Overview

overview

10

Static

static

7

file.apk

android-10-x64

10

file.apk

android-11-x64

10

file.apk

android-9-x86

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    file.apk

  • Size

    531KB

  • Sample

    221129-llfrzsfh84

  • MD5

    5bc6f74bce69f6b942426e21c69e08f0

  • SHA1

    b59d70df1e5d1f2d43708a00e6a97011154956fc

  • SHA256

    87f720b6bf890ae204f945cd302c792ebe4fa6199eb02451283b022a10d1aff8

  • SHA512

    efbf67d7b61e1747e597ecc7a60a212a3a6f118248cd8156941972d126cf54426a3732b810deaa9c5210d789f0c2be9467bf7c5cbff8dd4dc97bbb2c1f3ff784

  • SSDEEP

    12288:0eHNiUoe5L+uis1BsEZN0Yj+xY1lD1GQno+ZGjau:0UNZXV1BtZmM1lD1DtZGjau

Score
10/10
octoandroidbankerevasioninfostealerransomwarerattrojan

Malware Config

Extracted

Family

octo

C2

https://sfhasgiasasgh.com/YTFiYmViNzA3YjMz/

https://ghasvyashvas.com/YTFiYmViNzA3YjMz/

https://gyewuqghvsvx.com/YTFiYmViNzA3YjMz/

https://yqywywwyfcscv.com/YTFiYmViNzA3YjMz/

https://ysysyssvxwwfqs.top/YTFiYmViNzA3YjMz/
AES_key

Targets

    • Target

      file.apk

    • Size

      531KB

    • MD5

      5bc6f74bce69f6b942426e21c69e08f0

    • SHA1

      b59d70df1e5d1f2d43708a00e6a97011154956fc

    • SHA256

      87f720b6bf890ae204f945cd302c792ebe4fa6199eb02451283b022a10d1aff8

    • SHA512

      efbf67d7b61e1747e597ecc7a60a212a3a6f118248cd8156941972d126cf54426a3732b810deaa9c5210d789f0c2be9467bf7c5cbff8dd4dc97bbb2c1f3ff784

    • SSDEEP

      12288:0eHNiUoe5L+uis1BsEZN0Yj+xY1lD1GQno+ZGjau:0UNZXV1BtZmM1lD1DtZGjau

    Score
    10/10
    octobankerinfostealerransomwarerattrojanevasion

    • Octo

      Octo is a banking malware with remote access capabilities first seen in April 2022.

      bankertrojaninfostealerratocto

    • Octo payload

    • Makes use of the framework's Accessibility service.

    • Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps).

      banker

    • Acquires the wake lock.

    • Loads dropped Dex/Jar

      Runs executable file dropped to the device during analysis.

    • Reads information about phone network operator.

    • Requests disabling of battery optimizations (often used to enable hiding in the background).

      evasion

    • Removes a system notification.

      evasion

    • Uses Crypto APIs (Might try to encrypt user data).

      ransomware
    behavioral1behavioral2behavioral3

MITRE ATT&CK Matrix

Tasks