octo | 80b21c69991bba7bbb6e942fa4f1871133f667385c4bfe33a83839219056c8f2

Analysis

max time kernel
2512110s
max time network
156s
platform
android_x86
resource
android-x86-arm-20230831-en
submitted
14-09-2023 22:02

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

80b21c69991bba7bbb6e942fa4f1871133f667385c4bfe33a83839219056c8f2.apk
Size

541KB
MD5

d27641e60c2bdcf2b0e8e26ea6c17740
SHA1

b4580be1eab0900af8e648ca30c17bdda500c808
SHA256

80b21c69991bba7bbb6e942fa4f1871133f667385c4bfe33a83839219056c8f2
SHA512

fa49ec6c00a12f06e16b99643e871487201e196d14ee802054758121343babd83fcbf6c80c4421311d04638e5481f44db68b95e170e22437a5bd2122af499187
SSDEEP

12288:7TUY+FfggZ0k8B5InXdixMeg4n3qL0ykp+CReDOIy0DN:vU9FfggybGdo24nUM3ca05

Score

10^/10

octo banker evasion infostealer ransomware rat stealth trojan

Malware Config

Extracted

Family

octo

https://79.110.62.118/YTFlMzViNjNiNWM3/

https://3yamacfirarda22.xyz/YTFlMzViNjNiNWM3/

https://5yam7acfirarda22.xyz/YTFlMzViNjNiNWM3/

https://5yam4acfirarda22.xyz/YTFlMzViNjNiNWM3/

https://5yam8acfirarda22.xyz/YTFlMzViNjNiNWM3/

https://5y3am4acfirarda22.xyz/YTFlMzViNjNiNWM3/

https://6ya5m8acfirarda22.xyz/YTFlMzViNjNiNWM3/

https://7ya5m8acfirarda22.xyz/YTFlMzViNjNiNWM3/

https://8ya5m8acfirarda22.xyz/YTFlMzViNjNiNWM3/

https://9ya5m8acfirarda22.xyz/YTFlMzViNjNiNWM3/

https://15yam4acfirarda22.xyz/YTFlMzViNjNiNWM3/

https://25yam8acfirarda22.xyz/YTFlMzViNjNiNWM3/

https://35y3am4acfirarda22.xyz/YTFlMzViNjNiNWM3/

https://66ya5m8acfirarda22.xyz/YTFlMzViNjNiNWM3/

AES_key

Signatures

Octo
Octo is a banking malware with remote access capabilities first seen in April 2022.
banker trojan infostealer rat octo

Octo payload 3 IoCs

Processes:

resource	yara_rule
/data/data/com.onlywhere2/cache/ivkud	family_octo
/data/user/0/com.onlywhere2/cache/ivkud	family_octo
/data/user/0/com.onlywhere2/cache/ivkud	family_octo

Makes use of the framework's Accessibility service. 2 IoCs

Processes:

com.onlywhere2

description	ioc	process
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId	com.onlywhere2
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByViewId	com.onlywhere2

Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps). 1 IoCs
banker

Processes:

com.onlywhere2

description ioc process

Framework service call android.content.pm.IPackageManager.getInstalledApplications com.onlywhere2
Removes its main activity from the application launcher 1 IoCs
stealth trojan

Processes:

com.onlywhere2

pid process

4145 com.onlywhere2
Acquires the wake lock. 1 IoCs

Processes:

com.onlywhere2

description ioc process

Framework service call android.os.IPowerManager.acquireWakeLock com.onlywhere2
Loads dropped Dex/Jar 2 IoCs
Runs executable file dropped to the device during analysis.

