Analysis
-
max time kernel
3030297s -
max time network
130s -
platform
android_x86 -
resource
android-x86-arm-20230831-en -
submitted
20-09-2023 22:00
Static task
static1
Behavioral task
behavioral1
Sample
3de0ca27d3f0b6ae0deccb6ee1f11f8693100fe7d829ae73473e911aef8f1918.apk
Resource
android-x86-arm-20230831-en
Behavioral task
behavioral2
Sample
3de0ca27d3f0b6ae0deccb6ee1f11f8693100fe7d829ae73473e911aef8f1918.apk
Resource
android-x64-arm64-20230831-en
Behavioral task
behavioral3
Sample
license.html
Resource
win7-20230831-en
Behavioral task
behavioral4
Sample
license.html
Resource
win10v2004-20230915-en
General
-
Target
3de0ca27d3f0b6ae0deccb6ee1f11f8693100fe7d829ae73473e911aef8f1918.apk
-
Size
1.6MB
-
MD5
afd17cccd08c9a6d1fb7ef08418abf7a
-
SHA1
c1a43ca680c878b57add482d7165181f14711f96
-
SHA256
3de0ca27d3f0b6ae0deccb6ee1f11f8693100fe7d829ae73473e911aef8f1918
-
SHA512
d7b0757a7fd2f80006a95f6d849dce0130cefed56646d70616cec122336c8d4d01595c768694116e1b476c1f2b3cb888aa59f704f8204fb8ebf1f68b6a33c3d2
-
SSDEEP
49152:YMYwC1s8uEtxzOknlScJrud3AXWZGZbmqQyUtAE4KoSy:jv0sg3OklTJSdQXWZQ/Q8J
Malware Config
Extracted
octo
https://reservop.top/MmEzNTkzZDFkOWQz/
https://lauytropo.net/MmEzNTkzZDFkOWQz/
https://bobnoopo.org/MmEzNTkzZDFkOWQz/
https://junggvrebvqq.org/MmEzNTkzZDFkOWQz/
https://junggpervbvqqqqqq.com/MmEzNTkzZDFkOWQz/
https://junggvbvqqgroup.com/MmEzNTkzZDFkOWQz/
https://junggvbvqqnetok.com/MmEzNTkzZDFkOWQz/
Signatures
-
Octo
Octo is a banking malware with remote access capabilities first seen in April 2022.
-
Octo payload 3 IoCs
Processes:
resource yara_rule /data/data/com.seaknowsplp/cache/fxuzb family_octo /data/user/0/com.seaknowsplp/cache/fxuzb family_octo /data/user/0/com.seaknowsplp/cache/fxuzb family_octo -
Makes use of the framework's Accessibility service. 3 IoCs
Processes:
com.seaknowsplpdescription ioc process Framework service call android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId com.seaknowsplp Framework service call android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByViewId com.seaknowsplp Framework service call android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByText com.seaknowsplp -
Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps). 1 IoCs
Processes:
com.seaknowsplpdescription ioc process Framework service call android.content.pm.IPackageManager.getInstalledApplications com.seaknowsplp -
Processes:
com.seaknowsplppid process 4171 com.seaknowsplp -
Acquires the wake lock. 1 IoCs
Processes:
com.seaknowsplpdescription ioc process Framework service call android.os.IPowerManager.acquireWakeLock com.seaknowsplp -
Loads dropped Dex/Jar 4 IoCs
Runs executable file dropped to the device during analysis.
Processes:
/system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.seaknowsplp/app_DynamicOptDex/Dild.json --output-vdex-fd=41 --oat-fd=42 --oat-location=/data/user/0/com.seaknowsplp/app_DynamicOptDex/oat/x86/Dild.odex --compiler-filter=quicken --class-loader-context=&com.seaknowsplpioc pid process /data/user/0/com.seaknowsplp/app_DynamicOptDex/Dild.json 4196 /system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.seaknowsplp/app_DynamicOptDex/Dild.json --output-vdex-fd=41 --oat-fd=42 --oat-location=/data/user/0/com.seaknowsplp/app_DynamicOptDex/oat/x86/Dild.odex --compiler-filter=quicken --class-loader-context=& /data/user/0/com.seaknowsplp/app_DynamicOptDex/Dild.json 4171 com.seaknowsplp /data/user/0/com.seaknowsplp/cache/fxuzb 4171 com.seaknowsplp /data/user/0/com.seaknowsplp/cache/fxuzb 4171 com.seaknowsplp -
Reads information about phone network operator.
