octo | f44f19d4f4f4545b8851e443d6f86ffff3ab894eba0967b2839d7d01fc438728

Analysis

max time kernel
3s
max time network
153s
platform
android_x64
resource
android-x64-20240624-en
resource tags

androidarch:x64arch:x86image:android-x64-20240624-enlocale:en-usos:android-10-x64system
submitted
04/02/2025, 22:00

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

f44f19d4f4f4545b8851e443d6f86ffff3ab894eba0967b2839d7d01fc438728.apk
Size

3.2MB
MD5

1b6c5925746b271d58099a10ee0285fa
SHA1

7b88e6d58c13b1a52a07565f4c7b5c482088948f
SHA256

f44f19d4f4f4545b8851e443d6f86ffff3ab894eba0967b2839d7d01fc438728
SHA512

fe04296e929274b305ba6f0285f592d5ca50b11e569634121b631e058e8ff205a85ba44034d46b00f1f67d6d510f9d2d868ebf6734061882375beb22b11a1bed
SSDEEP

98304:ddGg4PIr10XFZ5hjtAAXagCR6NTNUILuY+v5pzm:/GgZ2BNCgTqIr+u

Score

10^/10

octo banker discovery evasion infostealer rat trojan

Malware Config

Extracted

Family

octo

https://otomatikbahcesulamasistemi.xyz/fHTKmZhmwRmq/

https://tarimsalverimsulamayontemi.xyz/fHTKmZhmwRmq/

https://damlamasulamateknolojileri.xyz/fHTKmZhmwRmq/

https://akillitarimsulamasistemleri.xyz/fHTKmZhmwRmq/

https://modernciftliksulamayontemi.xyz/fHTKmZhmwRmq/

https://verimlisulamataktikveyontem.xyz/fHTKmZhmwRmq/

https://tarlaotomatiksulamasistemleri.xyz/fHTKmZhmwRmq/

https://bahceveseraotomasyonsulama.xyz/fHTKmZhmwRmq/

https://sudepolamaveverimsulama.xyz/fHTKmZhmwRmq/

https://bitkisulamastratejiler.xyz/fHTKmZhmwRmq/

https://sebzesulamasistemcozumleri.xyz/fHTKmZhmwRmq/

https://akillibahcesulamauretimi.xyz/fHTKmZhmwRmq/

https://gelenekseltarimsulamamodeli.xyz/fHTKmZhmwRmq/

https://sulamaekipmanlariurunleri.xyz/fHTKmZhmwRmq/

https://akillidamlamaotomasyonsistemi.xyz/fHTKmZhmwRmq/

https://pratikverimlibitkisulama.xyz/fHTKmZhmwRmq/

https://topraksizserasulamasistemi.xyz/fHTKmZhmwRmq/

https://otomatiksektorelbitkisulama.xyz/fHTKmZhmwRmq/

https://verimlitarlavemodernsulama.xyz/fHTKmZhmwRmq/

https://bitkisagliginagoresulama.xyz/fHTKmZhmwRmq/

rc4.plain

Signatures

Octo
Octo is a banking malware with remote access capabilities first seen in April 2022.
banker trojan infostealer rat octo
Octo family
octo

Octo payload 1 IoCs

resource	yara_rule
behavioral2/memory/4985-0.dex	family_octo

Loads dropped Dex/Jar 1 TTPs 1 IoCs

Runs executable file dropped to the device during analysis.

evasion

Download New Code at Runtime

T1407

ioc	pid	Process
/data/user/0/com.victory.ball/app_bar/tpIQ.json	4985	com.victory.ball

Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
banker discovery

Security Software Discovery
T1418.001

com.victory.ball
1⤵
- Loads dropped Dex/Jar
PID:4985

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Download New Code at Runtime

T1407

Credential Access

Discovery

Software Discovery

T1418

Security Software Discovery

T1418.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

/data/data/com.victory.ball/app_bar/tpIQ.json

Filesize
153KB

MD5
0218ac8d5db66b39d2cc7c16448646d6

SHA1
7eb212b6c8a4a0e948d22e654c2bf930dc440ed5

SHA256
f54499208a665b2ab5b6770cf9e3d6bcf73cd2d85b780173ad5c2b50f6cd2fe2

SHA512
3a9752e976d4d1d03e200b931a90f6a54d53a32643dad87558869fecbdd091cb9cdbe4e30dae499fa2564914534dcb49d4c51365d71e58a1296672ff6fbf05d8

Download Submit
/data/data/com.victory.ball/app_bar/tpIQ.json

Filesize
153KB

MD5
189d066fdf913e1cca6ab995da2d2951

SHA1
2f8a9a8b352500f9434ab7e464015bd378676665

SHA256
a02b5510758225cd5761868272728412643e0b7683e5e427580ff730043289b4

SHA512
23b736c9942d996f5740ddab3f6189eaeb1db941c12a292034150653ebf1f5c59df6ce9f5f9afb1c6548fc63c7e74d730d0c57f8d36c347c01a1c72b0ee742d0

Download Submit
/data/user/0/com.victory.ball/app_bar/tpIQ.json

Filesize
450KB

MD5
30502d8285da45aafb8a97bbd17179b7

SHA1
b66f1e91cb04384d6297bf96da99e256815a5ce0

SHA256
b28e6d52a9e4451505d450873d23ad82abc91019f1fde70e0945d561f4ec9625

SHA512
24539ea39396be04d5657733300c8e4cd08340819fc57ae2ddf42296e22b3c977e0cca1894fb557ed4c3eb042248e3b0d9e25623a020c206128daa2ebde2505a

Download Submit