Analysis
-
max time kernel
2297165s -
max time network
144s -
platform
android_x86 -
resource
android-x86-arm-20220823-en -
submitted
05-06-2023 00:13
General
-
Target
65075ae9938efafa6e52b50f70dbae7c5b9ad116e79fed356a1c72011910de22.apk
-
Size
557KB
-
MD5
e06f839e7c37e02e94467032510b0802
-
SHA1
9e8afb2f94cd4a5cc80221b0ebf0b1ed9ab62e03
-
SHA256
65075ae9938efafa6e52b50f70dbae7c5b9ad116e79fed356a1c72011910de22
-
SHA512
543c9fcb98ef1cae44f8774d59de72c9ad19d2057cd84dd5068f302651cb254cf33456175dd5132975df52e90d3ffcf5df1544183d12fb16af91d2442fd1e9a8
-
SSDEEP
12288:cCholSt/Zti+Rwgwzpp7GRWd7EfhB6rCIxrScmUMul7PpokcoYtWReyNx0BJ4:Joib3RwgwmWdwhgrmcGo7Ppok3Rx3
Malware Config
Extracted
octo
https://179.43.163.113/YTFlMzViNjNiNWM3/
https://179.43.163.122/YTFlMzViNjNiNWM3/
https://slmmistosi.com/YTFlMzViNjNiNWM3/
https://slmmistosi2.com/YTFlMzViNjNiNWM3/
https://179.43.163.117/YTFlMzViNjNiNWM3/
https://179.43.163.118/YTFlMzViNjNiNWM3/
https://yamass2432425ds.xyz/YTFlMzViNjNiNWM3/
https://yamass3432425ds.xyz/YTFlMzViNjNiNWM3/
Signatures
-
Octo
Octo is a banking malware with remote access capabilities first seen in April 2022.
-
Octo payload 3 IoCs
-
Makes use of the framework's Accessibility service. 1 IoCs
-
Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps). 1 IoCs
-
Acquires the wake lock. 1 IoCs
-
Loads dropped Dex/Jar 2 IoCs
Runs executable file dropped to the device during analysis.
-
Reads information about phone network operator.
-
Requests disabling of battery optimizations (often used to enable hiding in the background). 1 IoCs
-
Uses Crypto APIs (Might try to encrypt user data). 1 IoCs
Processes
-
com.wellmosty1⤵
- Makes use of the framework's Accessibility service.
- Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps).
- Acquires the wake lock.
- Loads dropped Dex/Jar
- Requests disabling of battery optimizations (often used to enable hiding in the background).
- Uses Crypto APIs (Might try to encrypt user data).
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
48B
MD5046a414913add6f5bb60072c7db819b6
SHA1451ee4f6809260aec622d772fd329c7d0297a842
SHA256b66c1320cb063a1d391c94273572ea6edae76c8c8b0a07f8d75c88686f0df72a
SHA5124e6355f3051ed5e811ab030abde1f5be7f5e1cf33be99cd08477e9b6c015deb1d8bd75a09fb9c7176b8511c5ad0a67abc0902a3531e97564ccb6afc57496a47c
-
Filesize
448KB
MD5c340e087b6382b3038fdc8f3bdbd9108
SHA1591f61f9011f64e7df7b40a312503b5d73d99726
SHA2562d1e51d0e1fb6799ffa9216d0ee777fa5e9b39e6e321c3191855d48dd5242706
SHA512e145c7d58431330f83b8f14b2a85a62e9c4b822dd5ac42a6ecd26627321d9f59eeecd5cae4625490d24f65a7a22f9d5465570f9dcb8b7ce16e26b67fb758c78b
-
Filesize
448KB
MD5c340e087b6382b3038fdc8f3bdbd9108
SHA1591f61f9011f64e7df7b40a312503b5d73d99726
SHA2562d1e51d0e1fb6799ffa9216d0ee777fa5e9b39e6e321c3191855d48dd5242706
SHA512e145c7d58431330f83b8f14b2a85a62e9c4b822dd5ac42a6ecd26627321d9f59eeecd5cae4625490d24f65a7a22f9d5465570f9dcb8b7ce16e26b67fb758c78b
-
Filesize
448KB
MD5c340e087b6382b3038fdc8f3bdbd9108
SHA1591f61f9011f64e7df7b40a312503b5d73d99726
SHA2562d1e51d0e1fb6799ffa9216d0ee777fa5e9b39e6e321c3191855d48dd5242706
SHA512e145c7d58431330f83b8f14b2a85a62e9c4b822dd5ac42a6ecd26627321d9f59eeecd5cae4625490d24f65a7a22f9d5465570f9dcb8b7ce16e26b67fb758c78b
-
Filesize
131B
MD55f3dd0f7ebf04710708c47d08ae915f7
SHA1cb3aa5ea8a24b87363a5c35d87c3df432d7d7b6b
SHA2566c38390863c1250690bd798e72b9c3ccf447626290bfafbfd0f5bd5dffddabbf
SHA512e53f169360037daf00e4d48ce9b0a3be9a3c1c04e1f2e06ab8fdcf88bbee2406519069a24639b3cda21f1a6ac15d06ee68b532065f92c6869591a5206b0098ee
-
Filesize
3KB
MD5218d75f020eaa494054b6c55e208a882
SHA1d3c36f49e3644f93f0b963961c8d2d3c900d7b2e
SHA256522b51fc8a29d700aaa76fad55ed98e79aa16c6c45a8b97485512c449e4422ed
SHA512d28a407098328b35179d092ce942334cc08b71db2029e871291beb593e06ab55034ccc7649baff1b12c4018c03bdfe25f33b93dbd2f66b24027ee34deba90375