octo | 0bf73ff0ac2e81d23a005b08f8670249528170bfbb249e38a5af809c6a56c7f5

Analysis

max time kernel
870603s
max time network
144s
platform
android_x86
resource
android-x86-arm-20230824-en
submitted
26-08-2023 22:02

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

0bf73ff0ac2e81d23a005b08f8670249528170bfbb249e38a5af809c6a56c7f5.apk
Size

1.2MB
MD5

7bd6540df699c795d11c5241d4011be8
SHA1

72fa462dcee996c5c38f286ba604820ebe07ac20
SHA256

0bf73ff0ac2e81d23a005b08f8670249528170bfbb249e38a5af809c6a56c7f5
SHA512

a1f6118838bba95d666dc6ed97d97fe5c31edb4e248438999123727708c2d6d5d3b89bc30e944627c24d127794f58de4db8c1eedd7be7f2b4c69e9ab1b08896d
SSDEEP

24576:j5oRkLijU3deDZiOwjUH4nmpdpA/9eb02NT0+YQPDkQ5HvE5ICaEAx1snX:99oDQzsvpdpUeblH7H5H85ICaEAx1s

Score

10^/10

octo banker evasion infostealer ransomware rat stealth trojan

Malware Config

Extracted

Family

octo

https://rwjfgf.xyz/ZjI0NGY5MTMzMDhk/

https://houilles.info/ZjI0NGY5MTMzMDhk/

https://skyclouds.space/ZjI0NGY5MTMzMDhk/

https://perlmp.com/ZjI0NGY5MTMzMDhk/

AES_key

Signatures

Octo
Octo is a banking malware with remote access capabilities first seen in April 2022.
banker trojan infostealer rat octo

Octo payload 3 IoCs

resource	yara_rule
behavioral1/files/fstream-6.dat	family_octo
behavioral1/memory/4237-1.dex	family_octo
behavioral1/memory/4237-2.dex	family_octo

Makes use of the framework's Accessibility service. 2 IoCs

description	ioc	Process
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId	com.schoolbedpcfu
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByViewId	com.schoolbedpcfu

Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps). 1 IoCs

banker

description	ioc	Process
Framework service call	android.content.pm.IPackageManager.getInstalledApplications	com.schoolbedpcfu

Removes its main activity from the application launcher 1 IoCs

stealth trojan

pid	Process
4237	com.schoolbedpcfu

Acquires the wake lock. 1 IoCs

description	ioc	Process
Framework service call	android.os.IPowerManager.acquireWakeLock	com.schoolbedpcfu

Loads dropped Dex/Jar 4 IoCs

Runs executable file dropped to the device during analysis.

ioc	pid	Process
/data/user/0/com.schoolbedpcfu/app_DynamicOptDex/TeNID.json	4273	/system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.schoolbedpcfu/app_DynamicOptDex/TeNID.json --output-vdex-fd=41 --oat-fd=42 --oat-location=/data/user/0/com.schoolbedpcfu/app_DynamicOptDex/oat/x86/TeNID.odex --compiler-filter=quicken --class-loader-context=&
/data/user/0/com.schoolbedpcfu/app_DynamicOptDex/TeNID.json	4237	com.schoolbedpcfu
/data/user/0/com.schoolbedpcfu/cache/zxvwbntqrqlvw	4237	com.schoolbedpcfu
/data/user/0/com.schoolbedpcfu/cache/zxvwbntqrqlvw	4237	com.schoolbedpcfu

Reads information about phone network operator.

Requests disabling of battery optimizations (often used to enable hiding in the background). 1 IoCs

evasion

description	ioc	Process
Intent action	android.settings.REQUEST_IGNORE_BATTERY_OPTIMIZATIONS	com.schoolbedpcfu

Removes a system notification. 1 IoCs

evasion

description	ioc	Process
Framework service call	android.app.INotificationManager.cancelNotificationWithTag	com.schoolbedpcfu

Uses Crypto APIs (Might try to encrypt user data). 1 IoCs

ransomware

description	ioc	Process
Framework API call	javax.crypto.Cipher.doFinal	com.schoolbedpcfu

com.schoolbedpcfu
1⤵
- Makes use of the framework's Accessibility service.
- Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps).
- Removes its main activity from the application launcher
- Acquires the wake lock.
- Loads dropped Dex/Jar
- Requests disabling of battery optimizations (often used to enable hiding in the background).
- Removes a system notification.
- Uses Crypto APIs (Might try to encrypt user data).
PID:4237
- /system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.schoolbedpcfu/app_DynamicOptDex/TeNID.json --output-vdex-fd=41 --oat-fd=42 --oat-location=/data/user/0/com.schoolbedpcfu/app_DynamicOptDex/oat/x86/TeNID.odex --compiler-filter=quicken --class-loader-context=&
  2⤵
  - Loads dropped Dex/Jar
  PID:4273

