Overview

overview

10

Static

static

7

GooglePlay.apk

android-11-x64

10

Analysis

  • max time kernel
    2831890s
  • max time network
    89s
  • platform
    android_x64
  • resource
    android-x64-arm64-20220823-en
  • submitted
    24-11-2022 08:38

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    GooglePlay.apk

  • Size

    530KB

  • MD5

    fccad586a06a044704de138b30229b5d

  • SHA1

    50d4af7d8bbd6ad02bf708173ba115497d626549

  • SHA256

    610ebf1037134ef4be64c44846428e71ce30b51aa13a14c459f978531f09722c

  • SHA512

    6c54238e53ed23aaf0d84d9dad01d16e8a097e0fe5d63de1b9a653cb8e1be0498b060508fdc32569fd2eebc48a00d199d30fb174ad00728f362b0e860b2a8caa

  • SSDEEP

    12288:m0x6FtyhgGaZjf7JaRdmXyVgqQpmYwZ1W6AvOH2LaMPIXv:mLypa5tJiqmyFRLgv

Score
10/10
octobankerevasioninfostealerransomwarerattrojan

Malware Config

Extracted

Family

octo

C2

https://24fdghhoo1.top/doc/

https://25fdghhoo1.top/doc/

https://26fdghhoo1.top/doc/

https://27fdghhoo1.top/doc/

https://28fdghhoo1.top/doc/

https://29fdghhoo1.top/doc/

https://210fdghhoo1.top/doc/

https://211fdghhoo1.top/doc/

https://122fdghhoo1.top/doc/

https://123fdghhoo1.top/doc/

https://124fdghhoo1.top/doc/

https://125fdghhoo1.top/doc/

https://126fdghhoo1.top/doc/

https://127fdghhoo1.top/doc/

https://128fdghhoo1.top/doc/

https://129fdghhoo1.top/doc/

https://220fdghhoo1.top/doc/

https://234fdghhoo1.top/doc/

https://235fdghhoo1.top/doc/

https://236fdghhoo1.top/doc/
AES_key

Signatures

  • Octo

    Octo is a banking malware with remote access capabilities first seen in April 2022.

    bankertrojaninfostealerratocto
  • Octo payload 3 IoCs
  • Makes use of the framework's Accessibility service. 1 IoCs
  • Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps). 1 IoCs
    banker
  • Acquires the wake lock. 1 IoCs
  • Loads dropped Dex/Jar 2 IoCs

    Runs executable file dropped to the device during analysis.

  • Reads information about phone network operator.
  • Requests disabling of battery optimizations (often used to enable hiding in the background). 1 IoCs
    evasion
  • Uses Crypto APIs (Might try to encrypt user data). 1 IoCs
    ransomware

Processes

  • com.watchandlr
    1⤵
    • Makes use of the framework's Accessibility service.
    • Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps).
    • Acquires the wake lock.
    • Loads dropped Dex/Jar
    • Requests disabling of battery optimizations (often used to enable hiding in the background).
    • Uses Crypto APIs (Might try to encrypt user data).
    PID:4543

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • /data/user/0/com.watchandlr/cache/oat/vsuprmqfiebpsd.cur.prof
    MD5

    d41d8cd98f00b204e9800998ecf8427e

    SHA1

    da39a3ee5e6b4b0d3255bfef95601890afd80709

    SHA256

    e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

    SHA512

    cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

    Download Submit

  • /data/user/0/com.watchandlr/cache/vsuprmqfiebpsd
    Filesize

    446KB

    MD5

    ca588cd5d574d50a6beed1da7a37deb3

    SHA1

    b0d2a36248289e2377b41f0f5d0a9fe72ac207b7

    SHA256

    8d9176615356427e8b71def85af48e8cc59a7c15045060b3f8a182ab85cfd739

    SHA512

    cab4985b534c8cf06b39035723ceacd8ead995ec4c133c4dbabc6b4b813f317d4470cc90778b30e4668e7eda67f52a3f37ac3d605dc62cd14ce3de3186b493d4

    Download Submit

  • /data/user/0/com.watchandlr/cache/vsuprmqfiebpsd
    Filesize

    446KB

    MD5

    ca588cd5d574d50a6beed1da7a37deb3

    SHA1

    b0d2a36248289e2377b41f0f5d0a9fe72ac207b7

    SHA256

    8d9176615356427e8b71def85af48e8cc59a7c15045060b3f8a182ab85cfd739

    SHA512

    cab4985b534c8cf06b39035723ceacd8ead995ec4c133c4dbabc6b4b813f317d4470cc90778b30e4668e7eda67f52a3f37ac3d605dc62cd14ce3de3186b493d4

    Download Submit

  • /data/user/0/com.watchandlr/cache/vsuprmqfiebpsd
    Filesize

    446KB

    MD5

    ca588cd5d574d50a6beed1da7a37deb3

    SHA1

    b0d2a36248289e2377b41f0f5d0a9fe72ac207b7

    SHA256

    8d9176615356427e8b71def85af48e8cc59a7c15045060b3f8a182ab85cfd739

    SHA512

    cab4985b534c8cf06b39035723ceacd8ead995ec4c133c4dbabc6b4b813f317d4470cc90778b30e4668e7eda67f52a3f37ac3d605dc62cd14ce3de3186b493d4

    Download Submit

  • /data/user/0/com.watchandlr/shared_prefs/main.xml
    Filesize

    132B

    MD5

    7241c84014248658f8d5a9673a6e4de5

    SHA1

    b8b32ae474073b4e0413a795e9bbd2ccff023bc3

    SHA256

    fb5d018714f238bd70dece734d5d2f538ff26b7bf7c78ebfe91ff34fd58384b3

    SHA512

    6ef0cc9fe3b4a801fcf5f3a865ed1ddfdf083f5dcfdf462f54883d56e126b120974eb2d7e4fcb9bd89b51180ac9f63e503575e5c62a1dd7746353d6490829e0f

    Download Submit

  • /data/user/0/com.watchandlr/shared_prefs/main.xml
    Filesize

    7KB

    MD5

    3bb120f7aa05d109a1c8cef6563f33e4

    SHA1

    d16c623d725865b26106c2d7a5e41bf800e59bfb

    SHA256

    050f369b5fdd309782e943464c494415c5d0753be74c097c223cd64fa8805421

    SHA512

    c2a54cc4bae683517170b05e0bd3c6e495ea3c61e966e8a8def5ef011a4a5db1342a97ed23111963450f20e92f4241d79a35a8dc47f919888dee9f32e767f19c

    Download Submit