Analysis

  • max time kernel
    2894865s
  • max time network
    134s
  • platform
    android_x86
  • resource
    android-x86-arm-20230831-en
  • submitted
    19-09-2023 08:12

General

  • Target

    chrome-update23453.apk

  • Size

    1.8MB

  • MD5

    fd7a7e3a8f8a2961dfb9bb6b4bdef957

  • SHA1

    d99b1d196aa588e9f52bff8ae83c984691ea15d4

  • SHA256

    ab02e4cbe64c32b1ca18abd8a727c6e6e5f70d6ccb534da980df2f4210c23d6f

  • SHA512

    5dd947b9b386f21b94eb0b7f1cf719ecd46cd66611ef7dbc89eae99b44d539b64836b522e582c2aa0ed4bc55c581680e5be93d747215090a22f8825b67a489dc

  • SSDEEP

    49152:HGWTLEc/bDpPjdSXLmaahlfZH4lrnEStPXGZGZbmq76QFAE4KoSu:HG8TzFjkXLmaahlxHI/JXGZQ/74J

Malware Config

Extracted

Family

octo

C2

https://caramiliudj16.live/MTU2OWE0NzJjNGY5/

https://boodycookies41.info/MTU2OWE0NzJjNGY5/

https://smoorfikimv.pro/MTU2OWE0NzJjNGY5/

https://alimavij72.vip/MTU2OWE0NzJjNGY5/

https://5a9udxg6l6gd.su/MTU2OWE0NzJjNGY5/

https://f2kic1nam25n81k.cc/MTU2OWE0NzJjNGY5/

https://maza5rra11vti251mca.info/MTU2OWE0NzJjNGY5/

https://cleverk21da912mca.live/MTU2OWE0NzJjNGY5/

AES_key

Signatures

  • Octo

    Octo is a banking malware with remote access capabilities first seen in April 2022.

  • Octo payload 3 IoCs
  • Makes use of the framework's Accessibility service. 2 IoCs
  • Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps). 1 IoCs
  • Acquires the wake lock. 1 IoCs
  • Loads dropped Dex/Jar 3 IoCs

    Runs executable file dropped to the device during analysis.

  • Reads information about phone network operator.
  • Requests disabling of battery optimizations (often used to enable hiding in the background). 1 IoCs
  • Removes a system notification. 1 IoCs
  • Uses Crypto APIs (Might try to encrypt user data). 1 IoCs

Processes

  • com.wouldbegan28
    1⤵
    • Makes use of the framework's Accessibility service.
    • Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps).
    • Acquires the wake lock.
    • Loads dropped Dex/Jar
    • Requests disabling of battery optimizations (often used to enable hiding in the background).
    • Removes a system notification.
    • Uses Crypto APIs (Might try to encrypt user data).
    PID:4133

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • /data/data/com.wouldbegan28/.qcom.wouldbegan28

    Filesize

    48B

    MD5

    046a414913add6f5bb60072c7db819b6

    SHA1

    451ee4f6809260aec622d772fd329c7d0297a842

    SHA256

    b66c1320cb063a1d391c94273572ea6edae76c8c8b0a07f8d75c88686f0df72a

    SHA512

    4e6355f3051ed5e811ab030abde1f5be7f5e1cf33be99cd08477e9b6c015deb1d8bd75a09fb9c7176b8511c5ad0a67abc0902a3531e97564ccb6afc57496a47c

  • /data/data/com.wouldbegan28/app_DynamicOptDex/HdoCq.json

    Filesize

    2KB

    MD5

    28170be78b5ad3652a054edf8d5e8b1e

    SHA1

    7c75f9299e4b979428e6e87130b9d8f186d2330e

    SHA256

    16f76e47de48686e59d9314a14d0296c6b45e3f81327604d980e662170841234

    SHA512

    96a824ecccf00a598ef36ac296fc7ad8f64e2788533e8e698d6047a76c5411a48b84fc3023eb58db5857ef9b99e1d4cb71107966636ed7153df74699ba397ed0

  • /data/data/com.wouldbegan28/app_DynamicOptDex/HdoCq.json

    Filesize

    2KB

    MD5

    095439df27d25eafee908d27ed9ef84f

    SHA1

    e101b69770c6720d1f78abe1a5b8981d1844450a

    SHA256

    a9dbf65bd41426a28ce92be32f7688498bb6ace5eef5c5525d820ff3de4cff39

    SHA512

    a4883248ae56db04e9f1ce4917a1d108b78261c86334db12a119abb9bc7b17577d55eb9e933eb2d53cffb3260bb995f9caf0d5a752ba91d1e0295025eff67939

  • /data/data/com.wouldbegan28/cache/eaaej

    Filesize

    457KB

    MD5

    24ac7aeaa9235624fa180eb3ee6067a3

    SHA1

    2882e07823e18b33bf715bff3d881b87e94d75f0

    SHA256

    3a3c932c69144c05aba4be0ccb4815c08f77f1a4364894ba72f808564bfe6ddd

    SHA512

    e204dc2efafd7beb75c3b0d1f1e9dd8ca1c3153fa88c4088cbc25fab1205a1e2784055832f90f33630097d75328176c89aae4b330a080aeaca61d4c2f571ca1d

