octo | dc2a780f6abb9f0ec0a6675f20acb91ebe2a8748297682a59daf9164fbea2ee8

Resubmissions

28/02/2026, 22:55

260228-2wkrpabt2g10

28/02/2026, 22:53

260228-2t1p5abs6f10

28/02/2026, 22:51

260228-2swpsabs3c10

28/02/2026, 21:11

260228-z1p6vsgy6d10

Analysis

user interaction
yes
max time kernel
209s
max time network
212s
platform
android-11_x64
resource
android-x64-arm64-20260129-en
resource tags

arch:armarch:arm64arch:x64arch:x86image:android-x64-arm64-20260129-enlocale:en-usos:android-11-x64system
submitted
28/02/2026, 22:51

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Chrome.apk
Size 2.8MB
Sample260228-2swpsabs3c
SHA256 dc2a780f6abb9f0ec0a6675f20acb91ebe2a8748297682a59daf9164fbea2ee8
MD5 a17b06d4aa39ef2e1f3596cb72cb3911
SHA1 dd4aefc0c93dee4b63e8271c091eaf773b401737
SHA512 20ac4a68080fa1a571654cd22ca4e36e039c05f223de1b39d1e7edd1fd403b9c4ccf53a248f100e9e08e44dd0662aca330e5569fe22a9bf9b4dc04dd287bd8db
SSDEEP 49152:8+PmTcc+j4+srCdSgqzVg2ZCXbkKw0/M62vEHGJogKjOAUPP9AWtyus7q/:8+sc14JWdEZpg9pMrvPJpKjOHtAWY4/
TLSH
T1ECD5333FF869528ED9D4E37B98890DBAF071765CD323951E2CA032582E453CFC9249B9
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

banker collection credential_access defense_evasion discovery evasion octo impact infostealer persistence rat trojan

Malware Config

Extracted

Family

octo

https://personbro.com/YjQ1YmQ0ZGE5ODIz/
https://p4ersonbro.com/YjQ1YmQ0ZGE5ODIz/
https://pers6onbro.com/YjQ1YmQ0ZGE5ODIz/
https://p1ersonbro.com/YjQ1YmQ0ZGE5ODIz/
https://pers4onbro.com/YjQ1YmQ0ZGE5ODIz/
https://p7ersonbro.com/YjQ1YmQ0ZGE5ODIz/
https://perso3nbro.com/YjQ1YmQ0ZGE5ODIz/
https://pe1rsonbro.com/YjQ1YmQ0ZGE5ODIz/
https://per2sonbro.com/YjQ1YmQ0ZGE5ODIz/

rc4.plain

Extracted

Family

octo

https://personbro.com/YjQ1YmQ0ZGE5ODIz/
https://p4ersonbro.com/YjQ1YmQ0ZGE5ODIz/
https://pers6onbro.com/YjQ1YmQ0ZGE5ODIz/
https://p1ersonbro.com/YjQ1YmQ0ZGE5ODIz/
https://pers4onbro.com/YjQ1YmQ0ZGE5ODIz/
https://p7ersonbro.com/YjQ1YmQ0ZGE5ODIz/
https://perso3nbro.com/YjQ1YmQ0ZGE5ODIz/
https://pe1rsonbro.com/YjQ1YmQ0ZGE5ODIz/
https://per2sonbro.com/YjQ1YmQ0ZGE5ODIz/

AES_key

Signatures

Octo
Octo is a banking malware with remote access capabilities first seen in April 2022.
banker trojan infostealer rat octo
Octo family
octo

Octo payload 1 IoCs

resource	yara_rule
behavioral1/files/fstream-3.dat	family_octo

Loads dropped Dex/Jar 1 TTPs 3 IoCs

Runs executable file dropped to the device during analysis.

evasion

Download New Code at Runtime

T1407

ioc	pid	Process
/data/user/0/com.pagethan10/app_cargo/DDlfO.json	4742	com.pagethan10
/data/user/0/com.pagethan10/cache/vkicna	4742	com.pagethan10
/data/user/0/com.pagethan10/cache/vkicna	4742	com.pagethan10

Makes use of the framework's Accessibility service 4 TTPs 2 IoCs

Retrieves information displayed on the phone screen using AccessibilityService.

