Malware Analysis Report

2025-01-19 05:37

Sample ID 230317-jgfv3sgh7x
Target chrome-upd13111.apk
SHA256 57031f6fae595c9cbf89d9c9ae77fd4ccdb1cee766d8afaea9625efa58910fd1
Tags
octo banker evasion infostealer ransomware rat trojan
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

57031f6fae595c9cbf89d9c9ae77fd4ccdb1cee766d8afaea9625efa58910fd1

Threat Level: Known bad

The file chrome-upd13111.apk was found to be: Known bad.

Malicious Activity Summary

octo banker evasion infostealer ransomware rat trojan

Octo

Octo payload

Makes use of the framework's Accessibility service.

Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps).

Acquires the wake lock.

Loads dropped Dex/Jar

Requests dangerous framework permissions

Requests disabling of battery optimizations (often used to enable hiding in the background).

Reads information about phone network operator.

Uses Crypto APIs (Might try to encrypt user data).

MITRE ATT&CK

N/A

Analysis: static1

Detonation Overview

Reported

2023-03-17 07:38

Signatures

Requests dangerous framework permissions

Description Indicator Process Target
Allows an application to read from external storage. android.permission.READ_EXTERNAL_STORAGE N/A N/A
Allows an application to receive SMS messages. android.permission.RECEIVE_SMS N/A N/A
Allows an application to read SMS messages. android.permission.READ_SMS N/A N/A
Allows an application to send SMS messages. android.permission.SEND_SMS N/A N/A
Allows read only access to phone state, including the current cellular network information, the status of any ongoing calls, and a list of any PhoneAccounts registered on the device. android.permission.READ_PHONE_STATE N/A N/A
Allows an application to initiate a phone call without going through the Dialer user interface for the user to confirm the call. android.permission.CALL_PHONE N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2023-03-17 07:38

Reported

2023-03-17 07:40

Platform

android-x86-arm-20220823-en

Max time kernel

3997997s

Max time network

144s

Command Line

com.amongrestuv

Signatures

Octo

banker trojan infostealer rat octo

Octo payload

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Makes use of the framework's Accessibility service.

Description Indicator Process Target
Framework service call android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId N/A N/A

Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps).

banker
Description Indicator Process Target
Framework service call android.content.pm.IPackageManager.getInstalledApplications N/A N/A

Acquires the wake lock.

Description Indicator Process Target
Framework service call android.os.IPowerManager.acquireWakeLock N/A N/A

Loads dropped Dex/Jar

Description Indicator Process Target
N/A /data/user/0/com.amongrestuv/cache/qnqmyysldobxfxp N/A N/A
N/A /data/user/0/com.amongrestuv/cache/qnqmyysldobxfxp N/A N/A

Reads information about phone network operator.

Requests disabling of battery optimizations (often used to enable hiding in the background).

evasion
Description Indicator Process Target
Intent action android.settings.REQUEST_IGNORE_BATTERY_OPTIMIZATIONS N/A N/A

Uses Crypto APIs (Might try to encrypt user data).

ransomware
Description Indicator Process Target
Framework API call javax.crypto.Cipher.doFinal N/A N/A

Processes

com.amongrestuv

Network

Country Destination Domain Proto
NL 142.250.179.202:443 tcp
N/A 224.0.0.251:5353 udp
US 1.1.1.1:53 infinitedata-pa.googleapis.com udp
US 1.1.1.1:53 android.apis.google.com udp
US 1.1.1.1:53 www.ip-api.com udp
US 208.95.112.1:80 www.ip-api.com tcp
US 1.1.1.1:53 mix3etbt.website udp
US 1.1.1.1:53 btcountates.fun udp
NL 62.233.51.32:443 mix3etbt.website tcp
US 1.1.1.1:53 android.apis.google.com udp
US 1.1.1.1:53 android.apis.google.com udp
US 1.1.1.1:53 android.apis.google.com udp
NL 172.217.168.206:443 android.apis.google.com tcp
NL 142.251.36.46:443 android.apis.google.com tcp
GB 216.58.208.110:443 android.apis.google.com tcp
US 1.1.1.1:53 btcountates.fun udp
NL 62.233.51.32:443 btcountates.fun tcp
US 1.1.1.1:53 semanticlocation-pa.googleapis.com udp
NL 62.233.51.32:443 btcountates.fun tcp
US 1.1.1.1:853 tcp
US 1.1.1.1:853 tcp
NL 62.233.51.32:443 btcountates.fun tcp
NL 62.233.51.32:443 btcountates.fun tcp
NL 62.233.51.32:443 btcountates.fun tcp

