Overview

overview

10

Static

static

7

GooglePlay.apk

android-9-x86

10

GooglePlay.apk

android-10-x64

10

Analysis

  • max time kernel
    2801150s
  • max time network
    132s
  • platform
    android_x86
  • resource
    android-x86-arm-20220823-en
  • submitted
    24-11-2022 01:05

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    GooglePlay.apk

  • Size

    530KB

  • MD5

    fccad586a06a044704de138b30229b5d

  • SHA1

    50d4af7d8bbd6ad02bf708173ba115497d626549

  • SHA256

    610ebf1037134ef4be64c44846428e71ce30b51aa13a14c459f978531f09722c

  • SHA512

    6c54238e53ed23aaf0d84d9dad01d16e8a097e0fe5d63de1b9a653cb8e1be0498b060508fdc32569fd2eebc48a00d199d30fb174ad00728f362b0e860b2a8caa

  • SSDEEP

    12288:m0x6FtyhgGaZjf7JaRdmXyVgqQpmYwZ1W6AvOH2LaMPIXv:mLypa5tJiqmyFRLgv

Score
10/10
octobankerevasioninfostealerransomwarerattrojan

Malware Config

Extracted

Family

octo

C2

https://24fdghhoo1.top/doc/

https://25fdghhoo1.top/doc/

https://26fdghhoo1.top/doc/

https://27fdghhoo1.top/doc/

https://28fdghhoo1.top/doc/

https://29fdghhoo1.top/doc/

https://210fdghhoo1.top/doc/

https://211fdghhoo1.top/doc/

https://122fdghhoo1.top/doc/

https://123fdghhoo1.top/doc/

https://124fdghhoo1.top/doc/

https://125fdghhoo1.top/doc/

https://126fdghhoo1.top/doc/

https://127fdghhoo1.top/doc/

https://128fdghhoo1.top/doc/

https://129fdghhoo1.top/doc/

https://220fdghhoo1.top/doc/

https://234fdghhoo1.top/doc/

https://235fdghhoo1.top/doc/

https://236fdghhoo1.top/doc/
AES_key

Signatures

  • Octo

    Octo is a banking malware with remote access capabilities first seen in April 2022.

    bankertrojaninfostealerratocto
  • Octo payload 3 IoCs
  • Makes use of the framework's Accessibility service. 1 IoCs
  • Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps). 1 IoCs
    banker
  • Acquires the wake lock. 1 IoCs
  • Loads dropped Dex/Jar 2 IoCs

    Runs executable file dropped to the device during analysis.

  • Reads information about phone network operator.
  • Requests disabling of battery optimizations (often used to enable hiding in the background). 1 IoCs
    evasion
  • Removes a system notification. 1 IoCs
    evasion
  • Uses Crypto APIs (Might try to encrypt user data). 1 IoCs
    ransomware

Processes

  • com.watchandlr
    1⤵
    • Makes use of the framework's Accessibility service.
    • Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps).
    • Acquires the wake lock.
    • Loads dropped Dex/Jar
    • Requests disabling of battery optimizations (often used to enable hiding in the background).
    • Removes a system notification.
    • Uses Crypto APIs (Might try to encrypt user data).
    PID:4020

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • /data/user/0/com.watchandlr/app_webview/GPUCache/index
    Filesize

    20B

    MD5

    93027d42b314432c4216e6cfca48b384

    SHA1

    43448dd8102979c3926828182579691945eedd4e

    SHA256

    3cda72e67c62e52a342309c44f2cb3b6c1019c7b11822e2f628e48e254e2b41c

    SHA512

    a52d13cf7f5be196d1e2f135b8a010f80558c5d35e90e7792441d1c976517d55cf1c9587949db69ebef294cc6ef79529a65e7d779964793016efecacd152f70e

    Download Submit

  • /data/user/0/com.watchandlr/app_webview/GPUCache/index-dir/temp-index
    Filesize

