octo | 439f8c57bca9c09aa0364ebb7560eebb130d22a8e6482f3433a5797765a283d5

Analysis

max time kernel
1555543s
max time network
154s
platform
android_x64
resource
android-x64-arm64-20220310-en
submitted
13-06-2022 10:56

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

439f8c57bca9c09aa0364ebb7560eebb130d22a8e6482f3433a5797765a283d5.apk
Size

1.4MB
MD5

13f82c6f6f722e03b708bff539affd04
SHA1

7828eb95578e0483e07f875cc4821acf965e629f
SHA256

439f8c57bca9c09aa0364ebb7560eebb130d22a8e6482f3433a5797765a283d5
SHA512

a0a3d8eca8a301de2f23aeef411432800a4f999bf25b21a747526b2ac50acdea28435739aa1afaf2f02d094a485fa487b46bee2f8cc4ef583b83123d4248be9f

Score

10^/10

octo banker infostealer ransomware rat trojan

Malware Config

Extracted

Family

octo

https://idai2babd1.xyz/MWNhMjI2OTkyNjA3/

https://fabh23zuba.top/MWNhMjI2OTkyNjA3/

https://ahnudsbba.xyz/MWNhMjI2OTkyNjA3/

https://fu8hhaadl.com/MWNhMjI2OTkyNjA3/

https://jufhahbhazh.top/MWNhMjI2OTkyNjA3/

AES_key

Signatures

Octo
Octo is a banking malware with remote access capabilities first seen in April 2022.
banker trojan infostealer rat octo

Octo is a banking malware with remote access capabilities first seen in April 2022 3 IoCs

resource	yara_rule
behavioral2/files/6221-0.dat	family_octo
behavioral2/memory/6221-0.dex	family_octo
behavioral2/memory/6221-1.dex	family_octo

Makes use of the framework's Accessibility service. 1 IoCs

description	ioc	Process
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId	com.frontwonder2

Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps). 1 IoCs

banker

description	ioc	Process
Framework service call	android.content.pm.IPackageManager.getInstalledApplications	com.frontwonder2

Acquires the wake lock. 1 IoCs

description	ioc	Process
Framework service call	android.os.IPowerManager.acquireWakeLock	com.frontwonder2

Loads dropped Dex/Jar 2 IoCs

Runs executable file dropped to the device during analysis.

ioc	pid	Process
/data/user/0/com.frontwonder2/cache/entczqpw	6221	com.frontwonder2
/data/user/0/com.frontwonder2/cache/entczqpw	6221	com.frontwonder2

Uses Crypto APIs (Might try to encrypt user data). 1 IoCs

ransomware

description	ioc	Process
Framework API call	javax.crypto.Cipher.doFinal	com.frontwonder2

com.frontwonder2
1⤵
- Makes use of the framework's Accessibility service.
- Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps).
- Acquires the wake lock.
- Loads dropped Dex/Jar
- Uses Crypto APIs (Might try to encrypt user data).
PID:6221

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

/data/user/0/com.frontwonder2/app_webview/Default/Cookies

Filesize
64KB

MD5
dfb2098ca7b3bf16d6f5f1e7d3839af5

SHA1
ebb7a8bc886062d77a4092bd306b77a0ce7a3e9d

SHA256
e4119d32577d7fc63b267cc23eb7a9bbfb12d238f23e08918c38838fe0181224

SHA512
fccec45399258eb98220b7f01b492a72b8b3d1254dec6e196e344d89a0376c6ee24534a31a6675c866d4a17256d3ac6823657eaf04e1d386757d0cbfc6597e50

Download Submit
/data/user/0/com.frontwonder2/app_webview/Default/Cookies-journal

Filesize
1KB

MD5
bde9def1cef0859ed20b3e5ad782908d

SHA1
459c74fba362154f54608c8f032ea756656e5dc0

SHA256
3c27c080c040a3e7158e4fa0023eb0f958067541dd16e3a8a9e2ee84de9ebcf2

SHA512
dcb67d906a9cf9440d1b0638907e0a0bcc919a7dddf771a05594a561c7a0b5ea1c53a2ad7f12fd62298a20f6a5cadff52574babfd82b30db0c008b2753e87fd8