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

/data/data/com.schoolbedpcfu/.qcom.schoolbedpcfu

Filesize
48B

MD5
046a414913add6f5bb60072c7db819b6

SHA1
451ee4f6809260aec622d772fd329c7d0297a842

SHA256
b66c1320cb063a1d391c94273572ea6edae76c8c8b0a07f8d75c88686f0df72a

SHA512
4e6355f3051ed5e811ab030abde1f5be7f5e1cf33be99cd08477e9b6c015deb1d8bd75a09fb9c7176b8511c5ad0a67abc0902a3531e97564ccb6afc57496a47c

Download Submit
/data/data/com.schoolbedpcfu/app_DynamicOptDex/TeNID.json

Filesize
2KB

MD5
1f07b020a2bb3bd319e0484627df4609

SHA1
e0e432b40a214ae114076bf48af30c963b1ce800

SHA256
7b0b149422404e0a2aa4cac44e49cb22f93c2303b97b1944c5eb8fbcf64f19ec

SHA512
a352c32c3cdfffa6ab32eae7ea7c27e1cd64280e9f10f8d2742f2e8a596b13e1325f0f6020ae00554f2bf7eab6407d773095763e81df7cb1f988dbda77d4d83c

Download Submit
/data/data/com.schoolbedpcfu/app_DynamicOptDex/TeNID.json

Filesize
2KB

MD5
9844c3309c16a1668dd1b69b01f3cc9b

SHA1
daee6cc145e166b8ec4e94c1cb4e97f096d98683

SHA256
c16cf8f928da59fc3bb22231991a83f68819d4d30939947cd99df135c599330a

SHA512
26dce88d4dfb9798f8259760949b4ec1ceed418d47a821f81a5263d212bd8e45dd9d7812802f8cf7ce4e1ebc21d5db421be3684d025ef15e92abf687677de466

Download Submit
/data/data/com.schoolbedpcfu/cache/oat/zxvwbntqrqlvw.cur.prof

Filesize
348B

MD5
c646c07a7972fd07dc1830996b49dcf8

SHA1
e8aba5f78f7b8589ac61e5a053cf5d0cede18f7d

SHA256
9fc5ee62d7a8fa6765599593b2906db912ad2f63a89f2c9ca150b52234e376b2

SHA512
7f7a87beb4aba118316191f8f2880f565b46cbc84956524a1ff418e6de431ac83f2dda4837b25fafa7ed5711ff53b032a6b07b3229799f6d5066b32681f173dd

Download Submit
/data/data/com.schoolbedpcfu/cache/zxvwbntqrqlvw

Filesize
449KB

MD5
01c7a83b944410a637e900ad78fe529f

SHA1
2874c8f0ab9cf113127a783badd3083227a07ec6

SHA256
0cc5ed1d2e76ebed6dbe6b80702b177e57639ee3cada1011265c51e01c7463d4

SHA512
9d3bad524f6b0b4304dd2e89737e0189fac11aa869ff774a0932df136f002231d1a17dbd70b1a8af371b8c4d3c1fde78a739302c60b4853dfec7a00dc4d84dac

Download Submit
/data/data/com.schoolbedpcfu/kl.txt

Filesize
28B

MD5
6311c3fd15588bb5c126e6c28ff5fffe

SHA1
ce81d136fce31779f4dd62e20bdaf99c91e2fc57

SHA256
8b82f6032e29a2b5c96031a3630fb6173d12ff0295bc20bb21b877d08f0812d8

SHA512
2975fe2e94b6a8adc9cfc1a865ad113772b54572883a537b02a16dd2d029c0f7d9cca3b154fd849bdfe978e18b396bcf9fa6e67e7c61f92bdc089a29a9c355c6

Download Submit
/data/data/com.schoolbedpcfu/kl.txt

Filesize
237B

MD5
f67e914681bbd45b1f7f2c51f94ff56a

SHA1
d4396a37567b5a10fef919239a48515601497cc1

SHA256
330a336abff8a413be2e0060a13e9ee0d9a5cf8d1e988104e1415817cc337a25

SHA512
e4b158f7ec20429f8c2176972343435ff0bdfb68b8d9b32d05514e39adda4b69aa196eef0af3fd083e1ea48a6e05a0e4bab65ce657c10b8e48eef7f5ea4e461b