collection defense_evasion credential_access

Input Injection

T1516

Screen Capture

T1513

Keylogging

T1417.001

GUI Input Capture

T1417.002

description	ioc	Process
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId	com.pagethan10
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByViewId	com.pagethan10

Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
banker discovery

Security Software Discovery
T1418.001
Queries the phone number (MSISDN for GSM devices) 1 TTPs
discovery

System Network Configuration Discovery
T1422

Acquires the wake lock 1 IoCs

description	ioc	Process
Framework service call	android.os.IPowerManager.acquireWakeLock	com.pagethan10

Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs

Application may abuse the framework's foreground service to continue running in the foreground.

defense_evasion persistence

Foreground Persistence

T1541

description	ioc	Process
Framework service call	android.app.IActivityManager.setServiceForeground	com.pagethan10

Performs UI accessibility actions on behalf of the user 1 TTPs 4 IoCs

Application may abuse the accessibility service to prevent their removal.

evasion

Prevent Application Removal

T1629.001

ioc	Process
android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction	com.pagethan10
android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction	com.pagethan10
android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction	com.pagethan10
android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction	com.pagethan10

Queries the mobile country code (MCC) 1 TTPs 1 IoCs

discovery

System Network Configuration Discovery

T1422

description	ioc	Process
Framework service call	com.android.internal.telephony.ITelephony.getNetworkCountryIsoForPhone	com.pagethan10

Reads information about phone network operator. 1 TTPs
discovery

System Network Configuration Discovery
T1422

Requests accessing notifications (often used to intercept notifications before users become aware). 1 TTPs 1 IoCs

collection credential_access

Access Notifications

T1517

description	ioc	Process
Intent action	android.settings.ACTION_NOTIFICATION_LISTENER_SETTINGS	com.pagethan10

Requests disabling of battery optimizations (often used to enable hiding in the background). 1 TTPs 1 IoCs

defense_evasion

User Evasion

T1628.002

description	ioc	Process
Intent action	android.settings.REQUEST_IGNORE_BATTERY_OPTIMIZATIONS	com.pagethan10

Requests modifying system settings. 1 IoCs

defense_evasion

description	ioc	Process
Intent action	android.settings.action.MANAGE_WRITE_SETTINGS	com.pagethan10

Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs

impact

Data Encrypted for Impact

T1471

description	ioc	Process
Framework API call	javax.crypto.Cipher.doFinal	com.pagethan10

com.pagethan10
1⤵
- Loads dropped Dex/Jar
- Makes use of the framework's Accessibility service
- Acquires the wake lock
- Makes use of the framework's foreground persistence service
- Performs UI accessibility actions on behalf of the user
- Queries the mobile country code (MCC)
- Requests accessing notifications (often used to intercept notifications before users become aware).
- Requests disabling of battery optimizations (often used to enable hiding in the background).
- Requests modifying system settings.
- Uses Crypto APIs (Might try to encrypt user data)
PID:4742

Network

MITRE ATT&CK Mobile v16

Initial Access

Execution

Persistence

Foreground Persistence

T1541

Privilege Escalation

Defense Evasion

Download New Code at Runtime

T1407

Foreground Persistence

T1541

Hide Artifacts

T1628

User Evasion

T1628.002

Impair Defenses

T1629

Prevent Application Removal

T1629.001

Input Injection

T1516

Credential Access

Access Notifications

T1517

Input Capture

T1417

GUI Input Capture

T1417.002

Keylogging

T1417.001

Discovery

Software Discovery

T1418

Security Software Discovery

T1418.001

System Network Configuration Discovery

T1422

Lateral Movement

Collection

Access Notifications

T1517

Input Capture

T1417

GUI Input Capture

T1417.002

Keylogging

T1417.001

Screen Capture

T1513

Command and Control

Exfiltration

Impact

Data Encrypted for Impact

T1471

Input Injection

T1516

Replay Monitor

Loading Replay Monitor...

