Overview

overview

10

Static

static

7

com.passwereby.apk

android-9-x86

10

Resubmissions

14/08/2023, 02:48

230814-dafnvagg46

13/08/2023, 09:08

230813-k38cwscc2x10

13/08/2023, 08:43

230813-kmv3maaa2510

13/08/2023, 08:27

230813-kcjxlsca7v10

13/08/2023, 08:18

230813-j7l5saca2x10

13/08/2023, 07:48

230813-jm4t4ahg2510

13/08/2023, 07:06

230813-hw7rnsbf5x10

13/08/2023, 06:53

230813-hn6jmsbf4x10

13/08/2023, 06:52

230813-hnjpwabf4w

13/08/2023, 06:30

230813-g9nqaabe7y

Analysis

  • max time kernel
    3989003s
  • max time network
    766s
  • platform
    android_x86
  • resource
    android-x86-arm-20230621-en
  • submitted
    13/08/2023, 07:06

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    com.passwereby.apk
  • Size 1.4MB
  • Sample230813-hw7rnsbf5x
  • SHA256 e582bce830168449e6099be6288aec5e0c7c321652fe17a44c2ef3fdaea7694e
  • MD5 SHA1 SHA512 SSDEEP
Score
10/10
octobankerevasioninfostealerransomwarerattrojan

Malware Config

Extracted

Family

  • octo

C2

  • https://29p0jb1nyxmt.biz/MTU2OWE0NzJjNGY5/

  • https://fmri3i4567ng.biz/MTU2OWE0NzJjNGY5/

  • https://ahs8a4mz8ehq.online/MTU2OWE0NzJjNGY5/

  • https://518tudu7579h.xyz/MTU2OWE0NzJjNGY5/

  • https://4jsi8qj3203u.org/MTU2OWE0NzJjNGY5/

  • https://4n51yg9firr3.site/MTU2OWE0NzJjNGY5/

  • https://0eto0mhk6g7b.top/MTU2OWE0NzJjNGY5/

  • https://icbm5s5oj028.xyz/MTU2OWE0NzJjNGY5/

  • https://yjf241z0uu75.info/MTU2OWE0NzJjNGY5/

  • https://wanrflitrnvn.asia/MTU2OWE0NzJjNGY5/

  • https://tv1ed54je1ws.cc/MTU2OWE0NzJjNGY5/

  • https://63651iz40cio.biz/MTU2OWE0NzJjNGY5/

AES_key

Signatures

  • Octo

    Octo is a banking malware with remote access capabilities first seen in April 2022.

    bankertrojaninfostealerratocto
  • Octo payload 3 IoCs
  • Makes use of the framework's Accessibility service. 2 IoCs
  • Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps). 1 IoCs
    banker
  • Acquires the wake lock. 1 IoCs
  • Loads dropped Dex/Jar 4 IoCs

    Runs executable file dropped to the device during analysis.

  • Reads information about phone network operator.
  • Removes a system notification. 1 IoCs
    evasion
  • Uses Crypto APIs (Might try to encrypt user data). 1 IoCs
    ransomware

Processes

  • com.passwereby
    1⤵
    • Makes use of the framework's Accessibility service.
    • Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps).
    • Acquires the wake lock.
    • Loads dropped Dex/Jar
    • Removes a system notification.
    • Uses Crypto APIs (Might try to encrypt user data).
    PID:4092
    • /system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.passwereby/app_DynamicOptDex/JfluaaG.json --output-vdex-fd=41 --oat-fd=42 --oat-location=/data/user/0/com.passwereby/app_DynamicOptDex/oat/x86/JfluaaG.odex --compiler-filter=quicken --class-loader-context=&
      2⤵
      • Loads dropped Dex/Jar
      PID:4150

Network

        MITRE ATT&CK Matrix

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        .qcom.passwereby
        • Path /data/user/0/com.passwereby/.qcom.passwereby
        • Size 48B
        • SHA256 b66c1320cb063a1d391c94273572ea6edae76c8c8b0a07f8d75c88686f0df72a
        • MD5 SHA1 SHA512
        Submit Download

