octo | 80b21c69991bba7bbb6e942fa4f1871133f667385c4bfe33a83839219056c8f2

Analysis

max time kernel
2724499s
max time network
132s
platform
android_x86
resource
android-x86-arm-20230831-en
submitted
17-09-2023 09:04

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

80b21c69991bba7bbb6e942fa4f1871133f667385c4bfe33a83839219056c8f2bin_JC.apk
Size

541KB
MD5

d27641e60c2bdcf2b0e8e26ea6c17740
SHA1

b4580be1eab0900af8e648ca30c17bdda500c808
SHA256

80b21c69991bba7bbb6e942fa4f1871133f667385c4bfe33a83839219056c8f2
SHA512

fa49ec6c00a12f06e16b99643e871487201e196d14ee802054758121343babd83fcbf6c80c4421311d04638e5481f44db68b95e170e22437a5bd2122af499187
SSDEEP

12288:7TUY+FfggZ0k8B5InXdixMeg4n3qL0ykp+CReDOIy0DN:vU9FfggybGdo24nUM3ca05

Score

10^/10

octo banker evasion infostealer ransomware rat stealth trojan

Malware Config

Extracted

Family

octo

https://79.110.62.118/YTFlMzViNjNiNWM3/

https://3yamacfirarda22.xyz/YTFlMzViNjNiNWM3/

https://5yam7acfirarda22.xyz/YTFlMzViNjNiNWM3/

https://5yam4acfirarda22.xyz/YTFlMzViNjNiNWM3/

https://5yam8acfirarda22.xyz/YTFlMzViNjNiNWM3/

https://5y3am4acfirarda22.xyz/YTFlMzViNjNiNWM3/

https://6ya5m8acfirarda22.xyz/YTFlMzViNjNiNWM3/

https://7ya5m8acfirarda22.xyz/YTFlMzViNjNiNWM3/

https://8ya5m8acfirarda22.xyz/YTFlMzViNjNiNWM3/

https://9ya5m8acfirarda22.xyz/YTFlMzViNjNiNWM3/

https://15yam4acfirarda22.xyz/YTFlMzViNjNiNWM3/

https://25yam8acfirarda22.xyz/YTFlMzViNjNiNWM3/

https://35y3am4acfirarda22.xyz/YTFlMzViNjNiNWM3/

https://66ya5m8acfirarda22.xyz/YTFlMzViNjNiNWM3/

AES_key

Signatures

Octo
Octo is a banking malware with remote access capabilities first seen in April 2022.
banker trojan infostealer rat octo

Octo payload 3 IoCs

Processes:

resource	yara_rule
/data/data/com.onlywhere2/cache/ivkud	family_octo
/data/user/0/com.onlywhere2/cache/ivkud	family_octo
/data/user/0/com.onlywhere2/cache/ivkud	family_octo

Makes use of the framework's Accessibility service. 2 IoCs

Processes:

com.onlywhere2

description	ioc	process
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId	com.onlywhere2
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByViewId	com.onlywhere2

Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps). 1 IoCs
banker

Processes:

com.onlywhere2

description ioc process

Framework service call android.content.pm.IPackageManager.getInstalledApplications com.onlywhere2
Removes its main activity from the application launcher 1 IoCs
stealth trojan

Processes:

com.onlywhere2

pid process

4191 com.onlywhere2
Acquires the wake lock. 1 IoCs

Processes:

com.onlywhere2

description ioc process

Framework service call android.os.IPowerManager.acquireWakeLock com.onlywhere2
Loads dropped Dex/Jar 2 IoCs
Runs executable file dropped to the device during analysis.

