octo | 6153966e76e62c9a812601469553a291f1bc1f26c9e7ff56f0d3e0a28d6cf8ce

Resubmissions

20-09-2023 14:50

230920-r7rn9sgh6z 10

11-09-2023 22:03

230911-1ygblsbg39 10

Analysis

max time kernel
2253057s
max time network
138s
platform
android_x86
resource
android-x86-arm-20230831-en
submitted
11-09-2023 22:03

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

6153966e76e62c9a812601469553a291f1bc1f26c9e7ff56f0d3e0a28d6cf8ce.apk
Size

1.5MB
MD5

44e83dd5257260cf5c9e85100c016116
SHA1

22dc9c4250b9fdb837573308b3a2a6755f9d4b36
SHA256

6153966e76e62c9a812601469553a291f1bc1f26c9e7ff56f0d3e0a28d6cf8ce
SHA512

3cf9e9fa46a669bcc996c9b58883108bc463e0a3e73aeeb53387ec17c579fc8b18ac18c55201255571a5d853c4cf77943d4e38752091753fb6abc9df99f323ed
SSDEEP

24576:a7caN4hTiPRj7yphSSVxBLTDWXXaZODZH7mqNThUIHAE4KvAS1Q:aoaETgy//VnnWXKZGZbmqhqIHAE4KoSW

Score

10^/10

octo banker evasion infostealer ransomware rat stealth trojan

Malware Config

Extracted

Family

octo

https://blessedik591.info/MTU2OWE0NzJjNGY5/

https://cm603lzeyxdw.site/MTU2OWE0NzJjNGY5/

https://cm603lzeyxdw1.site/MTU2OWE0NzJjNGY5/

https://arw2he7x57wp.pw/MTU2OWE0NzJjNGY5/

https://9r8i1u84t2gp.online/MTU2OWE0NzJjNGY5/

https://cm603lzeyxdw.biz/MTU2OWE0NzJjNGY5/

https://arw2he7x57wp1.pw/MTU2OWE0NzJjNGY5/

https://9r8i1u84t2gp1.online/MTU2OWE0NzJjNGY5/

https://cm603lzeyxdw.space/MTU2OWE0NzJjNGY5/

https://5a9udxg6l6gd.su/MTU2OWE0NzJjNGY5/

https://s9rls3pp86p6.cc/MTU2OWE0NzJjNGY5/

https://a4ca15da511d151x.info/MTU2OWE0NzJjNGY5/

https://b1nkikaza12kinv21.live/MTU2OWE0NzJjNGY5/

https://f2kic1nam25n81k.cc/MTU2OWE0NzJjNGY5/

AES_key

Signatures

Octo
Octo is a banking malware with remote access capabilities first seen in April 2022.
banker trojan infostealer rat octo

Octo payload 3 IoCs

Processes:

resource	yara_rule
/data/data/com.pressfigure65/cache/hcjfh	family_octo
/data/user/0/com.pressfigure65/cache/hcjfh	family_octo
/data/user/0/com.pressfigure65/cache/hcjfh	family_octo

Makes use of the framework's Accessibility service. 3 IoCs

Processes:

com.pressfigure65

description	ioc	process
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId	com.pressfigure65
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByViewId	com.pressfigure65
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByText	com.pressfigure65

Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps). 1 IoCs
banker

Processes:

com.pressfigure65

description ioc process

Framework service call android.content.pm.IPackageManager.getInstalledApplications com.pressfigure65
Removes its main activity from the application launcher 1 IoCs
stealth trojan

Processes:

com.pressfigure65

pid process

4182 com.pressfigure65
Acquires the wake lock. 1 IoCs

Processes:

com.pressfigure65

description ioc process

Framework service call android.os.IPowerManager.acquireWakeLock com.pressfigure65

description	ioc	process
Framework service call	android.content.pm.IPackageManager.getInstalledApplications	com.pressfigure65

pid	process
4182	com.pressfigure65

description	ioc	process
Framework service call	android.os.IPowerManager.acquireWakeLock	com.pressfigure65

Loads dropped Dex/Jar 4 IoCs

Runs executable file dropped to the device during analysis.

Processes:

/system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.pressfigure65/app_DynamicOptDex/EGxsby.json --output-vdex-fd=41 --oat-fd=42 --oat-location=/data/user/0/com.pressfigure65/app_DynamicOptDex/oat/x86/EGxsby.odex --compiler-filter=quicken --class-loader-context=&com.pressfigure65

ioc	pid	process
/data/user/0/com.pressfigure65/app_DynamicOptDex/EGxsby.json	4209	/system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.pressfigure65/app_DynamicOptDex/EGxsby.json --output-vdex-fd=41 --oat-fd=42 --oat-location=/data/user/0/com.pressfigure65/app_DynamicOptDex/oat/x86/EGxsby.odex --compiler-filter=quicken --class-loader-context=&
/data/user/0/com.pressfigure65/app_DynamicOptDex/EGxsby.json	4182	com.pressfigure65
/data/user/0/com.pressfigure65/cache/hcjfh	4182	com.pressfigure65
/data/user/0/com.pressfigure65/cache/hcjfh	4182	com.pressfigure65