Files

/data/user/0/com.amongrestuv/cache/qnqmyysldobxfxp

MD5 7301601b80f1eb5e627e0dd665a1133b
SHA1 7beb4a9e85d728531e6931fbd49f7cc1562102a0
SHA256 e5d85ddf1caf74c78447f42998e050b291c7bd1326bdf696cf0e41b3d015c9e9
SHA512 9cb975f387b218b934e67abedc332a1266111660cf8431154ecb225fe6d61402f0213d34c87b1085929beccccf7abace618b91e5a2ca7a7a804ee82eb5761dc7

/data/user/0/com.amongrestuv/cache/qnqmyysldobxfxp.x86.flock

MD5 d41d8cd98f00b204e9800998ecf8427e
SHA1 da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512 cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

/data/user/0/com.amongrestuv/cache/qnqmyysldobxfxp

MD5 7301601b80f1eb5e627e0dd665a1133b
SHA1 7beb4a9e85d728531e6931fbd49f7cc1562102a0
SHA256 e5d85ddf1caf74c78447f42998e050b291c7bd1326bdf696cf0e41b3d015c9e9
SHA512 9cb975f387b218b934e67abedc332a1266111660cf8431154ecb225fe6d61402f0213d34c87b1085929beccccf7abace618b91e5a2ca7a7a804ee82eb5761dc7

/data/user/0/com.amongrestuv/cache/qnqmyysldobxfxp

MD5 7301601b80f1eb5e627e0dd665a1133b
SHA1 7beb4a9e85d728531e6931fbd49f7cc1562102a0
SHA256 e5d85ddf1caf74c78447f42998e050b291c7bd1326bdf696cf0e41b3d015c9e9
SHA512 9cb975f387b218b934e67abedc332a1266111660cf8431154ecb225fe6d61402f0213d34c87b1085929beccccf7abace618b91e5a2ca7a7a804ee82eb5761dc7

/data/user/0/com.amongrestuv/cache/oat/qnqmyysldobxfxp.cur.prof

MD5 d41d8cd98f00b204e9800998ecf8427e
SHA1 da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512 cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

/data/user/0/com.amongrestuv/shared_prefs/main.xml

MD5 548b670f6d33c340e0f841bd9554fedd
SHA1 23c2fcab6da21a03a6884a8db1fbda44dedb0e65
SHA256 367794fb22730c3925502e8968b17f5384c40795b69b9057dab41d97ef70d221
SHA512 7ce80d8623fd4efd7b50b653b34eddb6af9c17373cbee710954240c75607ab9ff0f3382e0fd6c8fb718bf1e38090585133c0f5c8af672f4c229d22d0adaec732

/data/user/0/com.amongrestuv/shared_prefs/main.xml

MD5 881309731879b553c3ab6adea60cc584
SHA1 afdf7b402a463cdb577644935705ce90be71b0b2
SHA256 83efcb3dad7e45d0ee52965cd6993b74da72aa2628838f28d706ed3d3d54090b
SHA512 7b4787d8dee78c3ec46a8416fe06d5a7f3de62ae976899a645a9fc556661543da66bebe16ac15c74fe17d55e37ebe68e78ad289e127015829799a6d158e051fe

/data/user/0/com.amongrestuv/kl.txt

MD5 d41d8cd98f00b204e9800998ecf8427e
SHA1 da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512 cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

/data/user/0/com.amongrestuv/kl.txt

MD5 d41d8cd98f00b204e9800998ecf8427e
SHA1 da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512 cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

/data/user/0/com.amongrestuv/.qcom.amongrestuv

MD5 046a414913add6f5bb60072c7db819b6
SHA1 451ee4f6809260aec622d772fd329c7d0297a842
SHA256 b66c1320cb063a1d391c94273572ea6edae76c8c8b0a07f8d75c88686f0df72a
SHA512 4e6355f3051ed5e811ab030abde1f5be7f5e1cf33be99cd08477e9b6c015deb1d8bd75a09fb9c7176b8511c5ad0a67abc0902a3531e97564ccb6afc57496a47c

Analysis: behavioral2

Detonation Overview

Submitted

2023-03-17 07:38

Reported

2023-03-17 07:41

Platform

android-x64-arm64-20220823-en

Max time kernel

4001608s

Max time network

156s

Command Line

com.amongrestuv

Signatures

Octo

banker trojan infostealer rat octo

Octo payload

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Makes use of the framework's Accessibility service.

