Overview

overview

10

Static

static

7

1733986e2e...e4.apk

android-9-x86

10

1733986e2e...e4.apk

android-10-x64

10

Resubmissions

30/11/2023, 10:07

231130-l5mpmsaf2t

30/11/2023, 09:22

231130-lbwqfsaa89

29/11/2023, 23:52

231129-3wyh8aeb6t10

29/06/2023, 22:41

230629-2mdl1sfd4810

Analysis

  • max time kernel
    156394s
  • max time network
    50s
  • platform
    android_x64
  • resource
    android-x64-20230621-en
  • submitted
    29/06/2023, 22:41

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    1733986e2e12304cb5890e458dfaea0fabd1db83737439a463970c3353172be4.apk
  • Size 541KB
  • Sample230629-2mdl1sfd48
  • SHA256 1733986e2e12304cb5890e458dfaea0fabd1db83737439a463970c3353172be4
  • MD5 SHA1 SHA512 SSDEEP
Score
10/10
octobankerinfostealerransomwarerattrojan

Malware Config

Extracted

Family

  • octo

C2

  • https://87.120.88.92/MGM2YzAzZGJlZTQz/

  • https://allahkitapads1940.xyz/MGM2YzAzZGJlZTQz/

  • https://siptralosxi13.xyz/MGM2YzAzZGJlZTQz/

  • https://parakazaniyozamcik323232123.xyz/MGM2YzAzZGJlZTQz/

  • https://anayinamiusom.xyz/MGM2YzAzZGJlZTQz/

  • https://birakyakamiorsupuogluusom312.xyz/MGM2YzAzZGJlZTQz/

AES_key

Signatures

  • Octo

    Octo is a banking malware with remote access capabilities first seen in April 2022.

    bankertrojaninfostealerratocto
  • Octo payload 3 IoCs
  • Loads dropped Dex/Jar 2 IoCs

    Runs executable file dropped to the device during analysis.

  • Reads information about phone network operator.
  • Uses Crypto APIs (Might try to encrypt user data). 1 IoCs
    ransomware

Processes

  • com.soonunity
    1⤵
    • Loads dropped Dex/Jar
    • Uses Crypto APIs (Might try to encrypt user data).
    PID:4830

Network

        MITRE ATT&CK Matrix

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        wnxlyhbya
        • Path /data/user/0/com.soonunity/cache/wnxlyhbya
        • Size 450KB
        • SHA256 c8526bfb140cf583f6f5ed7cfe6ad3a349c30232036bb3892afc7b031e17175f
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        wnxlyhbya
        • Path /data/user/0/com.soonunity/cache/wnxlyhbya
        • Size 450KB
        • SHA256 c8526bfb140cf583f6f5ed7cfe6ad3a349c30232036bb3892afc7b031e17175f
        • MD5 SHA1 SHA512 SSDEEP
        Download

        wnxlyhbya
        • Path /data/user/0/com.soonunity/cache/wnxlyhbya
        • Size 450KB
        • SHA256 c8526bfb140cf583f6f5ed7cfe6ad3a349c30232036bb3892afc7b031e17175f
        • MD5 SHA1 SHA512 SSDEEP
        Download

        main.xml
        • Path /data/user/0/com.soonunity/shared_prefs/main.xml
        • Size 131B
        • SHA256 ccfaab3fbb72a5e1a46cde3323019f42771b65c3d78eb24918f563a0d7234cd4
        • MD5 SHA1 SHA512
        Submit Download

        main.xml
        • Path /data/user/0/com.soonunity/shared_prefs/main.xml
        • Size 5KB
        • SHA256 5b4ddf185cac5969b824242a2a385e50520827933519ef3d85b82d5972fb8eff
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download