octo | 5a509a6504bfb7d09682ec44554c45e660bf5e20dc756360c052f97df55a3a37

Analysis

max time kernel
870760s
max time network
130s
platform
android_x86
resource
android-x86-arm-20230824-en
submitted
26-08-2023 22:04

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

5a509a6504bfb7d09682ec44554c45e660bf5e20dc756360c052f97df55a3a37.apk
Size

1.5MB
MD5

2380a8c53a3e15b004a06ab048f4153a
SHA1

36037bf8ef71c415d0ea7a88f5fe1296fd3f9207
SHA256

5a509a6504bfb7d09682ec44554c45e660bf5e20dc756360c052f97df55a3a37
SHA512

43ace8077d8b00617479042c977f0651d30e12e461da7f266d1a44040bdc925e6e9aa074cd2c3b05ddfa15c8458774b5f389f13e66a0feab8e6e5436f539a636
SSDEEP

49152:YwHhzKBkVJK4j/nspDwQFXWZGZbmqViK0AE4KoSi:YwBzKBkVJKafYJFXWZQ/Vb7

Score

10^/10

octo banker evasion infostealer ransomware rat stealth trojan

Malware Config

Extracted

Family

octo

https://superjunggvbvqq.com/M2EyOTM2M2FlY2My/

https://junggvbvqqqqqq.com/M2EyOTM2M2FlY2My/

https://lajunggvbvqq.com/M2EyOTM2M2FlY2My/

https://junggvbvqqgroup.com/M2EyOTM2M2FlY2My/

https://junggvbvqqnet.com/M2EyOTM2M2FlY2My/

https://abgggpoh.com/M2EyOTM2M2FlY2My/

https://nisiqniqqsiq.com/M2EyOTM2M2FlY2My/

https://nisiqnisiq.top/M2EyOTM2M2FlY2My/

https://abgggpoh.top/M2EyOTM2M2FlY2My/

AES_key

Signatures

Octo
Octo is a banking malware with remote access capabilities first seen in April 2022.
banker trojan infostealer rat octo

Octo payload 3 IoCs

resource	yara_rule
behavioral1/files/fstream-6.dat	family_octo
behavioral1/memory/4186-1.dex	family_octo
behavioral1/memory/4186-2.dex	family_octo

Makes use of the framework's Accessibility service. 2 IoCs

description	ioc	Process
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId	com.doorusualam
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByViewId	com.doorusualam

Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps). 1 IoCs

banker

description	ioc	Process
Framework service call	android.content.pm.IPackageManager.getInstalledApplications	com.doorusualam

Removes its main activity from the application launcher 1 IoCs

stealth trojan

pid	Process
4186	com.doorusualam

Acquires the wake lock. 1 IoCs

description	ioc	Process
Framework service call	android.os.IPowerManager.acquireWakeLock	com.doorusualam

Loads dropped Dex/Jar 4 IoCs

Runs executable file dropped to the device during analysis.

ioc	pid	Process
/data/user/0/com.doorusualam/app_DynamicOptDex/WeYO.json	4216	/system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.doorusualam/app_DynamicOptDex/WeYO.json --output-vdex-fd=41 --oat-fd=42 --oat-location=/data/user/0/com.doorusualam/app_DynamicOptDex/oat/x86/WeYO.odex --compiler-filter=quicken --class-loader-context=&
/data/user/0/com.doorusualam/app_DynamicOptDex/WeYO.json	4186	com.doorusualam
/data/user/0/com.doorusualam/cache/vzitddbzie	4186	com.doorusualam
/data/user/0/com.doorusualam/cache/vzitddbzie	4186	com.doorusualam

Reads information about phone network operator.

