Analysis

  • max time kernel
    1627957s
  • max time network
    167s
  • platform
    android_x64
  • resource
    android-x64-20220310-en
  • submitted
    14-06-2022 07:03

General

  • Target

    d518a26b3d98d4a8e1c0552e38da9bd70b43d626cfec71c831c1ad5314c69685.apk

  • Size

    1.4MB

  • MD5

    318a13b57c37c485cbb3a7ca8067f21f

  • SHA1

    136a1bf821a9af5ba6b658bacd27580b3c3988df

  • SHA256

    d518a26b3d98d4a8e1c0552e38da9bd70b43d626cfec71c831c1ad5314c69685

  • SHA512

    e53e37fcddbe6ec3947d0239933b36aaa7ccb1b71fbe3c02e37202191f9d5629f850d2e02a45788b2a63b5732d2abd664876a881eb4286ae141ce0b57af3a1a3

Malware Config

Extracted

Family

octo

C2

https://ifn1h8ag1g.com/MWNhMjI2OTkyNjA3/

https://irha3wzuu.top/MWNhMjI2OTkyNjA3/

https://uhnazu3au.top/MWNhMjI2OTkyNjA3/

https://hbaruuau3h.top/MWNhMjI2OTkyNjA3/

https://8ibaub3bav.com/MWNhMjI2OTkyNjA3/

https://ifua88ahahgh.com/MWNhMjI2OTkyNjA3/

https://utabwbazuu.com/MWNhMjI2OTkyNjA3/

AES_key

Signatures

  • Octo

    Octo is a banking malware with remote access capabilities first seen in April 2022.

  • Octo is a banking malware with remote access capabilities first seen in April 2022 3 IoCs
  • Loads dropped Dex/Jar 2 IoCs

    Runs executable file dropped to the device during analysis.

  • Reads information about phone network operator.
  • Uses Crypto APIs (Might try to encrypt user data). 1 IoCs

Processes

  • com.carbuildz
    1⤵
    • Loads dropped Dex/Jar
    • Uses Crypto APIs (Might try to encrypt user data).
    PID:6090

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • /data/user/0/com.carbuildz/app_webview/.com.google.Chrome.H2ISn4

    MD5

    d41d8cd98f00b204e9800998ecf8427e

    SHA1

    da39a3ee5e6b4b0d3255bfef95601890afd80709

    SHA256

    e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

    SHA512

    cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

  • /data/user/0/com.carbuildz/app_webview/Cookies

    Filesize

    64KB

    MD5

    9b23e6a88d5a95f155f205cb04b93cd0

    SHA1

    b62dccbbef087a0731f226b96d15d35d8aa5e5fc

    SHA256

    f2f3c3c0c7f085399a6f9a464c1ac30a59ceeb5a4b7026286fa5609e6e8ef857

    SHA512

    bce5f25d98e2e8296c4101b62082dcb6a43902f3431ff6f725e41be6b9aece76e887ef94c4818baf4da845708fd76fd51c37fb6915710c870647593868f27482

  • /data/user/0/com.carbuildz/app_webview/Cookies-journal

    Filesize

    1KB

    MD5

    96dcc84102bf55dba7138069750891b9

    SHA1

    a3edbbbbf8459f9943d5dcdc3e4e553d89491385

    SHA256

    49065d6e67811b7be738ee1d0befbda590d460a1c3d53c77a455afd9afa5189d

    SHA512

    115b36302bacc51466e41a61e841ce8c247e387ed9a14ac75d9621ed8928ffecea84de71de7165b82033bff856ebf84e496918bd3d2130a10019271c83434c00

  • /data/user/0/com.carbuildz/app_webview/GPUCache/index

    Filesize

    48B

    MD5

    6d7d499960179766cd4261d12dacc411

    SHA1

    e6f8553b0015e12b23cc551afe98763f3b1c9bed

    SHA256

    c96ac03cfdbc6f4c1bdcdf764f1a6573f852e7aae5ef405969516b93ed271182

    SHA512

    6526c668477a01a850b8757b77dd3e7be27ad1991f5cf777685efcb03a21f31b71f6eae00f326931599baae4b16360e33e3d0f2894f1b2c1753391df02a14547

  • /data/user/0/com.carbuildz/app_webview/GPUCache/index-dir/temp-index

    Filesize

    96B

    MD5

    eff71a537696e1001bfd4a20618138aa

    SHA1

    45cf5366cebfa61d6c2b56522a62ae95e44132ab

    SHA256

    3ecc5466cb13af324e40430b38ded4bde38ea5ab5e3830dc97ff267b39ba3714

    SHA512

    21d5cc994917575015b9ff6d281da1c680a4a0298a4d042a149576a18e72ebf54985262c3ff0a7ba4dfd459ef1710fccff59a3f764fd6e52a89afcc25460f241

