octo | 94d9a3428f6143a11bf674c1afdfef2dcf3ac4e62e109a2f1eb3a6647da45519

Analysis

max time kernel
1379638s
max time network
134s
platform
android_x64
resource
android-x64-20230831-en
submitted
01-09-2023 19:29

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

94d9a3428f6143a11bf674c1afdfef2dcf3ac4e62e109a2f1eb3a6647da45519_JC.apk
Size

541KB
MD5

808414f3db4fca9182bbc9e3e7c562a0
SHA1

b40693a1a63793b56e355ba6c82d0331c2c8a65e
SHA256

94d9a3428f6143a11bf674c1afdfef2dcf3ac4e62e109a2f1eb3a6647da45519
SHA512

a371354c5198ed2f542788f3d09505c52511aa7a7b9497b9fe382a0d8c07febb54e86603ea3b41732bcf5b3cc0c804679f12f7274a45a79b58b82a474e490b12
SSDEEP

12288:7NtSLlwmpUHPsOQk745tAG7LAITzew8s/0kp7obeAvQQ8R:zEeHzcLt7LAgr/0kp8qwU

Score

10^/10

octo banker evasion infostealer ransomware rat trojan

Malware Config

Extracted

Family

octo

https://79.110.62.118/YTFlMzViNjNiNWM3/

https://yamacfirarda22.xyz/YTFlMzViNjNiNWM3/

https://3yamacfirarda22.xyz/YTFlMzViNjNiNWM3/

https://5yam7acfirarda22.xyz/YTFlMzViNjNiNWM3/

https://5yam4acfirarda22.xyz/YTFlMzViNjNiNWM3/

https://5yam8acfirarda22.xyz/YTFlMzViNjNiNWM3/

https://5y3am4acfirarda22.xyz/YTFlMzViNjNiNWM3/

https://5ya5m8acfirarda22.xyz/YTFlMzViNjNiNWM3/

AES_key

Signatures

Octo
Octo is a banking malware with remote access capabilities first seen in April 2022.
banker trojan infostealer rat octo

Octo payload 3 IoCs

Processes:

resource	yara_rule
/data/data/com.laughschool0/cache/gixypdv	family_octo
/data/user/0/com.laughschool0/cache/gixypdv	family_octo
/data/user/0/com.laughschool0/cache/gixypdv	family_octo

Makes use of the framework's Accessibility service. 2 IoCs

Processes:

com.laughschool0

description	ioc	process
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId	com.laughschool0
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByViewId	com.laughschool0

Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps). 1 IoCs
banker

Processes:

com.laughschool0

description ioc process

Framework service call android.content.pm.IPackageManager.getInstalledApplications com.laughschool0
Acquires the wake lock. 1 IoCs

Processes:

com.laughschool0

description ioc process

Framework service call android.os.IPowerManager.acquireWakeLock com.laughschool0
Loads dropped Dex/Jar 2 IoCs
Runs executable file dropped to the device during analysis.

Processes:

com.laughschool0

ioc pid process

/data/user/0/com.laughschool0/cache/gixypdv 5053 com.laughschool0
/data/user/0/com.laughschool0/cache/gixypdv 5053 com.laughschool0
Reads information about phone network operator.
Removes a system notification. 1 IoCs
evasion

Processes:

com.laughschool0

description ioc process

Framework service call android.app.INotificationManager.cancelNotificationWithTag com.laughschool0
Uses Crypto APIs (Might try to encrypt user data). 1 IoCs
ransomware

Processes:

com.laughschool0

description ioc process

Framework API call javax.crypto.Cipher.doFinal com.laughschool0

description	ioc	process
Framework service call	android.content.pm.IPackageManager.getInstalledApplications	com.laughschool0

description	ioc	process
Framework service call	android.os.IPowerManager.acquireWakeLock	com.laughschool0

ioc	pid	process
/data/user/0/com.laughschool0/cache/gixypdv	5053	com.laughschool0
/data/user/0/com.laughschool0/cache/gixypdv	5053	com.laughschool0

description	ioc	process
Framework service call	android.app.INotificationManager.cancelNotificationWithTag	com.laughschool0

description	ioc	process
Framework API call	javax.crypto.Cipher.doFinal	com.laughschool0

com.laughschool0
1⤵
- Makes use of the framework's Accessibility service.
- Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps).
- Acquires the wake lock.
- Loads dropped Dex/Jar
- Removes a system notification.
- Uses Crypto APIs (Might try to encrypt user data).
PID:5053

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

/data/data/com.laughschool0/.qcom.laughschool0

Filesize
48B

MD5
046a414913add6f5bb60072c7db819b6

SHA1
451ee4f6809260aec622d772fd329c7d0297a842

SHA256
b66c1320cb063a1d391c94273572ea6edae76c8c8b0a07f8d75c88686f0df72a

SHA512
4e6355f3051ed5e811ab030abde1f5be7f5e1cf33be99cd08477e9b6c015deb1d8bd75a09fb9c7176b8511c5ad0a67abc0902a3531e97564ccb6afc57496a47c

