Overview

overview

10

Static

static

7

GooglePlay...te.apk

android-9-x86

10

GooglePlay...te.apk

android-10-x64

10

Resubmissions

10-06-2023 13:52

230610-q6nqjsfb34 10

10-06-2023 08:13

230610-j4wvtafb3x 10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    GooglePlay23Update.apk

  • Size

    527KB

  • Sample

    230610-q6nqjsfb34

  • MD5

    678ec9c49e39cfb9968133070a42bc68

  • SHA1

    81f3a1c6f9cb21da4b7583950c57df19ad792954

  • SHA256

    b8f6a1c6bca732179a2910f4edfe14da338fc450916c3ac30624ab0e97ee5cdb

  • SHA512

    08a4f71f1391b4576ae09c54202ada1e5fdeb4ee340d63c8238d6dd9eb957acb7648acf46720d6625551f65df504b65030665d4e7532d8e03870318a1349ca32

  • SSDEEP

    12288:dsrKKeBnu0q711M8r/P0YqyICAiVJJupr8+/CKIl4a:dsl4u0qn5TvZAqJom+HIl1

Score
10/10
octoandroidbankerevasioninfostealerransomwarerattrojan

Malware Config

Extracted

Family

octo

C2

https://2fdghhoo11.top/doc/

https://3fdghhoo11.top/doc/

https://4fdghhoo11.top/doc/

https://5fdghhoo11.top/doc/

https://6fdghhoo11.top/doc/

https://7fdghhoo11.top/doc/

https://8fdghhoo11.top/doc/

https://9fdghhoo11.top/doc/

https://10fdghhoo11.top/doc/

https://11fdghhoo11.top/doc/

https://12fdghhoo11.top/doc/

https://13fdghhoo11.top/doc/

https://14fdghhoo11.top/doc/

https://15fdghhoo11.top/doc/

https://16fdghhoo11.top/doc/

https://17fdghhoo11.top/doc/

https://18fdghhoo11.top/doc/

https://19fdghhoo11.top/doc/

https://20fdghhoo11.top/doc/

https://21fdghhoo11.top/doc/
AES_key

Targets

    • Target

      GooglePlay23Update.apk

    • Size

      527KB

    • MD5

      678ec9c49e39cfb9968133070a42bc68

    • SHA1

      81f3a1c6f9cb21da4b7583950c57df19ad792954

    • SHA256

      b8f6a1c6bca732179a2910f4edfe14da338fc450916c3ac30624ab0e97ee5cdb

    • SHA512

      08a4f71f1391b4576ae09c54202ada1e5fdeb4ee340d63c8238d6dd9eb957acb7648acf46720d6625551f65df504b65030665d4e7532d8e03870318a1349ca32

    • SSDEEP

      12288:dsrKKeBnu0q711M8r/P0YqyICAiVJJupr8+/CKIl4a:dsl4u0qn5TvZAqJom+HIl1

    Score
    10/10
    octobankerevasioninfostealerransomwarerattrojan

    • Octo

      Octo is a banking malware with remote access capabilities first seen in April 2022.

      bankertrojaninfostealerratocto

    • Octo payload

    • Makes use of the framework's Accessibility service.

    • Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps).

      banker

    • Acquires the wake lock.

    • Loads dropped Dex/Jar

      Runs executable file dropped to the device during analysis.

    • Requests enabling of the accessibility settings.

    • Reads information about phone network operator.

    • Requests disabling of battery optimizations (often used to enable hiding in the background).

      evasion

    • Removes a system notification.

      evasion

    • Uses Crypto APIs (Might try to encrypt user data).

      ransomware
    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks