octo | cd81f567e4179a5c1aa48d117dd702afcce94e567d8a82a049d691cded58a4a3

Analysis

max time kernel
1647872s
max time network
128s
platform
android_x86
resource
android-x86-arm-20230831-en
submitted
04-09-2023 22:00

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

cd81f567e4179a5c1aa48d117dd702afcce94e567d8a82a049d691cded58a4a3.apk
Size

541KB
MD5

392c9aef3ff168163f99a0669675cc63
SHA1

6959b63f22b5728e536de902b70c880f1908ef13
SHA256

cd81f567e4179a5c1aa48d117dd702afcce94e567d8a82a049d691cded58a4a3
SHA512

f26f24f83f6278fcb4b267e9949a3255a5b03bd5be176b74f43e21315d64e5b5c07c77ddc3eaf78f5f39cecc3f028a493e5ce4e10f849b39b8c2044cbb9cf11f
SSDEEP

12288:AYd77xNfkhSme6PFIJefUnZBeB415sBuqOdB5aGQp5gHtxnC:AYd7zfkEmepJkUZBI41mcLa9itxnC

Score

10^/10

octo banker evasion infostealer ransomware rat stealth trojan

Malware Config

Extracted

Family

octo

https://keplistensan.site/YWRhZjAxNGM1YjFh/

https://ikranjsfyu.space/YWRhZjAxNGM1YjFh/

https://ujsayhhfsakl.fun/YWRhZjAxNGM1YjFh/

https://hduuooasdj.website/YWRhZjAxNGM1YjFh/

https://pkasjjfoosa.host/YWRhZjAxNGM1YjFh/

AES_key

Signatures

Octo
Octo is a banking malware with remote access capabilities first seen in April 2022.
banker trojan infostealer rat octo

Octo payload 3 IoCs

Processes:

resource	yara_rule
/data/data/com.mightvoicegex/cache/gtzthueog	family_octo
/data/user/0/com.mightvoicegex/cache/gtzthueog	family_octo
/data/user/0/com.mightvoicegex/cache/gtzthueog	family_octo

Makes use of the framework's Accessibility service. 2 IoCs

Processes:

com.mightvoicegex

description	ioc	process
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId	com.mightvoicegex
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByViewId	com.mightvoicegex

Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps). 1 IoCs
banker

Processes:

com.mightvoicegex

description ioc process

Framework service call android.content.pm.IPackageManager.getInstalledApplications com.mightvoicegex
Removes its main activity from the application launcher 1 IoCs
stealth trojan

Processes:

com.mightvoicegex

pid process

4180 com.mightvoicegex
Acquires the wake lock. 1 IoCs

Processes:

com.mightvoicegex

description ioc process

Framework service call android.os.IPowerManager.acquireWakeLock com.mightvoicegex
Loads dropped Dex/Jar 2 IoCs
Runs executable file dropped to the device during analysis.

Processes:

com.mightvoicegex

ioc pid process

/data/user/0/com.mightvoicegex/cache/gtzthueog 4180 com.mightvoicegex
/data/user/0/com.mightvoicegex/cache/gtzthueog 4180 com.mightvoicegex
Reads information about phone network operator.
Requests disabling of battery optimizations (often used to enable hiding in the background). 1 IoCs
evasion

Processes:

com.mightvoicegex

description ioc process

Intent action android.settings.REQUEST_IGNORE_BATTERY_OPTIMIZATIONS com.mightvoicegex
Removes a system notification. 1 IoCs
evasion

Processes:

com.mightvoicegex

description ioc process

Framework service call android.app.INotificationManager.cancelNotificationWithTag com.mightvoicegex
Uses Crypto APIs (Might try to encrypt user data). 1 IoCs
ransomware

Processes:

com.mightvoicegex

description ioc process

Framework API call javax.crypto.Cipher.doFinal com.mightvoicegex

description	ioc	process
Framework service call	android.content.pm.IPackageManager.getInstalledApplications	com.mightvoicegex

pid	process
4180	com.mightvoicegex

description	ioc	process
Framework service call	android.os.IPowerManager.acquireWakeLock	com.mightvoicegex

ioc	pid	process
/data/user/0/com.mightvoicegex/cache/gtzthueog	4180	com.mightvoicegex
/data/user/0/com.mightvoicegex/cache/gtzthueog	4180	com.mightvoicegex

description	ioc	process
Intent action	android.settings.REQUEST_IGNORE_BATTERY_OPTIMIZATIONS	com.mightvoicegex

description	ioc	process
Framework service call	android.app.INotificationManager.cancelNotificationWithTag	com.mightvoicegex

description	ioc	process
Framework API call	javax.crypto.Cipher.doFinal	com.mightvoicegex

com.mightvoicegex
1⤵
- Makes use of the framework's Accessibility service.
- Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps).
- Removes its main activity from the application launcher
- Acquires the wake lock.
- Loads dropped Dex/Jar
- Requests disabling of battery optimizations (often used to enable hiding in the background).
- Removes a system notification.
- Uses Crypto APIs (Might try to encrypt user data).
PID:4180