Processes:

com.onlywhere2

ioc pid process

/data/user/0/com.onlywhere2/cache/ivkud 4191 com.onlywhere2
/data/user/0/com.onlywhere2/cache/ivkud 4191 com.onlywhere2
Reads information about phone network operator.
Requests disabling of battery optimizations (often used to enable hiding in the background). 1 IoCs
evasion

Processes:

com.onlywhere2

description ioc process

Intent action android.settings.REQUEST_IGNORE_BATTERY_OPTIMIZATIONS com.onlywhere2
Removes a system notification. 1 IoCs
evasion

Processes:

com.onlywhere2

description ioc process

Framework service call android.app.INotificationManager.cancelNotificationWithTag com.onlywhere2
Uses Crypto APIs (Might try to encrypt user data). 1 IoCs
ransomware

Processes:

com.onlywhere2

description ioc process

Framework API call javax.crypto.Cipher.doFinal com.onlywhere2

description	ioc	process
Framework service call	android.content.pm.IPackageManager.getInstalledApplications	com.onlywhere2

pid	process
4191	com.onlywhere2

description	ioc	process
Framework service call	android.os.IPowerManager.acquireWakeLock	com.onlywhere2

ioc	pid	process
/data/user/0/com.onlywhere2/cache/ivkud	4191	com.onlywhere2
/data/user/0/com.onlywhere2/cache/ivkud	4191	com.onlywhere2

description	ioc	process
Intent action	android.settings.REQUEST_IGNORE_BATTERY_OPTIMIZATIONS	com.onlywhere2

description	ioc	process
Framework service call	android.app.INotificationManager.cancelNotificationWithTag	com.onlywhere2

description	ioc	process
Framework API call	javax.crypto.Cipher.doFinal	com.onlywhere2

com.onlywhere2
1⤵
- Makes use of the framework's Accessibility service.
- Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps).
- Removes its main activity from the application launcher
- Acquires the wake lock.
- Loads dropped Dex/Jar
- Requests disabling of battery optimizations (often used to enable hiding in the background).
- Removes a system notification.
- Uses Crypto APIs (Might try to encrypt user data).
PID:4191

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

/data/data/com.onlywhere2/.qcom.onlywhere2

Filesize
48B

MD5
046a414913add6f5bb60072c7db819b6

SHA1
451ee4f6809260aec622d772fd329c7d0297a842

SHA256
b66c1320cb063a1d391c94273572ea6edae76c8c8b0a07f8d75c88686f0df72a

SHA512
4e6355f3051ed5e811ab030abde1f5be7f5e1cf33be99cd08477e9b6c015deb1d8bd75a09fb9c7176b8511c5ad0a67abc0902a3531e97564ccb6afc57496a47c

Download Submit
/data/data/com.onlywhere2/cache/ivkud

Filesize
450KB

MD5
35be94ac151eabd46693c6d422e82f43

SHA1
5522ec2c9e4405a63911e61010c901631010e5bd

SHA256
7b3620814f6b14d80411d6afe875c23184cbdbc0b04d2070e31cecd10248d9a9

SHA512
58614cb62016cd2ba6a5cf24f60a69ff2bcfc5b4f08ff8c6e1af2aaebd3b5883e92faa9138fb44bf666e2fab41808cc9cf9316e4f3449ef19783db68f3de055a

Download Submit
/data/data/com.onlywhere2/cache/oat/ivkud.cur.prof

Filesize
436B

MD5
3c61d2c777e5a07adde89657bdd48475

SHA1
2ca5c061023aca3eb719757c1508a7147b12c85f

SHA256
af9cc39c7077031f1235d2b51869b3f2f0ea870584dfa91357b36309259bd523

SHA512
1fc951b5cf93e0d9902aca49d89d9e0f469580bfbb1a7f58ca62f07981c9d3d33cbe62ce0088ecca4c2970982454f522ac10cc8dda9e791e81d262ec0abd34a9

