octo | 610ebf1037134ef4be64c44846428e71ce30b51aa13a14c459f978531f09722c

Analysis

max time kernel
2804758s
max time network
143s
platform
android_x64
resource
android-x64-20220823-en
submitted
24-11-2022 01:05

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

GooglePlay.apk
Size

530KB
MD5

fccad586a06a044704de138b30229b5d
SHA1

50d4af7d8bbd6ad02bf708173ba115497d626549
SHA256

610ebf1037134ef4be64c44846428e71ce30b51aa13a14c459f978531f09722c
SHA512

6c54238e53ed23aaf0d84d9dad01d16e8a097e0fe5d63de1b9a653cb8e1be0498b060508fdc32569fd2eebc48a00d199d30fb174ad00728f362b0e860b2a8caa
SSDEEP

12288:m0x6FtyhgGaZjf7JaRdmXyVgqQpmYwZ1W6AvOH2LaMPIXv:mLypa5tJiqmyFRLgv

Score

10^/10

octo banker infostealer ransomware rat trojan

Malware Config

Extracted

Family

octo

https://24fdghhoo1.top/doc/

https://25fdghhoo1.top/doc/

https://26fdghhoo1.top/doc/

https://27fdghhoo1.top/doc/

https://28fdghhoo1.top/doc/

https://29fdghhoo1.top/doc/

https://210fdghhoo1.top/doc/

https://211fdghhoo1.top/doc/

https://122fdghhoo1.top/doc/

https://123fdghhoo1.top/doc/

https://124fdghhoo1.top/doc/

https://125fdghhoo1.top/doc/

https://126fdghhoo1.top/doc/

https://127fdghhoo1.top/doc/

https://128fdghhoo1.top/doc/

https://129fdghhoo1.top/doc/

https://220fdghhoo1.top/doc/

https://234fdghhoo1.top/doc/

https://235fdghhoo1.top/doc/

https://236fdghhoo1.top/doc/

AES_key

Signatures

Octo
Octo is a banking malware with remote access capabilities first seen in April 2022.
banker trojan infostealer rat octo

Octo payload 3 IoCs

Processes:

resource	yara_rule
/data/user/0/com.watchandlr/cache/vsuprmqfiebpsd	family_octo
/data/user/0/com.watchandlr/cache/vsuprmqfiebpsd	family_octo
/data/user/0/com.watchandlr/cache/vsuprmqfiebpsd	family_octo

Loads dropped Dex/Jar 2 IoCs
Runs executable file dropped to the device during analysis.

Processes:

com.watchandlr

ioc pid process

/data/user/0/com.watchandlr/cache/vsuprmqfiebpsd 4824 com.watchandlr
/data/user/0/com.watchandlr/cache/vsuprmqfiebpsd 4824 com.watchandlr
Reads information about phone network operator.
Uses Crypto APIs (Might try to encrypt user data). 1 IoCs
ransomware

Processes:

com.watchandlr

description ioc process

Framework API call javax.crypto.Cipher.doFinal com.watchandlr

ioc	pid	process
/data/user/0/com.watchandlr/cache/vsuprmqfiebpsd	4824	com.watchandlr
/data/user/0/com.watchandlr/cache/vsuprmqfiebpsd	4824	com.watchandlr

description	ioc	process
Framework API call	javax.crypto.Cipher.doFinal	com.watchandlr

com.watchandlr
1⤵
- Loads dropped Dex/Jar
- Uses Crypto APIs (Might try to encrypt user data).
PID:4824

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

/data/user/0/com.watchandlr/app_webview/.com.google.Chrome.A4rOF4
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
/data/user/0/com.watchandlr/app_webview/GPUCache/index
Filesize
48B

MD5
6d7d499960179766cd4261d12dacc411

SHA1
e6f8553b0015e12b23cc551afe98763f3b1c9bed

SHA256
c96ac03cfdbc6f4c1bdcdf764f1a6573f852e7aae5ef405969516b93ed271182

SHA512
6526c668477a01a850b8757b77dd3e7be27ad1991f5cf777685efcb03a21f31b71f6eae00f326931599baae4b16360e33e3d0f2894f1b2c1753391df02a14547

