octo | 57031f6fae595c9cbf89d9c9ae77fd4ccdb1cee766d8afaea9625efa58910fd1

Resubmissions

03/05/2023, 10:24

230503-mfvjmaec56 10

17/03/2023, 07:38

230317-jgfv3sgh7x 10

Analysis

max time kernel
3997997s
max time network
144s
platform
android_x86
resource
android-x86-arm-20220823-en
submitted
17/03/2023, 07:38

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

chrome-upd13111.apk
Size

541KB
MD5

a9b1a776b600baff0832bf897c1a811d
SHA1

283e8e6d16caf9b9e4fb93644e3207a1c436735f
SHA256

57031f6fae595c9cbf89d9c9ae77fd4ccdb1cee766d8afaea9625efa58910fd1
SHA512

3d7a58582ecf58afa50b85f443f30328ee6fa1d441a5efab43346a922557274209a9b0ca087c07af0b4495f41ef2b3ecb1dd0843518d092cdcc18b07b1f2e3ce
SSDEEP

12288:GjSJnCtrt7YhSGyMZM/WH9iy94/oVHRjE8bztEqe7pudc9wjN:DnG/awWH/bVe8bz+qecc9wJ

Score

10^/10

octo banker evasion infostealer ransomware rat trojan

Malware Config

Extracted

Family

octo

https://countnatbt.site/YWRhZjAxNGM1YjFh/

https://mix3etbt.website/YWRhZjAxNGM1YjFh/

https://btcountates.fun/YWRhZjAxNGM1YjFh/

https://3countbt.pw/YWRhZjAxNGM1YjFh/

https://vat-app.su/YWRhZjAxNGM1YjFh/

https://alleggro.pw/YWRhZjAxNGM1YjFh/

https://ijectaeres.site/YWRhZjAxNGM1YjFh/

https://ijectaeres.online/YWRhZjAxNGM1YjFh/

https://jerkenates225.site/YWRhZjAxNGM1YjFh/

https://nobodysgonnanow.pw/YWRhZjAxNGM1YjFh/

AES_key

Signatures

Octo
Octo is a banking malware with remote access capabilities first seen in April 2022.
banker trojan infostealer rat octo

Octo payload 3 IoCs

resource	yara_rule
behavioral1/files/3983-0.dat	family_octo
behavioral1/memory/3983-0.dex	family_octo
behavioral1/memory/3983-1.dex	family_octo

Makes use of the framework's Accessibility service. 1 IoCs

description	ioc	Process
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId	com.amongrestuv

Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps). 1 IoCs

banker

description	ioc	Process
Framework service call	android.content.pm.IPackageManager.getInstalledApplications	com.amongrestuv

Acquires the wake lock. 1 IoCs

description	ioc	Process
Framework service call	android.os.IPowerManager.acquireWakeLock	com.amongrestuv

Loads dropped Dex/Jar 2 IoCs

Runs executable file dropped to the device during analysis.

ioc	pid	Process
/data/user/0/com.amongrestuv/cache/qnqmyysldobxfxp	3983	com.amongrestuv
/data/user/0/com.amongrestuv/cache/qnqmyysldobxfxp	3983	com.amongrestuv

Reads information about phone network operator.

Requests disabling of battery optimizations (often used to enable hiding in the background). 1 IoCs

evasion

description	ioc	Process
Intent action	android.settings.REQUEST_IGNORE_BATTERY_OPTIMIZATIONS	com.amongrestuv

Uses Crypto APIs (Might try to encrypt user data). 1 IoCs

ransomware

description	ioc	Process
Framework API call	javax.crypto.Cipher.doFinal	com.amongrestuv

com.amongrestuv
1⤵
- Makes use of the framework's Accessibility service.
- Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps).
- Acquires the wake lock.
- Loads dropped Dex/Jar
- Requests disabling of battery optimizations (often used to enable hiding in the background).
- Uses Crypto APIs (Might try to encrypt user data).
PID:3983

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

/data/user/0/com.amongrestuv/.qcom.amongrestuv

Filesize
48B

MD5
046a414913add6f5bb60072c7db819b6

SHA1
451ee4f6809260aec622d772fd329c7d0297a842

SHA256
b66c1320cb063a1d391c94273572ea6edae76c8c8b0a07f8d75c88686f0df72a

SHA512
4e6355f3051ed5e811ab030abde1f5be7f5e1cf33be99cd08477e9b6c015deb1d8bd75a09fb9c7176b8511c5ad0a67abc0902a3531e97564ccb6afc57496a47c

Download Submit
/data/user/0/com.amongrestuv/cache/qnqmyysldobxfxp

Filesize
448KB

MD5
7301601b80f1eb5e627e0dd665a1133b

SHA1
7beb4a9e85d728531e6931fbd49f7cc1562102a0

SHA256
e5d85ddf1caf74c78447f42998e050b291c7bd1326bdf696cf0e41b3d015c9e9

SHA512
9cb975f387b218b934e67abedc332a1266111660cf8431154ecb225fe6d61402f0213d34c87b1085929beccccf7abace618b91e5a2ca7a7a804ee82eb5761dc7

Download Submit
/data/user/0/com.amongrestuv/cache/qnqmyysldobxfxp

Filesize
448KB

MD5
7301601b80f1eb5e627e0dd665a1133b

SHA1
7beb4a9e85d728531e6931fbd49f7cc1562102a0

SHA256
e5d85ddf1caf74c78447f42998e050b291c7bd1326bdf696cf0e41b3d015c9e9

SHA512
9cb975f387b218b934e67abedc332a1266111660cf8431154ecb225fe6d61402f0213d34c87b1085929beccccf7abace618b91e5a2ca7a7a804ee82eb5761dc7

Download Submit
/data/user/0/com.amongrestuv/cache/qnqmyysldobxfxp

Filesize
448KB

MD5
7301601b80f1eb5e627e0dd665a1133b

SHA1
7beb4a9e85d728531e6931fbd49f7cc1562102a0

SHA256
e5d85ddf1caf74c78447f42998e050b291c7bd1326bdf696cf0e41b3d015c9e9

SHA512
9cb975f387b218b934e67abedc332a1266111660cf8431154ecb225fe6d61402f0213d34c87b1085929beccccf7abace618b91e5a2ca7a7a804ee82eb5761dc7

Download Submit
/data/user/0/com.amongrestuv/shared_prefs/main.xml

Filesize
133B

MD5
548b670f6d33c340e0f841bd9554fedd

SHA1
23c2fcab6da21a03a6884a8db1fbda44dedb0e65

SHA256
367794fb22730c3925502e8968b17f5384c40795b69b9057dab41d97ef70d221

SHA512
7ce80d8623fd4efd7b50b653b34eddb6af9c17373cbee710954240c75607ab9ff0f3382e0fd6c8fb718bf1e38090585133c0f5c8af672f4c229d22d0adaec732

Download Submit
/data/user/0/com.amongrestuv/shared_prefs/main.xml

Filesize
3KB

MD5
881309731879b553c3ab6adea60cc584

SHA1
afdf7b402a463cdb577644935705ce90be71b0b2

SHA256
83efcb3dad7e45d0ee52965cd6993b74da72aa2628838f28d706ed3d3d54090b

SHA512
7b4787d8dee78c3ec46a8416fe06d5a7f3de62ae976899a645a9fc556661543da66bebe16ac15c74fe17d55e37ebe68e78ad289e127015829799a6d158e051fe

Download Submit