  • /data/user/0/com.carbuildz/app_webview/Web Data

    Filesize

    112KB

    MD5

    b663831f8cc130493476d94f2d7a5330

    SHA1

    043a1956ab8e40821d67043f8a9110a8eb36fb93

    SHA256

    c109aa8bfc364d5fd0756f1c9d35ee3d6df31325061ac70d8469f28cfc882ab7

    SHA512

    e8ee923192cdf16318febdc23362f3eeaf5c914b923f80cd3a91a2e83e94bced54460d4ef1e54accc26a7d54b89e2e10c00097e60002cf6427298dc5f18fed16

  • /data/user/0/com.carbuildz/app_webview/Web Data-journal

    Filesize

    1KB

    MD5

    8462b356e402833738ddbab221cae6d0

    SHA1

    27ca4a1faf6125da2201fddf1c900688060bc42a

    SHA256

    4336fd2cb743fc00783bf9240de817a340f522897b9fb0c15995cf95601572d9

    SHA512

    ab0f55b4ba67eeaf1888a1dcd325623ff2bb68bd987346b80a94cae16b12b25268828885592c710f02363be7fe36ca9ff678a17347f4c1571b5b6f8a310b9013

  • /data/user/0/com.carbuildz/app_webview/metrics_guid

    MD5

    d41d8cd98f00b204e9800998ecf8427e

    SHA1

    da39a3ee5e6b4b0d3255bfef95601890afd80709

    SHA256

    e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

    SHA512

    cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

  • /data/user/0/com.carbuildz/app_webview/metrics_guid

    Filesize

    36B

    MD5

    a12a263104979057ae9dbb40d83b59e8

    SHA1

    026730c58d7a6b472ab8884fe6d819be659eacdd

    SHA256

    6526f61e629288462636e9f31fd16ac3244a1c261667d027d8c6ffbd90e12bad

    SHA512

    592aa57d52029198dd8a6d10d01c89c3921bf6d3aa77261323ed7e3bf2950b2e2ee225a56877a1898a043cc52f820a06d506625ab3e9dde81c70219049e1c8b0

  • /data/user/0/com.carbuildz/app_webview/variations_seed_new

    MD5

    d41d8cd98f00b204e9800998ecf8427e

    SHA1

    da39a3ee5e6b4b0d3255bfef95601890afd80709

    SHA256

    e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

    SHA512

    cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

  • /data/user/0/com.carbuildz/app_webview/variations_stamp

    MD5

    d41d8cd98f00b204e9800998ecf8427e

    SHA1

    da39a3ee5e6b4b0d3255bfef95601890afd80709

    SHA256

    e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

    SHA512

    cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

  • /data/user/0/com.carbuildz/app_webview/webview_data.lock

    MD5

    d41d8cd98f00b204e9800998ecf8427e

    SHA1

    da39a3ee5e6b4b0d3255bfef95601890afd80709

    SHA256

    e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

    SHA512

    cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

  • /data/user/0/com.carbuildz/cache/WebView/Crashpad/settings.dat

    Filesize

    40B

    MD5

    e324ac48b206d0d56b7f4d41c8321b54

    SHA1

    1fa42c71c974f5d718e7137ddeb8ea585d0be143

    SHA256

    57a88b8ff0cfdb2d8a0b3f18db1a30713aa53fb0e66b9ae945dc5ace5a91d57e

    SHA512

    4dd81fc9e788e2536c69af81e2ff43bfbf33a85571a89902798ab34e436fb6993e0845b74c0e9e607bba73fdd1086a187e3000d1056d75d2f4bc263825a8b525

  • /data/user/0/com.carbuildz/cache/jysuptjbirvg

    Filesize

    156KB

    MD5

    5f360e5de48ea3f08b07a100a55a066e

    SHA1

    56047f76955d6014c1148b39e7fb5b61fcf2b7fd

    SHA256

    9763b6cf87f2e07691ae2d699fbdf0298c33c91d522103bb03ddfd57fffbbe94

    SHA512

    9557e1267b0db0393859e9811d9e1afd91f20a6e2ce51e3ce605091e5fbd9d824938a527b9b7b83863041a7a49976beec794efc8cfada93797f79e954c5b0e26

  • /data/user/0/com.carbuildz/cache/jysuptjbirvg

    Filesize

    156KB

    MD5

    5f360e5de48ea3f08b07a100a55a066e

    SHA1

    56047f76955d6014c1148b39e7fb5b61fcf2b7fd

    SHA256

    9763b6cf87f2e07691ae2d699fbdf0298c33c91d522103bb03ddfd57fffbbe94

    SHA512

    9557e1267b0db0393859e9811d9e1afd91f20a6e2ce51e3ce605091e5fbd9d824938a527b9b7b83863041a7a49976beec794efc8cfada93797f79e954c5b0e26

  • /data/user/0/com.carbuildz/cache/jysuptjbirvg

    Filesize

    156KB

    MD5

    5f360e5de48ea3f08b07a100a55a066e

    SHA1

    56047f76955d6014c1148b39e7fb5b61fcf2b7fd

    SHA256

    9763b6cf87f2e07691ae2d699fbdf0298c33c91d522103bb03ddfd57fffbbe94

    SHA512

    9557e1267b0db0393859e9811d9e1afd91f20a6e2ce51e3ce605091e5fbd9d824938a527b9b7b83863041a7a49976beec794efc8cfada93797f79e954c5b0e26