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

/data/data/com.mightvoicegex/cache/gtzthueog

Filesize
449KB

MD5
8f6b3ee463090019270305097cb6fdaf

SHA1
44794d8476b7c236d28307230e5cfdd5738cd099

SHA256
3897c292bfea8af1c6944ec5a305d4d011bdd2ba3687da943449893836268965

SHA512
44b241812fdebb79f0b78649dd73ade622cbef612b80d984f47f892187f1f87315f453751a95e97a0e19a3a886c5fc3b69e6d02375c15f49ab4941e1c507549d

Download Submit
/data/data/com.mightvoicegex/cache/oat/gtzthueog.cur.prof

Filesize
477B

MD5
e9ba39339da4c8f54504a9c9984ebf05

SHA1
4daef89615961b9de4dfeb322974cd35ad750cd5

SHA256
ac80db1ca425b2d1d82ebfdf55f46c1f8cddc57399718b5eaa5c552e2cb7c9c7

SHA512
39cd9d40ffe9d4459015b01368208f0d6a271ab16d2946d0b3100de81fcdcb139bd4ad9aca44173318af2c2bf433c8753dd201395683c6ae0544b2194ac05b79

Download Submit
/data/data/com.mightvoicegex/kl.txt

Filesize
28B

MD5
6311c3fd15588bb5c126e6c28ff5fffe

SHA1
ce81d136fce31779f4dd62e20bdaf99c91e2fc57

SHA256
8b82f6032e29a2b5c96031a3630fb6173d12ff0295bc20bb21b877d08f0812d8

SHA512
2975fe2e94b6a8adc9cfc1a865ad113772b54572883a537b02a16dd2d029c0f7d9cca3b154fd849bdfe978e18b396bcf9fa6e67e7c61f92bdc089a29a9c355c6

Download Submit
/data/data/com.mightvoicegex/kl.txt

Filesize
63B

MD5
04b0b752f5ca437aa04a06245886960a

SHA1
7569360b166defd2ce8b1685203c051aeeeb1519

SHA256
0c530082979183027be7a413d1a4cf23cccbcb37342c8fc8b6b3751dea459f15

SHA512
8aa56e8e413f267fc56cd7155702b207ab3924cccb3721262f3b11dc80690edf1480dec0f2e8d91074e359f481fd511da0243f31429b7b9dbd2ddb579f9c89e6

Download Submit
/data/data/com.mightvoicegex/kl.txt

Filesize
54B

MD5
f4898a71ef12c99b6741d744d8a9d707

SHA1
c75e62ad3b9581632f4a537dffdd78ae7efc7b58

SHA256
00a866860cedf458b124764e15f94e85846ca158d54df87efe35effe7105d7d4

SHA512
72b91eb6b3ab80e7ead46d3dcc27bfcd7534c333df01aa5e66c6b35b27f5a4c808c0407615b8554914d8781ff42cffbce75afbfc1a484e792562f8f53f532969

Download Submit
/data/data/com.mightvoicegex/kl.txt

Filesize
63B

MD5
16764f0410d17ba308691b76446e1032

SHA1
034fc6c9f1f1be9287199c0408bd899aac4ffd91

SHA256
295e4cd614338110ca8819d241fe9f715c9ddfe6806820436d03ca3134d09e96

SHA512
b9c1fe9b21b4bf288dc2012230550d00202a5e87fd65cf55610d7ab17e3be5e8223edf6107af3e75baff41405dcf509aea4d6f10e393ed4cb9eddbd76186c666

Download Submit
/data/data/com.mightvoicegex/kl.txt

Filesize
423B

MD5
a2d4d451b53a9687293dc1a73e47db3e

SHA1
0a1f392c82802a9476b7fc5e371313ebf97032fc

SHA256
a4eb97cca7712b3fa76b92759b7b81e8b55ed706d74259272657eee604683ee0

SHA512
6df2f860a924b6f119e26acef72bec2327e646ce305d4612104b9db618729c0304d6cdb8d2557821432f9e982790f73b593bc662cdb53f22cc96604d9cb12e2f

Download Submit
/data/user/0/com.mightvoicegex/cache/gtzthueog

Filesize
449KB

MD5
8f6b3ee463090019270305097cb6fdaf

SHA1
44794d8476b7c236d28307230e5cfdd5738cd099

SHA256
3897c292bfea8af1c6944ec5a305d4d011bdd2ba3687da943449893836268965

SHA512
44b241812fdebb79f0b78649dd73ade622cbef612b80d984f47f892187f1f87315f453751a95e97a0e19a3a886c5fc3b69e6d02375c15f49ab4941e1c507549d

Download Submit
/data/user/0/com.mightvoicegex/cache/gtzthueog

Filesize
449KB

MD5
8f6b3ee463090019270305097cb6fdaf

SHA1
44794d8476b7c236d28307230e5cfdd5738cd099

SHA256
3897c292bfea8af1c6944ec5a305d4d011bdd2ba3687da943449893836268965

SHA512
44b241812fdebb79f0b78649dd73ade622cbef612b80d984f47f892187f1f87315f453751a95e97a0e19a3a886c5fc3b69e6d02375c15f49ab4941e1c507549d

Download Submit