Download Submit
/data/data/com.schoolbedpcfu/kl.txt

Filesize
63B

MD5
9b22a66e72a2d8527900aaad5ecd4755

SHA1
289c73491863467233bfbf5b2be5372eda2e2b6a

SHA256
49ac79b3e4db03d231c4648640803ac2b3eb6c8a400a87bf898b4a2ece94dc91

SHA512
2f9bc25b8c181253da8ad76af71fac677e38dc560a41f8a8c7c58e6861b8f403ba39747a263088f684d4fce638a55da534adb96d59326309a1a8fe3260258a25

Download Submit
/data/data/com.schoolbedpcfu/kl.txt

Filesize
45B

MD5
957d2cf7dce57b1009a7f962d377df8d

SHA1
3074fbef286153747c0a197a524e70429efdce22

SHA256
8952c6963a10171ba93527fd33bdf84b9ae8e06eb4df459a61ad0866c3d1025d

SHA512
adc1bd5a12eff828257a5714f2feae1695378cb57cd46cd9dc8c9fb1bad84afb22e815cba9db2fb25c8e232b5fae9b5039fd8c14fbeb5ee5396a37e54c775c7d

Download Submit
/data/data/com.schoolbedpcfu/kl.txt

Filesize
437B

MD5
6bb66b0b83a3ed71c1e40fe8fd0274bf

SHA1
56aedc6b4444bea951cf5842f3da1b28c9b724d2

SHA256
ae3a58a3132b44942037362f0a8808f74ecf10c6cce34ef474150355989539fc

SHA512
06f2c249b2b80f1fe24f982c899b387f391eb023d836dcba6b3b990db5081777c2408a69f97b96e643432c522ce5ebc8367cdc28dcabf251ad949f25bff422e7

Download Submit
/data/user/0/com.schoolbedpcfu/app_DynamicOptDex/TeNID.json

Filesize
7KB

MD5
d1239df42185aa1801245f470eebb4a2

SHA1
47f28c55fb1c7dd56fca860a6f4e94bff21450d2

SHA256
6784ee7cbf12d14f4352fa3f65a630ccf7e425fde2310e01aa688504b3764037

SHA512
9e4ba232d33c3fbc17456bef580f2f7bd4834147cf2bd2e18ab51e83f01e4c77619bb593fce643dd31ae8f6528e10f12f7c27f1991362710bbc5da2c9dc47113

Download Submit
/data/user/0/com.schoolbedpcfu/app_DynamicOptDex/TeNID.json

Filesize
7KB

MD5
6b55ed53d13c076562cf89ea38c5867b

SHA1
1269e62f95979a2d3232aaa8f80505f34a06260f

SHA256
d3f6896d3d470b6eca7ea89ab886ee9e43292adb509bc7c708f0d648f2cbd39d

SHA512
43eeff52fb1d94e841973b3e496eaa581dbd554fceb1255fedb4820de8212db6acd4943a2b0477ebdd746fe5f9228182a3c7f4ce07a469a10d3d48a12d179bdd

Download Submit
/data/user/0/com.schoolbedpcfu/cache/zxvwbntqrqlvw

Filesize
449KB

MD5
01c7a83b944410a637e900ad78fe529f

SHA1
2874c8f0ab9cf113127a783badd3083227a07ec6

SHA256
0cc5ed1d2e76ebed6dbe6b80702b177e57639ee3cada1011265c51e01c7463d4

SHA512
9d3bad524f6b0b4304dd2e89737e0189fac11aa869ff774a0932df136f002231d1a17dbd70b1a8af371b8c4d3c1fde78a739302c60b4853dfec7a00dc4d84dac

Download Submit
/data/user/0/com.schoolbedpcfu/cache/zxvwbntqrqlvw

Filesize
449KB

MD5
01c7a83b944410a637e900ad78fe529f

SHA1
2874c8f0ab9cf113127a783badd3083227a07ec6

SHA256
0cc5ed1d2e76ebed6dbe6b80702b177e57639ee3cada1011265c51e01c7463d4

SHA512
9d3bad524f6b0b4304dd2e89737e0189fac11aa869ff774a0932df136f002231d1a17dbd70b1a8af371b8c4d3c1fde78a739302c60b4853dfec7a00dc4d84dac

Download Submit