octo | 4dd2e25f45a10f9b1d622143bd197a54f9c0d516eaa3f0d8bddb7c189cdda4d4

Resubmissions

01-11-2023 09:31

231101-lhg6msge72 10

28-09-2023 09:21

230928-lbbehsaa8t 10

Analysis

max time kernel
3675775s
max time network
158s
platform
android_x64
resource
android-x64-20230831-en
submitted
28-09-2023 09:21

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

4dd2e25f45a10f9b1d622143bd197a54f9c0d516eaa3f0d8bddb7c189cdda4d4.apk
Size

1.7MB
MD5

d66860f4fbd02fdbc452b9e3fabdfe71
SHA1

332c7fa9260426e33e60ff5619ba2dbf630c60e8
SHA256

4dd2e25f45a10f9b1d622143bd197a54f9c0d516eaa3f0d8bddb7c189cdda4d4
SHA512

56c7025c23af5eb43a3db8f848f477d8b05d4dd68d86e3bb39756ef701202cc9a53645bb022741491efb8347513db10743f88aef6e1e2862d0ca9265d231abab
SSDEEP

49152:g7meK0meZdvS1S8ApovsEY1xMjhSDCaEA3DI:cmeZmUAXAoYkNwCaz3DI

Score

10^/10

octo banker infostealer rat trojan

Malware Config

Signatures

Octo
Octo is a banking malware with remote access capabilities first seen in April 2022.
banker trojan infostealer rat octo

Octo payload 3 IoCs

Processes:

resource	yara_rule
/data/data/com.bedfastqai/cache/hnxvgkcyylruk	family_octo
/data/user/0/com.bedfastqai/cache/hnxvgkcyylruk	family_octo
/data/user/0/com.bedfastqai/cache/hnxvgkcyylruk	family_octo

Loads dropped Dex/Jar 3 IoCs

Runs executable file dropped to the device during analysis.

Processes:

com.bedfastqai

ioc	pid	process
/data/user/0/com.bedfastqai/app_DynamicOptDex/ie.json	4995	com.bedfastqai
/data/user/0/com.bedfastqai/cache/hnxvgkcyylruk	4995	com.bedfastqai
/data/user/0/com.bedfastqai/cache/hnxvgkcyylruk	4995	com.bedfastqai

com.bedfastqai
1⤵
- Loads dropped Dex/Jar
PID:4995

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

/data/data/com.bedfastqai/app_DynamicOptDex/ie.json

Filesize
2KB

MD5
5313cf5d2bd97a0b8ff4221f6eca07f1

SHA1
a93d27a1ee53d8b61f3be86dc765d6c7d7d13b21

SHA256
11d35ba2668729f6ca9385aec5d1eb1b1816e60b9c6ba68c37e00ee204c6373f

SHA512
ed3395b74095068fd11718e8cfb5ebf5c22ec749e67e498d497daac22da29da59dadacf42c08313fe6dc3c432ca097623f378370a4b320a53b6372dea517036a

Download Submit
/data/data/com.bedfastqai/app_DynamicOptDex/ie.json

Filesize
2KB

MD5
3b6b10b7336972d32dcf32e2bc9edd5e

SHA1
8a52a861fc18ac05abcbf5c272a51f06c2669dba

SHA256
3fc53130b9e03212053c729cfe6fa59b1be60d959681f1698e9b9f613e25bdee

SHA512
131930c7170fdd02d310a400ebd392af9815d74594398d52f9a98f2df9dedc1c6cda2ba716975bc3bfa67ed35b17e0acf44eda604a01963a9ebb580e6ced1506

Download Submit
/data/data/com.bedfastqai/cache/hnxvgkcyylruk

Filesize
450KB

MD5
5a9761a682983ee65ac75afaa519d8c0

SHA1
e5981ac4bf216063605c9a64d9476a630adb7b2a

SHA256
4faad8b3f5387d871f8be01067ca70babec592a606f80197fcb324d0f91843ab

SHA512
ae11de405436affca50c8bbb625635cc8019782094443c84486f31d4d2ce1b6b8c4e5d1cfefe5808b443933526fe7160d0fe7b92a8a6549816b30ae81c34f662

Download Submit
/data/user/0/com.bedfastqai/app_DynamicOptDex/ie.json

Filesize
6KB

MD5
59194241714e86ba412dd1d28962818a

SHA1
9ea9f53ea3cc6a50f4722374d29d0296f3b0db01

SHA256
1cc7c8d53bf36a9fb86b45a671d3dff66551b69373fefe90338860f233b26346

SHA512
4bb300d0074618bcba8f14bd9cbd6ef5d463a4b40532aa2d998973bd91c5d623a73e41b1c814ef3a810f509d4b8a754d345b37bae9d3d3019870c385bc1b1434

Download Submit
/data/user/0/com.bedfastqai/cache/hnxvgkcyylruk

Filesize
450KB

MD5
5a9761a682983ee65ac75afaa519d8c0

SHA1
e5981ac4bf216063605c9a64d9476a630adb7b2a

SHA256
4faad8b3f5387d871f8be01067ca70babec592a606f80197fcb324d0f91843ab

SHA512
ae11de405436affca50c8bbb625635cc8019782094443c84486f31d4d2ce1b6b8c4e5d1cfefe5808b443933526fe7160d0fe7b92a8a6549816b30ae81c34f662

Download Submit
/data/user/0/com.bedfastqai/cache/hnxvgkcyylruk

Filesize
450KB

MD5
5a9761a682983ee65ac75afaa519d8c0

SHA1
e5981ac4bf216063605c9a64d9476a630adb7b2a

SHA256
4faad8b3f5387d871f8be01067ca70babec592a606f80197fcb324d0f91843ab

SHA512
ae11de405436affca50c8bbb625635cc8019782094443c84486f31d4d2ce1b6b8c4e5d1cfefe5808b443933526fe7160d0fe7b92a8a6549816b30ae81c34f662

Download Submit