octo | d518a26b3d98d4a8e1c0552e38da9bd70b43d626cfec71c831c1ad5314c69685

Analysis

max time kernel
1627841s
max time network
47s
platform
android_x86
resource
android-x86-arm-20220310-en
submitted
14-06-2022 07:03

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

d518a26b3d98d4a8e1c0552e38da9bd70b43d626cfec71c831c1ad5314c69685.apk
Size

1.4MB
MD5

318a13b57c37c485cbb3a7ca8067f21f
SHA1

136a1bf821a9af5ba6b658bacd27580b3c3988df
SHA256

d518a26b3d98d4a8e1c0552e38da9bd70b43d626cfec71c831c1ad5314c69685
SHA512

e53e37fcddbe6ec3947d0239933b36aaa7ccb1b71fbe3c02e37202191f9d5629f850d2e02a45788b2a63b5732d2abd664876a881eb4286ae141ce0b57af3a1a3

Score

10^/10

octo banker evasion infostealer ransomware rat trojan

Malware Config

Extracted

Family

octo

https://ifn1h8ag1g.com/MWNhMjI2OTkyNjA3/

https://irha3wzuu.top/MWNhMjI2OTkyNjA3/

https://uhnazu3au.top/MWNhMjI2OTkyNjA3/

https://hbaruuau3h.top/MWNhMjI2OTkyNjA3/

https://8ibaub3bav.com/MWNhMjI2OTkyNjA3/

https://ifua88ahahgh.com/MWNhMjI2OTkyNjA3/

https://utabwbazuu.com/MWNhMjI2OTkyNjA3/

AES_key

Signatures

Octo
Octo is a banking malware with remote access capabilities first seen in April 2022.
banker trojan infostealer rat octo

Octo is a banking malware with remote access capabilities first seen in April 2022 3 IoCs

resource	yara_rule
behavioral1/files/5082-0.dat	family_octo
behavioral1/memory/5082-0.dex	family_octo
behavioral1/memory/5082-1.dex	family_octo

Makes use of the framework's Accessibility service. 1 IoCs

description	ioc	Process
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId	com.carbuildz

Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps). 1 IoCs

banker

description	ioc	Process
Framework service call	android.content.pm.IPackageManager.getInstalledApplications	com.carbuildz

Acquires the wake lock. 1 IoCs

description	ioc	Process
Framework service call	android.os.IPowerManager.acquireWakeLock	com.carbuildz

Loads dropped Dex/Jar 2 IoCs

Runs executable file dropped to the device during analysis.

ioc	pid	Process
/data/user/0/com.carbuildz/cache/jysuptjbirvg	5082	com.carbuildz
/data/user/0/com.carbuildz/cache/jysuptjbirvg	5082	com.carbuildz

Reads information about phone network operator.

Removes a system notification. 1 IoCs

evasion

description	ioc	Process
Framework service call	android.app.INotificationManager.cancelNotificationWithTag	com.carbuildz

Uses Crypto APIs (Might try to encrypt user data). 1 IoCs

ransomware

description	ioc	Process
Framework API call	javax.crypto.Cipher.doFinal	com.carbuildz

com.carbuildz
1⤵
- Makes use of the framework's Accessibility service.
- Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps).
- Acquires the wake lock.
- Loads dropped Dex/Jar
- Removes a system notification.
- Uses Crypto APIs (Might try to encrypt user data).
PID:5082

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

/data/user/0/com.carbuildz/app_webview/Cookies

Filesize
64KB

MD5
cb7543c4df600f2af58097cce0e334ba

SHA1
83cc92f38c27fdb4fa519b1ce2f37912f24af1f0

SHA256
64c022ae708f94ffde986e105d88f708884de325720bfb9925c4160a6d417233

SHA512
ad51cad0472327bd68aa2d791341cfafed58971752352537bb603ed18b15a3f9185e9150983a28ecd09606e8dcaef6d1c9d93213dd246ef7720f39842eb3d980

