Overview

overview

10

Static

static

7

59f8a393a3...cd.apk

android-9-x86

10

59f8a393a3...cd.apk

android-11-x64

10

libirdevice.so

ubuntu-18.04-amd64

libirdevice.so

debian-9-armhf

libirdevice.so

debian-9-mips

libirdevice.so

debian-9-mipsel

libmibraindec.so

ubuntu-18.04-amd64

libmibraindec.so

debian-9-armhf

libmibraindec.so

debian-9-mips

libmibraindec.so

debian-9-mipsel

libmibrainjni.so

ubuntu-18.04-amd64

libmibrainjni.so

debian-9-armhf

libmibrainjni.so

debian-9-mips

libmibrainjni.so

debian-9-mipsel

libmiir.so

ubuntu-18.04-amd64

libmiir.so

debian-9-armhf

libmiir.so

debian-9-mips

libmiir.so

debian-9-mipsel

libphotocli.so

ubuntu-18.04-amd64

libphotocli.so

debian-9-armhf

libphotocli.so

debian-9-mips

libphotocli.so

debian-9-mipsel

libtruss2.so

ubuntu-18.04-amd64

libtruss2.so

debian-9-armhf

libtruss2.so

debian-9-mips

libtruss2.so

debian-9-mipsel

Analysis

  • max time kernel
    1907224s
  • max time network
    150s
  • platform
    android_x64
  • resource
    android-x64-arm64-20230831-en
  • submitted
    07-09-2023 22:01

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    59f8a393a30d1754e0ba9768aa4eaeeecdb838b79f6374061116a6cf8a0d5fcd.apk

  • Size

    1.9MB

  • MD5

    206ef4d8c65e7e826cad668c0b5e122e

  • SHA1

    10b3a7213d90cf8f6ddedee051e0920409f2846a

  • SHA256

    59f8a393a30d1754e0ba9768aa4eaeeecdb838b79f6374061116a6cf8a0d5fcd

  • SHA512

    0a86b368cfc43bc4e12df915d3c44ac6473e6cc25222e481766980e87f4191efb988f27cb0fe221355971703b83bc5999268f0c64b4a4ae650916e9d11cadc73

  • SSDEEP

    49152:DYaRSfALycw1LSlZ9fLp88wNJwFdKZu6BOU3PuDT:DYaR5mOZ9Tp81fLZnBOOG

Score
10/10
octobankerevasioninfostealerransomwarerattrojan

Malware Config

Extracted

Family

octo

C2

https://grpweufnh734bfr3.online/N2Y5ZmU3OTI5ZDky/

https://poewjehfbwery47fr.top/N2Y5ZmU3OTI5ZDky/

https://fcercvv7erwcvnrew.site/N2Y5ZmU3OTI5ZDky/

https://wevmuty56gbfdg.xyz/N2Y5ZmU3OTI5ZDky/
AES_key

Signatures

  • Octo

    Octo is a banking malware with remote access capabilities first seen in April 2022.

    bankertrojaninfostealerratocto
  • Octo payload 3 IoCs
  • Makes use of the framework's Accessibility service. 1 IoCs
  • Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps). 1 IoCs
    banker
  • Acquires the wake lock. 1 IoCs
  • Loads dropped Dex/Jar 3 IoCs

    Runs executable file dropped to the device during analysis.

  • Reads information about phone network operator.
  • Requests disabling of battery optimizations (often used to enable hiding in the background). 1 IoCs
    evasion
  • Uses Crypto APIs (Might try to encrypt user data). 1 IoCs
    ransomware

Processes

  • com.lotfrontt
    1⤵
    • Makes use of the framework's Accessibility service.
    • Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps).
    • Acquires the wake lock.
    • Loads dropped Dex/Jar
    • Requests disabling of battery optimizations (often used to enable hiding in the background).
    • Uses Crypto APIs (Might try to encrypt user data).
    PID:4593

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • /data/user/0/com.lotfrontt/app_DynamicOptDex/coeKn.json
    Filesize