Reads information about phone network operator.
Requests disabling of battery optimizations (often used to enable hiding in the background). 1 IoCs
evasion

Processes:

com.pressfigure65

description ioc process

Intent action android.settings.REQUEST_IGNORE_BATTERY_OPTIMIZATIONS com.pressfigure65
Removes a system notification. 1 IoCs
evasion

Processes:

com.pressfigure65

description ioc process

Framework service call android.app.INotificationManager.cancelNotificationWithTag com.pressfigure65
Uses Crypto APIs (Might try to encrypt user data). 1 IoCs
ransomware

Processes:

com.pressfigure65

description ioc process

Framework API call javax.crypto.Cipher.doFinal com.pressfigure65

description	ioc	process
Intent action	android.settings.REQUEST_IGNORE_BATTERY_OPTIMIZATIONS	com.pressfigure65

description	ioc	process
Framework service call	android.app.INotificationManager.cancelNotificationWithTag	com.pressfigure65

description	ioc	process
Framework API call	javax.crypto.Cipher.doFinal	com.pressfigure65

com.pressfigure65
1⤵
- Makes use of the framework's Accessibility service.
- Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps).
- Removes its main activity from the application launcher
- Acquires the wake lock.
- Loads dropped Dex/Jar
- Requests disabling of battery optimizations (often used to enable hiding in the background).
- Removes a system notification.
- Uses Crypto APIs (Might try to encrypt user data).
PID:4182
- /system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.pressfigure65/app_DynamicOptDex/EGxsby.json --output-vdex-fd=41 --oat-fd=42 --oat-location=/data/user/0/com.pressfigure65/app_DynamicOptDex/oat/x86/EGxsby.odex --compiler-filter=quicken --class-loader-context=&
  2⤵
  - Loads dropped Dex/Jar
  PID:4209

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

/data/data/com.pressfigure65/.qcom.pressfigure65

Filesize
48B

MD5
046a414913add6f5bb60072c7db819b6

SHA1
451ee4f6809260aec622d772fd329c7d0297a842

SHA256
b66c1320cb063a1d391c94273572ea6edae76c8c8b0a07f8d75c88686f0df72a

SHA512
4e6355f3051ed5e811ab030abde1f5be7f5e1cf33be99cd08477e9b6c015deb1d8bd75a09fb9c7176b8511c5ad0a67abc0902a3531e97564ccb6afc57496a47c

Download Submit
/data/data/com.pressfigure65/app_DynamicOptDex/EGxsby.json

Filesize
2KB

MD5
226f1cd6ab5661d77401fe89757beca8

SHA1
3ef0910dfd91b87b0c65c7a793007291c0cb7b33

SHA256
9676b36080d39f0663bf991bc9007a33306f7c549a9a5b3e87a8842735cc76f6

SHA512
2c3d2fe93f1c3ac004a282539dd26fa330445112404e2d7ca8ffd8b0374824e2e8de2bfff0beb5439022716d0ea727b140bbf8e1ca406a19d3c7c1d0b85a9c04

Download Submit
/data/data/com.pressfigure65/app_DynamicOptDex/EGxsby.json

Filesize
2KB

MD5
047c2cbc6d9706e3d9e4e1bec0910bf7

SHA1
e4f143d1eef6b74382a98258fa17a3cfeda6f418

SHA256
a7e525b82b7f94fa20a769d557e6616b734f9a675504682aee5fd1d277433dd0

SHA512
392d68bdcb8db634e1bce02c38aaadbeffa7982fb2012db1b1c42f23f3daa4c1385b83473f3fb14b78f9a7225ffb663f6c03be3461d3e189c8ab7273f879914d

Download Submit
/data/data/com.pressfigure65/cache/hcjfh

Filesize
271KB

MD5
59e431e1f02923d8d1de501547797bb6

SHA1
5be8d6ec7112fe0d3beb30f19967b4ca232b1a17

SHA256
63dfc78268b922a5d0fb34f3b56d7bdd24780176bf03dbd4bbff71a5f019d7c0

SHA512
72a2f60d6a163bc7281ece342559684e03b230e6f7e310c09301be4440a78e8340f490e4e73a47401d366f0f1de2879ff8f5bc9e81905a9afbd070cba61b26aa

Download Submit
/data/data/com.pressfigure65/cache/oat/hcjfh.cur.prof

Filesize
488B

MD5
c4c92cbcc55b17683493be88b0d2fe0c

SHA1
d05d461119b3f0d6933f612e1dc34b6a35affba3

SHA256
12ba27ecde952af2b18e40536911af5d4b181b60f92d2fc7b8b0142f0da31cad

SHA512
3644ce85b1fa8765cdc7b2a48dcb93a6ddcb58ea6ce9112bd2afb1a6c2f18bc096618e87f2570f15ffec156c934b645b02fde20a85f3419815e0382a40a9355d