Download Submit
/data/user/0/com.carbuildz/app_webview/Cookies-journal

Filesize
1KB

MD5
0e81d01caa69e8a8505ddd7c5935fd93

SHA1
aa1afbec090d471b2dbd65ac5ef43a433fe493b5

SHA256
d3d0d4475a8137823e8088dbeeae65cb7425ea852a8486b0026b8df2fa167e37

SHA512
1988e748a62c8f5f21e5b3472aaa8bfc5cbd331670f9ffa6ae34959d73530c163f78f7fd05d99ec84d9867dfd412f6c7987a1c10ebb4047861dbdbb9be7492ac

Download Submit
/data/user/0/com.carbuildz/app_webview/GPUCache/index

Filesize
20B

MD5
93027d42b314432c4216e6cfca48b384

SHA1
43448dd8102979c3926828182579691945eedd4e

SHA256
3cda72e67c62e52a342309c44f2cb3b6c1019c7b11822e2f628e48e254e2b41c

SHA512
a52d13cf7f5be196d1e2f135b8a010f80558c5d35e90e7792441d1c976517d55cf1c9587949db69ebef294cc6ef79529a65e7d779964793016efecacd152f70e

Download Submit
/data/user/0/com.carbuildz/app_webview/GPUCache/index-dir/temp-index

Filesize
48B

MD5
054cc4439f80a56b052fc8eef8482e1a

SHA1
0760b7cc68d16fa55ec5ca65c5dc9ded1dc6f628

SHA256
c9b81b8a6c86c70509b12df4da1d636272257c54dac80c49116d00dfd69d8ab8

SHA512
88d93cf3d14e0d06da66cb1104c858394964062af3ffb3c138fe763ed297068af92a61ffc08cf4b38642e231474ddc70234e679e6eb3acadd32ff3a64c786155

Download Submit
/data/user/0/com.carbuildz/app_webview/Web Data

Filesize
104KB

MD5
dc79f9ce5f3ab5270b33e61119dfc959

SHA1
1844bf222a5144b513dcf2fb50a18c011701c647

SHA256
47e65f4de08deabfd52ecdb8b0a29c61c482188b92c36182e2112ca0a8f4ff65

SHA512
18b8894a7f35df516f423bbdebf1e05ce09eaf4345b139e59e603cadb81f8d1fa20f793438c28e8fd9a64e64f0684223d90ce6f10d3f93cb0c781049a8cff03e

Download Submit
/data/user/0/com.carbuildz/app_webview/Web Data-journal

Filesize
1KB

MD5
efd6549055d672c9dce549f4e6e558cf

SHA1
138079f8293d277c3b681ba51e288ea59f530048

SHA256
abd92e95ac1faaefe46b8aa94e1eefe2279c97d0d5794bb2957d266397bb25f9

SHA512
e9e26efbd28f99ce6f7eb31b1474352f3b0a1f3a8a293b242485ea0039f12e3c447ee9b27460e228928446bfc0162bf84fa6e0307e56d4506799af2133f952ed

Download Submit
/data/user/0/com.carbuildz/app_webview/metrics_guid

Filesize
36B

MD5
71d56ca55f3dc1662d7c70069a469c33

SHA1
d5eac7c842b838d2836c519e4d4a139a7e2be68b

SHA256
0b158bc0a323468ec47089b3df5355018cbad65ede109a8bac627b72219a170f

SHA512
4d9451e55ae3627530b4e2ee3f5c315c66292bab9cf5ab6b69c1fa78788fb4c01504e6293c9d3e005636ad3ab963ac8449a91a3349bb49fdd438b76544963784

Download Submit
/data/user/0/com.carbuildz/cache/jysuptjbirvg

Filesize
156KB

MD5
5f360e5de48ea3f08b07a100a55a066e

SHA1
56047f76955d6014c1148b39e7fb5b61fcf2b7fd

SHA256
9763b6cf87f2e07691ae2d699fbdf0298c33c91d522103bb03ddfd57fffbbe94

SHA512
9557e1267b0db0393859e9811d9e1afd91f20a6e2ce51e3ce605091e5fbd9d824938a527b9b7b83863041a7a49976beec794efc8cfada93797f79e954c5b0e26

