Analysis
-
max time kernel
3030298s -
max time network
143s -
platform
android_x64 -
resource
android-x64-arm64-20230831-en -
submitted
20-09-2023 22:00
Static task
static1
Behavioral task
behavioral1
Sample
3de0ca27d3f0b6ae0deccb6ee1f11f8693100fe7d829ae73473e911aef8f1918.apk
Resource
android-x86-arm-20230831-en
Behavioral task
behavioral2
Sample
3de0ca27d3f0b6ae0deccb6ee1f11f8693100fe7d829ae73473e911aef8f1918.apk
Resource
android-x64-arm64-20230831-en
Behavioral task
behavioral3
Sample
license.html
Resource
win7-20230831-en
Behavioral task
behavioral4
Sample
license.html
Resource
win10v2004-20230915-en
General
-
Target
3de0ca27d3f0b6ae0deccb6ee1f11f8693100fe7d829ae73473e911aef8f1918.apk
-
Size
1.6MB
-
MD5
afd17cccd08c9a6d1fb7ef08418abf7a
-
SHA1
c1a43ca680c878b57add482d7165181f14711f96
-
SHA256
3de0ca27d3f0b6ae0deccb6ee1f11f8693100fe7d829ae73473e911aef8f1918
-
SHA512
d7b0757a7fd2f80006a95f6d849dce0130cefed56646d70616cec122336c8d4d01595c768694116e1b476c1f2b3cb888aa59f704f8204fb8ebf1f68b6a33c3d2
-
SSDEEP
49152:YMYwC1s8uEtxzOknlScJrud3AXWZGZbmqQyUtAE4KoSy:jv0sg3OklTJSdQXWZQ/Q8J
Malware Config
Extracted
octo
https://reservop.top/MmEzNTkzZDFkOWQz/
https://lauytropo.net/MmEzNTkzZDFkOWQz/
https://bobnoopo.org/MmEzNTkzZDFkOWQz/
https://junggvrebvqq.org/MmEzNTkzZDFkOWQz/
https://junggpervbvqqqqqq.com/MmEzNTkzZDFkOWQz/
https://junggvbvqqgroup.com/MmEzNTkzZDFkOWQz/
https://junggvbvqqnetok.com/MmEzNTkzZDFkOWQz/
Signatures
-
Octo
Octo is a banking malware with remote access capabilities first seen in April 2022.
-
Octo payload 3 IoCs
Processes:
resource yara_rule /data/user/0/com.seaknowsplp/cache/fxuzb family_octo /data/user/0/com.seaknowsplp/cache/fxuzb family_octo /data/user/0/com.seaknowsplp/cache/fxuzb family_octo -
Makes use of the framework's Accessibility service. 2 IoCs
Processes:
com.seaknowsplpdescription ioc process Framework service call android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId com.seaknowsplp Framework service call android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByViewId com.seaknowsplp -
Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps). 1 IoCs
Processes:
com.seaknowsplpdescription ioc process Framework service call android.content.pm.IPackageManager.getInstalledApplications com.seaknowsplp -
Acquires the wake lock. 1 IoCs
Processes:
com.seaknowsplpdescription ioc process Framework service call android.os.IPowerManager.acquireWakeLock com.seaknowsplp -
Loads dropped Dex/Jar 3 IoCs
Runs executable file dropped to the device during analysis.
Processes:
com.seaknowsplpioc pid process /data/user/0/com.seaknowsplp/app_DynamicOptDex/Dild.json 4458 com.seaknowsplp /data/user/0/com.seaknowsplp/cache/fxuzb 4458 com.seaknowsplp /data/user/0/com.seaknowsplp/cache/fxuzb 4458 com.seaknowsplp -
Reads information about phone network operator.
-
Requests disabling of battery optimizations (often used to enable hiding in the background). 1 IoCs
Processes:
com.seaknowsplpdescription ioc process Intent action android.settings.REQUEST_IGNORE_BATTERY_OPTIMIZATIONS com.seaknowsplp -
Uses Crypto APIs (Might try to encrypt user data). 1 IoCs
Processes:
com.seaknowsplpdescription ioc process Framework API call javax.crypto.Cipher.doFinal com.seaknowsplp
Processes
-
com.seaknowsplp1⤵
- Makes use of the framework's Accessibility service.
- Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps).
- Acquires the wake lock.
- Loads dropped Dex/Jar
- Requests disabling of battery optimizations (often used to enable hiding in the background).
- Uses Crypto APIs (Might try to encrypt user data).
PID:4458
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2KB
MD52e5fe405a120b75cc65cd2844ed028c8
SHA18009d3d4feda42bb679f76fcb2364b402a332672
SHA256654ddcc1dea947725ac83019b892a4ffba0b97845428d31026ca65a1385d44fe
SHA5120f304367b2fedefac22fa7b22ba1173bc32d0b79264b758cb2522aa929fdb62d9503786fb015660b4945dd67d346748ba6157fc4511a6001b7f406df49910cc0
-
Filesize
2KB
MD50c5d76c5fccdcd48df22b2fdea895c5b
SHA1ba846963bf3454f635b570239780734279fb07ae
SHA25687a5eaed5176f0c33f4d833fd4fc7bfb38da7aba6b4ebaaf569989ac38362fe1
SHA512263a85a31ffde6339f12df1acb5ae324849cba0a4b6a4b1f2ac6e93e41f273d34ed244ba2abff2d29a4f22ba9970d92bafdabdf7b14b7d9e4bb8567e6b25c501
-
Filesize
6KB
MD5abdfa1fc42842d12414d867f537a84be
SHA19892e8c24047ae6e3b1b35be1aaf4fec01620e3c
SHA256cd40e2d8a61b7a5d1fc9a3f05f8203ee7971ca8ebbd2f7b23106ec31dfd08298
SHA512ff0ab81d177eb898a91642162b15658b83dde11b886f95c36690f6c974ef949d9fa24689bdbbfa1546cad47314c24f2da94c3058f49e61d8c456950214d37849
-
Filesize
449KB
MD5a1405db751a141e61ad44b351fa1f62a
SHA1a3e44b7dd5e3e79b10d455cc951688d7716d589d
SHA25614f700d4160083a1081d1cd97fa3a612bdc4edc045bb944c8c9d5da09abe0082
SHA51256dd2a2b296637f7169a3e41be191a7b6a569681a791e4dae7bcf2d19af1d653adfc7725fb165bc9797d3b4ff1b6974cf5401b8a21996aac0bd6fff7f692aaa1
-
Filesize
449KB
MD5a1405db751a141e61ad44b351fa1f62a
SHA1a3e44b7dd5e3e79b10d455cc951688d7716d589d
SHA25614f700d4160083a1081d1cd97fa3a612bdc4edc045bb944c8c9d5da09abe0082
SHA51256dd2a2b296637f7169a3e41be191a7b6a569681a791e4dae7bcf2d19af1d653adfc7725fb165bc9797d3b4ff1b6974cf5401b8a21996aac0bd6fff7f692aaa1
-
Filesize
449KB
MD5a1405db751a141e61ad44b351fa1f62a
SHA1a3e44b7dd5e3e79b10d455cc951688d7716d589d
SHA25614f700d4160083a1081d1cd97fa3a612bdc4edc045bb944c8c9d5da09abe0082
SHA51256dd2a2b296637f7169a3e41be191a7b6a569681a791e4dae7bcf2d19af1d653adfc7725fb165bc9797d3b4ff1b6974cf5401b8a21996aac0bd6fff7f692aaa1
-
Filesize
295B
MD50825773fb2cf675cdb3a57e42c44537a
SHA1dd4bde6e3d9baeb77c88bac89080f4138b929d5d
SHA256a379bd7f1986eccfc2a13f49627f0aa7352d5abaaa676375fa7cd72b184af17a
SHA512dd85a598354cfdcc39504dfa48409a3d5006d3fd093b79692ca37a2e970588e1aea5c570109f79a3a25ab10093845a24bb998c806bd98539256bf8bb6a989d2a