Download Submit
/data/data/com.pressfigure65/kl.txt

Filesize
28B

MD5
6311c3fd15588bb5c126e6c28ff5fffe

SHA1
ce81d136fce31779f4dd62e20bdaf99c91e2fc57

SHA256
8b82f6032e29a2b5c96031a3630fb6173d12ff0295bc20bb21b877d08f0812d8

SHA512
2975fe2e94b6a8adc9cfc1a865ad113772b54572883a537b02a16dd2d029c0f7d9cca3b154fd849bdfe978e18b396bcf9fa6e67e7c61f92bdc089a29a9c355c6

Download Submit
/data/data/com.pressfigure65/kl.txt

Filesize
230B

MD5
333993d9368e4634990e3671af91aec5

SHA1
fbcc51c92a1a14f3e59ab35d97e2c032c2c712b2

SHA256
f24056ac4563b316fb1869444b3732db1af2664f3095932b4422ff38f2dd2de0

SHA512
2b070f38a8735e62023d25299e2787fca6726d341bd2983f3037d89fb7cfa36e1155f70d37d548296f96e68ade44969f8d70924f3c5af0d5ff66eaae17be32e7

Download Submit
/data/data/com.pressfigure65/kl.txt

Filesize
63B

MD5
350986ea1b0b8b132fe4cbd5a7bf81ba

SHA1
06810ed6ab78a87afc80f915faaaf48549fabcdf

SHA256
006f95195c918f226866978d00d5cc2e1ba5ab778d3e54a0b5864cbd6381eac4

SHA512
7087e43d3e19fb438db6ebd79e8eee93a41d3caf7107d66569c3442bcc86f2a4ed72f029ec4fda1f8b3dadfe38887cd00a86567f692c081e9f8d786a94cf9caf

Download Submit
/data/data/com.pressfigure65/kl.txt

Filesize
45B

MD5
b708902dab8042cbf5abde18c7c9bd7e

SHA1
5f70f0fd8a8ef72751be30219fc360170adf84a1

SHA256
9a91bd45643b15c7390a9eeb7aa183f05363c6e1dea0c38ba34655f89caa68f6

SHA512
dc0ec470958dd5e6706ee00ad26a4db4fae7c35aaf3ad95771bd06f6c33c3b621ab81d8d8900e99d48c33490cd81577557c5aa24f0540b9c3545c09896ac1cc9

Download Submit
/data/data/com.pressfigure65/kl.txt

Filesize
423B

MD5
c4b46eb23185fda1fbd01b2721174583

SHA1
e4ed5953b14776930a12ed4858b4d9ee5b4cf96b

SHA256
170b21713de33b8d7cbadb77e4b6e91d61ddaa350b82cb3eb84a8b0c31bfb2bc

SHA512
84f9bc408a6db5314e2cc0c0114ea5eabc97e58a4388fc6609db85cbb6832149393ac205e0e5ab6060db5bae549fed5cc373172aaf0fec778d52bc7798eec11a

Download Submit
/data/user/0/com.pressfigure65/app_DynamicOptDex/EGxsby.json

Filesize
6KB

MD5
d081aaa8c167bf676a3521d7dc6c888e

SHA1
cb56830b448ab1c485656d22d509b36839ce9acc

SHA256
d38501e22d23feb948612ea574812d167bc04874ec194ddb20864ca12b5f961c

SHA512
aa85ee5587af1c8565dd32ef2c38a8d0612d5be0fb76cff94707e2b7fa4d44dd6c2106deafcd2df9f9b2fec633f78c98ccb745e567c5cace9b5af0901a4b7fbd

Download Submit
/data/user/0/com.pressfigure65/app_DynamicOptDex/EGxsby.json

Filesize
6KB

MD5
af73f1889e4ada2c7fbb0512c31c6dbb

SHA1
927cae26592a79b9eefda0dc8e8473954b3b49cc

SHA256
67b19fae633db8d33717975a406969e59cc00f2e70bd43ae41c79349c6f74a7d

SHA512
be7a9381f6169910e0baf052bd2978ea5577e024074d68e909244e3e5c248e856d90a9cf42bb9819a7e285a8e9fcf159f4a8de9a5c099e6f0f6b87e3e2f3916d

Download Submit
/data/user/0/com.pressfigure65/cache/hcjfh

Filesize
271KB

MD5
59e431e1f02923d8d1de501547797bb6

SHA1
5be8d6ec7112fe0d3beb30f19967b4ca232b1a17

SHA256
63dfc78268b922a5d0fb34f3b56d7bdd24780176bf03dbd4bbff71a5f019d7c0

SHA512
72a2f60d6a163bc7281ece342559684e03b230e6f7e310c09301be4440a78e8340f490e4e73a47401d366f0f1de2879ff8f5bc9e81905a9afbd070cba61b26aa

Download Submit
/data/user/0/com.pressfigure65/cache/hcjfh

Filesize
271KB

MD5
59e431e1f02923d8d1de501547797bb6

SHA1
5be8d6ec7112fe0d3beb30f19967b4ca232b1a17

SHA256
63dfc78268b922a5d0fb34f3b56d7bdd24780176bf03dbd4bbff71a5f019d7c0

SHA512
72a2f60d6a163bc7281ece342559684e03b230e6f7e310c09301be4440a78e8340f490e4e73a47401d366f0f1de2879ff8f5bc9e81905a9afbd070cba61b26aa

Download Submit