    48B

    MD5

    e9d1b31c15e4194dbe358fe971f323dc

    SHA1

    bc69abc16b9f41332f52a88857edba76d6a7ca0d

    SHA256

    003ed245d17792fdd64249140503e0032901d3bccac11bd976158919c15a47bc

    SHA512

    6b89e527e5d05692cd095b74c36ae1c4c49c53f88948864cbca7543ae37684708c02874f4309712e3dd1dd8f6b5fe02d12f3659cd9d9cb550ee5abbab3c35d8a

    Download Submit

  • /data/user/0/com.watchandlr/app_webview/Web Data
    Filesize

    104KB

    MD5

    dc79f9ce5f3ab5270b33e61119dfc959

    SHA1

    1844bf222a5144b513dcf2fb50a18c011701c647

    SHA256

    47e65f4de08deabfd52ecdb8b0a29c61c482188b92c36182e2112ca0a8f4ff65

    SHA512

    18b8894a7f35df516f423bbdebf1e05ce09eaf4345b139e59e603cadb81f8d1fa20f793438c28e8fd9a64e64f0684223d90ce6f10d3f93cb0c781049a8cff03e

    Download Submit

  • /data/user/0/com.watchandlr/app_webview/Web Data-journal
    Filesize

    1KB

    MD5

    e5f3e5870507c172a1d4e2633f15ebc4

    SHA1

    d28cbd2321befc8617c4ec478d66462c09dffd00

    SHA256

    047ec70073a95eb6557d0f65aa406752c344bd8f7399e8aace4d1bcaaa99561a

    SHA512

    5f0cd0a83687ed83860c73dfb70b4020e8b8fba5e84d16197ab829c6b55b07dc0d3eb48fba8e2695b80aee9b2b7246d41ca812c3be6c2884f16a247e7168a149

    Download Submit

  • /data/user/0/com.watchandlr/app_webview/metrics_guid
    MD5

    d41d8cd98f00b204e9800998ecf8427e

    SHA1

    da39a3ee5e6b4b0d3255bfef95601890afd80709

    SHA256

    e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

    SHA512

    cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

    Download Submit

  • /data/user/0/com.watchandlr/app_webview/metrics_guid
    Filesize

    36B

    MD5

    014b6974557645d567718229a1b48bc5

    SHA1

    467b2846f34718f6f48113801ba38a0245b9bd8b

    SHA256

    0d0f14a15fb7a5cffe546a3d74e1b249392b6df1ba1c8c3de36cf1b0e8ce8b1d

    SHA512

    d0bf6c96228b45b78a46448cdb16f681b255bf17ec7f1d68566a2db5bd72ab8315402ccc838591f17a4fbb272d4d9a5b77ecac23aa843a25647dd6ace4c8e7e3

    Download Submit

  • /data/user/0/com.watchandlr/app_webview/variations_seed_new
    MD5

    d41d8cd98f00b204e9800998ecf8427e

    SHA1

    da39a3ee5e6b4b0d3255bfef95601890afd80709

    SHA256

    e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

    SHA512

    cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

    Download Submit

  • /data/user/0/com.watchandlr/app_webview/variations_stamp
    MD5

    d41d8cd98f00b204e9800998ecf8427e

    SHA1

    da39a3ee5e6b4b0d3255bfef95601890afd80709

    SHA256

    e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

    SHA512

    cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

    Download Submit

  • /data/user/0/com.watchandlr/app_webview/webview_data.lock
    MD5

    d41d8cd98f00b204e9800998ecf8427e

    SHA1

    da39a3ee5e6b4b0d3255bfef95601890afd80709

    SHA256

    e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

    SHA512

    cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

    Download Submit

  • /data/user/0/com.watchandlr/cache/oat/vsuprmqfiebpsd.cur.prof
    MD5

    d41d8cd98f00b204e9800998ecf8427e

    SHA1

    da39a3ee5e6b4b0d3255bfef95601890afd80709

    SHA256

    e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

    SHA512

    cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

    Download Submit

  • /data/user/0/com.watchandlr/cache/vsuprmqfiebpsd
    Filesize

    446KB

    MD5

    ca588cd5d574d50a6beed1da7a37deb3

    SHA1

    b0d2a36248289e2377b41f0f5d0a9fe72ac207b7

    SHA256

    8d9176615356427e8b71def85af48e8cc59a7c15045060b3f8a182ab85cfd739

    SHA512

    cab4985b534c8cf06b39035723ceacd8ead995ec4c133c4dbabc6b4b813f317d4470cc90778b30e4668e7eda67f52a3f37ac3d605dc62cd14ce3de3186b493d4