Requests disabling of battery optimizations (often used to enable hiding in the background). 1 IoCs

evasion

description	ioc	Process
Intent action	android.settings.REQUEST_IGNORE_BATTERY_OPTIMIZATIONS	com.doorusualam

Removes a system notification. 1 IoCs

evasion

description	ioc	Process
Framework service call	android.app.INotificationManager.cancelNotificationWithTag	com.doorusualam

Uses Crypto APIs (Might try to encrypt user data). 1 IoCs

ransomware

description	ioc	Process
Framework API call	javax.crypto.Cipher.doFinal	com.doorusualam

com.doorusualam
1⤵
- Makes use of the framework's Accessibility service.
- Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps).
- Removes its main activity from the application launcher
- Acquires the wake lock.
- Loads dropped Dex/Jar
- Requests disabling of battery optimizations (often used to enable hiding in the background).
- Removes a system notification.
- Uses Crypto APIs (Might try to encrypt user data).
PID:4186
- /system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.doorusualam/app_DynamicOptDex/WeYO.json --output-vdex-fd=41 --oat-fd=42 --oat-location=/data/user/0/com.doorusualam/app_DynamicOptDex/oat/x86/WeYO.odex --compiler-filter=quicken --class-loader-context=&
  2⤵
  - Loads dropped Dex/Jar
  PID:4216

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

/data/data/com.doorusualam/app_DynamicOptDex/WeYO.json

Filesize
2KB

MD5
c53429e4a42520106604453f96a16762

SHA1
1cda2588ac82970533ed9c9cf606425f9bc7fa20

SHA256
472e9d4c8e7965b71b01ca2af6cf6aed0441a82acbf3a37127816b5fb3809f01

SHA512
0c0c86959c115fa2d06f8bce9e5e780ddd9b448f189efdda856f3edb3299c7dfe4529a40b223be3fb5235a9338d4e2e7501d2e24b6547d8b3245a7e3d544560e

Download Submit
/data/data/com.doorusualam/app_DynamicOptDex/WeYO.json

Filesize
2KB

MD5
e39b791bd93a52612426e2f1f091cbfa

SHA1
ce5c902412ff9579428863b54f07132304354ae8

SHA256
fe5a395be9c8acb2424e53895d1ed2e4841dda251a2b0a0862964182bcf00380

SHA512
2cec39b3df9ed1696716a7d409b132bac621de0272134cf305b88a0843719d1ea07087e7aebea27dddcddfa88ce23d85b6b758b3c733de7cb3d8cdace4cac2f4

Download Submit
/data/data/com.doorusualam/cache/oat/vzitddbzie.cur.prof

Filesize
435B

MD5
338f160d85bd73b0501c140188c84132

SHA1
ec0a3536a6bd69fb76347426b09e80d541dfa29d

SHA256
4245848d0264be1cc3a1536b6d564fe266256a0826822c7ede33cd51f40aef78

SHA512
76c77672999fd231528b8f85cfa3ccfd7c464093adbff68f633c60298033830a0eb55cae09758c1be657f34d17b6243885fa46cb4ad315312d0135c0fcb1ce03

Download Submit
/data/data/com.doorusualam/cache/vzitddbzie

Filesize
449KB

MD5
6b3c3eeb943b95c6e24f22e23beee4a9

SHA1
2df84282daddf37bf3d8816b906bd32a973b6d10

SHA256
d03e8c7d59c14791b27f8221670a9ab511e711d5c0a2d57ea2fc522bca8ffd8b

SHA512
10f1750d4174624529416e82a025a7ade37275bcf005e89b0590fff97b4372b6e613da92b75d08314a4a80540248ec838afcbb82547c86697f85f78c9c07b56c

Download Submit
/data/data/com.doorusualam/kl.txt

Filesize
28B

MD5
6311c3fd15588bb5c126e6c28ff5fffe

SHA1
ce81d136fce31779f4dd62e20bdaf99c91e2fc57

SHA256
8b82f6032e29a2b5c96031a3630fb6173d12ff0295bc20bb21b877d08f0812d8

SHA512
2975fe2e94b6a8adc9cfc1a865ad113772b54572883a537b02a16dd2d029c0f7d9cca3b154fd849bdfe978e18b396bcf9fa6e67e7c61f92bdc089a29a9c355c6

Download Submit
/data/data/com.doorusualam/kl.txt

Filesize
237B

MD5
e768b4b24ed8def7eecaea8ba7558413

SHA1
455b83ee40cd6124f6e271c8de5129ee94d90611

SHA256
7c4e2debe6c9838adef031209815e11cbc69a7dc756b88813b661d5ad8a35a8f

SHA512
4b8960e5d81d39a65be47bd248e4f5eebe278b10bc810717a4657af01b760316f4edb6bce8f4eb04f69c6a97caed2b181abc164d846b0107a5342cb597cfd15d