-
Requests disabling of battery optimizations (often used to enable hiding in the background). 1 IoCs
Processes:
com.seaknowsplpdescription ioc process Intent action android.settings.REQUEST_IGNORE_BATTERY_OPTIMIZATIONS com.seaknowsplp -
Removes a system notification. 1 IoCs
Processes:
com.seaknowsplpdescription ioc process Framework service call android.app.INotificationManager.cancelNotificationWithTag com.seaknowsplp -
Uses Crypto APIs (Might try to encrypt user data). 1 IoCs
Processes:
com.seaknowsplpdescription ioc process Framework API call javax.crypto.Cipher.doFinal com.seaknowsplp
Processes
-
com.seaknowsplp1⤵
- Makes use of the framework's Accessibility service.
- Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps).
- Removes its main activity from the application launcher
- Acquires the wake lock.
- Loads dropped Dex/Jar
- Requests disabling of battery optimizations (often used to enable hiding in the background).
- Removes a system notification.
- Uses Crypto APIs (Might try to encrypt user data).
PID:4171 -
/system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.seaknowsplp/app_DynamicOptDex/Dild.json --output-vdex-fd=41 --oat-fd=42 --oat-location=/data/user/0/com.seaknowsplp/app_DynamicOptDex/oat/x86/Dild.odex --compiler-filter=quicken --class-loader-context=&2⤵
- Loads dropped Dex/Jar
PID:4196
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2KB
MD52e5fe405a120b75cc65cd2844ed028c8
SHA18009d3d4feda42bb679f76fcb2364b402a332672
SHA256654ddcc1dea947725ac83019b892a4ffba0b97845428d31026ca65a1385d44fe
SHA5120f304367b2fedefac22fa7b22ba1173bc32d0b79264b758cb2522aa929fdb62d9503786fb015660b4945dd67d346748ba6157fc4511a6001b7f406df49910cc0
-
Filesize
2KB
MD50c5d76c5fccdcd48df22b2fdea895c5b
SHA1ba846963bf3454f635b570239780734279fb07ae
SHA25687a5eaed5176f0c33f4d833fd4fc7bfb38da7aba6b4ebaaf569989ac38362fe1
SHA512263a85a31ffde6339f12df1acb5ae324849cba0a4b6a4b1f2ac6e93e41f273d34ed244ba2abff2d29a4f22ba9970d92bafdabdf7b14b7d9e4bb8567e6b25c501
-
Filesize
449KB
MD5a1405db751a141e61ad44b351fa1f62a
SHA1a3e44b7dd5e3e79b10d455cc951688d7716d589d
SHA25614f700d4160083a1081d1cd97fa3a612bdc4edc045bb944c8c9d5da09abe0082
SHA51256dd2a2b296637f7169a3e41be191a7b6a569681a791e4dae7bcf2d19af1d653adfc7725fb165bc9797d3b4ff1b6974cf5401b8a21996aac0bd6fff7f692aaa1
-
Filesize
494B
MD5bf3afc895847be4ce1ca5523c116551b
SHA1bea3a1b597f0c2a2c34bad2fd99e9a61fe84d566
SHA256ea49e09cb5e021fb34a4cf248ae576921a051d53fbb21395e010d74bd1a21631
SHA5128f10b234072473714dd5eec926875d321853a6cdcce2a6d95b6604c0055071c1c87ff72cc17d208399b0fa8ea22150804e55c0c9fbb8b595977159304116f3bc
-
Filesize
28B
MD56311c3fd15588bb5c126e6c28ff5fffe