    2KB

    MD5

    3051224099b13e258383aa7bf327a35a

    SHA1

    8ba1f27a5379d4a0a2275f19824f496cf9bef064

    SHA256

    46d3184df4dec112099743876f4c96e578c3be138fda643297c591c9e89a67f8

    SHA512

    bf6221ddcc640c689d2bae82aabdf0f4ab6ef76272a51a49616a9624dfd7942969464a892b1dd0f7d91b40d11250e30d879eee7564b64a60dfa310138eef5e8e

    Download Submit

  • /data/user/0/com.lotfrontt/app_DynamicOptDex/coeKn.json
    Filesize

    2KB

    MD5

    c8ef4028c434255d8ec9c0f71545d4dd

    SHA1

    a877a99140fada99e4eee4f8abdbdb7dae5216e2

    SHA256

    023a80612def66c1b1a8304d2337edaf53c8b33f042f2e4ce4d2add86e4e6ad9

    SHA512

    993b7bbed729016825b1f416ce39538191c126b1f5304b0e18f799a4358e4f4abc903e1bacc795000d88eb00d68ee6368bbc96946f1c00ae668983ed9f17744a

    Download Submit

  • /data/user/0/com.lotfrontt/app_DynamicOptDex/coeKn.json
    Filesize

    6KB

    MD5

    61cccd4a3f80a87db3ff3cf669c0c264

    SHA1

    61d9464ce446ac7104772f2d9463423b7c6fb124

    SHA256

    bad26a30a756847d804a99d7d98757cb20ea63d669ba1c1d3c9cc35ddcaa9f78

    SHA512

    56a97c7a730469ee7233f703b3ae4f0f676331b675fdd8bb7b006e6dadab88620294004d9048d7d59b60d4b5c556df67c49d12fa8e60e033f3955709555737c8

    Download Submit

  • /data/user/0/com.lotfrontt/cache/oat/xzhourgpnluqbd.cur.prof
    Filesize

    300B

    MD5

    4a03a1ae5b519f28998d9968270eaa0f

    SHA1

    3e49da06a0c46a8f8890c417aff3a498a75a8341

    SHA256

    ce57fc64ddc9dafb77722dd88545d2d9eba6f3c2dd23b758266d1eb11fa0ddfa

    SHA512

    838b7534baf57a2e820c3b42d9c967c6ecc8223dc5a33b3e8d91131a61e4802c9a607bceee932567e472d6ce8efeac547aaee5745e3c023254db61ebbff9d8f4

    Download Submit

  • /data/user/0/com.lotfrontt/cache/xzhourgpnluqbd
    Filesize

    448KB

    MD5

    c37b5f3f70dcc64cae744ac5c51c73f3

    SHA1

    1e632b0f0314ffeea00c71229689154e3dffdc8c

    SHA256

    21caa5e8a64e7e6d5e5355db951ec135a1701dd827a3e3b9a48f89da467e8579

    SHA512

    5d478334f13674fd0e2442656b32ab549d509c2eaf5619baf6265c6d4133fb001935c140ec8425a5caa0238e787b780f87dae2a53bccf0e88ff96c7ac1ab7f65

    Download Submit

  • /data/user/0/com.lotfrontt/cache/xzhourgpnluqbd
    Filesize

    448KB

    MD5

    c37b5f3f70dcc64cae744ac5c51c73f3

    SHA1

    1e632b0f0314ffeea00c71229689154e3dffdc8c

    SHA256

    21caa5e8a64e7e6d5e5355db951ec135a1701dd827a3e3b9a48f89da467e8579

    SHA512

    5d478334f13674fd0e2442656b32ab549d509c2eaf5619baf6265c6d4133fb001935c140ec8425a5caa0238e787b780f87dae2a53bccf0e88ff96c7ac1ab7f65

    Download Submit

  • /data/user/0/com.lotfrontt/cache/xzhourgpnluqbd
    Filesize

    448KB

    MD5

    c37b5f3f70dcc64cae744ac5c51c73f3

    SHA1

    1e632b0f0314ffeea00c71229689154e3dffdc8c

    SHA256

    21caa5e8a64e7e6d5e5355db951ec135a1701dd827a3e3b9a48f89da467e8579

    SHA512

    5d478334f13674fd0e2442656b32ab549d509c2eaf5619baf6265c6d4133fb001935c140ec8425a5caa0238e787b780f87dae2a53bccf0e88ff96c7ac1ab7f65

    Download Submit