        JfluaaG.json
        • Path /data/user/0/com.passwereby/app_DynamicOptDex/JfluaaG.json
        • Size 2KB
        • SHA256 1d15b33832ac157b46a6b358b04d58dbccb06e3efc7622a0cfab7cef06a30604
        • MD5 SHA1 SHA512
        Submit Download

        JfluaaG.json
        • Path /data/user/0/com.passwereby/app_DynamicOptDex/JfluaaG.json
        • Size 6KB
        • SHA256 402bc9113ec2e9d9e508bba5f87a3f6ab2dd99677490d955f03b26b64968c8b3
        • MD5 SHA1 SHA512 SSDEEP
        Download

        JfluaaG.json
        • Path /data/user/0/com.passwereby/app_DynamicOptDex/JfluaaG.json
        • Size 6KB
        • SHA256 17cd2bd8d23dcda29c14d909a7dc3563995699483eef643917585c3b83b7af8a
        • MD5 SHA1 SHA512 SSDEEP
        Download

        index
        • Path /data/user/0/com.passwereby/app_webview/GPUCache/index
        • Size 20B
        • SHA256 3cda72e67c62e52a342309c44f2cb3b6c1019c7b11822e2f628e48e254e2b41c
        • MD5 SHA1 SHA512
        Submit Download

        temp-index
        • Path /data/user/0/com.passwereby/app_webview/GPUCache/index-dir/temp-index
        • Size 48B
        • SHA256 e514c0acc2716c30a6b433bb81b5b8a7e738d2842fba11d0d1cbb6c30c924694
        • MD5 SHA1 SHA512
        Submit Download

        Web Data
        • Path /data/user/0/com.passwereby/app_webview/Web Data
        • Size 104KB
        • SHA256 47e65f4de08deabfd52ecdb8b0a29c61c482188b92c36182e2112ca0a8f4ff65
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        Web Data-journal
        • Path /data/user/0/com.passwereby/app_webview/Web Data-journal
        • Size 1KB
        • SHA256 a5ae64f5b8f7b5ba62102feac3a2699ed45962033b199e0900a9b49ca3d92067
        • MD5 SHA1 SHA512
        Submit Download

        metrics_guid
        • Path /data/user/0/com.passwereby/app_webview/metrics_guid
        • Size 36B
        • SHA256 6125665c010d13c37ef1864fe96141996eda3ff5052bd5724701a36bc0cce15e
        • MD5 SHA1 SHA512
        Submit Download

        kubmccjq
        • Path /data/user/0/com.passwereby/cache/kubmccjq
        • Size 271KB
        • SHA256 ecb4cfb8b1bbe439b57e8d63622606a4b3d76ce7bab4b3c89249bb99755089fa
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        kubmccjq
        • Path /data/user/0/com.passwereby/cache/kubmccjq
        • Size 271KB
        • SHA256 ecb4cfb8b1bbe439b57e8d63622606a4b3d76ce7bab4b3c89249bb99755089fa
        • MD5 SHA1 SHA512 SSDEEP
        Download

        kubmccjq
        • Path /data/user/0/com.passwereby/cache/kubmccjq
        • Size 271KB
        • SHA256 ecb4cfb8b1bbe439b57e8d63622606a4b3d76ce7bab4b3c89249bb99755089fa
        • MD5 SHA1 SHA512 SSDEEP
        Download

        WebViewChromiumPrefs.xml
        • Path /data/user/0/com.passwereby/shared_prefs/WebViewChromiumPrefs.xml
        • Size 127B
        • SHA256 bb61b7c087c2ae2de93a7740ff75707342940557146366e92b840284cd9446af
        • MD5 SHA1 SHA512
        Submit Download

        main.xml
        • Path /data/user/0/com.passwereby/shared_prefs/main.xml
        • Size 132B
        • SHA256 4b7baccffae6451813b1516905248e514440acd76081156b985771650e566f22
        • MD5 SHA1 SHA512
        Submit Download

        main.xml
        • Path /data/user/0/com.passwereby/shared_prefs/main.xml
        • Size 3KB
        • SHA256 1e88ab05ffdfa1bca2b4d5c3a9028dfb2b50a3145dcbe9682db80270f085dac7
        • MD5 SHA1 SHA512
        Submit Download