Description Indicator Process Target
Framework service call android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId N/A N/A

Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps).

banker
Description Indicator Process Target
Framework service call android.content.pm.IPackageManager.getInstalledApplications N/A N/A

Acquires the wake lock.

Description Indicator Process Target
Framework service call android.os.IPowerManager.acquireWakeLock N/A N/A

Loads dropped Dex/Jar

Description Indicator Process Target
N/A /data/user/0/com.amongrestuv/cache/qnqmyysldobxfxp N/A N/A
N/A /data/user/0/com.amongrestuv/cache/qnqmyysldobxfxp N/A N/A

Reads information about phone network operator.

Requests disabling of battery optimizations (often used to enable hiding in the background).

evasion
Description Indicator Process Target
Intent action android.settings.REQUEST_IGNORE_BATTERY_OPTIMIZATIONS N/A N/A

Uses Crypto APIs (Might try to encrypt user data).

ransomware
Description Indicator Process Target
Framework API call javax.crypto.Cipher.doFinal N/A N/A

Processes

com.amongrestuv

Network

Country Destination Domain Proto
US 1.1.1.1:53 android.apis.google.com udp
US 1.1.1.1:53 android.apis.google.com udp
NL 142.251.36.14:443 android.apis.google.com tcp
NL 142.251.36.14:443 android.apis.google.com tcp
N/A 224.0.0.251:5353 udp
NL 172.217.168.226:443 tcp
NL 142.251.39.102:443 tcp
US 1.1.1.1:53 android.apis.google.com udp
NL 142.251.36.14:443 android.apis.google.com tcp
US 1.1.1.1:53 infinitedata-pa.googleapis.com udp
NL 142.250.179.202:443 infinitedata-pa.googleapis.com tcp
US 1.1.1.1:53 www.ip-api.com udp
US 208.95.112.1:80 www.ip-api.com tcp
US 1.1.1.1:53 vat-app.su udp
US 1.1.1.1:53 mix3etbt.website udp
NL 62.233.51.32:443 mix3etbt.website tcp
US 1.1.1.1:53 ssl.google-analytics.com udp
NL 142.251.36.8:443 ssl.google-analytics.com tcp
NL 62.233.51.32:443 mix3etbt.website tcp
NL 142.251.36.14:443 android.apis.google.com tcp
NL 62.233.51.32:443 mix3etbt.website tcp
NL 62.233.51.32:443 mix3etbt.website tcp
NL 62.233.51.32:443 mix3etbt.website tcp
NL 62.233.51.32:443 mix3etbt.website tcp
NL 62.233.51.32:443 mix3etbt.website tcp
NL 62.233.51.32:443 mix3etbt.website tcp
NL 62.233.51.32:443 mix3etbt.website tcp
NL 62.233.51.32:443 mix3etbt.website tcp
NL 62.233.51.32:443 mix3etbt.website tcp
NL 62.233.51.32:443 mix3etbt.website tcp
NL 62.233.51.32:443 mix3etbt.website tcp
NL 62.233.51.32:443 mix3etbt.website tcp

Files

/data/user/0/com.amongrestuv/cache/qnqmyysldobxfxp

MD5 7301601b80f1eb5e627e0dd665a1133b
SHA1 7beb4a9e85d728531e6931fbd49f7cc1562102a0
SHA256 e5d85ddf1caf74c78447f42998e050b291c7bd1326bdf696cf0e41b3d015c9e9
SHA512 9cb975f387b218b934e67abedc332a1266111660cf8431154ecb225fe6d61402f0213d34c87b1085929beccccf7abace618b91e5a2ca7a7a804ee82eb5761dc7

/data/user/0/com.amongrestuv/cache/qnqmyysldobxfxp

MD5 7301601b80f1eb5e627e0dd665a1133b
SHA1 7beb4a9e85d728531e6931fbd49f7cc1562102a0
SHA256 e5d85ddf1caf74c78447f42998e050b291c7bd1326bdf696cf0e41b3d015c9e9
SHA512 9cb975f387b218b934e67abedc332a1266111660cf8431154ecb225fe6d61402f0213d34c87b1085929beccccf7abace618b91e5a2ca7a7a804ee82eb5761dc7

