Analysis
-
max time kernel
2894865s -
max time network
134s -
platform
android_x86 -
resource
android-x86-arm-20230831-en -
submitted
19-09-2023 08:12
Static task
static1
Behavioral task
behavioral1
Sample
chrome-update23453.apk
Resource
android-x86-arm-20230831-en
Behavioral task
behavioral2
Sample
chrome-update23453.apk
Resource
android-x64-arm64-20230831-en
General
-
Target
chrome-update23453.apk
-
Size
1.8MB
-
MD5
fd7a7e3a8f8a2961dfb9bb6b4bdef957
-
SHA1
d99b1d196aa588e9f52bff8ae83c984691ea15d4
-
SHA256
ab02e4cbe64c32b1ca18abd8a727c6e6e5f70d6ccb534da980df2f4210c23d6f
-
SHA512
5dd947b9b386f21b94eb0b7f1cf719ecd46cd66611ef7dbc89eae99b44d539b64836b522e582c2aa0ed4bc55c581680e5be93d747215090a22f8825b67a489dc
-
SSDEEP
49152:HGWTLEc/bDpPjdSXLmaahlfZH4lrnEStPXGZGZbmq76QFAE4KoSu:HG8TzFjkXLmaahlxHI/JXGZQ/74J
Malware Config
Extracted
octo
https://caramiliudj16.live/MTU2OWE0NzJjNGY5/
https://boodycookies41.info/MTU2OWE0NzJjNGY5/
https://smoorfikimv.pro/MTU2OWE0NzJjNGY5/
https://alimavij72.vip/MTU2OWE0NzJjNGY5/
https://5a9udxg6l6gd.su/MTU2OWE0NzJjNGY5/
https://f2kic1nam25n81k.cc/MTU2OWE0NzJjNGY5/
https://maza5rra11vti251mca.info/MTU2OWE0NzJjNGY5/
https://cleverk21da912mca.live/MTU2OWE0NzJjNGY5/
Signatures
-
Octo
Octo is a banking malware with remote access capabilities first seen in April 2022.
-
Octo payload 3 IoCs
Processes:
resource yara_rule /data/data/com.wouldbegan28/cache/eaaej family_octo /data/user/0/com.wouldbegan28/cache/eaaej family_octo /data/user/0/com.wouldbegan28/cache/eaaej family_octo -
Makes use of the framework's Accessibility service. 2 IoCs
Processes:
com.wouldbegan28description ioc process Framework service call android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByViewId com.wouldbegan28 Framework service call android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId com.wouldbegan28 -
Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps). 1 IoCs
Processes:
com.wouldbegan28description ioc process Framework service call android.content.pm.IPackageManager.getInstalledApplications com.wouldbegan28 -
Acquires the wake lock. 1 IoCs
Processes:
com.wouldbegan28description ioc process Framework service call android.os.IPowerManager.acquireWakeLock com.wouldbegan28 -
Loads dropped Dex/Jar 3 IoCs
Runs executable file dropped to the device during analysis.
Processes:
com.wouldbegan28ioc pid process /data/user/0/com.wouldbegan28/app_DynamicOptDex/HdoCq.json 4133 com.wouldbegan28 /data/user/0/com.wouldbegan28/cache/eaaej 4133 com.wouldbegan28 /data/user/0/com.wouldbegan28/cache/eaaej 4133 com.wouldbegan28 -
Reads information about phone network operator.
-
Requests disabling of battery optimizations (often used to enable hiding in the background). 1 IoCs
Processes:
com.wouldbegan28description ioc process Intent action android.settings.REQUEST_IGNORE_BATTERY_OPTIMIZATIONS com.wouldbegan28 -
Removes a system notification. 1 IoCs
Processes:
com.wouldbegan28description ioc process Framework service call android.app.INotificationManager.cancelNotificationWithTag com.wouldbegan28 -
Uses Crypto APIs (Might try to encrypt user data). 1 IoCs
Processes:
com.wouldbegan28description ioc process Framework API call javax.crypto.Cipher.doFinal com.wouldbegan28
Processes
-
com.wouldbegan281⤵
- Makes use of the framework's Accessibility service.
- Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps).
- Acquires the wake lock.
- Loads dropped Dex/Jar
- Requests disabling of battery optimizations (often used to enable hiding in the background).
- Removes a system notification.
- Uses Crypto APIs (Might try to encrypt user data).
