octo | 022e1e2decb27cb580a1234ffb095b9ecd3b5462939023a825bc7e604ff2fd1a

Analysis

max time kernel
3203063s
max time network
130s
platform
android_x86
resource
android-x86-arm-20230831-en
submitted
22-09-2023 22:00

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

022e1e2decb27cb580a1234ffb095b9ecd3b5462939023a825bc7e604ff2fd1a.apk
Size

557KB
MD5

0bcbd376e9bc986dac87590bc8eb22e7
SHA1

1dc43f9ffa2f86171919eca852a9a417ece7c082
SHA256

022e1e2decb27cb580a1234ffb095b9ecd3b5462939023a825bc7e604ff2fd1a
SHA512

5644555a496dd00aaad9e27c64a5635e0085ac5fae9cd81881edbe0f8074d3ca03ab6c5a55c434f74c55c92eec6ba0e09288deddb0b28350115999891432becf
SSDEEP

12288:hAi28oYZudl+QeQHFIU7Zuj9fMcloaArWDJJf+41naY7jCKcxznf:hAi2sZudJ2UYBMQv+AaYSxR

Score

10^/10

octo banker evasion infostealer ransomware rat stealth trojan

Malware Config

Extracted

Family

octo

https://185.225.75.207/ODVlZDlkMzU1ZTRi/

https://2jamiryo22113.net/ODVlZDlkMzU1ZTRi/

https://4jamiryo22113.net/ODVlZDlkMzU1ZTRi/

https://3jamiryo22113.net/ODVlZDlkMzU1ZTRi/

https://5jamiryo22113.net/ODVlZDlkMzU1ZTRi/

https://6jamiryo22113.net/ODVlZDlkMzU1ZTRi/

https://7jamiryo22113.net/ODVlZDlkMzU1ZTRi/

AES_key

Signatures

Octo
Octo is a banking malware with remote access capabilities first seen in April 2022.
banker trojan infostealer rat octo

Octo payload 3 IoCs

resource	yara_rule
behavioral1/files/fstream-1.dat	family_octo
behavioral1/memory/4173-0.dex	family_octo
behavioral1/memory/4173-1.dex	family_octo

Makes use of the framework's Accessibility service. 2 IoCs

description	ioc	Process
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId	com.bedhold27
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByViewId	com.bedhold27

Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps). 1 IoCs

banker

description	ioc	Process
Framework service call	android.content.pm.IPackageManager.getInstalledApplications	com.bedhold27

Removes its main activity from the application launcher 1 IoCs

stealth trojan

pid	Process
4173	com.bedhold27

Acquires the wake lock. 1 IoCs

description	ioc	Process
Framework service call	android.os.IPowerManager.acquireWakeLock	com.bedhold27

Loads dropped Dex/Jar 2 IoCs

Runs executable file dropped to the device during analysis.

ioc	pid	Process
/data/user/0/com.bedhold27/cache/jsyuggfsoyg	4173	com.bedhold27
/data/user/0/com.bedhold27/cache/jsyuggfsoyg	4173	com.bedhold27

Reads information about phone network operator.

Requests disabling of battery optimizations (often used to enable hiding in the background). 1 IoCs

evasion

description	ioc	Process
Intent action	android.settings.REQUEST_IGNORE_BATTERY_OPTIMIZATIONS	com.bedhold27

Removes a system notification. 1 IoCs

evasion

description	ioc	Process
Framework service call	android.app.INotificationManager.cancelNotificationWithTag	com.bedhold27

Uses Crypto APIs (Might try to encrypt user data). 1 IoCs

ransomware

description	ioc	Process
Framework API call	javax.crypto.Cipher.doFinal	com.bedhold27

com.bedhold27
1⤵
- Makes use of the framework's Accessibility service.
- Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps).
- Removes its main activity from the application launcher
- Acquires the wake lock.
- Loads dropped Dex/Jar
- Requests disabling of battery optimizations (often used to enable hiding in the background).
- Removes a system notification.
- Uses Crypto APIs (Might try to encrypt user data).
PID:4173

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

/data/data/com.bedhold27/.qcom.bedhold27

Filesize
48B

MD5
046a414913add6f5bb60072c7db819b6

SHA1
451ee4f6809260aec622d772fd329c7d0297a842

SHA256
b66c1320cb063a1d391c94273572ea6edae76c8c8b0a07f8d75c88686f0df72a

SHA512
4e6355f3051ed5e811ab030abde1f5be7f5e1cf33be99cd08477e9b6c015deb1d8bd75a09fb9c7176b8511c5ad0a67abc0902a3531e97564ccb6afc57496a47c

Download Submit
/data/data/com.bedhold27/cache/jsyuggfsoyg

Filesize
449KB

MD5
882a1e4e99ae0002eeb7e92682684cf5

SHA1
523c3240acde39974fce6cd6b9097237215b0ffb

SHA256
c711224b7419ff9c4699a16adb63173b10127631e1ebff4b33e20975d5b991df

SHA512
d13fcb64de9c1c18dbe070c26463bd10dc22e30d25a5b5b9c444ac144fda0f81dae8895b1acecf0e9281fcebdcaea2c7dc6206ed72a8a5fb49c8f28f0f98d598

