Analysis

  • max time kernel
    3030298s
  • max time network
    143s
  • platform
    android_x64
  • resource
    android-x64-arm64-20230831-en
  • submitted
    20-09-2023 22:00

General

  • Target

    3de0ca27d3f0b6ae0deccb6ee1f11f8693100fe7d829ae73473e911aef8f1918.apk

  • Size

    1.6MB

  • MD5

    afd17cccd08c9a6d1fb7ef08418abf7a

  • SHA1

    c1a43ca680c878b57add482d7165181f14711f96

  • SHA256

    3de0ca27d3f0b6ae0deccb6ee1f11f8693100fe7d829ae73473e911aef8f1918

  • SHA512

    d7b0757a7fd2f80006a95f6d849dce0130cefed56646d70616cec122336c8d4d01595c768694116e1b476c1f2b3cb888aa59f704f8204fb8ebf1f68b6a33c3d2

  • SSDEEP

    49152:YMYwC1s8uEtxzOknlScJrud3AXWZGZbmqQyUtAE4KoSy:jv0sg3OklTJSdQXWZQ/Q8J

Malware Config

Extracted

Family

octo

C2

https://reservop.top/MmEzNTkzZDFkOWQz/

https://lauytropo.net/MmEzNTkzZDFkOWQz/

https://bobnoopo.org/MmEzNTkzZDFkOWQz/

https://junggvrebvqq.org/MmEzNTkzZDFkOWQz/

https://junggpervbvqqqqqq.com/MmEzNTkzZDFkOWQz/

https://junggvbvqqgroup.com/MmEzNTkzZDFkOWQz/

https://junggvbvqqnetok.com/MmEzNTkzZDFkOWQz/

AES_key

Signatures

  • Octo

    Octo is a banking malware with remote access capabilities first seen in April 2022.

  • Octo payload 3 IoCs
  • Makes use of the framework's Accessibility service. 2 IoCs
  • Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps). 1 IoCs
  • Acquires the wake lock. 1 IoCs
  • Loads dropped Dex/Jar 3 IoCs

    Runs executable file dropped to the device during analysis.

  • Reads information about phone network operator.
  • Requests disabling of battery optimizations (often used to enable hiding in the background). 1 IoCs
  • Uses Crypto APIs (Might try to encrypt user data). 1 IoCs

Processes

  • com.seaknowsplp
    1⤵
    • Makes use of the framework's Accessibility service.
    • Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps).
    • Acquires the wake lock.
    • Loads dropped Dex/Jar
    • Requests disabling of battery optimizations (often used to enable hiding in the background).
    • Uses Crypto APIs (Might try to encrypt user data).
    PID:4458

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • /data/user/0/com.seaknowsplp/app_DynamicOptDex/Dild.json

    Filesize

    2KB

    MD5

    2e5fe405a120b75cc65cd2844ed028c8

    SHA1

    8009d3d4feda42bb679f76fcb2364b402a332672

    SHA256

    654ddcc1dea947725ac83019b892a4ffba0b97845428d31026ca65a1385d44fe

    SHA512

    0f304367b2fedefac22fa7b22ba1173bc32d0b79264b758cb2522aa929fdb62d9503786fb015660b4945dd67d346748ba6157fc4511a6001b7f406df49910cc0

  • /data/user/0/com.seaknowsplp/app_DynamicOptDex/Dild.json

    Filesize

    2KB

    MD5

    0c5d76c5fccdcd48df22b2fdea895c5b

    SHA1

    ba846963bf3454f635b570239780734279fb07ae

    SHA256

    87a5eaed5176f0c33f4d833fd4fc7bfb38da7aba6b4ebaaf569989ac38362fe1

    SHA512

    263a85a31ffde6339f12df1acb5ae324849cba0a4b6a4b1f2ac6e93e41f273d34ed244ba2abff2d29a4f22ba9970d92bafdabdf7b14b7d9e4bb8567e6b25c501

  • /data/user/0/com.seaknowsplp/app_DynamicOptDex/Dild.json

    Filesize

    6KB

    MD5

    abdfa1fc42842d12414d867f537a84be

    SHA1

    9892e8c24047ae6e3b1b35be1aaf4fec01620e3c

    SHA256

    cd40e2d8a61b7a5d1fc9a3f05f8203ee7971ca8ebbd2f7b23106ec31dfd08298

    SHA512

    ff0ab81d177eb898a91642162b15658b83dde11b886f95c36690f6c974ef949d9fa24689bdbbfa1546cad47314c24f2da94c3058f49e61d8c456950214d37849

  • /data/user/0/com.seaknowsplp/cache/fxuzb

    Filesize

    449KB

    MD5

    a1405db751a141e61ad44b351fa1f62a

    SHA1

    a3e44b7dd5e3e79b10d455cc951688d7716d589d

    SHA256

    14f700d4160083a1081d1cd97fa3a612bdc4edc045bb944c8c9d5da09abe0082

    SHA512

    56dd2a2b296637f7169a3e41be191a7b6a569681a791e4dae7bcf2d19af1d653adfc7725fb165bc9797d3b4ff1b6974cf5401b8a21996aac0bd6fff7f692aaa1

  • /data/user/0/com.seaknowsplp/cache/fxuzb

    Filesize

    449KB

    MD5

    a1405db751a141e61ad44b351fa1f62a

    SHA1

    a3e44b7dd5e3e79b10d455cc951688d7716d589d

    SHA256

    14f700d4160083a1081d1cd97fa3a612bdc4edc045bb944c8c9d5da09abe0082

    SHA512

    56dd2a2b296637f7169a3e41be191a7b6a569681a791e4dae7bcf2d19af1d653adfc7725fb165bc9797d3b4ff1b6974cf5401b8a21996aac0bd6fff7f692aaa1

  • /data/user/0/com.seaknowsplp/cache/fxuzb

    Filesize

    449KB

    MD5

    a1405db751a141e61ad44b351fa1f62a

    SHA1

    a3e44b7dd5e3e79b10d455cc951688d7716d589d

    SHA256

    14f700d4160083a1081d1cd97fa3a612bdc4edc045bb944c8c9d5da09abe0082

    SHA512

    56dd2a2b296637f7169a3e41be191a7b6a569681a791e4dae7bcf2d19af1d653adfc7725fb165bc9797d3b4ff1b6974cf5401b8a21996aac0bd6fff7f692aaa1

  • /data/user/0/com.seaknowsplp/cache/oat/fxuzb.cur.prof

    Filesize

    295B

    MD5

    0825773fb2cf675cdb3a57e42c44537a

    SHA1

    dd4bde6e3d9baeb77c88bac89080f4138b929d5d

    SHA256

    a379bd7f1986eccfc2a13f49627f0aa7352d5abaaa676375fa7cd72b184af17a

    SHA512

    dd85a598354cfdcc39504dfa48409a3d5006d3fd093b79692ca37a2e970588e1aea5c570109f79a3a25ab10093845a24bb998c806bd98539256bf8bb6a989d2a