Download Submit
/data/data/com.doorusualam/kl.txt

Filesize
53B

MD5
b77bf6623a177e0bf1d1e2a0e977b6f2

SHA1
17dfb671277f8ee10dbd586490382d553906da3c

SHA256
39ea575de125fc62ea5c9599ef673de3fc7a30a3db3188789be2e42e7faf0a0e

SHA512
57dd71bb51a9498349e6c77622c2afc7bcbc2a3117f58c475b0991aab19f5e7ff5834508e60e1fe8d3be2e9ad128bf125d020291261016042567c0dcf3cc22ef

Download Submit
/data/data/com.doorusualam/kl.txt

Filesize
237B

MD5
07661d9db8dee300dd7f6767af92dedc

SHA1
a27c1e101f819056795b8e21da410e53c3a4529c

SHA256
5dc6b1d2c45dd30288280b994d5d56a0cff965fe1ecf754d6d24b9beff6dd90a

SHA512
dea0ea59da24f1f862786ccd0bab019162b9c4a8495fd52fb83a8c5c31a8a3a6da941046c181999037139abb8210bf9493b278dda00f2b7cb3eb251043556901

Download Submit
/data/data/com.doorusualam/kl.txt

Filesize
437B

MD5
bbae4eef29959d1bb33931d29ec8aa03

SHA1
a260355c2059f54fd7ab10e54f84049ea1813a82

SHA256
f65e531b85a44748b643e7657518dbb35e705c0b5c1139f113d295de633cd4bf

SHA512
3c8448b418129a72f5989cc381f6ed3ae5909ca340236d6e229ce570248b6f839827c84d369799565db4e559a0403dcc836b3a0c6c7533778acefc3ceba9fd0f

Download Submit
/data/user/0/com.doorusualam/app_DynamicOptDex/WeYO.json

Filesize
5KB

MD5
95936c400a98fe5eb2fa2e9b51322b60

SHA1
d71ebc370697bdd57c8f9a311381c1d519e33e11

SHA256
d04df7b7ac99c840c6eb5b42741a2b07228d5f247675a32c8c50f8bf120c4a19

SHA512
8ffdbd10eac6ed707b3f72e08b4b96de0dd0babe576a1ae70958f7583f2f372cc147362cc1feb27ee7156df1c108c7df88c85ab475f28c8efebd9335f0348d02

Download Submit
/data/user/0/com.doorusualam/app_DynamicOptDex/WeYO.json

Filesize
5KB

MD5
62ff2762f9263cdb658369e17eb93296

SHA1
05ec5da751175b01a2551634d4feb65f25453a81

SHA256
058dc0e4b6f33f7c066dfaecd7b5b4e22662c34dfb3d35e9174cb07e30d4d051

SHA512
a3283a30a033bc9ee7972f21ae9f761b207a1d6c7f208fccda9cf2c08155e97907928a78c84853fe28dc424829eb607be7194287942f80532320fb99fc8e4280

Download Submit
/data/user/0/com.doorusualam/cache/vzitddbzie

Filesize
449KB

MD5
6b3c3eeb943b95c6e24f22e23beee4a9

SHA1
2df84282daddf37bf3d8816b906bd32a973b6d10

SHA256
d03e8c7d59c14791b27f8221670a9ab511e711d5c0a2d57ea2fc522bca8ffd8b

SHA512
10f1750d4174624529416e82a025a7ade37275bcf005e89b0590fff97b4372b6e613da92b75d08314a4a80540248ec838afcbb82547c86697f85f78c9c07b56c

Download Submit
/data/user/0/com.doorusualam/cache/vzitddbzie

Filesize
449KB

MD5
6b3c3eeb943b95c6e24f22e23beee4a9

SHA1
2df84282daddf37bf3d8816b906bd32a973b6d10

SHA256
d03e8c7d59c14791b27f8221670a9ab511e711d5c0a2d57ea2fc522bca8ffd8b

SHA512
10f1750d4174624529416e82a025a7ade37275bcf005e89b0590fff97b4372b6e613da92b75d08314a4a80540248ec838afcbb82547c86697f85f78c9c07b56c

Download Submit