Download Submit
/data/data/com.laughschool0/cache/gixypdv

Filesize
450KB

MD5
f9294b7e7c2537a1bc2c48cea85f4202

SHA1
0ecd38e90cc33356055b18b93fc1b1941285f6c6

SHA256
b48849f18e0a75946885a3d2a1b01f090509d4b80e0515c1a5dc1c3fdec5ac55

SHA512
3d146a04ae907123d9926b5a062fd01ab93b2fccbb4a0be4552dc2b4c7de76042e447ed92e3db9cb2db4069f78a00f6695c70f8f46d3ce5afafad90b0e83d1c4

Download Submit
/data/data/com.laughschool0/cache/oat/gixypdv.cur.prof

Filesize
432B

MD5
43a4aefca17c2923575bf509f3ec4c84

SHA1
fe83459999a28fd93f78e269ed60fc0b18d4f2f7

SHA256
d48560528b30fe4f49fbdee49b43a26b9d442414980dd9dd8f7b680e242c77ec

SHA512
80c14222df69e3527d7d6dec01fe158e45a302105a7a0e37576ff7556f5c5cab1bc29567b0b8699b2cbb2fdb15bc6dbc36186902404307b38e9a71be363efa9a

Download Submit
/data/data/com.laughschool0/kl.txt

Filesize
28B

MD5
6311c3fd15588bb5c126e6c28ff5fffe

SHA1
ce81d136fce31779f4dd62e20bdaf99c91e2fc57

SHA256
8b82f6032e29a2b5c96031a3630fb6173d12ff0295bc20bb21b877d08f0812d8

SHA512
2975fe2e94b6a8adc9cfc1a865ad113772b54572883a537b02a16dd2d029c0f7d9cca3b154fd849bdfe978e18b396bcf9fa6e67e7c61f92bdc089a29a9c355c6

Download Submit
/data/data/com.laughschool0/kl.txt

Filesize
234B

MD5
591d0a1be7898ca867040ba3fbed7e65

SHA1
8c08df35ef6f8e65fa5a9f6126eb4adf54b7be4e

SHA256
96ceac89c492ea8180a1cba35e82af92126b382ddce6102b201e1ecd5bc33563

SHA512
c144a6e3e4ff4a22e38a7f7bb9205d95da0fff6abe25b96c711f428d091ac84ea1f042ccdd7c5976aae9e57af2b5e475700b80359d6215e47485972abbf48a47

Download Submit
/data/data/com.laughschool0/kl.txt

Filesize
64B

MD5
31e7ed4b47493f8021c2767ebe96c39b

SHA1
6e37ed8ac4e8d5d60b8b5aa4d00debda5b0e967f

SHA256
eca8fcc0643b6012fa0520a334c5569d068e34422d31e5650e144acc0dce0a0e

SHA512
48e8ab6308bcc0bcf8342cad5a569aec079813623412705981665a770b46bf2b9a4898eb3264b7202ca0e5a0d953b08a08e32b9cdfbf2f738d980120c2a7f800

Download Submit
/data/data/com.laughschool0/kl.txt

Filesize
68B

MD5
1647d4a39fb446924b87ef977702d4dc

SHA1
4f4ca7b284befedb66bb185868f6a7606d4ec69f

SHA256
c7d5386028f87ff80c2dcfa3557cc96bd8b3bbe51814d2cbe8056b48613810a8

SHA512
c8135112343002e54f7c7b7fef756134d5e075cb3b88474fe0fedad3a70b914597766b7e563bf5acced5b3312a0777761574f7034220404633da1bfaf83784b2

Download Submit
/data/data/com.laughschool0/kl.txt

Filesize
76B

MD5
7dae886709a7864509ec77b1e36c5120

SHA1
b4a9a90d8fe6b4e71bc6701e74d64d75c3a2f558

SHA256
67c356366de08793aa25a12f2e09500071c8571b0b79622733f1e3899176774d

SHA512
408c725e1c65a21925abb65c700ddf208ba8db1a73cdc83914eee1c9fd75fb3223bd9baa34f01edae32c4fb6b149a6693dc768f35c7279ee67079f4fde0d5e2e

Download Submit
/data/user/0/com.laughschool0/cache/gixypdv

Filesize
450KB

MD5
f9294b7e7c2537a1bc2c48cea85f4202

SHA1
0ecd38e90cc33356055b18b93fc1b1941285f6c6

SHA256
b48849f18e0a75946885a3d2a1b01f090509d4b80e0515c1a5dc1c3fdec5ac55

SHA512
3d146a04ae907123d9926b5a062fd01ab93b2fccbb4a0be4552dc2b4c7de76042e447ed92e3db9cb2db4069f78a00f6695c70f8f46d3ce5afafad90b0e83d1c4

Download Submit
/data/user/0/com.laughschool0/cache/gixypdv

Filesize
450KB

MD5
f9294b7e7c2537a1bc2c48cea85f4202

SHA1
0ecd38e90cc33356055b18b93fc1b1941285f6c6

SHA256
b48849f18e0a75946885a3d2a1b01f090509d4b80e0515c1a5dc1c3fdec5ac55

SHA512
3d146a04ae907123d9926b5a062fd01ab93b2fccbb4a0be4552dc2b4c7de76042e447ed92e3db9cb2db4069f78a00f6695c70f8f46d3ce5afafad90b0e83d1c4

Download Submit