octo | ea3273837383a25fecda6ea919478d3cf9b1b60586c60b4b5e84e51f77fa14fe

Analysis

max time kernel
1475251s
max time network
157s
platform
android_x86
resource
android-x86-arm-20230831-en
submitted
02-09-2023 22:01

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ea3273837383a25fecda6ea919478d3cf9b1b60586c60b4b5e84e51f77fa14fe.apk
Size

541KB
MD5

90ae8d151ece7f6a7cba97cfcf5639c7
SHA1

225f21665dfb8a579779241452b39101e693a8b0
SHA256

ea3273837383a25fecda6ea919478d3cf9b1b60586c60b4b5e84e51f77fa14fe
SHA512

9dc715e0802f3a0241c8001f6ae6fac26fde0f844a307241a72939d642692e506d275df62de50145fe00085950fda2bb283f40e29c3f9987d5970b57611243df
SSDEEP

12288:P00xErmI9HEP4BQ5Ws7iFRgIEpbyiCM7FfYQ3Z8:P00KVW4Y7qRBsbDCKtS

Score

10^/10

octo banker evasion infostealer ransomware rat stealth trojan

Malware Config

Extracted

Family

octo

https://176.111.174.92/ZTIyNTVmMmE1NzNl/

https://12logites432532s.xyz/ZTIyNTVmMmE1NzNl/

https://13logites432532s.xyz/ZTIyNTVmMmE1NzNl/

https://14logites432532s.xyz/ZTIyNTVmMmE1NzNl/

https://15logites432532s.xyz/ZTIyNTVmMmE1NzNl/

https://16logites432532s.xyz/ZTIyNTVmMmE1NzNl/

https://17logites432532s.xyz/ZTIyNTVmMmE1NzNl/

https://18logites432532s.xyz/ZTIyNTVmMmE1NzNl/

https://19logites432532s.xyz/ZTIyNTVmMmE1NzNl/

https://20logites432532s.xyz/ZTIyNTVmMmE1NzNl/

https://21logites432532s.xyz/ZTIyNTVmMmE1NzNl/

https://22logites432532s.xyz/ZTIyNTVmMmE1NzNl/

https://kalpazanlan101.xyz/ZTIyNTVmMmE1NzNl/

https://kalpazanlan102.xyz/ZTIyNTVmMmE1NzNl/

https://kalpazanlan103.xyz/ZTIyNTVmMmE1NzNl/

https://kalpazanlan104.xyz/ZTIyNTVmMmE1NzNl/

https://kalpazanlan105.xyz/ZTIyNTVmMmE1NzNl/

https://kalpazanlan106.xyz/ZTIyNTVmMmE1NzNl/

https://kalpazanlan107.xyz/ZTIyNTVmMmE1NzNl/

https://kalpazanlan108.xyz/ZTIyNTVmMmE1NzNl/

AES_key

Signatures

Octo
Octo is a banking malware with remote access capabilities first seen in April 2022.
banker trojan infostealer rat octo

Octo payload 3 IoCs

Processes:

resource	yara_rule
/data/data/com.theirwhatdm/cache/lyqxrvigw	family_octo
/data/user/0/com.theirwhatdm/cache/lyqxrvigw	family_octo
/data/user/0/com.theirwhatdm/cache/lyqxrvigw	family_octo

Makes use of the framework's Accessibility service. 2 IoCs

Processes:

com.theirwhatdm

description	ioc	process
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId	com.theirwhatdm
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByViewId	com.theirwhatdm

Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps). 1 IoCs
banker

Processes:

com.theirwhatdm

description ioc process

Framework service call android.content.pm.IPackageManager.getInstalledApplications com.theirwhatdm
Removes its main activity from the application launcher 1 IoCs
stealth trojan

Processes:

com.theirwhatdm

pid process

4135 com.theirwhatdm
Acquires the wake lock. 1 IoCs

Processes:

com.theirwhatdm

description ioc process

Framework service call android.os.IPowerManager.acquireWakeLock com.theirwhatdm
Loads dropped Dex/Jar 2 IoCs
Runs executable file dropped to the device during analysis.

