octo | b52f6c6687a8ea9e562ddacbe9c0b54b03d7fea7aa55ecc27b2f3ae96b2a6437

General

Target
b52f6c6687a8ea9e562ddacbe9c0b54b03d7fea7aa55ecc27b2f3ae96b2a6437
Size 13.8MB
Sample260717-tkdv1aay4z
SHA256 b52f6c6687a8ea9e562ddacbe9c0b54b03d7fea7aa55ecc27b2f3ae96b2a6437
MD5 362f5050dfe13e934a0a01ad74509a50
SHA1 6ca0b45f517833762e3c463697ae751d86145203
SHA512 36ddc813e638081cea616b31065200614b784accdbad418681c3a7a3dc66e445f5152948510d532bb130d1bb16307511fc351cc5917c6aeb6bde254faa43d608
SSDEEP 98304:oO7EaYgtXmdzILfPQO8+NCses3XxRs6sVKk+5iSRGXxt7NkE:PYqrLfPQaCsh3XxRXsU7rOt7Nb
TLSH
T1F5E69F1BBDC0DF32E5D61877040581FAE32A1865BBDA47C21706DE3E38562D6BF25B82
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

banker trojan infostealer rat octo

Malware Config

Signatures

Family: Octo
Octo is a banking malware with remote access capabilities first seen in April 2022.
banker trojan infostealer rat octo

Octo DGA 4 IoCs

Contains strings associated with the Octo/Coper variant that uses a domain generation algorithm (DGA).

resource	yara_rule
sample	Coper_DGA_Strings
sample	Coper_DGA_Strings
sample	Coper_DGA_Strings
sample	Coper_DGA_Strings

Declares broadcast receivers with permission to handle system events 1 IoCs

description	ioc
Required by device admin receivers to bind with the system. Allows apps to manage device administration features.	android.permission.BIND_DEVICE_ADMIN

Declares services with permission to bind to the system 2 IoCs

description	ioc
Required by accessibility services to bind with the system. Allows apps to access accessibility features.	android.permission.BIND_ACCESSIBILITY_SERVICE
Required by notification listener services to bind with the system. Allows apps to listen to and interact with notifications on the device.	android.permission.BIND_NOTIFICATION_LISTENER_SERVICE

Requests dangerous framework permissions 13 IoCs

description	ioc
Allows an application to read the user's contacts data.	android.permission.READ_CONTACTS
Allows an application to read SMS messages.	android.permission.READ_SMS
Allows an application to send SMS messages.	android.permission.SEND_SMS
Allows an application to receive SMS messages.	android.permission.RECEIVE_SMS
Allows an application to monitor incoming MMS messages.	android.permission.RECEIVE_MMS
Allows read access to the device's phone number(s).	android.permission.READ_PHONE_NUMBERS
Allows an application to initiate a phone call without going through the Dialer user interface for the user to confirm the call.	android.permission.CALL_PHONE
Allows an application to read or write the system settings.	android.permission.WRITE_SETTINGS
Allows an app to create windows using the type LayoutParams.TYPE_APPLICATION_OVERLAY, shown on top of all other apps.	android.permission.SYSTEM_ALERT_WINDOW
Allows an application to write to external storage.	android.permission.WRITE_EXTERNAL_STORAGE
Allows an application a broad access to external storage in scoped storage.	android.permission.MANAGE_EXTERNAL_STORAGE
Allows an app to post notifications.	android.permission.POST_NOTIFICATIONS
Allows read only access to phone state, including the current cellular network information, the status of any ongoing calls, and a list of any PhoneAccounts registered on the device.	android.permission.READ_PHONE_STATE

Untrusted Codesign Signers 1 IoCs

Codesigned file was signed by an untrusted entity.

resource
b52f6c6687a8ea9e562ddacbe9c0b54b03d7fea7aa55ecc27b2f3ae96b2a6437

File Explorer

b52f6c6687a8ea9e562ddacbe9c0b54b03d7fea7aa55ecc27b2f3ae96b2a6437

.apk 13.8MB

b52f6c6687a8ea9e562ddacbe9c0b54b03d7fea7aa55ecc27b2f3ae96b2a6437

SHA256 b52f6c6687a8ea9e562ddacbe9c0b54b03d7fea7aa55ecc27b2f3ae96b2a6437
MD5 362f5050dfe13e934a0a01ad74509a50
SHA1 6ca0b45f517833762e3c463697ae751d86145203
SHA512 36ddc813e638081cea616b31065200614b784accdbad418681c3a7a3dc66e445f5152948510d532bb130d1bb16307511fc351cc5917c6aeb6bde254faa43d608
SSDEEP 98304:oO7EaYgtXmdzILfPQO8+NCses3XxRs6sVKk+5iSRGXxt7NkE:PYqrLfPQaCsh3XxRXsU7rOt7Nb
TLSH
T1F5E69F1BBDC0DF32E5D61877040581FAE32A1865BBDA47C21706DE3E38562D6BF25B82
MD5 SHA1 SHA512 SSDEEP TLSH

android arch:arm arch:arm64 arch:x64 arch:x86

Octo DGA

Contains strings associated with the Octo/Coper variant that uses a domain generation algorithm (DGA).
Untrusted Codesign Signers

Codesigned file was signed by an untrusted entity.