Download Submit
/data/user/0/com.frontwonder2/app_webview/Default/GPUCache/index

Filesize
48B

MD5
6d7d499960179766cd4261d12dacc411

SHA1
e6f8553b0015e12b23cc551afe98763f3b1c9bed

SHA256
c96ac03cfdbc6f4c1bdcdf764f1a6573f852e7aae5ef405969516b93ed271182

SHA512
6526c668477a01a850b8757b77dd3e7be27ad1991f5cf777685efcb03a21f31b71f6eae00f326931599baae4b16360e33e3d0f2894f1b2c1753391df02a14547

Download Submit
/data/user/0/com.frontwonder2/app_webview/Default/GPUCache/index-dir/temp-index

Filesize
96B

MD5
e0e761d9ff1d3f2ede82d671d03da047

SHA1
934bd1595c1872478a615c34fb3fcf7cb4078c51

SHA256
389a1a229398fa7cc7097c73cd7f395237e9f936fcf6ede3a4296b4cabf97948

SHA512
517914e434704de66906c4e4ac766a1236485e97bf2272afb15b6ffde517992737921183f4b2f0d890213fc4810903640fa162a078512d402cba91a77b74a72b

Download Submit
/data/user/0/com.frontwonder2/app_webview/Default/Web Data

Filesize
120KB

MD5
a48cd9324b1f8754b07f00d863b840f3

SHA1
11c6614775b35a58f440971dfc87c8aaac6d6173

SHA256
8859a216183793485d4699bf69d7ed96904679834188d07b9a70424d47eb1420

SHA512
35fa712f0af4a5eeed7e00e4e59ed5027dc6609d268462fe79d92043be9ae0c5961ce9e1d2f64b1a196c9b6aa6242b8b83817b3ee4c1058596c58a99c45478b1

Download Submit
/data/user/0/com.frontwonder2/app_webview/Default/Web Data-journal

Filesize
2KB

MD5
d13a8ad2fee7ce2e755b247920f4b5d5

SHA1
9bcbed231a2f7e8f4b1c71793a9346a00873c874

SHA256
91169c8197048447b487ac971280d614ee05d559e3936cc542a9d05547d54b0b

SHA512
47b15743209a17e53cf8da773237f3188d228e7312a69d122449c8fced9fd0274367ed4881a37289ac0005325fc043313b26471a1758dc0095e22cc0c1858fb4

Download Submit
/data/user/0/com.frontwonder2/app_webview/webview_data.lock

Filesize
22B

MD5
6a9dc26686acbc73290cc5e9a0b99cdd

SHA1
c55afd0681a1ece78ad9ef31bccc2b1e596437f4

SHA256
12079d69b28d144831981929147fd10132da8f1ff9c78c3fd39a3a0109489525

SHA512
3568d075ce4058a5cda78a9b1f8bc9da98b64458cc8de61d659ec38cd7bb765d6ac2439d6b333b8edd3987e8df782f397da1b92bdf5a9c872acdb5fc7e22dcf0

Download Submit
/data/user/0/com.frontwonder2/cache/WebView/Crashpad/settings.dat

Filesize
40B

MD5
51cea9169f427ea5ecc1d7dd64c5082a

SHA1
88d04eaf5bbb2cbc7813e1a7063c0fcb8707e388

SHA256
3df7484a1d7fd9540def0551dab91706a5f6c4daad60920f86318bcc62ef0e5e

SHA512
330059a8ddfdbfcadd2964917c470ea4a42fe88079fa36952f817906f7a78a794b4458f9adcaa2b1a3f8947832248f4f6eeaeea734b08bbb20dca1990673152e

Download Submit
/data/user/0/com.frontwonder2/cache/WebView/Default/HTTP Cache/Code Cache/js/index

