Analysis

  • max time kernel
    3030297s
  • max time network
    130s
  • platform
    android_x86
  • resource
    android-x86-arm-20230831-en
  • submitted
    20-09-2023 22:00

General

  • Target

    3de0ca27d3f0b6ae0deccb6ee1f11f8693100fe7d829ae73473e911aef8f1918.apk

  • Size

    1.6MB

  • MD5

    afd17cccd08c9a6d1fb7ef08418abf7a

  • SHA1

    c1a43ca680c878b57add482d7165181f14711f96

  • SHA256

    3de0ca27d3f0b6ae0deccb6ee1f11f8693100fe7d829ae73473e911aef8f1918

  • SHA512

    d7b0757a7fd2f80006a95f6d849dce0130cefed56646d70616cec122336c8d4d01595c768694116e1b476c1f2b3cb888aa59f704f8204fb8ebf1f68b6a33c3d2

  • SSDEEP

    49152:YMYwC1s8uEtxzOknlScJrud3AXWZGZbmqQyUtAE4KoSy:jv0sg3OklTJSdQXWZQ/Q8J

Malware Config

Extracted

Family

octo

C2

https://reservop.top/MmEzNTkzZDFkOWQz/

https://lauytropo.net/MmEzNTkzZDFkOWQz/

https://bobnoopo.org/MmEzNTkzZDFkOWQz/

https://junggvrebvqq.org/MmEzNTkzZDFkOWQz/

https://junggpervbvqqqqqq.com/MmEzNTkzZDFkOWQz/

https://junggvbvqqgroup.com/MmEzNTkzZDFkOWQz/

https://junggvbvqqnetok.com/MmEzNTkzZDFkOWQz/

AES_key

Signatures

  • Octo

    Octo is a banking malware with remote access capabilities first seen in April 2022.

  • Octo payload 3 IoCs
  • Makes use of the framework's Accessibility service. 3 IoCs
  • Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps). 1 IoCs
  • Removes its main activity from the application launcher 1 IoCs
  • Acquires the wake lock. 1 IoCs
  • Loads dropped Dex/Jar 4 IoCs

    Runs executable file dropped to the device during analysis.

  • Reads information about phone network operator.
  • Requests disabling of battery optimizations (often used to enable hiding in the background). 1 IoCs
  • Removes a system notification. 1 IoCs
  • Uses Crypto APIs (Might try to encrypt user data). 1 IoCs

Processes

  • com.seaknowsplp
    1⤵
    • Makes use of the framework's Accessibility service.
    • Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps).
    • Removes its main activity from the application launcher
    • Acquires the wake lock.
    • Loads dropped Dex/Jar
    • Requests disabling of battery optimizations (often used to enable hiding in the background).
    • Removes a system notification.
    • Uses Crypto APIs (Might try to encrypt user data).
    PID:4171
    • /system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.seaknowsplp/app_DynamicOptDex/Dild.json --output-vdex-fd=41 --oat-fd=42 --oat-location=/data/user/0/com.seaknowsplp/app_DynamicOptDex/oat/x86/Dild.odex --compiler-filter=quicken --class-loader-context=&
      2⤵
      • Loads dropped Dex/Jar
      PID:4196

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • /data/data/com.seaknowsplp/app_DynamicOptDex/Dild.json

    Filesize

    2KB

    MD5

    2e5fe405a120b75cc65cd2844ed028c8

    SHA1

    8009d3d4feda42bb679f76fcb2364b402a332672

    SHA256

    654ddcc1dea947725ac83019b892a4ffba0b97845428d31026ca65a1385d44fe

    SHA512

    0f304367b2fedefac22fa7b22ba1173bc32d0b79264b758cb2522aa929fdb62d9503786fb015660b4945dd67d346748ba6157fc4511a6001b7f406df49910cc0

  • /data/data/com.seaknowsplp/app_DynamicOptDex/Dild.json

    Filesize

    2KB

    MD5

    0c5d76c5fccdcd48df22b2fdea895c5b

    SHA1

    ba846963bf3454f635b570239780734279fb07ae

    SHA256

    87a5eaed5176f0c33f4d833fd4fc7bfb38da7aba6b4ebaaf569989ac38362fe1

    SHA512

    263a85a31ffde6339f12df1acb5ae324849cba0a4b6a4b1f2ac6e93e41f273d34ed244ba2abff2d29a4f22ba9970d92bafdabdf7b14b7d9e4bb8567e6b25c501

  • /data/data/com.seaknowsplp/cache/fxuzb

    Filesize

    449KB

    MD5

    a1405db751a141e61ad44b351fa1f62a

    SHA1

    a3e44b7dd5e3e79b10d455cc951688d7716d589d

    SHA256

    14f700d4160083a1081d1cd97fa3a612bdc4edc045bb944c8c9d5da09abe0082

    SHA512

    56dd2a2b296637f7169a3e41be191a7b6a569681a791e4dae7bcf2d19af1d653adfc7725fb165bc9797d3b4ff1b6974cf5401b8a21996aac0bd6fff7f692aaa1

  • /data/data/com.seaknowsplp/cache/oat/fxuzb.cur.prof

    Filesize

    494B

    MD5

    bf3afc895847be4ce1ca5523c116551b

    SHA1

    bea3a1b597f0c2a2c34bad2fd99e9a61fe84d566

    SHA256

    ea49e09cb5e021fb34a4cf248ae576921a051d53fbb21395e010d74bd1a21631

    SHA512

    8f10b234072473714dd5eec926875d321853a6cdcce2a6d95b6604c0055071c1c87ff72cc17d208399b0fa8ea22150804e55c0c9fbb8b595977159304116f3bc