Download Submit
/data/user/0/com.carbuildz/cache/jysuptjbirvg

Filesize
156KB

MD5
5f360e5de48ea3f08b07a100a55a066e

SHA1
56047f76955d6014c1148b39e7fb5b61fcf2b7fd

SHA256
9763b6cf87f2e07691ae2d699fbdf0298c33c91d522103bb03ddfd57fffbbe94

SHA512
9557e1267b0db0393859e9811d9e1afd91f20a6e2ce51e3ce605091e5fbd9d824938a527b9b7b83863041a7a49976beec794efc8cfada93797f79e954c5b0e26

Download Submit
/data/user/0/com.carbuildz/cache/jysuptjbirvg

Filesize
156KB

MD5
5f360e5de48ea3f08b07a100a55a066e

SHA1
56047f76955d6014c1148b39e7fb5b61fcf2b7fd

SHA256
9763b6cf87f2e07691ae2d699fbdf0298c33c91d522103bb03ddfd57fffbbe94

SHA512
9557e1267b0db0393859e9811d9e1afd91f20a6e2ce51e3ce605091e5fbd9d824938a527b9b7b83863041a7a49976beec794efc8cfada93797f79e954c5b0e26

Download Submit
/data/user/0/com.carbuildz/cache/org.chromium.android_webview/1b7e12e5f2979175_0

Filesize
214B

MD5
f6ce97668d71ddd92eccc66ca3438fd2

SHA1
f679bde8e373474cf0a5bc17c139b34a78a3ed47

SHA256
edb70e31297db1a5e446622dcc1467653f02dc052c91dea5b68f13fda6a0d854

SHA512
28b0a5f17cbd03752c5e87eb60b6c80c60f6e036f465b4a41318c48b3d73cbcc99acae7d5a0ad59bb10dcd4141e8264f85a17cc032002ec17496b610ce01831d

Download Submit
/data/user/0/com.carbuildz/cache/org.chromium.android_webview/index

Filesize
20B

MD5
93027d42b314432c4216e6cfca48b384

SHA1
43448dd8102979c3926828182579691945eedd4e

SHA256
3cda72e67c62e52a342309c44f2cb3b6c1019c7b11822e2f628e48e254e2b41c

SHA512
a52d13cf7f5be196d1e2f135b8a010f80558c5d35e90e7792441d1c976517d55cf1c9587949db69ebef294cc6ef79529a65e7d779964793016efecacd152f70e

Download Submit
/data/user/0/com.carbuildz/cache/org.chromium.android_webview/index-dir/temp-index

Filesize
48B

MD5
932e7d9f92ccee9f599c3c3d04dbf7df

SHA1
af7705b0181c4401b0222d9e0e57159c1539de32

SHA256
ebc49c173f79bfb3bd1aafee85b2895a2f684d2910a7d9c8a9656fba4dea70c9

SHA512
fd6cf0ce6172f14562464df34ea90d211bb150f60802cb1bfbe68e4850e5964b2cc6974d23147c60d686b4ae0137e8cc52257b875b079fdd7fa40a02cf088db2

Download Submit
/data/user/0/com.carbuildz/cache/org.chromium.android_webview/index-dir/temp-index

Filesize
48B

MD5
e5f8607f7a8e57abb7b63f5e381152be

SHA1
0cc572c40af074be051132b8baeda008be6b6811

SHA256
48e9ba554b7c09d642f64062bbae8981e898558be3f185ea9dffd4e6cfb4aaab

SHA512
bb8a7fed02d020a6f73f56f14bed8d14223078122947d9d4c86946a8f718c9c62936a0f2efaca8716b59fdfe01e74d5dc8e396d3cc5f71e14e7f4435fffc6864

Download Submit
/data/user/0/com.carbuildz/shared_prefs/WebViewChromiumPrefs.xml

Filesize
127B

MD5
21223e9184445fe043476484cd8cb1f9

SHA1
2b4813f849121d60ba35eb0889080668bb62c778

SHA256
bb61b7c087c2ae2de93a7740ff75707342940557146366e92b840284cd9446af

SHA512
be21408de0cc643650e5d9ab9057a8f9de88e37fbdc6417cfeba160402ec4cd14fccbc82cbbfd941ecfc0bb3d4056ee61ac199efdc99d647d53e65818835fd48

Download Submit