Analysis
-
max time kernel
2801150s -
max time network
132s -
platform
android_x86 -
resource
android-x86-arm-20220823-en -
submitted
24-11-2022 01:05
Static task
static1
Behavioral task
behavioral1
Sample
GooglePlay.apk
Resource
android-x86-arm-20220823-en
Behavioral task
behavioral2
Sample
GooglePlay.apk
Resource
android-x64-20220823-en
General
-
Target
GooglePlay.apk
-
Size
530KB
-
MD5
fccad586a06a044704de138b30229b5d
-
SHA1
50d4af7d8bbd6ad02bf708173ba115497d626549
-
SHA256
610ebf1037134ef4be64c44846428e71ce30b51aa13a14c459f978531f09722c
-
SHA512
6c54238e53ed23aaf0d84d9dad01d16e8a097e0fe5d63de1b9a653cb8e1be0498b060508fdc32569fd2eebc48a00d199d30fb174ad00728f362b0e860b2a8caa
-
SSDEEP
12288:m0x6FtyhgGaZjf7JaRdmXyVgqQpmYwZ1W6AvOH2LaMPIXv:mLypa5tJiqmyFRLgv
Malware Config
Extracted
octo
https://24fdghhoo1.top/doc/
https://25fdghhoo1.top/doc/
https://26fdghhoo1.top/doc/
https://27fdghhoo1.top/doc/
https://28fdghhoo1.top/doc/
https://29fdghhoo1.top/doc/
https://210fdghhoo1.top/doc/
https://211fdghhoo1.top/doc/
https://122fdghhoo1.top/doc/
https://123fdghhoo1.top/doc/
https://124fdghhoo1.top/doc/
https://125fdghhoo1.top/doc/
https://126fdghhoo1.top/doc/
https://127fdghhoo1.top/doc/
https://128fdghhoo1.top/doc/
https://129fdghhoo1.top/doc/
https://220fdghhoo1.top/doc/
https://234fdghhoo1.top/doc/
https://235fdghhoo1.top/doc/
https://236fdghhoo1.top/doc/
https://237fdghhoo1.top/doc/
https://238fdghhoo1.top/doc/
https://239fdghhoo1.top/doc/
https://2310fdghhoo1.top/doc/
https://2311fdghhoo1.top/doc/
https://1322fdghhoo1.top/doc/
https://1323fdghhoo1.top/doc/
https://1324fdghhoo1.top/doc/
https://1325fdghhoo1.top/doc/
https://1326fdghhoo1.top/doc/
https://1327fdghhoo1.top/doc/
https://1328fdghhoo1.top/doc/
https://1329fdghhoo1.top/doc/
https://2320fdghhoo1.top/doc/
https://sdxasd2.top/doc/
https://14fdghhoo1.top/doc/
https://15fdghhoo1.top/doc/
https://16fdghhoo1.top/doc/
https://17fdghhoo1.top/doc/
https://18fdghhoo1.top/doc/
https://19fdghhoo1.top/doc/
https://20fdghhoo1.top/doc/
Signatures
-
Octo
Octo is a banking malware with remote access capabilities first seen in April 2022.
-
Octo payload 3 IoCs
Processes:
resource yara_rule /data/user/0/com.watchandlr/cache/vsuprmqfiebpsd family_octo /data/user/0/com.watchandlr/cache/vsuprmqfiebpsd family_octo /data/user/0/com.watchandlr/cache/vsuprmqfiebpsd family_octo -
Makes use of the framework's Accessibility service. 1 IoCs
Processes:
com.watchandlrdescription ioc process Framework service call android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId com.watchandlr -
Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps). 1 IoCs
Processes:
com.watchandlrdescription ioc process Framework service call android.content.pm.IPackageManager.getInstalledApplications com.watchandlr -
Acquires the wake lock. 1 IoCs
Processes:
com.watchandlrdescription ioc process Framework service call android.os.IPowerManager.acquireWakeLock com.watchandlr -
Loads dropped Dex/Jar 2 IoCs
Runs executable file dropped to the device during analysis.
Processes:
com.watchandlrioc pid process /data/user/0/com.watchandlr/cache/vsuprmqfiebpsd 4020 com.watchandlr /data/user/0/com.watchandlr/cache/vsuprmqfiebpsd 4020 com.watchandlr -
Reads information about phone network operator.
-
Requests disabling of battery optimizations (often used to enable hiding in the background). 1 IoCs
Processes:
com.watchandlrdescription ioc process Intent action android.settings.REQUEST_IGNORE_BATTERY_OPTIMIZATIONS com.watchandlr -
Removes a system notification. 1 IoCs
Processes:
com.watchandlrdescription ioc process Framework service call android.app.INotificationManager.cancelNotificationWithTag com.watchandlr -
Uses Crypto APIs (Might try to encrypt user data). 1 IoCs
Processes:
com.watchandlrdescription ioc process Framework API call javax.crypto.Cipher.doFinal com.watchandlr
Processes
-
com.watchandlr1⤵
- Makes use of the framework's Accessibility service.
- Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps).
- Acquires the wake lock.
- Loads dropped Dex/Jar
- Requests disabling of battery optimizations (often used to enable hiding in the background).
- Removes a system notification.
- Uses Crypto APIs (Might try to encrypt user data).