    Download Submit

  • /data/user/0/com.watchandlr/cache/vsuprmqfiebpsd
    Filesize

    446KB

    MD5

    ca588cd5d574d50a6beed1da7a37deb3

    SHA1

    b0d2a36248289e2377b41f0f5d0a9fe72ac207b7

    SHA256

    8d9176615356427e8b71def85af48e8cc59a7c15045060b3f8a182ab85cfd739

    SHA512

    cab4985b534c8cf06b39035723ceacd8ead995ec4c133c4dbabc6b4b813f317d4470cc90778b30e4668e7eda67f52a3f37ac3d605dc62cd14ce3de3186b493d4

    Download Submit

  • /data/user/0/com.watchandlr/cache/vsuprmqfiebpsd
    Filesize

    446KB

    MD5

    ca588cd5d574d50a6beed1da7a37deb3

    SHA1

    b0d2a36248289e2377b41f0f5d0a9fe72ac207b7

    SHA256

    8d9176615356427e8b71def85af48e8cc59a7c15045060b3f8a182ab85cfd739

    SHA512

    cab4985b534c8cf06b39035723ceacd8ead995ec4c133c4dbabc6b4b813f317d4470cc90778b30e4668e7eda67f52a3f37ac3d605dc62cd14ce3de3186b493d4

    Download Submit

  • /data/user/0/com.watchandlr/cache/vsuprmqfiebpsd.x86.flock
    MD5

    d41d8cd98f00b204e9800998ecf8427e

    SHA1

    da39a3ee5e6b4b0d3255bfef95601890afd80709

    SHA256

    e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

    SHA512

    cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

    Download Submit

  • /data/user/0/com.watchandlr/kl.txt
    MD5

    d41d8cd98f00b204e9800998ecf8427e

    SHA1

    da39a3ee5e6b4b0d3255bfef95601890afd80709

    SHA256

    e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

    SHA512

    cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

    Download Submit

  • /data/user/0/com.watchandlr/shared_prefs/WebViewChromiumPrefs.xml
    Filesize

    127B

    MD5

    21223e9184445fe043476484cd8cb1f9

    SHA1

    2b4813f849121d60ba35eb0889080668bb62c778

    SHA256

    bb61b7c087c2ae2de93a7740ff75707342940557146366e92b840284cd9446af

    SHA512

    be21408de0cc643650e5d9ab9057a8f9de88e37fbdc6417cfeba160402ec4cd14fccbc82cbbfd941ecfc0bb3d4056ee61ac199efdc99d647d53e65818835fd48

    Download Submit

  • /data/user/0/com.watchandlr/shared_prefs/main.xml
    Filesize

    132B

    MD5

    7241c84014248658f8d5a9673a6e4de5

    SHA1

    b8b32ae474073b4e0413a795e9bbd2ccff023bc3

    SHA256

    fb5d018714f238bd70dece734d5d2f538ff26b7bf7c78ebfe91ff34fd58384b3

    SHA512

    6ef0cc9fe3b4a801fcf5f3a865ed1ddfdf083f5dcfdf462f54883d56e126b120974eb2d7e4fcb9bd89b51180ac9f63e503575e5c62a1dd7746353d6490829e0f

    Download Submit

  • /data/user/0/com.watchandlr/shared_prefs/main.xml
    Filesize

    3KB

    MD5

    5809e79aa54b01a78c2f0397f7b03d73

    SHA1

    9bf1153837e765302d454ee1bdd460aed9d88fdd

    SHA256

    d3a44e15012d4c9ffad1521a72998bd84dfafa30b2bd8d490f28548d6c8a8f9c

    SHA512

    684c6ece50b5f4d41b4fbb619de21dfbc59a0b5341a99134a71ce45de350155bcd172694281418109ae5419db9099d7463a126e780a44db0368e86a760ddb040

    Download Submit