Download Submit
/data/data/com.onlywhere2/kl.txt

Filesize
28B

MD5
6311c3fd15588bb5c126e6c28ff5fffe

SHA1
ce81d136fce31779f4dd62e20bdaf99c91e2fc57

SHA256
8b82f6032e29a2b5c96031a3630fb6173d12ff0295bc20bb21b877d08f0812d8

SHA512
2975fe2e94b6a8adc9cfc1a865ad113772b54572883a537b02a16dd2d029c0f7d9cca3b154fd849bdfe978e18b396bcf9fa6e67e7c61f92bdc089a29a9c355c6

Download Submit
/data/data/com.onlywhere2/kl.txt

Filesize
234B

MD5
4a7b58f6367d8928342f8a73cf61f3a1

SHA1
655dde13df3706447786b9652aa1119df5fc8c46

SHA256
8cbe37daeb639ff99c0db13787f16c25681666305e70ba9ccf2926f5e580018c

SHA512
ad86420ed240b7d8c397d2c05bfb50565a855f2afbb88544150ba8419fa7370186b6e5445939c040755a77a7bf544e19973090ff0822e28eb2c7fe4f80b5210f

Download Submit
/data/data/com.onlywhere2/kl.txt

Filesize
63B

MD5
337208233b6b19b16728bad0792eb8d5

SHA1
62e7ec5aa7d4fda150aea95f363e7a0c40931f68

SHA256
6e32cf902f084ec1913a757e7e8348e265246130407b69245b459572ee9c616b

SHA512
52a326421597ef6a70340c8502a88eb5fea63979acbb26f95615f6333d1a7ce44a0ddf614b1bac30e6fec8f37bb08b44673bae7d88acb9fc2314675593bcf9ae

Download Submit
/data/data/com.onlywhere2/kl.txt

Filesize
54B

MD5
0ce7d4e4aec5a67ae5ab12ee235558d6

SHA1
d5b410f9bf96cee1f6c32a232c3a5e0a5dce2b25

SHA256
2b5824d4394ab071fd2a68a24988ca408513080a65bc4559e172ba3c6253c5a5

SHA512
66bf0be85dfb262bdf380cf81e07ebb7d7f16d90d8b4aeb1d7eac8265068f7c8d4a130b8c553e3b910607a3b37cf4c293e6376f7d4ebe989c7fc65ebfc285cd5

Download Submit
/data/data/com.onlywhere2/kl.txt

Filesize
431B

MD5
e689c7a2f10fc40550d1e13f9eedeced

SHA1
55d1ccc9da38b8ef7880c88f7172865cfdc9719a

SHA256
016a9c84ad51e9a3ae4f26ee49bacc3e67ddf8d425218b5ce023559a666807b2

SHA512
27acecba0303ec9a8fc17e584bb89277fdf22301e020cb6b628213f5efca44aca71ebf9b6b59139bc996df57b2231ef8d77baab9309a6184879dd2174e167ea2

Download Submit
/data/user/0/com.onlywhere2/cache/ivkud

Filesize
450KB

MD5
35be94ac151eabd46693c6d422e82f43

SHA1
5522ec2c9e4405a63911e61010c901631010e5bd

SHA256
7b3620814f6b14d80411d6afe875c23184cbdbc0b04d2070e31cecd10248d9a9

SHA512
58614cb62016cd2ba6a5cf24f60a69ff2bcfc5b4f08ff8c6e1af2aaebd3b5883e92faa9138fb44bf666e2fab41808cc9cf9316e4f3449ef19783db68f3de055a

Download Submit
/data/user/0/com.onlywhere2/cache/ivkud

Filesize
450KB

MD5
35be94ac151eabd46693c6d422e82f43

SHA1
5522ec2c9e4405a63911e61010c901631010e5bd

SHA256
7b3620814f6b14d80411d6afe875c23184cbdbc0b04d2070e31cecd10248d9a9

SHA512
58614cb62016cd2ba6a5cf24f60a69ff2bcfc5b4f08ff8c6e1af2aaebd3b5883e92faa9138fb44bf666e2fab41808cc9cf9316e4f3449ef19783db68f3de055a

Download Submit