Processes:

com.onlywhere2

ioc pid process

/data/user/0/com.onlywhere2/cache/ivkud 4145 com.onlywhere2
/data/user/0/com.onlywhere2/cache/ivkud 4145 com.onlywhere2
Reads information about phone network operator.
Requests disabling of battery optimizations (often used to enable hiding in the background). 1 IoCs
evasion

Processes:

com.onlywhere2

description ioc process

Intent action android.settings.REQUEST_IGNORE_BATTERY_OPTIMIZATIONS com.onlywhere2
Removes a system notification. 1 IoCs
evasion

Processes:

com.onlywhere2

description ioc process

Framework service call android.app.INotificationManager.cancelNotificationWithTag com.onlywhere2
Uses Crypto APIs (Might try to encrypt user data). 1 IoCs
ransomware

Processes:

com.onlywhere2

description ioc process

Framework API call javax.crypto.Cipher.doFinal com.onlywhere2

description	ioc	process
Framework service call	android.content.pm.IPackageManager.getInstalledApplications	com.onlywhere2

pid	process
4145	com.onlywhere2

description	ioc	process
Framework service call	android.os.IPowerManager.acquireWakeLock	com.onlywhere2

ioc	pid	process
/data/user/0/com.onlywhere2/cache/ivkud	4145	com.onlywhere2
/data/user/0/com.onlywhere2/cache/ivkud	4145	com.onlywhere2

description	ioc	process
Intent action	android.settings.REQUEST_IGNORE_BATTERY_OPTIMIZATIONS	com.onlywhere2

description	ioc	process
Framework service call	android.app.INotificationManager.cancelNotificationWithTag	com.onlywhere2

description	ioc	process
Framework API call	javax.crypto.Cipher.doFinal	com.onlywhere2

com.onlywhere2
1⤵
- Makes use of the framework's Accessibility service.
- Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps).
- Removes its main activity from the application launcher
- Acquires the wake lock.
- Loads dropped Dex/Jar
- Requests disabling of battery optimizations (often used to enable hiding in the background).
- Removes a system notification.
- Uses Crypto APIs (Might try to encrypt user data).
PID:4145

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

/data/data/com.onlywhere2/.qcom.onlywhere2

Filesize
48B

MD5
046a414913add6f5bb60072c7db819b6

SHA1
451ee4f6809260aec622d772fd329c7d0297a842

SHA256
b66c1320cb063a1d391c94273572ea6edae76c8c8b0a07f8d75c88686f0df72a

SHA512
4e6355f3051ed5e811ab030abde1f5be7f5e1cf33be99cd08477e9b6c015deb1d8bd75a09fb9c7176b8511c5ad0a67abc0902a3531e97564ccb6afc57496a47c

Download Submit
/data/data/com.onlywhere2/cache/ivkud

Filesize
450KB

MD5
35be94ac151eabd46693c6d422e82f43

SHA1
5522ec2c9e4405a63911e61010c901631010e5bd

SHA256
7b3620814f6b14d80411d6afe875c23184cbdbc0b04d2070e31cecd10248d9a9

SHA512
58614cb62016cd2ba6a5cf24f60a69ff2bcfc5b4f08ff8c6e1af2aaebd3b5883e92faa9138fb44bf666e2fab41808cc9cf9316e4f3449ef19783db68f3de055a

Download Submit
/data/data/com.onlywhere2/cache/oat/ivkud.cur.prof

Filesize
442B

MD5
163a00cbb728e6fc6ed7db1bcb1ab5db

SHA1
6a4dab738e40222ed42a63bb5d581f2871fdd504

SHA256
842f1548d997108afdd81a0cc21be149eaad396f99c39540aaac8f83f2a4b27b

SHA512
47205c1a7e8bd476ecafbae6a0f5ebe833f5b0372a355add1f3f3cfcc19e98b7d2ba62e57573cd6be0a3114f9d839aff95496e55d89581c4cbbb35d8d5ae73a1