  • /data/data/com.wouldbegan28/cache/oat/eaaej.cur.prof

    Filesize

    444B

    MD5

    7a9fae4da9a8f474ef37e7313fbea545

    SHA1

    d0f74a5acee3eb5e9688b5d4e57af748e33e5bbc

    SHA256

    9f3dc7da2361ce4fee7212f2f713d69d414237f47c265c4dc20f0e3f1a3729e2

    SHA512

    48d0e51ba593aea3c0cc7e4a9acd7cc024d37950cb613e8657c6cf0601bba9e50dd06462ab84dd9feffe3c13e288500c2530bb7ed201af5256662d351a1893bd

  • /data/data/com.wouldbegan28/kl.txt

    Filesize

    28B

    MD5

    6311c3fd15588bb5c126e6c28ff5fffe

    SHA1

    ce81d136fce31779f4dd62e20bdaf99c91e2fc57

    SHA256

    8b82f6032e29a2b5c96031a3630fb6173d12ff0295bc20bb21b877d08f0812d8

    SHA512

    2975fe2e94b6a8adc9cfc1a865ad113772b54572883a537b02a16dd2d029c0f7d9cca3b154fd849bdfe978e18b396bcf9fa6e67e7c61f92bdc089a29a9c355c6

  • /data/data/com.wouldbegan28/kl.txt

    Filesize

    230B

    MD5

    f06160d8b4dc68cdbf2a04400ef3a859

    SHA1

    e9f1923b29db048dbd19b0fdfab2b307d060afe4

    SHA256

    3f80a68e3ccf882fbe8547828df38f9e153c4e03379801f6fc32d5b8f296b530

    SHA512

    5aa8f3db4dcb5150a311e35cb7af12c3ca0d1d457dc1de196e9468063523dbc700fba993057221ef06caa91ccb68f43c919fa585fb62af51525e34058b9f2b22

  • /data/data/com.wouldbegan28/kl.txt

    Filesize

    63B

    MD5

    d8ec63dc14740a4e6c378fb3bdcda468

    SHA1

    05928b9d90753cb1ecb6be872d4b5a1640b94ed5

    SHA256

    31a1663ecba9509cfb1f843c93cbc69c43a06c3677033b9037c1fffeb17c89d2

    SHA512

    c08387e21f732b15416906b5a3f8557b41af1c87c5bdeee0d95db4d78a432044ae91b441e878779a7f567abf52f06dc87d7ea1962b441beb418458d5c5296025

  • /data/data/com.wouldbegan28/kl.txt

    Filesize

    45B

    MD5

    c4d30c537ff7aa5d41c5d15e0c5ede74

    SHA1

    efa52b3ee6d052275cb18ef5ae9f6104ce377ca1

    SHA256

    f4f3e6522fc6ec170733f180ff1bd027e622212db2913c5923ebe4c88b4c1188

    SHA512

    cca069308790ae1d5ba4c36c569508e108472c121704134d8cff64e1a291db372694719070d447bfb132527e7fecac7870540ad72f711a56d9039f287af4abcf

  • /data/data/com.wouldbegan28/kl.txt

    Filesize

    423B

    MD5

    40aceb8977ed795cdd12617dd9d0120d

    SHA1

    b7741d2aa60feba97e6a28b78853bb69bcfc5823

    SHA256

    1035376ec5efef549cdaed19ba495bc16f01f9fa1507ef9a27105ee193b3ea75

    SHA512

    ff0dbc875cc34fffca8e3afc4107dc434f64ead727b52d12e8c1449607b5da92ccce14734e0d86bf3b2fe119a8bed9fc948c657d95ba616048223d97758d5132

  • /data/user/0/com.wouldbegan28/app_DynamicOptDex/HdoCq.json

    Filesize

    5KB

    MD5

    1b0f40a4711285faa8988c53c198d925

    SHA1

    740235e31edb1bb69454f99579b4936994dc0cad

    SHA256

    1c63b4ad699c13b3e88e63fd74869d092f24a16591ab62ee2a514586704c22e8

    SHA512

    11f5736a43ffe1c9154d44851b5006319b5dd448a8554062da24ee184e02d53233b292c3973ec58158f10dedd55ddf4d862c9a4b1ed86543abf95e52c51eed83

  • /data/user/0/com.wouldbegan28/cache/eaaej

    Filesize

    457KB

    MD5

    24ac7aeaa9235624fa180eb3ee6067a3

    SHA1

    2882e07823e18b33bf715bff3d881b87e94d75f0

    SHA256

    3a3c932c69144c05aba4be0ccb4815c08f77f1a4364894ba72f808564bfe6ddd

    SHA512

    e204dc2efafd7beb75c3b0d1f1e9dd8ca1c3153fa88c4088cbc25fab1205a1e2784055832f90f33630097d75328176c89aae4b330a080aeaca61d4c2f571ca1d

  • /data/user/0/com.wouldbegan28/cache/eaaej

    Filesize

    457KB

    MD5

    24ac7aeaa9235624fa180eb3ee6067a3

    SHA1

    2882e07823e18b33bf715bff3d881b87e94d75f0

    SHA256

    3a3c932c69144c05aba4be0ccb4815c08f77f1a4364894ba72f808564bfe6ddd

    SHA512

    e204dc2efafd7beb75c3b0d1f1e9dd8ca1c3153fa88c4088cbc25fab1205a1e2784055832f90f33630097d75328176c89aae4b330a080aeaca61d4c2f571ca1d