Processes:

com.theirwhatdm

ioc pid process

/data/user/0/com.theirwhatdm/cache/lyqxrvigw 4135 com.theirwhatdm
/data/user/0/com.theirwhatdm/cache/lyqxrvigw 4135 com.theirwhatdm
Reads information about phone network operator.
Requests disabling of battery optimizations (often used to enable hiding in the background). 1 IoCs
evasion

Processes:

com.theirwhatdm

description ioc process

Intent action android.settings.REQUEST_IGNORE_BATTERY_OPTIMIZATIONS com.theirwhatdm
Removes a system notification. 1 IoCs
evasion

Processes:

com.theirwhatdm

description ioc process

Framework service call android.app.INotificationManager.cancelNotificationWithTag com.theirwhatdm
Uses Crypto APIs (Might try to encrypt user data). 1 IoCs
ransomware

Processes:

com.theirwhatdm

description ioc process

Framework API call javax.crypto.Cipher.doFinal com.theirwhatdm

description	ioc	process
Framework service call	android.content.pm.IPackageManager.getInstalledApplications	com.theirwhatdm

pid	process
4135	com.theirwhatdm

description	ioc	process
Framework service call	android.os.IPowerManager.acquireWakeLock	com.theirwhatdm

ioc	pid	process
/data/user/0/com.theirwhatdm/cache/lyqxrvigw	4135	com.theirwhatdm
/data/user/0/com.theirwhatdm/cache/lyqxrvigw	4135	com.theirwhatdm

description	ioc	process
Intent action	android.settings.REQUEST_IGNORE_BATTERY_OPTIMIZATIONS	com.theirwhatdm

description	ioc	process
Framework service call	android.app.INotificationManager.cancelNotificationWithTag	com.theirwhatdm

description	ioc	process
Framework API call	javax.crypto.Cipher.doFinal	com.theirwhatdm

com.theirwhatdm
1⤵
- Makes use of the framework's Accessibility service.
- Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps).
- Removes its main activity from the application launcher
- Acquires the wake lock.
- Loads dropped Dex/Jar
- Requests disabling of battery optimizations (often used to enable hiding in the background).
- Removes a system notification.
- Uses Crypto APIs (Might try to encrypt user data).
PID:4135

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

/data/data/com.theirwhatdm/.qcom.theirwhatdm

Filesize
48B

MD5
046a414913add6f5bb60072c7db819b6

SHA1
451ee4f6809260aec622d772fd329c7d0297a842

SHA256
b66c1320cb063a1d391c94273572ea6edae76c8c8b0a07f8d75c88686f0df72a

SHA512
4e6355f3051ed5e811ab030abde1f5be7f5e1cf33be99cd08477e9b6c015deb1d8bd75a09fb9c7176b8511c5ad0a67abc0902a3531e97564ccb6afc57496a47c

Download Submit
/data/data/com.theirwhatdm/cache/lyqxrvigw

Filesize
450KB

MD5
bb95554c6eeeeb6bc2028c3222121cf2

SHA1
86c996492c4d852cc1ba55a2c635c3d75ae78afe

SHA256
0bf40fe1171740bfb03aeac836cd0bf4e833502ebdd703a93c36b7efd1eb76e3

SHA512
651fc97a641918ec52b6ea0232490b0825242072b8b5b689f8235e67e59344c4b09f8bb65f0317bddf88fe446a947fb4917da508e0f6b69ac538675175fc3aca

Download Submit
/data/data/com.theirwhatdm/cache/oat/lyqxrvigw.cur.prof

Filesize
448B

MD5
4af57abfd479b093b16e565907dca13d

SHA1
5ffa5a81623d19bfba82b05239b58ca2c06e10a5

SHA256
d6b857773d64f360a1463d1d41b61d2074dd9fad1b491bdc2cb5b876c7f27967

SHA512
2f40da8d90cdef4731c6a144c0852b1d29717d38eb29c70a25c091e2701a8f389b7dfc23497f801292275015bd76602fde3be084ee17caf0c6b5d551db3393d7