Download Submit
/data/user/0/com.watchandlr/app_webview/GPUCache/index-dir/temp-index
Filesize
96B

MD5
5b4fa603ba9961759c61849a0a5a0b67

SHA1
07a92d5cc2c458cc8dd84e70e700839d179cfbfc

SHA256
903cf28c460874b311eb72b1ca09d951ff17b7510d5ce4755b158680afe5678d

SHA512
844030610a2d50cbf18be6992e0b97b41cc4239205217643ab91726e5718fb98150c2053f6dd101c5f7d917129169fdfafdf56327a3ab0ca0a675bcd26e8ff91

Download Submit
/data/user/0/com.watchandlr/app_webview/Web Data
Filesize
112KB

MD5
b663831f8cc130493476d94f2d7a5330

SHA1
043a1956ab8e40821d67043f8a9110a8eb36fb93

SHA256
c109aa8bfc364d5fd0756f1c9d35ee3d6df31325061ac70d8469f28cfc882ab7

SHA512
e8ee923192cdf16318febdc23362f3eeaf5c914b923f80cd3a91a2e83e94bced54460d4ef1e54accc26a7d54b89e2e10c00097e60002cf6427298dc5f18fed16

Download Submit
/data/user/0/com.watchandlr/app_webview/Web Data-journal
Filesize
1KB

MD5
56f2d1d8730a6c59d686bf19756e380e

SHA1
a9d3f3ba031ea05005640ff5d53990548c557cb6

SHA256
c962ba8a708012aa0d63c7a8b4725f0799740d3f4a15c797c94cc06a2dc48225

SHA512
7597ca2d60aed3083821713dbf10ac65dd3e188c2ed15bb7ca7364b09a1bebcb59f7b855a5481fb35e111bdf5ceae80529f936e535aaa5e878db57957a7ba8ad

Download Submit
/data/user/0/com.watchandlr/app_webview/metrics_guid
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
/data/user/0/com.watchandlr/app_webview/metrics_guid
Filesize
36B

MD5
828a964c406dc2dc68add8ebe07e0e45

SHA1
aac9c39f370e25dc15748dcfe3ea7a4e0f74d50d

SHA256
3702e59162422be2984917cfa2bb5d2a3739cb5877d5e8d9b34045aa5b1f3b80

SHA512
90c6bc4af16d6198b61d0ea806015e093ce3e7f378769a8a3ed133c705e8edd6666e073eea91f964be0e59d56bafad0594f88655abe914ff6e5dd45e6b045172

Download Submit
/data/user/0/com.watchandlr/app_webview/variations_seed_new
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
/data/user/0/com.watchandlr/app_webview/variations_stamp
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
/data/user/0/com.watchandlr/app_webview/webview_data.lock
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
/data/user/0/com.watchandlr/cache/WebView/Crashpad/settings.dat
Filesize
40B

MD5
19bc68006f6503f9545673b7dd48d2c6

SHA1
8785da749cfb65a1f8352cb0bd5aed5c8b822c6c

SHA256
402ac4ab0be8486857a425c2fbefbe949474de9f53d79cdf8523bb969d6105a7

SHA512
f23918999894e3fd5c8764c960f44558b09b06dd24512df06d501c068c8883baa8a990ed7752a47d3e9e6bf55f5f4006888b5c15a99be3c9cc3791e3b73555c8

Download Submit
/data/user/0/com.watchandlr/cache/oat/vsuprmqfiebpsd.cur.prof
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
/data/user/0/com.watchandlr/cache/org.chromium.android_webview/Code Cache/js/index
Filesize
48B

MD5
6d7d499960179766cd4261d12dacc411

SHA1
e6f8553b0015e12b23cc551afe98763f3b1c9bed

SHA256
c96ac03cfdbc6f4c1bdcdf764f1a6573f852e7aae5ef405969516b93ed271182

SHA512
6526c668477a01a850b8757b77dd3e7be27ad1991f5cf777685efcb03a21f31b71f6eae00f326931599baae4b16360e33e3d0f2894f1b2c1753391df02a14547

Download Submit
/data/user/0/com.watchandlr/cache/org.chromium.android_webview/Code Cache/js/index-dir/temp-index
Filesize
96B

