Analysis

  • max time kernel
    2716797s
  • max time network
    130s
  • platform
    android_x86
  • resource
    android-x86-arm-20230831-en
  • submitted
    17-09-2023 06:55

General

  • Target

    4edfda2401c48da8c0cf205daeafc7f2ece3044245333062f258961e21827deebin_JC.apk

  • Size

    541KB

  • MD5

    831b72515b0ac0f2a514518b5f1444d5

  • SHA1

    8d2b6b3b661f083bd57ffe1f1b01281e2760ba47

  • SHA256

    4edfda2401c48da8c0cf205daeafc7f2ece3044245333062f258961e21827dee

  • SHA512

    fbc47a46814cb3dbdce63f65a1240ccc068e3e2c6b0414d8febbd3edabb4ded0540e57834f345564554113baaf92a72d6ec1e3e2ac826260429cb8cbe7f59817

  • SSDEEP

    12288:qIsQrYaoDEZ88wwJwDXkx6yQelhpamxEFOBjzflQvYhicj/ekchF:qIsQrYY8qrrtli/OBjLlQvaiczYF

Malware Config

Extracted

Family

octo

C2

https://176.111.174.92/ZTIyNTVmMmE1NzNl/

https://12logites432532s.xyz/ZTIyNTVmMmE1NzNl/

https://13logites432532s.xyz/ZTIyNTVmMmE1NzNl/

https://14logites432532s.xyz/ZTIyNTVmMmE1NzNl/

https://15logites432532s.xyz/ZTIyNTVmMmE1NzNl/

https://16logites432532s.xyz/ZTIyNTVmMmE1NzNl/

https://17logites432532s.xyz/ZTIyNTVmMmE1NzNl/

https://18logites432532s.xyz/ZTIyNTVmMmE1NzNl/

https://19logites432532s.xyz/ZTIyNTVmMmE1NzNl/

https://20logites432532s.xyz/ZTIyNTVmMmE1NzNl/

https://21logites432532s.xyz/ZTIyNTVmMmE1NzNl/

https://22logites432532s.xyz/ZTIyNTVmMmE1NzNl/

https://kalpazanlan101.xyz/ZTIyNTVmMmE1NzNl/

https://kalpazanlan102.xyz/ZTIyNTVmMmE1NzNl/

https://kalpazanlan103.xyz/ZTIyNTVmMmE1NzNl/

https://kalpazanlan104.xyz/ZTIyNTVmMmE1NzNl/

https://kalpazanlan105.xyz/ZTIyNTVmMmE1NzNl/

https://kalpazanlan106.xyz/ZTIyNTVmMmE1NzNl/

https://kalpazanlan107.xyz/ZTIyNTVmMmE1NzNl/

https://kalpazanlan108.xyz/ZTIyNTVmMmE1NzNl/

AES_key

Signatures

  • Octo

    Octo is a banking malware with remote access capabilities first seen in April 2022.

  • Octo payload 3 IoCs
  • Makes use of the framework's Accessibility service. 2 IoCs
  • Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps). 1 IoCs
  • Removes its main activity from the application launcher 1 IoCs
  • Acquires the wake lock. 1 IoCs
  • Loads dropped Dex/Jar 2 IoCs

    Runs executable file dropped to the device during analysis.

  • Reads information about phone network operator.
  • Requests disabling of battery optimizations (often used to enable hiding in the background). 1 IoCs
  • Removes a system notification. 1 IoCs
  • Uses Crypto APIs (Might try to encrypt user data). 1 IoCs

Processes

  • com.restbestczti
    1⤵
    • Makes use of the framework's Accessibility service.
    • Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps).
    • Removes its main activity from the application launcher
    • Acquires the wake lock.
    • Loads dropped Dex/Jar
    • Requests disabling of battery optimizations (often used to enable hiding in the background).
    • Removes a system notification.
    • Uses Crypto APIs (Might try to encrypt user data).
    PID:4175

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • /data/data/com.restbestczti/.qcom.restbestczti

    Filesize

    48B

    MD5

    046a414913add6f5bb60072c7db819b6

    SHA1

    451ee4f6809260aec622d772fd329c7d0297a842

    SHA256

    b66c1320cb063a1d391c94273572ea6edae76c8c8b0a07f8d75c88686f0df72a

    SHA512

    4e6355f3051ed5e811ab030abde1f5be7f5e1cf33be99cd08477e9b6c015deb1d8bd75a09fb9c7176b8511c5ad0a67abc0902a3531e97564ccb6afc57496a47c

  • /data/data/com.restbestczti/cache/ndyrl

    Filesize

    450KB

    MD5

    b0c8229ae4269d198dac8c673aedd0df

    SHA1

    3b9e5aafa3089f774600882e07a79a827f21e43b

    SHA256

    84d567023bec71b39488c7bac9a90d4dab05bcc40d1039c7eb6d4acac9163edb

    SHA512

    4478cd2277d89f6d82a81e858d39e0bc6dbae873678c23befe3eb55bb11a09207a9b34df8ad0d9d1ac7200c70b1252bee0d1e1d9e9a9edc6489999a183a2c0b8

