Analysis
-
max time kernel
1365193s -
max time network
131s -
platform
android_x86 -
resource
android-x86-arm-20230831-en -
submitted
01-09-2023 15:29
General
-
Target
1f034cc20ecc702d16d3284cc0b4716839160726942115b72475d65879634cb3_JC.apk
-
Size
541KB
-
MD5
d000abd0acfe8ef3b90e50aa2b95d338
-
SHA1
1fc5fa8d4415f5ac36a1efbd066cd323e8d0926a
-
SHA256
1f034cc20ecc702d16d3284cc0b4716839160726942115b72475d65879634cb3
-
SHA512
b00caefa7104cf243abc1598531acde5958f5bf07da7334ceacb3784f85419c3d417eaa7e388ad2935c775c4da38b9953da399a6f7e83ad2aea6f7699b3391d1
-
SSDEEP
12288:hvmYF7k7/Z2wldgs6Id5vYIjewEGfVGe0AFbTQZSVar:hvmY6r0EdgO5AseZGtdQD
Malware Config
Extracted
octo
https://79.110.62.118/YTFlMzViNjNiNWM3/
https://yamacfirarda22.xyz/YTFlMzViNjNiNWM3/
https://3yamacfirarda22.xyz/YTFlMzViNjNiNWM3/
https://5yam7acfirarda22.xyz/YTFlMzViNjNiNWM3/
https://5yam4acfirarda22.xyz/YTFlMzViNjNiNWM3/
https://5yam8acfirarda22.xyz/YTFlMzViNjNiNWM3/
https://5y3am4acfirarda22.xyz/YTFlMzViNjNiNWM3/
https://5ya5m8acfirarda22.xyz/YTFlMzViNjNiNWM3/
Signatures
-
Octo
Octo is a banking malware with remote access capabilities first seen in April 2022.
-
Octo payload 3 IoCs
-
Makes use of the framework's Accessibility service. 3 IoCs
-
Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps). 1 IoCs
-
Removes its main activity from the application launcher 1 IoCs
-
Acquires the wake lock. 1 IoCs
-
Loads dropped Dex/Jar 2 IoCs
Runs executable file dropped to the device during analysis.
-
Reads information about phone network operator.
-
Requests disabling of battery optimizations (often used to enable hiding in the background). 1 IoCs
-
Removes a system notification. 1 IoCs
-
Uses Crypto APIs (Might try to encrypt user data). 1 IoCs
Processes
-
com.alsoeat881⤵
- Makes use of the framework's Accessibility service.
- Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps).
- Removes its main activity from the application launcher
- Acquires the wake lock.
- Loads dropped Dex/Jar
- Requests disabling of battery optimizations (often used to enable hiding in the background).
- Removes a system notification.
- Uses Crypto APIs (Might try to encrypt user data).