SHA1ce81d136fce31779f4dd62e20bdaf99c91e2fc57
SHA2568b82f6032e29a2b5c96031a3630fb6173d12ff0295bc20bb21b877d08f0812d8
SHA5122975fe2e94b6a8adc9cfc1a865ad113772b54572883a537b02a16dd2d029c0f7d9cca3b154fd849bdfe978e18b396bcf9fa6e67e7c61f92bdc089a29a9c355c6
-
Filesize
237B
MD543a12c1b7ac47221c235b4164115c7ad
SHA1414872e672858bc176421ed340bd6865f8a689c8
SHA256921c50a8018bc49871a73a0aae01397f11517757d47a02c94e9b44547996ff86
SHA512775c5a253c30ebbda09a2b81690b7cce901ca25fb09e9f34f46051c306e322ffe285dca9bfcfa521bf22e8f47186f78bc4b1e3f330913109be7a38196ffce03c
-
Filesize
63B
MD5afed4d27932a62fd826897259b74641a
SHA11d55e5687ca7139b1ab5b9a49707c9bbb32e2f6e
SHA2562a61a30b4715c6bd270c5ccab197302830f7a60f2e1c7f5ad3d5e828d5d0912b
SHA512e5dbabbd326815d280bd8a1b672e18f7726f7db7c6f4a7d401c8a9c720cd43d8dd36a48fae1042f9af08b703d1863c0e1dd86b4c0df38cf6b4155e8600ee5240
-
Filesize
45B
MD523bd1e795b1d8d1a1f98edfbb3a1e1de
SHA1c5b97364fe6b5299cf652d040cfbcc771386323a
SHA25694438fb44f243eaa4a9edf1c70f1c0d848c0662ecaa7b15ab5d3a12f6cd1ac6a
SHA512a1c9e38c1aaa85259c6190956f3a18376fa986244d11db17bd33d52b6c06d27e53455735202703f809cb5e91b686c05b21e0a7a03855f189f2382c857984ae62
-
Filesize
437B
MD5e7dcdb937399fb4ee468f28ccd6141f1
SHA1629a9892c9caa139451ef92d92b771075e25ddc7
SHA256f6d1cc67654ef77a14de89734845bde9e0beff6307d62c3ea92fa021587e62f6
SHA51238a79604d598afea9ec9eecc60faf1fc6b5f4a68ebde29b70ed502b9bb2e647250198c4478e6f0cecb82c0e267a95e2918a9c1eab187c89ce78e0176a6ed4574
-
Filesize
6KB
MD564a95da5ce47d088bb564caf680bd228
SHA1eb70c209906b1f9c66c9ac2eae37395221348695
SHA2562fc975b6b4c3e231e12c1b9fdfb188fbfaf7ed50758a6ea55e36be506dea0551
SHA512f9c6a1fa8a829be4e84634176027f41931b00282033720182d25e4cfae746321655940483ac39c27ef7c11e86de046cc589c031d8175407288b3e3ce62e3ed23
-
Filesize
6KB
MD5abdfa1fc42842d12414d867f537a84be
SHA19892e8c24047ae6e3b1b35be1aaf4fec01620e3c
SHA256cd40e2d8a61b7a5d1fc9a3f05f8203ee7971ca8ebbd2f7b23106ec31dfd08298
SHA512ff0ab81d177eb898a91642162b15658b83dde11b886f95c36690f6c974ef949d9fa24689bdbbfa1546cad47314c24f2da94c3058f49e61d8c456950214d37849
-
Filesize
449KB
MD5a1405db751a141e61ad44b351fa1f62a
SHA1a3e44b7dd5e3e79b10d455cc951688d7716d589d
SHA25614f700d4160083a1081d1cd97fa3a612bdc4edc045bb944c8c9d5da09abe0082
SHA51256dd2a2b296637f7169a3e41be191a7b6a569681a791e4dae7bcf2d19af1d653adfc7725fb165bc9797d3b4ff1b6974cf5401b8a21996aac0bd6fff7f692aaa1
-
Filesize
449KB
MD5a1405db751a141e61ad44b351fa1f62a
SHA1a3e44b7dd5e3e79b10d455cc951688d7716d589d
SHA25614f700d4160083a1081d1cd97fa3a612bdc4edc045bb944c8c9d5da09abe0082
SHA51256dd2a2b296637f7169a3e41be191a7b6a569681a791e4dae7bcf2d19af1d653adfc7725fb165bc9797d3b4ff1b6974cf5401b8a21996aac0bd6fff7f692aaa1