octo | cd81f567e4179a5c1aa48d117dd702afcce94e567d8a82a049d691cded58a4a3

General

Target

cd81f567e4179a5c1aa48d117dd702afcce94e567d8a82a049d691cded58a4a3.apk
Size

541KB
MD5

392c9aef3ff168163f99a0669675cc63
SHA1

6959b63f22b5728e536de902b70c880f1908ef13
SHA256

cd81f567e4179a5c1aa48d117dd702afcce94e567d8a82a049d691cded58a4a3
SHA512

f26f24f83f6278fcb4b267e9949a3255a5b03bd5be176b74f43e21315d64e5b5c07c77ddc3eaf78f5f39cecc3f028a493e5ce4e10f849b39b8c2044cbb9cf11f
SSDEEP

12288:AYd77xNfkhSme6PFIJefUnZBeB415sBuqOdB5aGQp5gHtxnC:AYd7zfkEmepJkUZBI41mcLa9itxnC

Score

10^/10

octo banker evasion infostealer ransomware rat trojan

Malware Config

Extracted

Family

octo

C2

https://keplistensan.site/YWRhZjAxNGM1YjFh/

https://ikranjsfyu.space/YWRhZjAxNGM1YjFh/

https://ujsayhhfsakl.fun/YWRhZjAxNGM1YjFh/

https://hduuooasdj.website/YWRhZjAxNGM1YjFh/

https://pkasjjfoosa.host/YWRhZjAxNGM1YjFh/

AES_key

Signatures

Octo
Octo is a banking malware with remote access capabilities first seen in April 2022.
banker trojan infostealer rat octo

Octo payload 3 IoCs

Processes:

resource	yara_rule
/data/user/0/com.mightvoicegex/cache/gtzthueog	family_octo
/data/user/0/com.mightvoicegex/cache/gtzthueog	family_octo
/data/user/0/com.mightvoicegex/cache/gtzthueog	family_octo

Makes use of the framework's Accessibility service. 2 IoCs

Processes:

com.mightvoicegex

description	ioc	process
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId	com.mightvoicegex
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByViewId	com.mightvoicegex

Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps). 1 IoCs
banker

Processes:

com.mightvoicegex

description ioc process

Framework service call android.content.pm.IPackageManager.getInstalledApplications com.mightvoicegex
Acquires the wake lock. 1 IoCs

Processes:

com.mightvoicegex

description ioc process

Framework service call android.os.IPowerManager.acquireWakeLock com.mightvoicegex
Loads dropped Dex/Jar 2 IoCs
Runs executable file dropped to the device during analysis.

Processes:

com.mightvoicegex

ioc pid process

/data/user/0/com.mightvoicegex/cache/gtzthueog 4610 com.mightvoicegex
/data/user/0/com.mightvoicegex/cache/gtzthueog 4610 com.mightvoicegex
Reads information about phone network operator.
Requests disabling of battery optimizations (often used to enable hiding in the background). 1 IoCs
evasion

Processes:

com.mightvoicegex

description ioc process

Intent action android.settings.REQUEST_IGNORE_BATTERY_OPTIMIZATIONS com.mightvoicegex
Uses Crypto APIs (Might try to encrypt user data). 1 IoCs
ransomware

Processes:

com.mightvoicegex

description ioc process

Framework API call javax.crypto.Cipher.doFinal com.mightvoicegex

description	ioc	process
Framework service call	android.content.pm.IPackageManager.getInstalledApplications	com.mightvoicegex

description	ioc	process
Framework service call	android.os.IPowerManager.acquireWakeLock	com.mightvoicegex

ioc	pid	process
/data/user/0/com.mightvoicegex/cache/gtzthueog	4610	com.mightvoicegex
/data/user/0/com.mightvoicegex/cache/gtzthueog	4610	com.mightvoicegex

description	ioc	process
Intent action	android.settings.REQUEST_IGNORE_BATTERY_OPTIMIZATIONS	com.mightvoicegex

description	ioc	process
Framework API call	javax.crypto.Cipher.doFinal	com.mightvoicegex

com.mightvoicegex
1⤵
- Makes use of the framework's Accessibility service.
- Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps).
- Acquires the wake lock.
- Loads dropped Dex/Jar
- Requests disabling of battery optimizations (often used to enable hiding in the background).
- Uses Crypto APIs (Might try to encrypt user data).
PID:4610

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

/data/user/0/com.mightvoicegex/cache/gtzthueog

Filesize
449KB

MD5
8f6b3ee463090019270305097cb6fdaf

SHA1
44794d8476b7c236d28307230e5cfdd5738cd099

SHA256
3897c292bfea8af1c6944ec5a305d4d011bdd2ba3687da943449893836268965

SHA512
44b241812fdebb79f0b78649dd73ade622cbef612b80d984f47f892187f1f87315f453751a95e97a0e19a3a886c5fc3b69e6d02375c15f49ab4941e1c507549d

Download Submit
/data/user/0/com.mightvoicegex/cache/gtzthueog

Filesize
449KB

MD5
8f6b3ee463090019270305097cb6fdaf

SHA1
44794d8476b7c236d28307230e5cfdd5738cd099

SHA256
3897c292bfea8af1c6944ec5a305d4d011bdd2ba3687da943449893836268965

SHA512
44b241812fdebb79f0b78649dd73ade622cbef612b80d984f47f892187f1f87315f453751a95e97a0e19a3a886c5fc3b69e6d02375c15f49ab4941e1c507549d

Download Submit
/data/user/0/com.mightvoicegex/cache/gtzthueog

Filesize
449KB

MD5
8f6b3ee463090019270305097cb6fdaf

SHA1
44794d8476b7c236d28307230e5cfdd5738cd099

SHA256
3897c292bfea8af1c6944ec5a305d4d011bdd2ba3687da943449893836268965

SHA512
44b241812fdebb79f0b78649dd73ade622cbef612b80d984f47f892187f1f87315f453751a95e97a0e19a3a886c5fc3b69e6d02375c15f49ab4941e1c507549d

Download Submit
/data/user/0/com.mightvoicegex/cache/oat/gtzthueog.cur.prof

Filesize
294B

MD5
927a334746ce3827585dd6136fb58cb0

SHA1
c7df9c090bb75887699d12d29cb4684c28e8f878

SHA256
01a6b523c4e67f60fd3eba56ac9e6454e0e0c476915fd6e708f957ea5b7ffff1

SHA512
e5c41e1cb05dfc5f6212dc135723c9b58e70b8ce4fdd1cea5c512fcdb1708ad2f84777f018a3e73402d7271d606936f75e3436164597dfaac7bd32aad1f28109

Download Submit

Analysis

Sharing