octo | ba03a250f61166d27449d8a8ecdcdfc208b96d7e37f70ba85bd835500dc8d9f3

Analysis

max time kernel
8s
max time network
157s
platform
android_x64
resource
android-x64-20240624-en
resource tags

androidarch:x64arch:x86image:android-x64-20240624-enlocale:en-usos:android-10-x64system
submitted
20-01-2025 22:10

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ba03a250f61166d27449d8a8ecdcdfc208b96d7e37f70ba85bd835500dc8d9f3.apk
Size

2.5MB
MD5

7395477b98c99a45c4a25d326de81a81
SHA1

dd646f90c4e57793910b3cb9ccbe8b1f3d1fd054
SHA256

ba03a250f61166d27449d8a8ecdcdfc208b96d7e37f70ba85bd835500dc8d9f3
SHA512

aba8ce05e0f33e9419ade3b8269551a5076339b73a3063375442c3b6654121dabfcf257fa08b8d327a1e8e8ba79f1b905946821c3b8e192d67549f6ec9bb9d2b
SSDEEP

49152:eo/N/OfLjOmtp6UY0tSh3HIVxkwz/nbvQTYG3tx5mUlSiKbWribW:egGfLjOmtp6uQSvZzrQ8+tPmUlUauW

Score

10^/10

octo banker discovery evasion infostealer rat trojan

Malware Config

Extracted

Family

octo

https://hastanebilgimrehber.xyz/MzhiMTg0NTAwOTY5/

https://hastanebilgimiletisim.xyz/MzhiMTg0NTAwOTY5/

https://hastanebilgimkapsami.xyz/MzhiMTg0NTAwOTY5/

https://hastanebilgimtavsiyesi.xyz/MzhiMTg0NTAwOTY5/

https://hastanebilgimkaynak.xyz/MzhiMTg0NTAwOTY5/

https://hastanebilgimyolu.xyz/MzhiMTg0NTAwOTY5/

https://hastanebilgimgucu.xyz/MzhiMTg0NTAwOTY5/

https://hastanebilgimguncel.xyz/MzhiMTg0NTAwOTY5/

https://hastanebilgimyonetim.xyz/MzhiMTg0NTAwOTY5/

https://hastanebilgimdestek.xyz/MzhiMTg0NTAwOTY5/

https://hastanebilgimyenilik.xyz/MzhiMTg0NTAwOTY5/

https://hastanebilgimtarih.xyz/MzhiMTg0NTAwOTY5/

https://hastanebilgimkaynaklari.xyz/MzhiMTg0NTAwOTY5/

https://hastanebilgimplatform.xyz/MzhiMTg0NTAwOTY5/

https://hastanebilgimdogru.xyz/MzhiMTg0NTAwOTY5/

https://hastanebilgimdogruluk.xyz/MzhiMTg0NTAwOTY5/

https://hastanebilgimanlayis.xyz/MzhiMTg0NTAwOTY5/

https://hastanebilgimhizmet.xyz/MzhiMTg0NTAwOTY5/

https://hastanebilgimkalite.xyz/MzhiMTg0NTAwOTY5/

https://hastanebilgimiletim.xyz/MzhiMTg0NTAwOTY5/

rc4.plain

Signatures

Octo
Octo is a banking malware with remote access capabilities first seen in April 2022.
banker trojan infostealer rat octo
Octo family
octo

Octo payload 1 IoCs

resource	yara_rule
behavioral2/memory/5012-0.dex	family_octo

Loads dropped Dex/Jar 1 TTPs 1 IoCs

Runs executable file dropped to the device during analysis.

evasion

Download New Code at Runtime

T1407

ioc	pid	Process
/data/user/0/co.learnol.bksfz/app_clog/bJq.json	5012	co.learnol.bksfz

Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
banker discovery

Security Software Discovery
T1418.001

co.learnol.bksfz
1⤵
- Loads dropped Dex/Jar
PID:5012

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Download New Code at Runtime

T1407

Credential Access

Discovery

Software Discovery

T1418

Security Software Discovery

T1418.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

/data/data/co.learnol.bksfz/app_clog/bJq.json

Filesize
153KB

MD5
ea8885a294e5d61bfb87a78b44a190de

SHA1
b43f78299f935bddb3c5a86eb782902e1000b40d

SHA256
a2f4d42274ae8a0e041ddcab97d7f59065d02b6a224d67b23f240ac6a8d7eccb

SHA512
75af54e9163c1e4e16bb2f699a12172759b1299615ef38a41314396a2f805d32a616407bd0fd3b6f43ac58eff0052ad57136f2702ec9b12e4ffdcd7ec9d4e7e6

Download Submit
/data/data/co.learnol.bksfz/app_clog/bJq.json

Filesize
153KB

MD5
488e14c6c1a49d0f360e6cb8f2c40016

SHA1
ae9a2de8487fb9ea8a60ffd4002f2bd8e57b8a90

SHA256
f7e4993c508867115bfd0952499e182ca0d89cb6e73e246489da95043f90b618

SHA512
0425fe28b4646d49eedbc1503d95a3f4e278ec6604944f0991a42e3cf8dcfcf560ddfc220de563a219e28d6f27b8fbe6c683582a7273c344ffdc416991050c2d

Download Submit
/data/user/0/co.learnol.bksfz/app_clog/bJq.json

Filesize
450KB

MD5
89243960818c1c09c1cb24b04f67faec

SHA1
593160660db3c7042ecea68687b63a454d19e440

SHA256
c305a073d24953c41b175ef45d02e03f73419e6809a7ab1b0f774550f768fb73

SHA512
52ae77c8985026d89ed84601e9a6e072f0556839e207866f9e053068858e68be9a814d2ebf7095c2e0814252edeea4715557818e029ee76fe1eec575f7aa8601

Download Submit