octo | 08478c94df97cf5240855d2104e3ea383aeb9a7e750730a6ffcf4dd5868c55a1

Analysis

max time kernel
4s
max time network
34s
platform
android_x64
resource
android-x64-20240624-en
resource tags

androidarch:x64arch:x86image:android-x64-20240624-enlocale:en-usos:android-10-x64system
submitted
21-01-2025 14:10

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

08478c94df97cf5240855d2104e3ea383aeb9a7e750730a6ffcf4dd5868c55a1.apk
Size

7.7MB
MD5

ca4de35f2f56cff2b39a73b87aa2a936
SHA1

73b060c80d61150aa0e5d9b1496069c185b2ba58
SHA256

08478c94df97cf5240855d2104e3ea383aeb9a7e750730a6ffcf4dd5868c55a1
SHA512

70e753417983106ae1542900b307668399df328d470deb9aecc4cdfdc4cf138ffd4c5a67d9c778130be169448cc060f17c95e27733355cafa8c3af279fb685e6
SSDEEP

98304:jasM4sdjVKL8ub+j7O5iSRGdqfGw0kRsqO4vylamAg0:GsMbUb6j7Or3f/RK4b

Score

10^/10

octo banker discovery evasion infostealer rat trojan

Malware Config

Signatures

Octo
Octo is a banking malware with remote access capabilities first seen in April 2022.
banker trojan infostealer rat octo
Octo family
octo

Octo payload 1 IoCs

resource	yara_rule
behavioral2/memory/4971-1.dex	family_octo

Loads dropped Dex/Jar 1 TTPs 2 IoCs

Runs executable file dropped to the device during analysis.

evasion

Download New Code at Runtime

T1407

ioc	pid	Process
/data/user/0/com.reinstalls_connectivity32/app_repeat/OQn.json	4971	com.reinstalls_connectivity32
/data/user/0/com.reinstalls_connectivity32/[email protected]	4971	com.reinstalls_connectivity32

Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
banker discovery

Security Software Discovery
T1418.001
Queries the phone number (MSISDN for GSM devices) 1 TTPs
discovery

System Network Configuration Discovery
T1422

Queries the mobile country code (MCC) 1 TTPs 1 IoCs

discovery

System Network Configuration Discovery

T1422

description	ioc	Process
Framework service call	com.android.internal.telephony.ITelephony.getNetworkCountryIsoForPhone	com.reinstalls_connectivity32

Reads information about phone network operator. 1 TTPs
discovery

System Network Configuration Discovery
T1422

com.reinstalls_connectivity32
1⤵
- Loads dropped Dex/Jar
- Queries the mobile country code (MCC)
PID:4971

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Download New Code at Runtime

T1407

Credential Access

Discovery

Software Discovery

T1418

Security Software Discovery

T1418.001

System Network Configuration Discovery

T1422

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

/data/data/com.reinstalls_connectivity32/.global.com.reinstalls_connectivity32

Filesize
48B

MD5
046a414913add6f5bb60072c7db819b6

SHA1
451ee4f6809260aec622d772fd329c7d0297a842

SHA256
b66c1320cb063a1d391c94273572ea6edae76c8c8b0a07f8d75c88686f0df72a

SHA512
4e6355f3051ed5e811ab030abde1f5be7f5e1cf33be99cd08477e9b6c015deb1d8bd75a09fb9c7176b8511c5ad0a67abc0902a3531e97564ccb6afc57496a47c

Download Submit
/data/data/com.reinstalls_connectivity32/app_repeat/OQn.json

Filesize
1024B

MD5
f2c866a12562658d06a53e3cc02462cc

SHA1
f6f2f3492129ea09a41181c2e93974f044a06eba

SHA256
f4d1df987fab58d3a6e63260768b7dc3be0e032bf89f3c5b77f44b1548c4c683

SHA512
56866ee10007e59aa3c4cbf86d29f6fa8cf44bdef4f7361b1062d6aea32c5e01ef99b296fc510b9b072f1c4b4b239d13d8603e73f59c1470b16f9641222e8422

Download Submit
/data/data/com.reinstalls_connectivity32/app_repeat/OQn.json

Filesize
1024B

MD5
f85ff86605a6fc5d554f26a7bf4b4f6a

SHA1
9b4c2d830fffc199f821060471cfe0123ee998ff

SHA256
b26b2d75da3e3b0b11ea728ae4a151b30456bf19579448ebeab538ff0fcd973f

SHA512
2c49ec83b0480f2fe4e16004d90b6bac8d4c5c75530a609caf87da4ff1bf33434057b227a62166af3d344e77e8ecb0a84f452d29e6c492e07a68e707672f5040

Download Submit
/data/data/com.reinstalls_connectivity32/files/.k

Filesize
322KB

MD5
77dc50489b9323274732d27dc8a4e803

SHA1
0e02a3595b62489d0739d771881da8604d117c65

SHA256
c5684e792d1ebefea6aac09fed45911703fd58c899f8a08133d49dd91429a820

SHA512
0684a92f3e9c525384cfa53f531afba61e5930e1c27032a7e27e3315f72761b62e122dc34768d8162ba08f9bed53d148aa8dc034b46456bdd211f230637eba58

Download Submit
/data/data/com.reinstalls_connectivity32/oat/x86_64/[email protected]

Filesize
308B

MD5
8b4f97c5e7cd4ba6878becf4873879ab

SHA1
168d694b58213502568ddf7daeb0ff12006bd073

SHA256
a250cb7d5870c0cc73583699a51e1600244b0449e13a2e2ac3ab434c50c5f576

SHA512
8ffe0638ea2b50e90cf6f71ea15f165674c070e9015d6dd5533b2b994fac5b1e9c07d95292e1112d920230f8bbd0fc13842954ee454046718bae3bda5453b4d4

Download Submit
/data/user/0/com.reinstalls_connectivity32/[email protected]

Filesize
526KB

MD5
c5134e2284f48730dbb76c13513d78a8

SHA1
d7fe8c15d036fc48e61df11cb19613465059e027

SHA256
d8fa77147c9fb582512fe6c2bf5cf0e12414e89b35879a7369b0296245bea831

SHA512
d94967ef2aa72cf0a9eca86ac318100e8b7947e3ef84c6fac4ae12b84c2a8c95bbadf6c4acc6f02e54a37afceefb2c4a215a19aad6bc2215b9852b652497a8c8

Download Submit
/data/user/0/com.reinstalls_connectivity32/app_repeat/OQn.json

Filesize
1KB

MD5
591135b74d2ee23511d86093a525fa1a

SHA1
c0a11ba57c392a6a764f8ab2f47dfeea07bf2b15

SHA256
1124e2b10527b5c1c5239aa8d205396975daf6fdd616835d176f27b59aab7b8f

SHA512
0e53ab4a689078436b392c7204de6488211a431946d883d44f473260d12ea2c9d5aa9d466af4c2acb0ff8f3ed80dfd796517540bd7bb363fadd04ea4bf876c41

Download Submit