PID:4020
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
20B
MD593027d42b314432c4216e6cfca48b384
SHA143448dd8102979c3926828182579691945eedd4e
SHA2563cda72e67c62e52a342309c44f2cb3b6c1019c7b11822e2f628e48e254e2b41c
SHA512a52d13cf7f5be196d1e2f135b8a010f80558c5d35e90e7792441d1c976517d55cf1c9587949db69ebef294cc6ef79529a65e7d779964793016efecacd152f70e
-
Filesize
48B
MD5e9d1b31c15e4194dbe358fe971f323dc
SHA1bc69abc16b9f41332f52a88857edba76d6a7ca0d
SHA256003ed245d17792fdd64249140503e0032901d3bccac11bd976158919c15a47bc
SHA5126b89e527e5d05692cd095b74c36ae1c4c49c53f88948864cbca7543ae37684708c02874f4309712e3dd1dd8f6b5fe02d12f3659cd9d9cb550ee5abbab3c35d8a
-
Filesize
104KB
MD5dc79f9ce5f3ab5270b33e61119dfc959
SHA11844bf222a5144b513dcf2fb50a18c011701c647
SHA25647e65f4de08deabfd52ecdb8b0a29c61c482188b92c36182e2112ca0a8f4ff65
SHA51218b8894a7f35df516f423bbdebf1e05ce09eaf4345b139e59e603cadb81f8d1fa20f793438c28e8fd9a64e64f0684223d90ce6f10d3f93cb0c781049a8cff03e
-
Filesize
1KB
MD5e5f3e5870507c172a1d4e2633f15ebc4
SHA1d28cbd2321befc8617c4ec478d66462c09dffd00
SHA256047ec70073a95eb6557d0f65aa406752c344bd8f7399e8aace4d1bcaaa99561a
SHA5125f0cd0a83687ed83860c73dfb70b4020e8b8fba5e84d16197ab829c6b55b07dc0d3eb48fba8e2695b80aee9b2b7246d41ca812c3be6c2884f16a247e7168a149
-
MD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e
-
Filesize
36B
MD5014b6974557645d567718229a1b48bc5
SHA1467b2846f34718f6f48113801ba38a0245b9bd8b
SHA2560d0f14a15fb7a5cffe546a3d74e1b249392b6df1ba1c8c3de36cf1b0e8ce8b1d
SHA512d0bf6c96228b45b78a46448cdb16f681b255bf17ec7f1d68566a2db5bd72ab8315402ccc838591f17a4fbb272d4d9a5b77ecac23aa843a25647dd6ace4c8e7e3
-
MD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e
-
MD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e
-
MD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e
-
MD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e
-
Filesize
446KB
MD5ca588cd5d574d50a6beed1da7a37deb3
SHA1b0d2a36248289e2377b41f0f5d0a9fe72ac207b7
SHA2568d9176615356427e8b71def85af48e8cc59a7c15045060b3f8a182ab85cfd739
SHA512cab4985b534c8cf06b39035723ceacd8ead995ec4c133c4dbabc6b4b813f317d4470cc90778b30e4668e7eda67f52a3f37ac3d605dc62cd14ce3de3186b493d4
-
Filesize
446KB
MD5ca588cd5d574d50a6beed1da7a37deb3
SHA1b0d2a36248289e2377b41f0f5d0a9fe72ac207b7
SHA2568d9176615356427e8b71def85af48e8cc59a7c15045060b3f8a182ab85cfd739
SHA512cab4985b534c8cf06b39035723ceacd8ead995ec4c133c4dbabc6b4b813f317d4470cc90778b30e4668e7eda67f52a3f37ac3d605dc62cd14ce3de3186b493d4
-
Filesize
446KB
MD5ca588cd5d574d50a6beed1da7a37deb3
SHA1b0d2a36248289e2377b41f0f5d0a9fe72ac207b7
SHA2568d9176615356427e8b71def85af48e8cc59a7c15045060b3f8a182ab85cfd739
SHA512cab4985b534c8cf06b39035723ceacd8ead995ec4c133c4dbabc6b4b813f317d4470cc90778b30e4668e7eda67f52a3f37ac3d605dc62cd14ce3de3186b493d4
-
MD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e
-
MD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e
-
Filesize
127B
MD521223e9184445fe043476484cd8cb1f9
SHA12b4813f849121d60ba35eb0889080668bb62c778
SHA256bb61b7c087c2ae2de93a7740ff75707342940557146366e92b840284cd9446af
SHA512be21408de0cc643650e5d9ab9057a8f9de88e37fbdc6417cfeba160402ec4cd14fccbc82cbbfd941ecfc0bb3d4056ee61ac199efdc99d647d53e65818835fd48
-
Filesize
132B
MD57241c84014248658f8d5a9673a6e4de5
SHA1b8b32ae474073b4e0413a795e9bbd2ccff023bc3
SHA256fb5d018714f238bd70dece734d5d2f538ff26b7bf7c78ebfe91ff34fd58384b3
SHA5126ef0cc9fe3b4a801fcf5f3a865ed1ddfdf083f5dcfdf462f54883d56e126b120974eb2d7e4fcb9bd89b51180ac9f63e503575e5c62a1dd7746353d6490829e0f
-
Filesize
3KB
MD55809e79aa54b01a78c2f0397f7b03d73
SHA19bf1153837e765302d454ee1bdd460aed9d88fdd
SHA256d3a44e15012d4c9ffad1521a72998bd84dfafa30b2bd8d490f28548d6c8a8f9c
SHA512684c6ece50b5f4d41b4fbb619de21dfbc59a0b5341a99134a71ce45de350155bcd172694281418109ae5419db9099d7463a126e780a44db0368e86a760ddb040