Overview

overview

10

Static

static

7

com.amvery4.apk

android-10-x64

10

com.amvery4.apk

android-11-x64

10

com.amvery4.apk

android-9-x86

10

Resubmissions

03/11/2023, 03:44

231103-eapr7ade77 10

14/08/2023, 23:16

230814-28586afg99 10

14/08/2023, 23:14

230814-28bpjshh6t 10

14/08/2023, 23:13

230814-27c6zsfg95 10

14/08/2023, 04:43

230814-fcfsqshe37 10

14/08/2023, 04:42

230814-fbpz1she28 10

13/08/2023, 13:51

230813-q5sccach63 10

13/07/2023, 06:05

230713-gtdv5sfe43 10

Analysis

  • max time kernel
    4066245s
  • max time network
    139s
  • platform
    android_x86
  • resource
    android-x86-arm-20230621-en
  • submitted
    14/08/2023, 04:43

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    com.amvery4.apk

  • Size

    1.7MB

  • MD5

    25d99eea253d09f79fb4b8d39364ed8d

  • SHA1

    8d923163764cc12fc287d81a718b4533e08f2fe9

  • SHA256

    11dcd47ea09e8c1efe551e1832c7aeea810dce127f78299fce8d72a638fd9f51

  • SHA512

    c82abf598ad8d3ac817c817496b8edeb0672d57a7771f7f707598a7c6d1ead5e282170c6da2f467b66e06f89020ab7152e6936b6b9a0c947805a55b34e9b3e25

  • SSDEEP

    24576:VuNlJrpZQO3cf8Flg0f4dpDWRghaJMpv2uQOdPq0ZmARC6LD6RCaEABDMyZF:2j4M4/a+haJqv2uQOzZ2RCaEABYCF

Score
10/10
octobankerevasioninfostealerransomwarerattrojan

Malware Config

Extracted

Family

octo

C2

https://176.113.115.110/YjcyMWYzZjc5OTUy/

https://31fdghhoo11.com/YjcyMWYzZjc5OTUy/

https://32fdghhoo11.com/YjcyMWYzZjc5OTUy/

https://33fdghhoo11.com/YjcyMWYzZjc5OTUy/

https://34fdghhoo11.com/YjcyMWYzZjc5OTUy/

https://35fdghhoo11.com/YjcyMWYzZjc5OTUy/

https://36fdghhoo11.com/YjcyMWYzZjc5OTUy/

https://37fdghhoo11.com/YjcyMWYzZjc5OTUy/

https://38fdghhoo11.com/YjcyMWYzZjc5OTUy/

https://39fdghhoo11.com/YjcyMWYzZjc5OTUy/

https://40fdghhoo11.com/YjcyMWYzZjc5OTUy/

https://41fdghhoo11.com/YjcyMWYzZjc5OTUy/

https://42fdghhoo11.com/YjcyMWYzZjc5OTUy/

https://43fdghhoo11.com/YjcyMWYzZjc5OTUy/

https://44fdghhoo11.com/YjcyMWYzZjc5OTUy/

https://45fdghhoo11.com/YjcyMWYzZjc5OTUy/

https://46fdghhoo11.com/YjcyMWYzZjc5OTUy/

https://47fdghhoo11.com/YjcyMWYzZjc5OTUy/

https://48fdghhoo11.com/YjcyMWYzZjc5OTUy/

https://49fdghhoo11.com/YjcyMWYzZjc5OTUy/
AES_key

Signatures

  • Octo

    Octo is a banking malware with remote access capabilities first seen in April 2022.

    bankertrojaninfostealerratocto
  • Octo payload 3 IoCs
  • Makes use of the framework's Accessibility service. 2 IoCs
  • Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps). 1 IoCs
    banker
  • Acquires the wake lock. 1 IoCs
  • Loads dropped Dex/Jar 4 IoCs

    Runs executable file dropped to the device during analysis.

  • Reads information about phone network operator.
  • Removes a system notification. 1 IoCs
    evasion
  • Uses Crypto APIs (Might try to encrypt user data). 1 IoCs
    ransomware

Processes

  • com.amvery4
    1⤵
    • Makes use of the framework's Accessibility service.
    • Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps).
    • Acquires the wake lock.
    • Loads dropped Dex/Jar
    • Removes a system notification.
    • Uses Crypto APIs (Might try to encrypt user data).
    PID:4062
    • /system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.amvery4/app_DynamicOptDex/rQiZfat.json --output-vdex-fd=41 --oat-fd=42 --oat-location=/data/user/0/com.amvery4/app_DynamicOptDex/oat/x86/rQiZfat.odex --compiler-filter=quicken --class-loader-context=&
      2⤵
      • Loads dropped Dex/Jar
      PID:4162