  • /data/user/0/com.carbuildz/cache/oat/jysuptjbirvg.cur.prof

    MD5

    d41d8cd98f00b204e9800998ecf8427e

    SHA1

    da39a3ee5e6b4b0d3255bfef95601890afd80709

    SHA256

    e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

    SHA512

    cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

  • /data/user/0/com.carbuildz/cache/org.chromium.android_webview/1b7e12e5f2979175_0

    Filesize

    452B

    MD5

    ccb2f81aa164b6bb8e746afdf75e05fd

    SHA1

    4cf015a7952a8e030deb67b4650460a30b88c4ed

    SHA256

    bacb30538a0d7ae1a1ef985533ea2e52191889af9089c69980858539ee08fd6b

    SHA512

    091cd5b478f809d9fd7d560ff30fd864d269a838b795794122d13f32b430ae326211cb68310a32462035c3a7c2eab6b1d54c9d85023c3e737696320718dfe616

  • /data/user/0/com.carbuildz/cache/org.chromium.android_webview/Code Cache/js/index

    Filesize

    48B

    MD5

    6d7d499960179766cd4261d12dacc411

    SHA1

    e6f8553b0015e12b23cc551afe98763f3b1c9bed

    SHA256

    c96ac03cfdbc6f4c1bdcdf764f1a6573f852e7aae5ef405969516b93ed271182

    SHA512

    6526c668477a01a850b8757b77dd3e7be27ad1991f5cf777685efcb03a21f31b71f6eae00f326931599baae4b16360e33e3d0f2894f1b2c1753391df02a14547

  • /data/user/0/com.carbuildz/cache/org.chromium.android_webview/Code Cache/js/index-dir/temp-index

    Filesize

    96B

    MD5

    81ae7c35b5e8bdd548851324fe65eeb1

    SHA1

    116f4520d702acc461abe845f855964c43ff0795

    SHA256

    8d0e614602cb17c8868763c5b8c38bd895289754b708c4274015299da4a09ad6

    SHA512

    5780b9247836a2113b94199bab7d575ba3a37ce17e4b625b080cf0c311a927a223faa80f9a5428466d641165c7b5c1bdbab5eb278d470a1f4aa7dfb9431a815b

  • /data/user/0/com.carbuildz/cache/org.chromium.android_webview/index

    Filesize

    48B

    MD5

    6d7d499960179766cd4261d12dacc411

    SHA1

    e6f8553b0015e12b23cc551afe98763f3b1c9bed

    SHA256

    c96ac03cfdbc6f4c1bdcdf764f1a6573f852e7aae5ef405969516b93ed271182

    SHA512

    6526c668477a01a850b8757b77dd3e7be27ad1991f5cf777685efcb03a21f31b71f6eae00f326931599baae4b16360e33e3d0f2894f1b2c1753391df02a14547

  • /data/user/0/com.carbuildz/cache/org.chromium.android_webview/index-dir/temp-index

    Filesize

    96B

    MD5

    76c6cfcd54f9a729aaf97e1435c9e636

    SHA1

    22a5147124b18021d450c762233dcb2b3aceaf3f

    SHA256

    c3d8b37be1e8ab0869466ba9d8af9dcdd4d91b296cffe0f0bf3b1204e3f04a58

    SHA512

    6c8895595482025695d8d5bf4a35caa080eadfc9e0f285274d43d0227328ec77906e140bdee4df7a43333591bd7cb4ef1f046f5bf43de6aac0bc0e172cc4782a

  • /data/user/0/com.carbuildz/cache/org.chromium.android_webview/index-dir/temp-index

    Filesize

    96B

    MD5

    82633569a507f149742f1719226f0fbf

    SHA1

    4b2120c30098597336c5ed07e38c3700d28f1956

    SHA256

    eee89cdf1736ef3e6edd03840e3ec8c474896bd5d94fbb6fd0028748cb8e71ac

    SHA512

    2d96ba5471bc97877998f02d926b8d60c3280cf46c804e0edc06da71a49b115d41ecef982da90d3f71d7096674e62666738cab74e62b85ab9c84e1189f51a354

  • /data/user/0/com.carbuildz/shared_prefs/WebViewChromiumPrefs.xml

    Filesize

    127B

    MD5

    6ef709b8536878951e87c29a1518fc2b

    SHA1

    24376c70b00152501b3d98df61fa7db435339172

    SHA256

    10b13d894f36d4391fcc31313a244d5f6cd89c8e8c03347282e281c4af13c0a6

    SHA512

    96547eff6779251a5c4941e812ec56ed273e9270265005723e1f2864688b04f3b852a90145fba4ea0ddf1e02b39d99e33d28f761b07a04d46e0e4257d8909ff9