octo

General

Target
b3b6a47aa1b1d8d21ba3e1f7db1210dc5ff90cff89739fd1002889b87a07e157.bin
Size 2.0MB
Sample230719-x5k2laag55
SHA256 b3b6a47aa1b1d8d21ba3e1f7db1210dc5ff90cff89739fd1002889b87a07e157
MD5 bc9b93848ac3d38f68f99a91c2428343
SHA1 796ceaa60c838d7a97e70c822bfce8f77b192963
SHA512 d80e3858d0a6e938a68f658983980c512934f788b3829ba728d3072d7913b0719abcb49ced57653c9491c4fe39ba1826dddcdb272e7fe81dbcb12e19703fc204
SSDEEP 24576:5cYsudeQ3Njm5MYUsmDkHnN4yoLNu7Oab2Rpb65gwROQKgb3u3TcPk/MxsXGGeFg:5cYsudeL8smD6oBuJnKgjS4k/gOtqg+M
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

Malware Config

Extracted

Family

octo

C2

https://marmonth.space/YWRhZjAxNGM1YjFh/
https://spaceopenstar.tech/YWRhZjAxNGM1YjFh/
https://yupinytro.pw/YWRhZjAxNGM1YjFh/
https://kopenhardm.fun/YWRhZjAxNGM1YjFh/
https://bugutars.online/YWRhZjAxNGM1YjFh/

AES_key

Targets

- Target
  b3b6a47aa1b1d8d21ba3e1f7db1210dc5ff90cff89739fd1002889b87a07e157.bin
- Size 2.0MB
- SHA256 b3b6a47aa1b1d8d21ba3e1f7db1210dc5ff90cff89739fd1002889b87a07e157
- MD5 bc9b93848ac3d38f68f99a91c2428343
- SHA1 796ceaa60c838d7a97e70c822bfce8f77b192963
- SHA512 d80e3858d0a6e938a68f658983980c512934f788b3829ba728d3072d7913b0719abcb49ced57653c9491c4fe39ba1826dddcdb272e7fe81dbcb12e19703fc204
- SSDEEP 24576:5cYsudeQ3Njm5MYUsmDkHnN4yoLNu7Oab2Rpb65gwROQKgb3u3TcPk/MxsXGGeFg:5cYsudeL8smD6oBuJnKgjS4k/gOtqg+M
- MD5 SHA1 SHA512 SSDEEP
Score

10^/10

octo banker evasion infostealer ransomware rat trojan
- Octo
  Octo is a banking malware with remote access capabilities first seen in April 2022.
  banker trojan infostealer rat octo
- Octo payload
- Makes use of the framework's Accessibility service.
- Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps).
  banker
- Acquires the wake lock.
- Loads dropped Dex/Jar
  Runs executable file dropped to the device during analysis.
- Reads information about phone network operator.
- Removes a system notification.
  evasion
- Uses Crypto APIs (Might try to encrypt user data).
  ransomware
behavioral1 behavioral2
- Target
  libimage_processing_util_jni.so
- Size 20KB
- SHA256 9513a5bd56b26987bd08b7cfbea17bd7ac912c2889607b1fdd048bd96b574f02
- MD5 9dfe35d5469fe03d14204963ebfc8379
- SHA1 9941f236f5fc1f12949d7f0c2cdd8ba643951e07
- SHA512 a1009bbf78d958869fe705bb0197a3e5350597f356bce1f9cbe468846002c76677a861ae385813c662ab53713b71fa02b9db1f255c7854a3dc02f6ec998ca7fa
- SSDEEP 384:bnDsmWnR9BWBqZduyQ0cnZF8C1upI/tttn/8cF4AXnKBFPclI:HsmWnV5fuyQTnZF8qupI/tDkcF4MKrPt
- MD5 SHA1 SHA512 SSDEEP
Score

1^/10
behavioral3
- Target
  librsjni.so
- Size 58KB
- SHA256 28198c4d011320d8283ae85fc49190fe57ab8b6a466d3ac770e07c113f5ad9f4
- MD5 c4ad69a70160b7a3bc4d322eae197c15
- SHA1 466e073c49417507a3418e2079b9696c0d78e727
- SHA512 16f28c340dfcd1f01e3622ebb677662ffeb035f3b1153aee7aadc7a5cf34426fe32653cd58ce1e5cea5dc081676e09bf14bf97cb3e5a75a951b7ea756c3464e0
- SSDEEP 1536:jSu9/Xfk80MEcUsk80MEcUsk80MEcUsk80MEcUsVtlQBxhsrr5LGZtXGeVVJ1S6K:jSyXfk80MEcUsk80MEcUsk80MEcUsk8n
- MD5 SHA1 SHA512 SSDEEP
Score

1^/10
behavioral4

MITRE ATT&CK Matrix

Tasks

Sharing

General

Malware Config

Extracted

Targets

Octo payload

Makes use of the framework's Accessibility service.

Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps).

Acquires the wake lock.

Loads dropped Dex/Jar

Reads information about phone network operator.

Removes a system notification.

Uses Crypto APIs (Might try to encrypt user data).

MITRE ATT&CK Matrix

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4