Filesize
48B

MD5
6d7d499960179766cd4261d12dacc411

SHA1
e6f8553b0015e12b23cc551afe98763f3b1c9bed

SHA256
c96ac03cfdbc6f4c1bdcdf764f1a6573f852e7aae5ef405969516b93ed271182

SHA512
6526c668477a01a850b8757b77dd3e7be27ad1991f5cf777685efcb03a21f31b71f6eae00f326931599baae4b16360e33e3d0f2894f1b2c1753391df02a14547

Download Submit
/data/user/0/com.frontwonder2/cache/WebView/Default/HTTP Cache/Code Cache/js/index-dir/temp-index

Filesize
96B

MD5
450fb7278fc170203d7ce82feee7b121

SHA1
fefe7f8107c53b067d9279a40cb9c17ab2d3179b

SHA256
8d3b70bb796f9802835dae76958dab7c4a5247fb44d64b1c767925200aae0592

SHA512
1da436a69da0f30efbd40a3b316fbae7a13b659059e71ed09673ab533094e98ae8f5006ef71e63d60b2e8fa015c6fb91213e9f139832261c3f2061346f243b90

Download Submit
/data/user/0/com.frontwonder2/cache/WebView/Default/HTTP Cache/Code Cache/wasm/index

Filesize
48B

MD5
6d7d499960179766cd4261d12dacc411

SHA1
e6f8553b0015e12b23cc551afe98763f3b1c9bed

SHA256
c96ac03cfdbc6f4c1bdcdf764f1a6573f852e7aae5ef405969516b93ed271182

SHA512
6526c668477a01a850b8757b77dd3e7be27ad1991f5cf777685efcb03a21f31b71f6eae00f326931599baae4b16360e33e3d0f2894f1b2c1753391df02a14547

Download Submit
/data/user/0/com.frontwonder2/cache/WebView/Default/HTTP Cache/Code Cache/wasm/index-dir/temp-index

Filesize
96B

MD5
0678a6f15d3daf6a0be4b96e86ebb698

SHA1
f218891a23fbf1a40699e5846954097a811f88de

SHA256
633be98e4817b63b1ec34d72742c78f5ab27bc3611d0eedbfa2aa56fe39b5871

SHA512
36ea83a6da67e0d269148e678f9d0c406e2ba63d4fbb0e64a7e55a5fb6dd6e6f699ce720a115d48cb1a280a5ab9d81416d1a462e91a8661f728787c375747835

Download Submit
/data/user/0/com.frontwonder2/cache/WebView/Default/HTTP Cache/b0a02b365a6162e1_0

Filesize
458B

MD5
3020f28ef892c94024b789cdab593a53

SHA1
57b6f8740eab25b833e1c051033676f42021b21b

SHA256
8e93a629948b93e419681529b966c22f249e3d4c559dd726c97c7e81afad80cd

SHA512
7795ecb1a597b262fa643cc3aee988aca5a6669a526e054c32b8e3169639610695d1b2bcfcd00351b63992c16a2b1e021861028e2be1ad9fbcc21cee33a659f2

Download Submit
/data/user/0/com.frontwonder2/cache/WebView/Default/HTTP Cache/index

Filesize
48B

MD5
6d7d499960179766cd4261d12dacc411

SHA1
e6f8553b0015e12b23cc551afe98763f3b1c9bed

SHA256
c96ac03cfdbc6f4c1bdcdf764f1a6573f852e7aae5ef405969516b93ed271182

SHA512
6526c668477a01a850b8757b77dd3e7be27ad1991f5cf777685efcb03a21f31b71f6eae00f326931599baae4b16360e33e3d0f2894f1b2c1753391df02a14547

Download Submit
/data/user/0/com.frontwonder2/cache/WebView/Default/HTTP Cache/index-dir/temp-index

Filesize
144B

MD5
4ab362730f71ff93044f6abe4ee4bb13

SHA1
cac03e7d97dc04c41676f468309436aaa475fa62

SHA256
5a3d6ed6123ef0a38f8b8ffbb1721a628759e6dfb5279c99cd5257e8c5658441

SHA512
1ff48f8f351fa0d344bc4891fc11a42f93777d63b79ab20899d0c8f665df3c75be0f7202da417d79d81b9143752e9d30ed3ab371982afffe518c2fde84ad8a8c