Download Submit
/data/data/com.onlywhere2/kl.txt

Filesize
28B

MD5
6311c3fd15588bb5c126e6c28ff5fffe

SHA1
ce81d136fce31779f4dd62e20bdaf99c91e2fc57

SHA256
8b82f6032e29a2b5c96031a3630fb6173d12ff0295bc20bb21b877d08f0812d8

SHA512
2975fe2e94b6a8adc9cfc1a865ad113772b54572883a537b02a16dd2d029c0f7d9cca3b154fd849bdfe978e18b396bcf9fa6e67e7c61f92bdc089a29a9c355c6

Download Submit
/data/data/com.onlywhere2/kl.txt

Filesize
234B

MD5
0c0e6c47097e3566497bea18d2215ac8

SHA1
a82da0ac90065b3d233a28579c30416d089e4ff4

SHA256
005b0f97a39f93fbe5e741fca6b9cbd696612e02c176f6d2dd33d378e27fe11e

SHA512
554bf9f6edbaa16a1b77e5ceb46aca6249ceddba58a01bc41946bdb83da9462ad20e8cbd609e6b5bf67c8155b887b058184c609923becf3d2baef5b74802de76

Download Submit
/data/data/com.onlywhere2/kl.txt

Filesize
63B

MD5
8238e916d54e7b2aa5647bdcf08b4547

SHA1
9c5698a7c54fcf088482deb92e42d63319c5be84

SHA256
7acdc6ca6343dc0e94a2f6a9ae25cf2de1a2185a749eb55db7fcdb8ebd5bf8fa

SHA512
759d5ff39c7b71c2bfcc0047c71662a28dfd5e725222aa3dc23f5cfead95b0b3e88b83aa0481b4782b6c29c7db471c430f471433f860e78d5dd5b15e993cec40

Download Submit
/data/data/com.onlywhere2/kl.txt

Filesize
54B

MD5
b1e59dcccd88999e53a9b0e432274cd1

SHA1
a622544ea9fa32ce08d7a28a4df5fa2533ce1872

SHA256
909abe18d065daebbe48a757948bafef6b71fa10cb8f70a899f758e1133bc35f

SHA512
78074210199ff4eea9075082459315b39fddbdb2d8a5caea1c563d44b293878dae3250ba724468d08e8230d0c74fe905526b3b72dd4e4b51f98b45de0696d2da

Download Submit
/data/data/com.onlywhere2/kl.txt

Filesize
431B

MD5
5d21d6aaedf277761b4cfc86512c7140

SHA1
0ecce50a3f86418f4175a1b8334dbe9895f8ff09

SHA256
e79c2feff1b353b7bc8df5ac2e850e1cf0f405792be61150d0a29284b92dcd9d

SHA512
c91e98d532078b9bc739122d7b13f6f9af5c49c1484579b951c600dc664aed89d91127bb71aab2d760e5108d42e4564289a940e2b52c06b553b524afab1eaf81

Download Submit
/data/user/0/com.onlywhere2/cache/ivkud

Filesize
450KB

MD5
35be94ac151eabd46693c6d422e82f43

SHA1
5522ec2c9e4405a63911e61010c901631010e5bd

SHA256
7b3620814f6b14d80411d6afe875c23184cbdbc0b04d2070e31cecd10248d9a9

SHA512
58614cb62016cd2ba6a5cf24f60a69ff2bcfc5b4f08ff8c6e1af2aaebd3b5883e92faa9138fb44bf666e2fab41808cc9cf9316e4f3449ef19783db68f3de055a

Download Submit
/data/user/0/com.onlywhere2/cache/ivkud

Filesize
450KB

MD5
35be94ac151eabd46693c6d422e82f43

SHA1
5522ec2c9e4405a63911e61010c901631010e5bd

SHA256
7b3620814f6b14d80411d6afe875c23184cbdbc0b04d2070e31cecd10248d9a9

SHA512
58614cb62016cd2ba6a5cf24f60a69ff2bcfc5b4f08ff8c6e1af2aaebd3b5883e92faa9138fb44bf666e2fab41808cc9cf9316e4f3449ef19783db68f3de055a

Download Submit