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • /data/user/0/com.amvery4/.qcom.amvery4
    Filesize

    48B

    MD5

    046a414913add6f5bb60072c7db819b6

    SHA1

    451ee4f6809260aec622d772fd329c7d0297a842

    SHA256

    b66c1320cb063a1d391c94273572ea6edae76c8c8b0a07f8d75c88686f0df72a

    SHA512

    4e6355f3051ed5e811ab030abde1f5be7f5e1cf33be99cd08477e9b6c015deb1d8bd75a09fb9c7176b8511c5ad0a67abc0902a3531e97564ccb6afc57496a47c

    Download Submit

  • /data/user/0/com.amvery4/app_DynamicOptDex/rQiZfat.json
    Filesize

    2KB

    MD5

    5c519f982df7fcab7870e7fff354c542

    SHA1

    3c524914a02e74be7e7ad881789d279855273f0f

    SHA256

    dd033abf3260f89a03caae3c1e846c68480b8fd4007a93bba6796a1c01d4f6d5

    SHA512

    352f60e27cbffc8000c8abbeb459727517b10cc6313d427b2372d792f3dd4cca46c5fc610350b6993c62da165798cb56932b631a1baa1f397bec735cd43710e7

    Download Submit

  • /data/user/0/com.amvery4/app_DynamicOptDex/rQiZfat.json
    Filesize

    7KB

    MD5

    f6d2bb48198740f7cf74e18f441ff2b7

    SHA1

    104948a000c2a126e4af16f7e1301e0d09aea857

    SHA256

    376763bdf1ffe888569532a4f61d5d793fb6fdb3fa77ddd7e051b29e6698ed63

    SHA512

    aad3f6537a7adfcda7bcf7352fd6aad789ab6f769744943a690dd2b4818e03522b0959198adc9f22379cceb6d3ff9f1854a7eab20ce16b424a4044a589ad92bc

    Download Submit

  • /data/user/0/com.amvery4/app_DynamicOptDex/rQiZfat.json
    Filesize

    7KB

    MD5

    1ad40f1fa90afaa39a0d8e268045a6f0

    SHA1

    0709a40568c29d072dbdaa27d8a571035628d4bb

    SHA256

    9fef690c0399b32fccbcf1c5a92df2c9c8e4f025ea7dddfc4e7018f1d6805e55

    SHA512

    5344da4532028d13d70f24f7d1b61859db2192d43d240a27ba4e03893b2cb048b52167c301cf2ac92175972575da8b61a5be4379a1007515a509cc653e2fba21

    Download Submit

  • /data/user/0/com.amvery4/app_webview/GPUCache/index
    Filesize

    20B

    MD5

    93027d42b314432c4216e6cfca48b384

    SHA1

    43448dd8102979c3926828182579691945eedd4e

    SHA256

    3cda72e67c62e52a342309c44f2cb3b6c1019c7b11822e2f628e48e254e2b41c

    SHA512

    a52d13cf7f5be196d1e2f135b8a010f80558c5d35e90e7792441d1c976517d55cf1c9587949db69ebef294cc6ef79529a65e7d779964793016efecacd152f70e

    Download Submit

  • /data/user/0/com.amvery4/app_webview/GPUCache/index-dir/temp-index
    Filesize

    48B

    MD5

    c560e2a75d071c5045a67e93aa9b37d7

    SHA1

    ff1fc7643ec86fc406170ccfa14f934a51cf3e07

    SHA256

    74a029b99e105cc65f0932b6bc79f044fb74fbce45eb3a36c4456f54a293dc02

    SHA512

    1474796a0e58cc4144fa446a54ecd556a5566b7db1f8c2f7d4e9515ded09186d25d4220dad21af5a12e1e3a8cd7e49373d9361cda1ece19402e3aa68d5173ddd

    Download Submit

  • /data/user/0/com.amvery4/app_webview/Web Data
    Filesize

    104KB

    MD5

    dc79f9ce5f3ab5270b33e61119dfc959

    SHA1

    1844bf222a5144b513dcf2fb50a18c011701c647

    SHA256

    47e65f4de08deabfd52ecdb8b0a29c61c482188b92c36182e2112ca0a8f4ff65

    SHA512

    18b8894a7f35df516f423bbdebf1e05ce09eaf4345b139e59e603cadb81f8d1fa20f793438c28e8fd9a64e64f0684223d90ce6f10d3f93cb0c781049a8cff03e

    Download Submit

  • /data/user/0/com.amvery4/app_webview/Web Data-journal
    Filesize

    1KB

    MD5

    f4c33b3deab86309f3a69194b85faff1

    SHA1

    2ec8b5fa684d4b7af59e31513c116f7261519a6c

    SHA256

    fa6b9f089885b7692219093a3c2d52a864d43af34727341aa7db949ad79c3f9e

    SHA512

    688e563794287536ff6c7884d5e06bd73758adf11f94a9cbe68936bc8dbf5076314071cacf5c0e93027721ccdc2c99569487acfc2c73d7d3fd9cbd0a8f4a787f