PID:4133
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
48B
MD5046a414913add6f5bb60072c7db819b6
SHA1451ee4f6809260aec622d772fd329c7d0297a842
SHA256b66c1320cb063a1d391c94273572ea6edae76c8c8b0a07f8d75c88686f0df72a
SHA5124e6355f3051ed5e811ab030abde1f5be7f5e1cf33be99cd08477e9b6c015deb1d8bd75a09fb9c7176b8511c5ad0a67abc0902a3531e97564ccb6afc57496a47c
-
Filesize
2KB
MD528170be78b5ad3652a054edf8d5e8b1e
SHA17c75f9299e4b979428e6e87130b9d8f186d2330e
SHA25616f76e47de48686e59d9314a14d0296c6b45e3f81327604d980e662170841234
SHA51296a824ecccf00a598ef36ac296fc7ad8f64e2788533e8e698d6047a76c5411a48b84fc3023eb58db5857ef9b99e1d4cb71107966636ed7153df74699ba397ed0
-
Filesize
2KB
MD5095439df27d25eafee908d27ed9ef84f
SHA1e101b69770c6720d1f78abe1a5b8981d1844450a
SHA256a9dbf65bd41426a28ce92be32f7688498bb6ace5eef5c5525d820ff3de4cff39
SHA512a4883248ae56db04e9f1ce4917a1d108b78261c86334db12a119abb9bc7b17577d55eb9e933eb2d53cffb3260bb995f9caf0d5a752ba91d1e0295025eff67939
-
Filesize
457KB
MD524ac7aeaa9235624fa180eb3ee6067a3
SHA12882e07823e18b33bf715bff3d881b87e94d75f0
SHA2563a3c932c69144c05aba4be0ccb4815c08f77f1a4364894ba72f808564bfe6ddd
SHA512e204dc2efafd7beb75c3b0d1f1e9dd8ca1c3153fa88c4088cbc25fab1205a1e2784055832f90f33630097d75328176c89aae4b330a080aeaca61d4c2f571ca1d
-
Filesize
444B
MD57a9fae4da9a8f474ef37e7313fbea545
SHA1d0f74a5acee3eb5e9688b5d4e57af748e33e5bbc
SHA2569f3dc7da2361ce4fee7212f2f713d69d414237f47c265c4dc20f0e3f1a3729e2
SHA51248d0e51ba593aea3c0cc7e4a9acd7cc024d37950cb613e8657c6cf0601bba9e50dd06462ab84dd9feffe3c13e288500c2530bb7ed201af5256662d351a1893bd
-
Filesize
28B
MD56311c3fd15588bb5c126e6c28ff5fffe
SHA1ce81d136fce31779f4dd62e20bdaf99c91e2fc57
SHA2568b82f6032e29a2b5c96031a3630fb6173d12ff0295bc20bb21b877d08f0812d8
SHA5122975fe2e94b6a8adc9cfc1a865ad113772b54572883a537b02a16dd2d029c0f7d9cca3b154fd849bdfe978e18b396bcf9fa6e67e7c61f92bdc089a29a9c355c6
-
Filesize
230B
MD5f06160d8b4dc68cdbf2a04400ef3a859
SHA1e9f1923b29db048dbd19b0fdfab2b307d060afe4
SHA2563f80a68e3ccf882fbe8547828df38f9e153c4e03379801f6fc32d5b8f296b530
SHA5125aa8f3db4dcb5150a311e35cb7af12c3ca0d1d457dc1de196e9468063523dbc700fba993057221ef06caa91ccb68f43c919fa585fb62af51525e34058b9f2b22
-
Filesize
63B
MD5d8ec63dc14740a4e6c378fb3bdcda468
SHA105928b9d90753cb1ecb6be872d4b5a1640b94ed5
SHA25631a1663ecba9509cfb1f843c93cbc69c43a06c3677033b9037c1fffeb17c89d2
SHA512c08387e21f732b15416906b5a3f8557b41af1c87c5bdeee0d95db4d78a432044ae91b441e878779a7f567abf52f06dc87d7ea1962b441beb418458d5c5296025
-
Filesize
45B
MD5c4d30c537ff7aa5d41c5d15e0c5ede74
SHA1efa52b3ee6d052275cb18ef5ae9f6104ce377ca1
SHA256f4f3e6522fc6ec170733f180ff1bd027e622212db2913c5923ebe4c88b4c1188
SHA512cca069308790ae1d5ba4c36c569508e108472c121704134d8cff64e1a291db372694719070d447bfb132527e7fecac7870540ad72f711a56d9039f287af4abcf
-
Filesize
423B
MD540aceb8977ed795cdd12617dd9d0120d
SHA1b7741d2aa60feba97e6a28b78853bb69bcfc5823
SHA2561035376ec5efef549cdaed19ba495bc16f01f9fa1507ef9a27105ee193b3ea75
SHA512ff0dbc875cc34fffca8e3afc4107dc434f64ead727b52d12e8c1449607b5da92ccce14734e0d86bf3b2fe119a8bed9fc948c657d95ba616048223d97758d5132
-
Filesize
5KB
MD51b0f40a4711285faa8988c53c198d925
SHA1740235e31edb1bb69454f99579b4936994dc0cad
SHA2561c63b4ad699c13b3e88e63fd74869d092f24a16591ab62ee2a514586704c22e8
SHA51211f5736a43ffe1c9154d44851b5006319b5dd448a8554062da24ee184e02d53233b292c3973ec58158f10dedd55ddf4d862c9a4b1ed86543abf95e52c51eed83
-
Filesize
457KB
MD524ac7aeaa9235624fa180eb3ee6067a3
SHA12882e07823e18b33bf715bff3d881b87e94d75f0
SHA2563a3c932c69144c05aba4be0ccb4815c08f77f1a4364894ba72f808564bfe6ddd
SHA512e204dc2efafd7beb75c3b0d1f1e9dd8ca1c3153fa88c4088cbc25fab1205a1e2784055832f90f33630097d75328176c89aae4b330a080aeaca61d4c2f571ca1d
-
Filesize
457KB
MD524ac7aeaa9235624fa180eb3ee6067a3
SHA12882e07823e18b33bf715bff3d881b87e94d75f0
SHA2563a3c932c69144c05aba4be0ccb4815c08f77f1a4364894ba72f808564bfe6ddd
SHA512e204dc2efafd7beb75c3b0d1f1e9dd8ca1c3153fa88c4088cbc25fab1205a1e2784055832f90f33630097d75328176c89aae4b330a080aeaca61d4c2f571ca1d