File Signature issue

Digest

41e949df52f03ec4169421dcecb37de4d9c6d630fdaa1bcaa94506e1cc497b6a

Digest Algorithm

sha256

Digest Matches

Trusted

Not trusted

Signer

CN=Android Debug,OU=Android,O=Unknown,L=Unknown,ST=Unknown,C=US

File Signature issue

Digest

9390ae1bc00a4156a82f6ed17d95ee0bb8f0ba978a1494459d6ea0fd1f8e7f3a7d7fc5db0ca8dd125b85b5528f56038adafe699bc0e613980f73a128f904db01

Digest Algorithm

sha512

Digest Matches

Trusted

Not trusted

Signer

CN=Deploy Key,OU=Technology,O=Development Team,L=Los Angeles,ST=Michigan,C=US

com.jhhole_handb

Android Permissions

b52f6c6687a8ea9e562ddacbe9c0b54b03d7fea7aa55ecc27b2f3ae96b2a6437

Permissions

android.permission.REQUEST_IGNORE_BATTERY_OPTIMIZATIONS

android.permission.FOREGROUND_SERVICE

android.permission.RECEIVE_BOOT_COMPLETED

android.permission.INTERNET

android.permission.WAKE_LOCK

android.permission.REORDER_TASKS

android.permission.ACCESS_NOTIFICATION_POLICY

android.permission.READ_CONTACTS

android.permission.READ_SMS

android.permission.WRITE_SMS

android.permission.SEND_SMS

android.permission.RECEIVE_SMS

android.permission.RECEIVE_MMS

android.provider.Telephony.SMS_RECEIVED

android.permission.READ_PHONE_NUMBERS

android.permission.CALL_PHONE

android.permission.USES_POLICY_FORCE_LOCK

android.permission.VIBRATE

android.permission.REQUEST_DELETE_PACKAGES

android.permission.MODIFY_AUDIO_SETTINGS

android.permission.ACCESS_NETWORK_STATE

android.permission.QUERY_ALL_PACKAGES

android.permission.WRITE_SETTINGS

android.permission.USE_FULL_SCREEN_INTENT

android.permission.ACTION_MANAGE_OVERLAY_PERMISSION

android.permission.SYSTEM_ALERT_WINDOW

android.permission.WRITE_EXTERNAL_STORAGE

android.permission.MANAGE_EXTERNAL_STORAGE

android.permission.POST_NOTIFICATIONS

android.permission.FOREGROUND_SERVICE_MEDIA_PLAYBACK

android.permission.READ_PHONE_STATE

b52f6c6687a8ea9e562ddacbe9c0b54b03d7fea7aa55ecc27b2f3ae96b2a6437

File Signature issue

File Signature issue

com.jhhole_handb.dpB6ta9

com.jhhole_handb.pmi1IdYdOI

com.jhhole_handb.zowvqiBAD

com.jhhole_handb.fiS22

com.jhhole_handb.v3ym8mc4z

com.jhhole_handb.sXz8EYCV

com.jhhole_handb.rfRedRvU

com.jhhole_handb.uQXmqi

com.jhhole_handb.cZ9mD

com.jhhole_handb.crc4XRhcvBAM

com.jhhole_handb.nyNaMsEBmiy

com.jhhole_handb.unaOi9Fj

com.jhhole_handb.vxl18Hw7SP

com.jhhole_handb.oqCx1c

com.jhhole_handb.tZcSHxKX

com.jhhole_handb.llvkEkHE

com.jhhole_handb.q3aTK

com.jhhole_handb.mljipzbmnx

com.jhhole_handb.gzkraYR

Resubmissions

Sharing

General

Malware Config

Signatures

File Explorer

b52f6c6687a8ea9e562ddacbe9c0b54b03d7fea7aa55ecc27b2f3ae96b2a6437

File Signature issue

File Signature issue

com.jhhole_handb.dpB6ta9

com.jhhole_handb.pmi1IdYdOI

com.jhhole_handb.zowvqiBAD

com.jhhole_handb.fiS22

com.jhhole_handb.v3ym8mc4z

com.jhhole_handb.sXz8EYCV

com.jhhole_handb.rfRedRvU

com.jhhole_handb.uQXmqi

com.jhhole_handb.cZ9mD

com.jhhole_handb.crc4XRhcvBAM

com.jhhole_handb.nyNaMsEBmiy

com.jhhole_handb.unaOi9Fj

com.jhhole_handb.vxl18Hw7SP

com.jhhole_handb.oqCx1c

com.jhhole_handb.tZcSHxKX

com.jhhole_handb.llvkEkHE

com.jhhole_handb.q3aTK

com.jhhole_handb.mljipzbmnx

com.jhhole_handb.gzkraYR

Android Permissions

b52f6c6687a8ea9e562ddacbe9c0b54b03d7fea7aa55ecc27b2f3ae96b2a6437