octo | b2c01a8141c1be61e26e8f663d5b28207f1bdd2e259487d0904f11e7eafcae31

General

Target

b2c01a8141c1be61e26e8f663d5b28207f1bdd2e259487d0904f11e7eafcae31.apk
Size

541KB
MD5

e9686ea8a9a4ff91980f2d6dcfdfda38
SHA1

4cc8010d3b69c768be00be2437da56a1232d1bac
SHA256

b2c01a8141c1be61e26e8f663d5b28207f1bdd2e259487d0904f11e7eafcae31
SHA512

c429605ab8aa6d768134b3e0c3fb91a15d1103b8a19f588e7937afb9eea2873962b995d61fec31418e74aa81b6a96d6a24d3fb62a1897f9121ce1de1cecb0d19
SSDEEP

12288:TXGbO+aqAoyN+bvPUv/XxZJ8M9pjTmdsH88kO9fNkq2fcK:bGpaqA5NJhZXlpd99fw3

Score

10^/10

octo banker evasion infostealer ransomware rat trojan

Malware Config

Extracted

Family

octo

C2

https://12logites432532s.xyz/ZTIyNTVmMmE1NzNl/

https://13logites432532s.xyz/ZTIyNTVmMmE1NzNl/

https://14logites432532s.xyz/ZTIyNTVmMmE1NzNl/

https://15logites432532s.xyz/ZTIyNTVmMmE1NzNl/

https://16logites432532s.xyz/ZTIyNTVmMmE1NzNl/

https://17logites432532s.xyz/ZTIyNTVmMmE1NzNl/

https://18logites432532s.xyz/ZTIyNTVmMmE1NzNl/

https://19logites432532s.xyz/ZTIyNTVmMmE1NzNl/

https://20logites432532s.xyz/ZTIyNTVmMmE1NzNl/

https://21logites432532s.xyz/ZTIyNTVmMmE1NzNl/

https://22logites432532s.xyz/ZTIyNTVmMmE1NzNl/

AES_key

Signatures

Octo
Octo is a banking malware with remote access capabilities first seen in April 2022.
banker trojan infostealer rat octo

Octo payload 3 IoCs

resource	yara_rule
behavioral2/files/4317-0.dat	family_octo
behavioral2/memory/4317-0.dex	family_octo
behavioral2/memory/4317-1.dex	family_octo

Makes use of the framework's Accessibility service. 2 IoCs

description	ioc	Process
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId	com.recordoutqvk
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByViewId	com.recordoutqvk

Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps). 1 IoCs

banker

description	ioc	Process
Framework service call	android.content.pm.IPackageManager.getInstalledApplications	com.recordoutqvk

Acquires the wake lock. 1 IoCs

description	ioc	Process
Framework service call	android.os.IPowerManager.acquireWakeLock	com.recordoutqvk

Loads dropped Dex/Jar 2 IoCs

Runs executable file dropped to the device during analysis.

ioc	pid	Process
/data/user/0/com.recordoutqvk/cache/ibnpgejlkv	4317	com.recordoutqvk
/data/user/0/com.recordoutqvk/cache/ibnpgejlkv	4317	com.recordoutqvk

Reads information about phone network operator.

Requests disabling of battery optimizations (often used to enable hiding in the background). 1 IoCs

evasion

description	ioc	Process
Intent action	android.settings.REQUEST_IGNORE_BATTERY_OPTIMIZATIONS	com.recordoutqvk

Uses Crypto APIs (Might try to encrypt user data). 1 IoCs

ransomware

description	ioc	Process
Framework API call	javax.crypto.Cipher.doFinal	com.recordoutqvk

com.recordoutqvk
1⤵
- Makes use of the framework's Accessibility service.
- Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps).
- Acquires the wake lock.
- Loads dropped Dex/Jar
- Requests disabling of battery optimizations (often used to enable hiding in the background).
- Uses Crypto APIs (Might try to encrypt user data).
PID:4317

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

/data/user/0/com.recordoutqvk/.qcom.recordoutqvk

Filesize
48B

MD5
046a414913add6f5bb60072c7db819b6

SHA1
451ee4f6809260aec622d772fd329c7d0297a842

SHA256
b66c1320cb063a1d391c94273572ea6edae76c8c8b0a07f8d75c88686f0df72a

SHA512
4e6355f3051ed5e811ab030abde1f5be7f5e1cf33be99cd08477e9b6c015deb1d8bd75a09fb9c7176b8511c5ad0a67abc0902a3531e97564ccb6afc57496a47c

Download Submit
/data/user/0/com.recordoutqvk/cache/ibnpgejlkv

Filesize
450KB

MD5
db9d420d9fd9f5634cdd1121e9119c73

SHA1
0d6dbae3e81924006101c114f40c3571ae74fdde

SHA256
2a7b666c91c2f3b5985cc7e630baae58c330cf76e43028971c9be1827f5e17d7

SHA512
ab4ac57565bb227705e3c09f1a37d76a7c015240600ae420f1bf9a7b0cf89883c647eaee4d19ddddf0b831e7782bf3eed8c056511155aaea54da464e5aaaa119

Download Submit
/data/user/0/com.recordoutqvk/cache/ibnpgejlkv

Filesize
450KB

MD5
db9d420d9fd9f5634cdd1121e9119c73

SHA1
0d6dbae3e81924006101c114f40c3571ae74fdde

SHA256
2a7b666c91c2f3b5985cc7e630baae58c330cf76e43028971c9be1827f5e17d7

SHA512
ab4ac57565bb227705e3c09f1a37d76a7c015240600ae420f1bf9a7b0cf89883c647eaee4d19ddddf0b831e7782bf3eed8c056511155aaea54da464e5aaaa119

Download Submit
/data/user/0/com.recordoutqvk/cache/ibnpgejlkv

Filesize
450KB

MD5
db9d420d9fd9f5634cdd1121e9119c73

SHA1
0d6dbae3e81924006101c114f40c3571ae74fdde

SHA256
2a7b666c91c2f3b5985cc7e630baae58c330cf76e43028971c9be1827f5e17d7

SHA512
ab4ac57565bb227705e3c09f1a37d76a7c015240600ae420f1bf9a7b0cf89883c647eaee4d19ddddf0b831e7782bf3eed8c056511155aaea54da464e5aaaa119

Download Submit
/data/user/0/com.recordoutqvk/shared_prefs/main.xml

Filesize
134B

MD5
839204e3d36682c50980085c0b580327

SHA1
2bf1344f6bfbf8aacc48f331d6b9a0e9c1e24265

SHA256
91f015249a236826ef39ae19c1ec0dff285cafb648677592245094a3a0142b84

SHA512
9c85248a1147df4270e07494f06dc1604ce5d6e9d864bbf4f84c61dca894a72bab392217bd84f522d02d6dddba21ef5710fa2cb5c0826be2bd535b391a521962

Download Submit
/data/user/0/com.recordoutqvk/shared_prefs/main.xml

Filesize
7KB

MD5
3d221ce1bcd8cc68e515df7783c48f29

SHA1
3ea12cbe0c56a6133bafa3fc8341769a2908eec6

SHA256
22d367b2100dc314fd6feeabed34299a8b16764e7d236e4011bec6d4a825807c

SHA512
c8a768a198ed530dd9fe01a84fc65fbd3256aff45a2d189a0099670a4ad75bba7c8e700a037a895fcf1bcfb372019fc9b5504a667f2a43be89bb3d85cbbbf448

Download Submit

Analysis

Sharing