  • /data/data/com.seaknowsplp/kl.txt

    Filesize

    28B

    MD5

    6311c3fd15588bb5c126e6c28ff5fffe

    SHA1

    ce81d136fce31779f4dd62e20bdaf99c91e2fc57

    SHA256

    8b82f6032e29a2b5c96031a3630fb6173d12ff0295bc20bb21b877d08f0812d8

    SHA512

    2975fe2e94b6a8adc9cfc1a865ad113772b54572883a537b02a16dd2d029c0f7d9cca3b154fd849bdfe978e18b396bcf9fa6e67e7c61f92bdc089a29a9c355c6

  • /data/data/com.seaknowsplp/kl.txt

    Filesize

    237B

    MD5

    43a12c1b7ac47221c235b4164115c7ad

    SHA1

    414872e672858bc176421ed340bd6865f8a689c8

    SHA256

    921c50a8018bc49871a73a0aae01397f11517757d47a02c94e9b44547996ff86

    SHA512

    775c5a253c30ebbda09a2b81690b7cce901ca25fb09e9f34f46051c306e322ffe285dca9bfcfa521bf22e8f47186f78bc4b1e3f330913109be7a38196ffce03c

  • /data/data/com.seaknowsplp/kl.txt

    Filesize

    63B

    MD5

    afed4d27932a62fd826897259b74641a

    SHA1

    1d55e5687ca7139b1ab5b9a49707c9bbb32e2f6e

    SHA256

    2a61a30b4715c6bd270c5ccab197302830f7a60f2e1c7f5ad3d5e828d5d0912b

    SHA512

    e5dbabbd326815d280bd8a1b672e18f7726f7db7c6f4a7d401c8a9c720cd43d8dd36a48fae1042f9af08b703d1863c0e1dd86b4c0df38cf6b4155e8600ee5240

  • /data/data/com.seaknowsplp/kl.txt

    Filesize

    45B

    MD5

    23bd1e795b1d8d1a1f98edfbb3a1e1de

    SHA1

    c5b97364fe6b5299cf652d040cfbcc771386323a

    SHA256

    94438fb44f243eaa4a9edf1c70f1c0d848c0662ecaa7b15ab5d3a12f6cd1ac6a

    SHA512

    a1c9e38c1aaa85259c6190956f3a18376fa986244d11db17bd33d52b6c06d27e53455735202703f809cb5e91b686c05b21e0a7a03855f189f2382c857984ae62

  • /data/data/com.seaknowsplp/kl.txt

    Filesize

    437B

    MD5

    e7dcdb937399fb4ee468f28ccd6141f1

    SHA1

    629a9892c9caa139451ef92d92b771075e25ddc7

    SHA256

    f6d1cc67654ef77a14de89734845bde9e0beff6307d62c3ea92fa021587e62f6

    SHA512

    38a79604d598afea9ec9eecc60faf1fc6b5f4a68ebde29b70ed502b9bb2e647250198c4478e6f0cecb82c0e267a95e2918a9c1eab187c89ce78e0176a6ed4574

  • /data/user/0/com.seaknowsplp/app_DynamicOptDex/Dild.json

    Filesize

    6KB

    MD5

    64a95da5ce47d088bb564caf680bd228

    SHA1

    eb70c209906b1f9c66c9ac2eae37395221348695

    SHA256

    2fc975b6b4c3e231e12c1b9fdfb188fbfaf7ed50758a6ea55e36be506dea0551

    SHA512

    f9c6a1fa8a829be4e84634176027f41931b00282033720182d25e4cfae746321655940483ac39c27ef7c11e86de046cc589c031d8175407288b3e3ce62e3ed23

  • /data/user/0/com.seaknowsplp/app_DynamicOptDex/Dild.json

    Filesize

    6KB

    MD5

    abdfa1fc42842d12414d867f537a84be

    SHA1

    9892e8c24047ae6e3b1b35be1aaf4fec01620e3c

    SHA256

    cd40e2d8a61b7a5d1fc9a3f05f8203ee7971ca8ebbd2f7b23106ec31dfd08298

    SHA512

    ff0ab81d177eb898a91642162b15658b83dde11b886f95c36690f6c974ef949d9fa24689bdbbfa1546cad47314c24f2da94c3058f49e61d8c456950214d37849

  • /data/user/0/com.seaknowsplp/cache/fxuzb

    Filesize

    449KB

    MD5

    a1405db751a141e61ad44b351fa1f62a

    SHA1

    a3e44b7dd5e3e79b10d455cc951688d7716d589d

    SHA256

    14f700d4160083a1081d1cd97fa3a612bdc4edc045bb944c8c9d5da09abe0082

    SHA512

    56dd2a2b296637f7169a3e41be191a7b6a569681a791e4dae7bcf2d19af1d653adfc7725fb165bc9797d3b4ff1b6974cf5401b8a21996aac0bd6fff7f692aaa1

  • /data/user/0/com.seaknowsplp/cache/fxuzb

    Filesize

    449KB

    MD5

    a1405db751a141e61ad44b351fa1f62a

    SHA1

    a3e44b7dd5e3e79b10d455cc951688d7716d589d

    SHA256

    14f700d4160083a1081d1cd97fa3a612bdc4edc045bb944c8c9d5da09abe0082

    SHA512

    56dd2a2b296637f7169a3e41be191a7b6a569681a791e4dae7bcf2d19af1d653adfc7725fb165bc9797d3b4ff1b6974cf5401b8a21996aac0bd6fff7f692aaa1