/data/user/0/com.amongrestuv/cache/qnqmyysldobxfxp

MD5 7301601b80f1eb5e627e0dd665a1133b
SHA1 7beb4a9e85d728531e6931fbd49f7cc1562102a0
SHA256 e5d85ddf1caf74c78447f42998e050b291c7bd1326bdf696cf0e41b3d015c9e9
SHA512 9cb975f387b218b934e67abedc332a1266111660cf8431154ecb225fe6d61402f0213d34c87b1085929beccccf7abace618b91e5a2ca7a7a804ee82eb5761dc7

/data/user/0/com.amongrestuv/cache/oat/qnqmyysldobxfxp.cur.prof

MD5 d41d8cd98f00b204e9800998ecf8427e
SHA1 da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512 cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

/data/user/0/com.amongrestuv/shared_prefs/main.xml

MD5 548b670f6d33c340e0f841bd9554fedd
SHA1 23c2fcab6da21a03a6884a8db1fbda44dedb0e65
SHA256 367794fb22730c3925502e8968b17f5384c40795b69b9057dab41d97ef70d221
SHA512 7ce80d8623fd4efd7b50b653b34eddb6af9c17373cbee710954240c75607ab9ff0f3382e0fd6c8fb718bf1e38090585133c0f5c8af672f4c229d22d0adaec732

/data/user/0/com.amongrestuv/shared_prefs/main.xml

MD5 81c6104750d372773d6c6450c80680bf
SHA1 78914a4ba82c293a2c3496e6a9a6403391e1054e
SHA256 c98d24a14680a3e748c5ffb9d5749290a40a4cf93873564584e80c9a3d425173
SHA512 0bd3bbe002e31460b855f36cc1ec27c97af99910f502d2647555f9de76d7886bea4382ada2d745c8f53c913585efb8d34a6468c91d5b34715aa3d01dc58248ac

/data/user/0/com.amongrestuv/kl.txt

MD5 d41d8cd98f00b204e9800998ecf8427e
SHA1 da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512 cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

/data/user/0/com.amongrestuv/kl.txt

MD5 d41d8cd98f00b204e9800998ecf8427e
SHA1 da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512 cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

/data/user/0/com.amongrestuv/kl.txt

MD5 d41d8cd98f00b204e9800998ecf8427e
SHA1 da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512 cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

/data/user/0/com.amongrestuv/kl.txt

MD5 d41d8cd98f00b204e9800998ecf8427e
SHA1 da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512 cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

/data/user/0/com.amongrestuv/.qcom.amongrestuv

MD5 046a414913add6f5bb60072c7db819b6
SHA1 451ee4f6809260aec622d772fd329c7d0297a842
SHA256 b66c1320cb063a1d391c94273572ea6edae76c8c8b0a07f8d75c88686f0df72a
SHA512 4e6355f3051ed5e811ab030abde1f5be7f5e1cf33be99cd08477e9b6c015deb1d8bd75a09fb9c7176b8511c5ad0a67abc0902a3531e97564ccb6afc57496a47c

/data/user/0/com.amongrestuv/kl.txt

MD5 d41d8cd98f00b204e9800998ecf8427e
SHA1 da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512 cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

/data/user/0/com.amongrestuv/kl.txt

MD5 d41d8cd98f00b204e9800998ecf8427e
SHA1 da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512 cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

/data/user/0/com.amongrestuv/kl.txt

MD5 d41d8cd98f00b204e9800998ecf8427e
SHA1 da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512 cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

/data/user/0/com.amongrestuv/kl.txt

MD5 d41d8cd98f00b204e9800998ecf8427e
SHA1 da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512 cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

/data/user/0/com.amongrestuv/kl.txt

MD5 d41d8cd98f00b204e9800998ecf8427e
SHA1 da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512 cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

/data/user/0/com.amongrestuv/kl.txt

MD5 d41d8cd98f00b204e9800998ecf8427e
SHA1 da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512 cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

/data/user/0/com.amongrestuv/kl.txt

MD5 d41d8cd98f00b204e9800998ecf8427e
SHA1 da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512 cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e