Download Submit
/data/user/0/com.frontwonder2/cache/WebView/Default/HTTP Cache/index-dir/temp-index

Filesize
96B

MD5
41dff0cc622ded2c53fd74530623a09e

SHA1
50f5a2749a40c119d0f126a3f703ca5f16f9a494

SHA256
aef2097790d5dc2cfdc1ffc753dce2ac4f8fdbd79f265bb137cadd4d00dc1f30

SHA512
46a0aa6a4f21b7eb97be979e734e08b2d6fe570cb2adeaa57f529d84f1f4a82cdeac3e73af52c7639e5491f341fcc9aeb3f83e1b715b92bc48976d622bcbfac6

Download Submit
/data/user/0/com.frontwonder2/cache/WebView/font_unique_name_table.pb

Filesize
57KB

MD5
f080fa2a56ab5479d58063e5ea871447

SHA1
4b3fd57a98916fa5784305b76ba30af26b5253d9

SHA256
0aa374bc456330fd1b5daf18d25b4bb8e2df1998dfa85466f2c31843ff56e815

SHA512
8aee3186a95b389d39882620b7c4199a29aa50580aa98a381b2931a934de6406943c89d4d00ebeabff21e2b03b4a4adcc01e37e32a2335c4838be24bdbf61936

Download Submit
/data/user/0/com.frontwonder2/cache/entczqpw

Filesize
155KB

MD5
20ffa38d89d8f8f884bb9e936e614334

SHA1
cc7af211bcdfa8f57f6156de83e4c35c94791e89

SHA256
d2ed55a694a29213ef3f03b879e5b4a60174fd1de31530fded93b0425c7d8248

SHA512
29a811b4e66e3dae39ff14a3f9d3735aae2e39fe34e200a1dca880699cb8461fd71a832a3d03df39709bf1cd7d2d13fbb9b5a4c438e1afbf4b2bf51e51f7a677

Download Submit
/data/user/0/com.frontwonder2/cache/entczqpw

Filesize
155KB

MD5
20ffa38d89d8f8f884bb9e936e614334

SHA1
cc7af211bcdfa8f57f6156de83e4c35c94791e89

SHA256
d2ed55a694a29213ef3f03b879e5b4a60174fd1de31530fded93b0425c7d8248

SHA512
29a811b4e66e3dae39ff14a3f9d3735aae2e39fe34e200a1dca880699cb8461fd71a832a3d03df39709bf1cd7d2d13fbb9b5a4c438e1afbf4b2bf51e51f7a677

Download Submit
/data/user/0/com.frontwonder2/cache/entczqpw

Filesize
155KB

MD5
20ffa38d89d8f8f884bb9e936e614334

SHA1
cc7af211bcdfa8f57f6156de83e4c35c94791e89

SHA256
d2ed55a694a29213ef3f03b879e5b4a60174fd1de31530fded93b0425c7d8248

SHA512
29a811b4e66e3dae39ff14a3f9d3735aae2e39fe34e200a1dca880699cb8461fd71a832a3d03df39709bf1cd7d2d13fbb9b5a4c438e1afbf4b2bf51e51f7a677

Download Submit
/data/user/0/com.frontwonder2/shared_prefs/WebViewChromiumPrefs.xml

Filesize
127B

MD5
97ccd9a2b2063143df56b6937f961ca4

SHA1
5e78a91ae5df289ce83443cb7d5589dd3504fb5d

SHA256
248ff7928128015b1cfe3e6517c8f9b8c9511bfb8c8baf44fc1370640eac61fd

SHA512
86c05a5bb3d7eedea390664796966e9e5a5bf846c85808da54407788a76b3ee25b91428242a1e76d8765bfe51e1ba3636617fbab6e7dbb39fcc433e07c3fcd3b

Download Submit