  • /data/data/com.restbestczti/cache/oat/ndyrl.cur.prof

    Filesize

    446B

    MD5

    7e3fa9dd70a423d75a40c944c4fd0f08

    SHA1

    75946129208b57a7707d6424eda2abdcabc99148

    SHA256

    5fbc2899a05ffc416256a20d16298216cfbe49f43c403712d6d366435262c607

    SHA512

    1cbe5c801f97a3658fbf48c443f93a4b63baf9ffd1e6c65d415a7e895412beee7b6d81cc3f515ec513b401724a6d9adeb559e422b297f699ddd2b147c26acf8e

  • /data/data/com.restbestczti/kl.txt

    Filesize

    28B

    MD5

    6311c3fd15588bb5c126e6c28ff5fffe

    SHA1

    ce81d136fce31779f4dd62e20bdaf99c91e2fc57

    SHA256

    8b82f6032e29a2b5c96031a3630fb6173d12ff0295bc20bb21b877d08f0812d8

    SHA512

    2975fe2e94b6a8adc9cfc1a865ad113772b54572883a537b02a16dd2d029c0f7d9cca3b154fd849bdfe978e18b396bcf9fa6e67e7c61f92bdc089a29a9c355c6

  • /data/data/com.restbestczti/kl.txt

    Filesize

    235B

    MD5

    f54867e78a704c2ac516d3817a145bba

    SHA1

    1689829a2c362f8427f13ce2fd808ceccbc755f9

    SHA256

    f0873026315f45f4c52fe57c463098968507c5eeb5d93104d1c41b7c91401c42

    SHA512

    752fa16acb2c4cf07e563ec5cb41e16d821e40d1c0ae3faf1f95d2ab8a6ab366e38e1601a8a24b0f0d33ff360aa7121cf6443fb22772cc680e55a71ddf526aae

  • /data/data/com.restbestczti/kl.txt

    Filesize

    63B

    MD5

    00c262e8359e7d85e26ccd86f9d3dd6d

    SHA1

    02930cc42701d4dd7b921fa27d2476cb32c849a9

    SHA256

    08ca038c3f956c2efa53b1d3e40172e07d4893d8a76c7c456747baee15ef9d1b

    SHA512

    0ca801c8858d6f9f8152f30adc299a605387f9975c7d75ec024eb553eae7e9b8b375f9d60445682f4d4061e33691ee0063b1ca1b80d2a0d2d8e2eda8475ec3a7

  • /data/data/com.restbestczti/kl.txt

    Filesize

    54B

    MD5

    19b0ba0dfde62ca1ef503ae7913a08cd

    SHA1

    317892f6c534c48b9a2a62a05f21f44c04b7bcc7

    SHA256

    ea0ab29b8d826856230c55466d6c9851dc71f40b94c82e0df66f540cc8109bae

    SHA512

    6fd3f8a32f882f0a2c913751789c4d2643b8129090382f1b3632d5cbb54bc88d119f34edc1ddc406897e50da15809c66dc73085f020766200bbb6fc520c4dcee

  • /data/data/com.restbestczti/kl.txt

    Filesize

    433B

    MD5

    a0e8ae9000f872e684057fd1dcb4f26a

    SHA1

    57a5db3de7e6266871740c6e30610e658b079db6

    SHA256

    3c39a1d237694581ec93341e90423eb532a23d60dc32457205a4c45688650395

    SHA512

    ffd19c708cd705e364370bb9d01e4ffae0ad2fa17f44583c8e0c0ba11ecc44af12a5ef733a3ee28a364b651e75779899b004b9f6066ac54001cbbb802ea1542d

  • /data/user/0/com.restbestczti/cache/ndyrl

    Filesize

    450KB

    MD5

    b0c8229ae4269d198dac8c673aedd0df

    SHA1

    3b9e5aafa3089f774600882e07a79a827f21e43b

    SHA256

    84d567023bec71b39488c7bac9a90d4dab05bcc40d1039c7eb6d4acac9163edb

    SHA512

    4478cd2277d89f6d82a81e858d39e0bc6dbae873678c23befe3eb55bb11a09207a9b34df8ad0d9d1ac7200c70b1252bee0d1e1d9e9a9edc6489999a183a2c0b8

  • /data/user/0/com.restbestczti/cache/ndyrl

    Filesize

    450KB

    MD5

    b0c8229ae4269d198dac8c673aedd0df

    SHA1

    3b9e5aafa3089f774600882e07a79a827f21e43b

    SHA256

    84d567023bec71b39488c7bac9a90d4dab05bcc40d1039c7eb6d4acac9163edb

    SHA512

    4478cd2277d89f6d82a81e858d39e0bc6dbae873678c23befe3eb55bb11a09207a9b34df8ad0d9d1ac7200c70b1252bee0d1e1d9e9a9edc6489999a183a2c0b8