MD5
b74c1019f4b66cf5964b88e4a226592b

SHA1
2e6b8e48c9370bb59c8a8b8c6ca92c45330373bb

SHA256
a2f379cc2c639049f6218ab0f73b310f569734c020ea6baf7497aa36af227148

SHA512
0c06adfac4655e65ccb01b40d51ade25d5b5bdd4df0f04fe8c5121f68c31d05053378c8093a947115085ac7b611e76d5d81993213bdb8734174b241dd1d91f7e

Download Submit
/data/user/0/com.watchandlr/cache/vsuprmqfiebpsd
Filesize
446KB

MD5
ca588cd5d574d50a6beed1da7a37deb3

SHA1
b0d2a36248289e2377b41f0f5d0a9fe72ac207b7

SHA256
8d9176615356427e8b71def85af48e8cc59a7c15045060b3f8a182ab85cfd739

SHA512
cab4985b534c8cf06b39035723ceacd8ead995ec4c133c4dbabc6b4b813f317d4470cc90778b30e4668e7eda67f52a3f37ac3d605dc62cd14ce3de3186b493d4

Download Submit
/data/user/0/com.watchandlr/cache/vsuprmqfiebpsd
Filesize
446KB

MD5
ca588cd5d574d50a6beed1da7a37deb3

SHA1
b0d2a36248289e2377b41f0f5d0a9fe72ac207b7

SHA256
8d9176615356427e8b71def85af48e8cc59a7c15045060b3f8a182ab85cfd739

SHA512
cab4985b534c8cf06b39035723ceacd8ead995ec4c133c4dbabc6b4b813f317d4470cc90778b30e4668e7eda67f52a3f37ac3d605dc62cd14ce3de3186b493d4

Download Submit
/data/user/0/com.watchandlr/cache/vsuprmqfiebpsd
Filesize
446KB

MD5
ca588cd5d574d50a6beed1da7a37deb3

SHA1
b0d2a36248289e2377b41f0f5d0a9fe72ac207b7

SHA256
8d9176615356427e8b71def85af48e8cc59a7c15045060b3f8a182ab85cfd739

SHA512
cab4985b534c8cf06b39035723ceacd8ead995ec4c133c4dbabc6b4b813f317d4470cc90778b30e4668e7eda67f52a3f37ac3d605dc62cd14ce3de3186b493d4

Download Submit
/data/user/0/com.watchandlr/kl.txt
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
/data/user/0/com.watchandlr/kl.txt
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
/data/user/0/com.watchandlr/shared_prefs/WebViewChromiumPrefs.xml
Filesize
127B

MD5
6ef709b8536878951e87c29a1518fc2b

SHA1
24376c70b00152501b3d98df61fa7db435339172

SHA256
10b13d894f36d4391fcc31313a244d5f6cd89c8e8c03347282e281c4af13c0a6

SHA512
96547eff6779251a5c4941e812ec56ed273e9270265005723e1f2864688b04f3b852a90145fba4ea0ddf1e02b39d99e33d28f761b07a04d46e0e4257d8909ff9

Download Submit
/data/user/0/com.watchandlr/shared_prefs/main.xml
Filesize
132B

MD5
7241c84014248658f8d5a9673a6e4de5

SHA1
b8b32ae474073b4e0413a795e9bbd2ccff023bc3

SHA256
fb5d018714f238bd70dece734d5d2f538ff26b7bf7c78ebfe91ff34fd58384b3

SHA512
6ef0cc9fe3b4a801fcf5f3a865ed1ddfdf083f5dcfdf462f54883d56e126b120974eb2d7e4fcb9bd89b51180ac9f63e503575e5c62a1dd7746353d6490829e0f

Download Submit
/data/user/0/com.watchandlr/shared_prefs/main.xml
Filesize
5KB

MD5
05e2e9a30faa3e41c9d2a9a8d2cf11e8

SHA1
0717a624abeaf2d9d289f803fd29505e806a1259

SHA256
9503487105fb7728733c79a6b1b473bdf50b8fc3446a79b6511133b2dfac3cc1

SHA512
d5df4f6a72c20493a7eeae3de7e72aedc1c1ed94a97ed1d36947e147362eb58f3d950094802cd26d211149b9743bd01ea3758d1494ac9e6e0914a892456d3dde

Download Submit