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
48B
MD5046a414913add6f5bb60072c7db819b6
SHA1451ee4f6809260aec622d772fd329c7d0297a842
SHA256b66c1320cb063a1d391c94273572ea6edae76c8c8b0a07f8d75c88686f0df72a
SHA5124e6355f3051ed5e811ab030abde1f5be7f5e1cf33be99cd08477e9b6c015deb1d8bd75a09fb9c7176b8511c5ad0a67abc0902a3531e97564ccb6afc57496a47c
-
Filesize
466B
MD5d93d2730e16973a57dd85f735036b93c
SHA1dddb42de12499edca1f844b31c05299526bbb955
SHA256967238ee202f85ce615d5dc9067fe91c87158a119ff49b23707a2fc025fd42d2
SHA512d333d046bf081442f62c133998c42339661047f89ff32748c6e0732b4bba1094d40ff5ed5b361a55c2c5f562ca07983696bf4e0e9a55f537d78c3f0b59b8873f
-
Filesize
450KB
MD5553e4c888b5eb645838171c1c9fb2494
SHA1c924ad38357d73d4db72618aeb05bd265ed95267
SHA256230e37393e3f6298c871faee2ef5579dbeff3c21d6d762ab0662fe671c46a210
SHA51216e5f987762954cb513f3740338c45dbd1fdd8e7a1b9a52a6a0b5d58851747802c2964ea4f2a2d6222bfa7f33ebb14c8fbe0170f2428ae6d708502ab19877b6a
-
Filesize
28B
MD56311c3fd15588bb5c126e6c28ff5fffe
SHA1ce81d136fce31779f4dd62e20bdaf99c91e2fc57
SHA2568b82f6032e29a2b5c96031a3630fb6173d12ff0295bc20bb21b877d08f0812d8
SHA5122975fe2e94b6a8adc9cfc1a865ad113772b54572883a537b02a16dd2d029c0f7d9cca3b154fd849bdfe978e18b396bcf9fa6e67e7c61f92bdc089a29a9c355c6
-
Filesize
63B
MD5b165dc6aab4f2d176fc741443fd976ec
SHA1e1b0010a91b15811a30c94e853170f3a4b18d52c
SHA25613e93cac6b4ef7a40fd6c1d5d75a052f3d6de8a9d7928721eed895b01de2aad0
SHA51253da86ad22d060f771b319cc3ed227dad5e41dea891083e72d28e1b8c250757e1392bbba604b03ce348dbfcce500ef40502a01be487bb8f2e0bb93de7c0d31a6
-
Filesize
45B
MD5d47aa87680e748a1e6d8aca67e38e288
SHA1e37b4306cf65c036ab849a4cbb2114ca4b0a4fc1
SHA256a4f37f1f3477302e30adb79263ff1e76f01c791c3f444b7e9fd6bba14d67c4ca
SHA512598555f168c3757562a52e15e0249b9ed80073e84d4fd0c0ad57c83c62e99f82bdc0f1ae9de0cc5522648ac71c3be5a784328c21323d516d084a47d478cd21da
-
Filesize
63B
MD5b165dc6aab4f2d176fc741443fd976ec
SHA1e1b0010a91b15811a30c94e853170f3a4b18d52c
SHA25613e93cac6b4ef7a40fd6c1d5d75a052f3d6de8a9d7928721eed895b01de2aad0
SHA51253da86ad22d060f771b319cc3ed227dad5e41dea891083e72d28e1b8c250757e1392bbba604b03ce348dbfcce500ef40502a01be487bb8f2e0bb93de7c0d31a6
-
Filesize
431B
MD5d6654c623a5abb5a5b901e0063fc1c41
SHA124010ccd09cd7dab0232c42d0acb101476abd086
SHA2562a8079b2138e97665056148656543188218c55d1f49c4ae792e121bb67127bb7
SHA5121504fddb7c734ac4aa6b197700adacdc7b64867c8b3d01fd490fd2e8859fe312da8dbc5aee6de0202ed4e93113ee1e9b4c9c8f1c54e944a0ce0db632577bb479
-
Filesize
450KB
MD5553e4c888b5eb645838171c1c9fb2494
SHA1c924ad38357d73d4db72618aeb05bd265ed95267
SHA256230e37393e3f6298c871faee2ef5579dbeff3c21d6d762ab0662fe671c46a210
SHA51216e5f987762954cb513f3740338c45dbd1fdd8e7a1b9a52a6a0b5d58851747802c2964ea4f2a2d6222bfa7f33ebb14c8fbe0170f2428ae6d708502ab19877b6a
-
Filesize
450KB
MD5553e4c888b5eb645838171c1c9fb2494
SHA1c924ad38357d73d4db72618aeb05bd265ed95267
SHA256230e37393e3f6298c871faee2ef5579dbeff3c21d6d762ab0662fe671c46a210
SHA51216e5f987762954cb513f3740338c45dbd1fdd8e7a1b9a52a6a0b5d58851747802c2964ea4f2a2d6222bfa7f33ebb14c8fbe0170f2428ae6d708502ab19877b6a