octo | 0172a93ab3f19b968c8bcf01d43022fb662c213b473fb43e6bdf25248ee1eadd

Analysis

max time kernel
9s
max time network
153s
platform
android_x64
resource
android-x64-20240624-en
resource tags

androidarch:x64arch:x86image:android-x64-20240624-enlocale:en-usos:android-10-x64system
submitted
21-01-2025 07:01

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

file.apk
Size

7.0MB
MD5

1f603e8cdd515bde64145eb1ff77f424
SHA1

23de762898566b70016715b928f05effaa7075f3
SHA256

0172a93ab3f19b968c8bcf01d43022fb662c213b473fb43e6bdf25248ee1eadd
SHA512

8f18df0deca158759e79360e6e6c2dd5eba1245c89acfd20964fdc811a4fc5efadafcb4af4b2a6a3b7e61c2322f6409c95b726e08b7e40abdd4ae5faa5b14253
SSDEEP

98304:2s75iSRGJeu2t+Si2M6ZRsUpDIaCj7aVKubTDlRZYcgOJ0:2s7rrt1i2MKR1yPj7aUSvlRZjJ0

Score

10^/10

octo banker discovery evasion infostealer rat trojan

Malware Config

Signatures

Octo
Octo is a banking malware with remote access capabilities first seen in April 2022.
banker trojan infostealer rat octo
Octo family
octo

Octo payload 1 IoCs

resource	yara_rule
behavioral2/memory/4936-1.dex	family_octo

Loads dropped Dex/Jar 1 TTPs 2 IoCs

Runs executable file dropped to the device during analysis.

evasion

Download New Code at Runtime

T1407

ioc	pid	Process
/data/user/0/com.fcontacts_threeey/app_false/Ue.json	4936	com.fcontacts_threeey
/data/user/0/com.fcontacts_threeey/[email protected]	4936	com.fcontacts_threeey

Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
banker discovery

Security Software Discovery
T1418.001
Queries the phone number (MSISDN for GSM devices) 1 TTPs
discovery

System Network Configuration Discovery
T1422

Queries the mobile country code (MCC) 1 TTPs 1 IoCs

discovery

System Network Configuration Discovery

T1422

description	ioc	Process
Framework service call	com.android.internal.telephony.ITelephony.getNetworkCountryIsoForPhone	com.fcontacts_threeey

Reads information about phone network operator. 1 TTPs
discovery

System Network Configuration Discovery
T1422

com.fcontacts_threeey
1⤵
- Loads dropped Dex/Jar
- Queries the mobile country code (MCC)
PID:4936

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Download New Code at Runtime

T1407

Credential Access

Discovery

Software Discovery

T1418

Security Software Discovery

T1418.001

System Network Configuration Discovery

T1422

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

/data/data/com.fcontacts_threeey/.global.com.fcontacts_threeey

Filesize
48B

MD5
046a414913add6f5bb60072c7db819b6

SHA1
451ee4f6809260aec622d772fd329c7d0297a842

SHA256
b66c1320cb063a1d391c94273572ea6edae76c8c8b0a07f8d75c88686f0df72a

SHA512
4e6355f3051ed5e811ab030abde1f5be7f5e1cf33be99cd08477e9b6c015deb1d8bd75a09fb9c7176b8511c5ad0a67abc0902a3531e97564ccb6afc57496a47c

Download Submit
/data/data/com.fcontacts_threeey/app_false/Ue.json

Filesize
1009B

MD5
1a775b04dd41d780ef03f33c4a056646

SHA1
aaba70e56d9e7ce2e8443c88556a41ab83b160ab

SHA256
e7615420fe98ab46cab25fa737e698ca7c5aa9d657b5633f7b5c10a4fd5d5553

SHA512
995ba5a9f9e679757a47666b0ba227c098939176ee55cea1a5658d9e63ed0edc2e6f021b498d751ba6c67dfcdba3b0de0b163560b957a537615e619b4c59b381

Download Submit
/data/data/com.fcontacts_threeey/app_false/Ue.json

Filesize
1009B

MD5
38e37940e70c3f985d7879ced9200b0a

SHA1
3a7771bc95b7711fc6262f062c7a42409cd2cf1a

SHA256
7240ee0119f7de0a97983beda5deeecad487711b96938b2a0da6cb7c24c03f3e

SHA512
46979e08da1b98adfe41caae8128ca9d7b8db933b18ac5f0b7c08b00a4cf2fb2b8b709fed44dca9144284007bd46a5a146fd3ebeaac98e7b38a84de486f3c5bf

Download Submit
/data/data/com.fcontacts_threeey/files/.s

Filesize
322KB

MD5
77dc50489b9323274732d27dc8a4e803

SHA1
0e02a3595b62489d0739d771881da8604d117c65

SHA256
c5684e792d1ebefea6aac09fed45911703fd58c899f8a08133d49dd91429a820

SHA512
0684a92f3e9c525384cfa53f531afba61e5930e1c27032a7e27e3315f72761b62e122dc34768d8162ba08f9bed53d148aa8dc034b46456bdd211f230637eba58

Download Submit
/data/data/com.fcontacts_threeey/oat/x86_64/[email protected]

Filesize
290B

MD5
246021b4043cffb3e45dddf0670da876

SHA1
ab0b5890ed274aab6553a4bcca6b3e82d33adabe

SHA256
8f1b26821d6b576e110f273d03456508ab9b1180d39a3200a7b2cd9b36744180

SHA512
9c89da71f6c62c1a2b7c5b748b3bacc52df3075444210cfce97164ffed81077881881b7cff7628c1a989f1ea098faf864e24db591bca123880c6ca9e7a8ec168

Download Submit
/data/user/0/com.fcontacts_threeey/[email protected]

Filesize
525KB

MD5
6e1262bcb015b056e16f0a8374a56174

SHA1
8b1bda24bed0a7e6d450a1ab37e3c0c83c85cf20

SHA256
9ee6516ee147bc8f0fe7de2be4b86434f483a8c22ee1fb18abdb29a07e20015f

SHA512
a5a387190b3b7b6d25a261c6bbb71251f2b7a5ea57bd20faaf052ac971e0fb9137412ca65c4a3e822676841214104f7081e16ab4d27c11ff5190705cddae1210

Download Submit
/data/user/0/com.fcontacts_threeey/app_false/Ue.json

Filesize
1KB

MD5
8f95870b5ac5b96f85ac633cdc50b059

SHA1
56c50fac0aa24dbb717fe181272992b5cb1001a0

SHA256
ab309d34a2f834c80f3ac9e8982e0a8bb42256295a5e34b70e781172983b1b6a

SHA512
759377365e5e8a18900b296ce70781264ceb2945735688e023738eb70c74668ebe442621c9c3740e573dce97d3d23324336f7c50815c9b8d07dfd4e3e9c05ab7

Download Submit