    Download Submit

  • /data/user/0/com.amvery4/app_webview/metrics_guid
    Filesize

    36B

    MD5

    713547a426cc98b75f2ad03231d19ed9

    SHA1

    32290e54dc3005c1a3bca619079d38654d15feeb

    SHA256

    95a499eeaed1ae0487dc94b2a31ee23930dc6d0e679e0e2890c0e22cd93c9b8a

    SHA512

    04ab204b91f56868c8326a6ad428238d734787b2195a388d2d27f4590d0407ec403571a2df62bd7200d83afb700a0452f7a122f3835ed8047babc279ffef1bb7

    Download Submit

  • /data/user/0/com.amvery4/cache/vnfnsmibqlol
    Filesize

    449KB

    MD5

    24cafdac8d497681aa80d3e9a8ef4e72

    SHA1

    cef8331c3a85490fa5d6c6cc18e8ac406d6c6b9d

    SHA256

    9e51a48a222bd90d32e2243aac9f53b8afcbb4bdd0d13c0d7748fa73138ab114

    SHA512

    c0c4da7f63c26a88b9ae1b90e4680d7a97db4775c27dae4f0050af747f447850adab5e0569fd43e61825dc870754723525572d45e9c1d5980f5d25b9b5659389

    Download Submit

  • /data/user/0/com.amvery4/cache/vnfnsmibqlol
    Filesize

    449KB

    MD5

    24cafdac8d497681aa80d3e9a8ef4e72

    SHA1

    cef8331c3a85490fa5d6c6cc18e8ac406d6c6b9d

    SHA256

    9e51a48a222bd90d32e2243aac9f53b8afcbb4bdd0d13c0d7748fa73138ab114

    SHA512

    c0c4da7f63c26a88b9ae1b90e4680d7a97db4775c27dae4f0050af747f447850adab5e0569fd43e61825dc870754723525572d45e9c1d5980f5d25b9b5659389

    Download Submit

  • /data/user/0/com.amvery4/cache/vnfnsmibqlol
    Filesize

    449KB

    MD5

    24cafdac8d497681aa80d3e9a8ef4e72

    SHA1

    cef8331c3a85490fa5d6c6cc18e8ac406d6c6b9d

    SHA256

    9e51a48a222bd90d32e2243aac9f53b8afcbb4bdd0d13c0d7748fa73138ab114

    SHA512

    c0c4da7f63c26a88b9ae1b90e4680d7a97db4775c27dae4f0050af747f447850adab5e0569fd43e61825dc870754723525572d45e9c1d5980f5d25b9b5659389

    Download Submit

  • /data/user/0/com.amvery4/shared_prefs/WebViewChromiumPrefs.xml
    Filesize

    127B

    MD5

    21223e9184445fe043476484cd8cb1f9

    SHA1

    2b4813f849121d60ba35eb0889080668bb62c778

    SHA256

    bb61b7c087c2ae2de93a7740ff75707342940557146366e92b840284cd9446af

    SHA512

    be21408de0cc643650e5d9ab9057a8f9de88e37fbdc6417cfeba160402ec4cd14fccbc82cbbfd941ecfc0bb3d4056ee61ac199efdc99d647d53e65818835fd48

    Download Submit

  • /data/user/0/com.amvery4/shared_prefs/main.xml
    Filesize

    129B

    MD5

    3be23d81b0180b702a47a2725e913b69

    SHA1

    69220bf27070eda071dbfb5daf1aa296f2355cb1

    SHA256

    8a06dbe0212feba5a3bf4a39ead0de9428910383b9f8e5889434d807a753172e

    SHA512

    d3c74c3c030451144ffe2b5bba6f0c12d0f2c7522fccdf07b1e66f7808d5ced4b5f6325faed72236a596a370e9a8e528116ca775eb55b5d169e309980744f001

    Download Submit

  • /data/user/0/com.amvery4/shared_prefs/main.xml
    Filesize

    3KB

    MD5

    21ef0c72a6e68cd619d53c864e488707

    SHA1

    dd100d238dbd79229a1bc7678474b8ef112c26d4

    SHA256

    65f57cfb1e755c8a2c911b2f1e56eae96356dc24cc4d786db347887730a8dada

    SHA512

    4c4765316858c100d2cf197eba74abf123c4ebd2731b7951b3d28e68fd16f625881cb3507f82dabbe1e26a9fba42396bbc37e2d91f30c779a5210059268f4166

    Download Submit