Download Submit
/data/data/com.bedhold27/cache/oat/jsyuggfsoyg.cur.prof

Filesize
467B

MD5
6b50928a8d5d75ab6e0655ff95094005

SHA1
1f877a37c54260bca1ebe0a88e0286f5b0644328

SHA256
6eb538c28c50a83d846c4985da02e28f4171221012383819271a2d62967cd926

SHA512
6d168c8a829500c64f1bf7fdb98724eeca569e5afe9278d69687e0ef08ef05c319b7295aa1b0525905de51d188ead52c52cf43bdc8340e22c60045066be844b8

Download Submit
/data/data/com.bedhold27/kl.txt

Filesize
28B

MD5
6311c3fd15588bb5c126e6c28ff5fffe

SHA1
ce81d136fce31779f4dd62e20bdaf99c91e2fc57

SHA256
8b82f6032e29a2b5c96031a3630fb6173d12ff0295bc20bb21b877d08f0812d8

SHA512
2975fe2e94b6a8adc9cfc1a865ad113772b54572883a537b02a16dd2d029c0f7d9cca3b154fd849bdfe978e18b396bcf9fa6e67e7c61f92bdc089a29a9c355c6

Download Submit
/data/data/com.bedhold27/kl.txt

Filesize
232B

MD5
c546723fc5cfd2a7ce916ec23135f1c2

SHA1
c967c4ad2e7941833cb02cfa03fbd1632a36e492

SHA256
7a2824aee00bfe4d20e1db6015db7f035d3e2a653e4675d9495d4b67c85e9b8a

SHA512
35403c125ad923493595d6907c402a2a3fa933d26686ac7ec7cdcb2718642c45fded95ce9a14ca3fea21729871025667309b95b55d6de8815b5665bb63e9d0c7

Download Submit
/data/data/com.bedhold27/kl.txt

Filesize
63B

MD5
1c098e18f85f235dfa6db027771592d3

SHA1
1c8214ddc795be316563b8546a4bbda246d2f5f6

SHA256
b7413028bdb526465aba863945297970f1021204770e4b30ef634e12487049e1

SHA512
091ebf96e14910be714075dcefe76ff26c205e7f202450c5e5bc4307312018a842e7a0f39cb432f942ec03919d8493f571feb1c7f04a6854db69fa02e201a91b

Download Submit
/data/data/com.bedhold27/kl.txt

Filesize
54B

MD5
7f35fb302c2e5f98843b35ee4e973d94

SHA1
e3e2f2dcbc2169dc7da52865a0c7db4a64b69df4

SHA256
6330fce6b2c16505ac461b64a05b6bc16a13141bb4364c3883fc4d27dbec98a3

SHA512
1c7d77a4cd346fede72dcb7eb0bfc4a00d2df3d81decc90bc546ce1bff909988e1630830debcca2f2593838c0988f7f52bd5b29966917ef6086d6397879e4d57

Download Submit
/data/data/com.bedhold27/kl.txt

Filesize
427B

MD5
a9d533e52b100f68e4b63323618f48ff

SHA1
4a01a49a814b4adad0bfb328338bb0801399f664

SHA256
c7d9e225839ba42b6409d876b7a5a8623e929745c66794c8f5dd902144311320

SHA512
d0ada28692d15954e4bfeebff54cb3a4849769a98a5bf923fc40194fd0cce60c2a3995840cb097439b0b3e20d0124093537ec65c28a13d639bd00615ed21326c

Download Submit
/data/user/0/com.bedhold27/cache/jsyuggfsoyg

Filesize
449KB

MD5
882a1e4e99ae0002eeb7e92682684cf5

SHA1
523c3240acde39974fce6cd6b9097237215b0ffb

SHA256
c711224b7419ff9c4699a16adb63173b10127631e1ebff4b33e20975d5b991df

SHA512
d13fcb64de9c1c18dbe070c26463bd10dc22e30d25a5b5b9c444ac144fda0f81dae8895b1acecf0e9281fcebdcaea2c7dc6206ed72a8a5fb49c8f28f0f98d598

Download Submit
/data/user/0/com.bedhold27/cache/jsyuggfsoyg

Filesize
449KB

MD5
882a1e4e99ae0002eeb7e92682684cf5

SHA1
523c3240acde39974fce6cd6b9097237215b0ffb

SHA256
c711224b7419ff9c4699a16adb63173b10127631e1ebff4b33e20975d5b991df

SHA512
d13fcb64de9c1c18dbe070c26463bd10dc22e30d25a5b5b9c444ac144fda0f81dae8895b1acecf0e9281fcebdcaea2c7dc6206ed72a8a5fb49c8f28f0f98d598

Download Submit