Downloads

DDlfO.json

Path /data/data/com.pagethan10/app_cargo/DDlfO.json
Size 1.0MB
SHA256 2692723fa908541ddf63f84a90bd02cf7315b9ed1530e1b953445063571a3dfe
MD5 80f667c885e35aacac0eae4e0535716f
SHA1 e94901ed3671d9367d38aaff07caada0bfe57312
SHA512 f48b4409d3e13bc016b53553d433ee9210ded18ea5c0898805267b97bf4bf2cc4e7a87f3fda6d6893f357f64177e2501dc6dc4e343b9d7ff01e0f6b57d09ed82
SSDEEP 24576:wIeQsyQxQgcYtm8YTB+08Xyccj4IaIdREdqxylh3hu:W2HYtgowj4EgNo
TLSH
T19E3533EDBC3B21DA52B8DFB3F8D9A1BD8439416CD87E97442C790A9E6468503D87087C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DDlfO.json

Path /data/data/com.pagethan10/app_cargo/DDlfO.json
Size 1.0MB
SHA256 e018dd01218d708ec2dd3eafd4b2a9c7bdbab40bfc58a609f681b39fb78453e5
MD5 09412f3e878c1727e1e6fc75edbc8bdd
SHA1 58f417bd00b83a747a2722fc334447fbadcb0dcd
SHA512 82d361a1f4cb167c9ecf5f1c84f0f2afe353aad7fd7bcecc04094d15bd7ae7c6c66dad0ee724ec8f0015dadece8996fb392cae0086f630bae58c4d4349b5a163
SSDEEP 24576:oueeK0kPylCvKa5xXYrcxgbAdOCgxzQxYwlIukOJ:oNeKHPysiaLXBgcdOCgtSYwiukO
TLSH
T16E3533C9B9CD1AC350A71A34D6808C8F5AE5BC96616307874A5FC3B78DA5F6DCD08B22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vkicna.cur.prof

Path /data/data/com.pagethan10/cache/oat/vkicna.cur.prof
Size 323B
SHA256 30a1cf6a1dfdfef6d3dcf4bc6fd1c269657ce0c38c45bc40def94e5a18e81859
MD5 4415d94d02636e0d5e1d7caa8320b0dc
SHA1 fe02c68c6685f69e3051e5f5eedc793648b63598
SHA512 797f6699de1abeaa8e0740154d4c1c8fceb7c42fd1c6edb88ed3c8b062156a435c4a40a849ba505c9d67e41685175e49574f61ad1a0a05622d6981996ba6a9bd
TLSH
T13EE02D7F45FDCB98200AA22DE18A8E1357E4AB2DA0C02781140C1D610938380E9C64A3
MD5 SHA1 SHA512 TLSH

Submit Download

vkicna

Path /data/data/com.pagethan10/cache/vkicna
Size 976KB
SHA256 d2370e05eb0477d0e733070ae0da4685da0f14c18d2c50fe1d687cc8bb9f782f
MD5 90d8faa04048ef2012e02e5966e85349
SHA1 36c5b916befaf54ae9fc6c2b3fcb410d56ca6d87
SHA512 dd37bcb8ca45093b0a1f3063cd069a201062b9fe71cace20452db9bf194e91c181dd73ae2ff559d594e0a8556a389d78a6ace48a015108f9cf91756773da4973
SSDEEP 12288:npyJMEWd8I2fU+vXHKNEQGLW9e4paBwbi7UOs3N2p52+gvfU3MdzykhiKF8q4YCU:pyJxc+vX8RGp52tfU3Mdzykhii8K1
TLSH
T133258D97A7C61F63CD2897B43DF207842332A08A2253AB47491DEDFC1C575E26EE52C9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DDlfO.json

Path /data/user/0/com.pagethan10/app_cargo/DDlfO.json
Size 3.0MB
SHA256 6335cb1d61f238c74f352f81657b8f0e0bcc521003b8884a68b50ff4b64b3475
MD5 61ab9621327c2ea58e504ed42e256d07
SHA1 55a877d5059a1978e8114b0fd0b781e495db29ff
SHA512 e0db41819466d2f4f87bc197200a3cd04d11d8fd360b0a393b1bc805f7622361574f3b28c8237a585416ed65a775b22853529ce33e04c9e073f0ca543445b4db
SSDEEP 49152:ClF28ajWGb0Yz9YxJEJNwIguGizYdpsDGM:+IH7gV5kDx
TLSH
T134E56A53B9545E31C72F6FB949BD6F0DA33962AB7EC347824184C92C7C423A5628B1EC
MD5 SHA1 SHA512 SSDEEP TLSH

Download

Resubmissions

Analysis

Sharing

General

Malware Config

Extracted

Extracted

Signatures

Processes

Network

MITRE ATT&CK Mobile v16

Replay Monitor

Loading Replay Monitor...

Downloads