Download Submit
/data/data/com.theirwhatdm/kl.txt

Filesize
28B

MD5
6311c3fd15588bb5c126e6c28ff5fffe

SHA1
ce81d136fce31779f4dd62e20bdaf99c91e2fc57

SHA256
8b82f6032e29a2b5c96031a3630fb6173d12ff0295bc20bb21b877d08f0812d8

SHA512
2975fe2e94b6a8adc9cfc1a865ad113772b54572883a537b02a16dd2d029c0f7d9cca3b154fd849bdfe978e18b396bcf9fa6e67e7c61f92bdc089a29a9c355c6

Download Submit
/data/data/com.theirwhatdm/kl.txt

Filesize
235B

MD5
da036885cf064054229e2b91da029b58

SHA1
73b939e8e12fa590c5d45f471b0acc5eede8e5bc

SHA256
f8b48674c72d8633a11bc21e04276cef446acbabf7c840938855bdc78f174033

SHA512
e0a3ca8be61314ac51a32f6c1489aa6c16bcf4d6bb896a0adba652378738381dfbbe8f89e349191ca02d83d984134a065bf34a02b5b191c07b0dcfee51a76300

Download Submit
/data/data/com.theirwhatdm/kl.txt

Filesize
63B

MD5
358e1168a2c4d66b2881998425f0466e

SHA1
224adb57ffa293f2606b067931bdd79ccc9af193

SHA256
1474214ab40f9625d17d13d73c07bb008130afebaa5a567fa8c28eaa558660d7

SHA512
0241e48e1ff23e70577724d44cc69dd7d119abb4c78f40de9a990dffa6af297acaf7b6b301466f34db35c8f6655654164eaa26e911a939f9f51b0a1e1a9f587b

Download Submit
/data/data/com.theirwhatdm/kl.txt

Filesize
54B

MD5
d1b67809b0eda778b08131137b51cff8

SHA1
8936c019e4c61d93da24792a429045f31b50bbc7

SHA256
cd5e74c1e12da26fc6900d6d43fd65b84f9a80d7010cf041f600d544adec350c

SHA512
91b5b1d7873271972c1f032ba51cd593beed48de377105c0ccf14d5e3da95f43318b27fe7397fbe7e42f05be5b7ec3ef1cf491f9b4530f49bc5e9845525725ac

Download Submit
/data/data/com.theirwhatdm/kl.txt

Filesize
433B

MD5
c6a4ef6b0cb9776dea7599f6db0a3533

SHA1
a2b91b3894a35435b972b2bbc5c9beb048436a7c

SHA256
2134a5ae9c66746f3c3a066ea77700144552da5b247fd78d4dff17d705d0022b

SHA512
8b35635a8887d603036e5af75e1ecdcb83b3d6d8d3018093bb970e71ff63e8f4b7395573ac53c2816b22a9d3eae9d04fb2e27219d33bd6e891da09881f73a55a

Download Submit
/data/user/0/com.theirwhatdm/cache/lyqxrvigw

Filesize
450KB

MD5
bb95554c6eeeeb6bc2028c3222121cf2

SHA1
86c996492c4d852cc1ba55a2c635c3d75ae78afe

SHA256
0bf40fe1171740bfb03aeac836cd0bf4e833502ebdd703a93c36b7efd1eb76e3

SHA512
651fc97a641918ec52b6ea0232490b0825242072b8b5b689f8235e67e59344c4b09f8bb65f0317bddf88fe446a947fb4917da508e0f6b69ac538675175fc3aca

Download Submit
/data/user/0/com.theirwhatdm/cache/lyqxrvigw

Filesize
450KB

MD5
bb95554c6eeeeb6bc2028c3222121cf2

SHA1
86c996492c4d852cc1ba55a2c635c3d75ae78afe

SHA256
0bf40fe1171740bfb03aeac836cd0bf4e833502ebdd703a93c36b7efd1eb76e3

SHA512
651fc97a641918ec52b6ea0232490b0825242072b8b5b689f8235e67e59344c4b09f8bb65f0317bddf88fe446a947fb4917da508e0f6b69ac538675175fc3aca

Download Submit