octo | ac304ed2f1ffc973ebf9cad35468473310c8a3472833cec5dbbc65f5541d8b92

General

Target

ac304ed2f1ffc973ebf9cad35468473310c8a3472833cec5dbbc65f5541d8b92.apk
Size

541KB
MD5

0331356b4fd152b94482b2b136a63c7a
SHA1

6182861e23b411f28b79325bb113aa2c0526482f
SHA256

ac304ed2f1ffc973ebf9cad35468473310c8a3472833cec5dbbc65f5541d8b92
SHA512

2e2dec0e1abdd1d20d30dec466ee5f41fdcdc7ce965ff5347ea4982b4925ea9dbf5744164b570b2f5490cd957d2fd79d1e67bc3b9962f3f852100396dba7b203
SSDEEP

12288:UykRqYxsL++RDHFAe3mHwBKNU1xVBcKY2l6HiqcT+aQaLDZ:UXfxfErF5S9UHVBrY50HQah

Score

10^/10

octo banker evasion infostealer ransomware rat trojan

Malware Config

Extracted

Family

octo

C2

https://eses432532s.xyz/ZTIyNTVmMmE1NzNl/

https://3ses432532s.xyz/ZTIyNTVmMmE1NzNl/

https://5ses432532s.xyz/ZTIyNTVmMmE1NzNl/

https://4ses432532s.xyz/ZTIyNTVmMmE1NzNl/

https://logite234s.xyz/ZTIyNTVmMmE1NzNl/

https://logit32532s.xyz/ZTIyNTVmMmE1NzNl/

https://logits432532s.xyz/ZTIyNTVmMmE1NzNl/

https://logites432532s.xyz/ZTIyNTVmMmE1NzNl/

https://2logite234s.xyz/ZTIyNTVmMmE1NzNl/

https://5logit32532s.xyz/ZTIyNTVmMmE1NzNl/

https://8logits432532s.xyz/ZTIyNTVmMmE1NzNl/

https://1logites432532s.xyz/ZTIyNTVmMmE1NzNl/

AES_key

Signatures

Octo
Octo is a banking malware with remote access capabilities first seen in April 2022.
banker trojan infostealer rat octo

Octo payload 3 IoCs

resource	yara_rule
behavioral1/files/4189-0.dat	family_octo
behavioral1/memory/4189-0.dex	family_octo
behavioral1/memory/4189-1.dex	family_octo

Makes use of the framework's Accessibility service. 2 IoCs

description	ioc	Process
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId	com.noticetopzw
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByViewId	com.noticetopzw

Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps). 1 IoCs

banker

description	ioc	Process
Framework service call	android.content.pm.IPackageManager.getInstalledApplications	com.noticetopzw

Acquires the wake lock. 1 IoCs

description	ioc	Process
Framework service call	android.os.IPowerManager.acquireWakeLock	com.noticetopzw

Loads dropped Dex/Jar 2 IoCs

Runs executable file dropped to the device during analysis.

ioc	pid	Process
/data/user/0/com.noticetopzw/cache/jibvxqniygismef	4189	com.noticetopzw
/data/user/0/com.noticetopzw/cache/jibvxqniygismef	4189	com.noticetopzw

Reads information about phone network operator.

Requests disabling of battery optimizations (often used to enable hiding in the background). 1 IoCs

evasion

description	ioc	Process
Intent action	android.settings.REQUEST_IGNORE_BATTERY_OPTIMIZATIONS	com.noticetopzw

Uses Crypto APIs (Might try to encrypt user data). 1 IoCs

ransomware

description	ioc	Process
Framework API call	javax.crypto.Cipher.doFinal	com.noticetopzw

com.noticetopzw
1⤵
- Makes use of the framework's Accessibility service.
- Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps).
- Acquires the wake lock.
- Loads dropped Dex/Jar
- Requests disabling of battery optimizations (often used to enable hiding in the background).
- Uses Crypto APIs (Might try to encrypt user data).
PID:4189

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

/data/user/0/com.noticetopzw/cache/jibvxqniygismef

Filesize
450KB

MD5
9b008dfb5967d948056edf09e4abbf26

SHA1
e11f68e09c73bc53610d5013125f801403dee329

SHA256
44ebb6b15123e14ecc3c0cd4c2550ab005a7a4fcdc6ed4047c4eddbe56d59bf4

SHA512
688b8eac6a235833b6bf168737aaa9d143ae2a08677e3085e086de630bfe69d1406f463b6ce7a8b8c71ab6efe22214e8ad016e81fa3ad9d091a5f1d5bca8485a

Download Submit
/data/user/0/com.noticetopzw/cache/jibvxqniygismef

Filesize
450KB

MD5
9b008dfb5967d948056edf09e4abbf26

SHA1
e11f68e09c73bc53610d5013125f801403dee329

SHA256
44ebb6b15123e14ecc3c0cd4c2550ab005a7a4fcdc6ed4047c4eddbe56d59bf4

SHA512
688b8eac6a235833b6bf168737aaa9d143ae2a08677e3085e086de630bfe69d1406f463b6ce7a8b8c71ab6efe22214e8ad016e81fa3ad9d091a5f1d5bca8485a

Download Submit
/data/user/0/com.noticetopzw/cache/jibvxqniygismef

Filesize
450KB

MD5
9b008dfb5967d948056edf09e4abbf26

SHA1
e11f68e09c73bc53610d5013125f801403dee329

SHA256
44ebb6b15123e14ecc3c0cd4c2550ab005a7a4fcdc6ed4047c4eddbe56d59bf4

SHA512
688b8eac6a235833b6bf168737aaa9d143ae2a08677e3085e086de630bfe69d1406f463b6ce7a8b8c71ab6efe22214e8ad016e81fa3ad9d091a5f1d5bca8485a

Download Submit
/data/user/0/com.noticetopzw/shared_prefs/main.xml

Filesize
133B

MD5
baee19d7f89602a967859ad5955bb19c

SHA1
75da769464dfaf928a0f66eed444b6134b561ebf

SHA256
cebc9bec6859a51207597a4423a78444d3c6b01a4f900fae1e7860313c321768

SHA512
ebab57225e2d83151573737f9ff3a9f72d9f1bd02f639d3a4c4335903f983a2645a66d8f0a13ad0313fad9a6d2d5bb26462ca5847adee89202ea874f35931cec

Download Submit
/data/user/0/com.noticetopzw/shared_prefs/main.xml

Filesize
202B

MD5
fe1f3581f415f51dad0ca7e595e9122a

SHA1
1869c3c2496084e43a4c45dab331aa3774c93846

SHA256
62eb2b44c73a015c0b27caea1ce262ec8a2ab53c9a94eb09d8c796db88ff02c1

SHA512
8a8b2e14cd3dc27d87a3fd40dfefdf8b622e7796a6fc1b7ec53c011475de52823544201a3c9a8f552163a5fe81d6bc0dc3efba5d2614295a165732e5193d683d

Download Submit
/data/user/0/com.noticetopzw/shared_prefs/main.xml

Filesize
3KB

MD5
35da630573b96efcc81f5b49083209e4

SHA1
871497cf0aab1799c0d021ecd53773e2e1055c10

SHA256
ac604f2bf80bb70ffc92747e44c540c9c3d5a712fefb08941c12cd3c765d7310

SHA512
151009b8934a12c3ce0f5790aa1ef9a8cef7302a56768d9d9227a6474ec5f4abd8d4dcec81e785c526330f71b3303b217e82d2dbf4f2f2e01947acce5665aa45

Download Submit

Analysis

Sharing