3d13a60231ffd828d0b2509befe341eee2e7300293be2729d368cef650284ce68e08d78311480f234f9a53efdbf53b4448bcb3d7dede92bbdfce046d
SSDEEP

196608:Afx3X0RvrTUwFpVL28fV4ap3Zt99UKGP/AQ:AIrT/FpVVaaU

Score

10^/10

octo banker discovery evasion infostealer rat trojan

Malware Config

Signatures

Octo
Octo is a banking malware with remote access capabilities first seen in April 2022.
banker trojan infostealer rat octo
Octo family
octo

Octo payload 1 IoCs

resource	yara_rule
behavioral2/memory/4965-1.dex	family_octo

Loads dropped Dex/Jar 1 TTPs 2 IoCs

Runs executable file dropped to the device during analysis.

evasion

Download New Code at Runtime

T1407

ioc	pid	Process
/data/user/0/com.launchermonitor_sec57/app_episode/DGWRQ.json	4965	com.launchermonitor_sec57
/data/user/0/com.launchermonitor_sec57/[email protected]	4965	com.launchermonitor_sec57

Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
banker discovery

Security Software Discovery
T1418.001
Queries the phone number (MSISDN for GSM devices) 1 TTPs
discovery

System Network Configuration Discovery
T1422

Queries the mobile country code (MCC) 1 TTPs 1 IoCs

discovery

System Network Configuration Discovery

T1422

description	ioc	Process
Framework service call	com.android.internal.telephony.ITelephony.getNetworkCountryIsoForPhone	com.launchermonitor_sec57

com.launchermonitor_sec57
1⤵
- Loads dropped Dex/Jar
- Queries the mobile country code (MCC)
PID:4965

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Download New Code at Runtime

T1407

Credential Access

Discovery

Software Discovery

T1418

Security Software Discovery

T1418.001

System Network Configuration Discovery

T1422

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

/data/data/com.launchermonitor_sec57/.global.com.launchermonitor_sec57

Filesize
48B

MD5
046a414913add6f5bb60072c7db819b6

SHA1
451ee4f6809260aec622d772fd329c7d0297a842

SHA256
b66c1320cb063a1d391c94273572ea6edae76c8c8b0a07f8d75c88686f0df72a

SHA512
4e6355f3051ed5e811ab030abde1f5be7f5e1cf33be99cd08477e9b6c015deb1d8bd75a09fb9c7176b8511c5ad0a67abc0902a3531e97564ccb6afc57496a47c

Download Submit
/data/data/com.launchermonitor_sec57/app_episode/DGWRQ.json

Filesize
1023B

MD5
e022495720963f31c4c1163c6e3f632d

SHA1
188761b2ff22fea101d8a2fb4bbb8cff57c927cd

SHA256
3a89e01e05c1c28704e18872fb922bda03fab7ffa84ec8dc69053af9a1a716a9

SHA512
56122fee009aaa7c63069cf1fa1c649391fa58129399057953f25b14e6ccf3c04eb16e33e27645ab034b6cedae7e7d9ddb6e4b7152fdba472158baf17ac65d0d

Download Submit
/data/data/com.launchermonitor_sec57/app_episode/DGWRQ.json

Filesize
1023B

MD5
fed243237d4d5bea77ebf64fc2ba488b

SHA1
63868f6bf104757bbcdab3cb1c8eb78867bac508

SHA256
8450670b4501bda2cd46f819bd48f8b3e8a4c94323dcd09044e74e22bd3dc674

SHA512
a19fac62b3dc5858aa962cd5d0200cc7dca48b1643f328f8ce64717a014afae1faf79ced0f108275cbed9baeb6fc20db454b53a0c615f5d1cbc64cb33800be72

Download Submit
/data/data/com.launchermonitor_sec57/files/.c

Filesize
322KB

MD5
77dc50489b9323274732d27dc8a4e803

SHA1
0e02a3595b62489d0739d771881da8604d117c65

SHA256
c5684e792d1ebefea6aac09fed45911703fd58c899f8a08133d49dd91429a820

SHA512
0684a92f3e9c525384cfa53f531afba61e5930e1c27032a7e27e3315f72761b62e122dc34768d8162ba08f9bed53d148aa8dc034b46456bdd211f230637eba58

Download Submit
/data/data/com.launchermonitor_sec57/oat/x86_64/[email protected]

Filesize
302B

MD5
874f733e8ac49966fc561a8541c960a8

SHA1
4fa0eb3a2e14bf41cc9600a3383dd8a5cfc306d1

SHA256
f20073ebc3fda231234b3e8d2c38055c17559445562c303052bce0d475200ae5

SHA512
56395ccbcd56ef3865be056304d89633241d986d146afa7606ebd7adbbfc5e46eefeca89d087d202614e45acccb311a676f16ca0773742e6bef30f2c37982ca5

Download Submit
/data/user/0/com.launchermonitor_sec57/[email protected]

Filesize
526KB

MD5
492e7c0e49e72308d41ec4f2e8ca2837

SHA1
71ec18234de15af83c609ac5d1acde6e9b2c0cba

SHA256
54370d178c66d85424a9074528f7b30cba978f8be8183a5ef71e20555667ac07

SHA512
d281afe4400b5d589541f9cda8ccafccc4c3601e3ae62065d19520c5748cc26fad62c0f571e8eb51560de4f53097d55a8b6323b8dc71348bccdd6458d6c33e7a

Download Submit
/data/user/0/com.launchermonitor_sec57/app_episode/DGWRQ.json

Filesize
1KB

MD5
d832750e5fcead617b8ef8a1b9386d37

SHA1
9787dc49f1dc41637f81511171a87ecc67181ccc

SHA256
cd920a4baeaa2feaff76f8a6633bd8a95cf09d1d4c72ec0ae19d06c5392f8b4b

SHA512
ab8c26eb3e9314264a683f7b4d9d96313a3bee98c360616c93dfa839a34eb218a4042345dfb6e39efc7459eb67c2334c3df98fbacce2c22ac5cc736db545238f

Download Submit