Analysis
-
max time kernel
3462983s -
max time network
132s -
platform
android_x86 -
resource
android-x86-arm-20230831-en -
submitted
25-09-2023 22:02
Static task
static1
Behavioral task
behavioral1
Sample
8f0284b41c15c0c6745aa86b340f31b5c3f7d5ebc18017eaced95301d39f98d7.apk
Resource
android-x86-arm-20230831-en
Behavioral task
behavioral2
Sample
8f0284b41c15c0c6745aa86b340f31b5c3f7d5ebc18017eaced95301d39f98d7.apk
Resource
android-x64-20230831-en
General
-
Target
8f0284b41c15c0c6745aa86b340f31b5c3f7d5ebc18017eaced95301d39f98d7.apk
-
Size
541KB
-
MD5
c5b77da398a9234ec7a8137fb49981d7
-
SHA1
27ead5af5ecc90dec8481c645ab317c5dcf23655
-
SHA256
8f0284b41c15c0c6745aa86b340f31b5c3f7d5ebc18017eaced95301d39f98d7
-
SHA512
9e15a105e5ee65ce9df8716d8e7fc3390dff77d04fb97e05748922572c6a37f8639f37d4e41f464006a839643422fc796583efe251761a7987e52644219b46d8
-
SSDEEP
12288:+kOkEiUWX4/jo/Ib54fejzv70xB0KiaDMtr+cY49nJ:Cni5X4/joQtXjKiJ1+z0nJ
Malware Config
Extracted
octo
https://waytoupio.click/M2I2NGMzMzk4YzM0/
https://acsmartio.tech/M2I2NGMzMzk4YzM0/
https://apppro.live/M2I2NGMzMzk4YzM0/
https://waytoupio.click/m2i2ngmzmzk4yzm0/M2I2NGMzMzk4YzM0/
https://acsmartio.tech/m2i2ngmzmzk4yzm0/M2I2NGMzMzk4YzM0/
https://apppro.live/m2i2ngmzmzk4yzm0/M2I2NGMzMzk4YzM0/
Signatures
-
Octo
Octo is a banking malware with remote access capabilities first seen in April 2022.
-
Octo payload 3 IoCs
Processes:
resource yara_rule /data/data/com.simplesun4/cache/zpaofggcurnjq family_octo /data/user/0/com.simplesun4/cache/zpaofggcurnjq family_octo /data/user/0/com.simplesun4/cache/zpaofggcurnjq family_octo -
Makes use of the framework's Accessibility service. 2 IoCs
Processes:
com.simplesun4description ioc process Framework service call android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId com.simplesun4 Framework service call android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByViewId com.simplesun4 -
Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps). 1 IoCs
Processes:
com.simplesun4description ioc process Framework service call android.content.pm.IPackageManager.getInstalledApplications com.simplesun4 -
Processes:
com.simplesun4pid process 4172 com.simplesun4 -
Acquires the wake lock. 1 IoCs
Processes:
com.simplesun4description ioc process Framework service call android.os.IPowerManager.acquireWakeLock com.simplesun4 -
Loads dropped Dex/Jar 2 IoCs
Runs executable file dropped to the device during analysis.
Processes:
com.simplesun4ioc pid process /data/user/0/com.simplesun4/cache/zpaofggcurnjq 4172 com.simplesun4 /data/user/0/com.simplesun4/cache/zpaofggcurnjq 4172 com.simplesun4 -
Reads information about phone network operator.
-
Requests disabling of battery optimizations (often used to enable hiding in the background). 1 IoCs
Processes:
com.simplesun4description ioc process Intent action android.settings.REQUEST_IGNORE_BATTERY_OPTIMIZATIONS com.simplesun4 -
Removes a system notification. 1 IoCs
Processes:
com.simplesun4description ioc process Framework service call android.app.INotificationManager.cancelNotificationWithTag com.simplesun4 -
Uses Crypto APIs (Might try to encrypt user data). 1 IoCs
Processes:
com.simplesun4description ioc process Framework API call javax.crypto.Cipher.doFinal com.simplesun4
Processes
-
com.simplesun41⤵
- Makes use of the framework's Accessibility service.
- Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps).
- Removes its main activity from the application launcher
- Acquires the wake lock.
- Loads dropped Dex/Jar
- Requests disabling of battery optimizations (often used to enable hiding in the background).
- Removes a system notification.
- Uses Crypto APIs (Might try to encrypt user data).
PID:4172
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
48B
MD5046a414913add6f5bb60072c7db819b6
SHA1451ee4f6809260aec622d772fd329c7d0297a842
SHA256b66c1320cb063a1d391c94273572ea6edae76c8c8b0a07f8d75c88686f0df72a
SHA5124e6355f3051ed5e811ab030abde1f5be7f5e1cf33be99cd08477e9b6c015deb1d8bd75a09fb9c7176b8511c5ad0a67abc0902a3531e97564ccb6afc57496a47c
-
Filesize
476B
MD52c4d3eb866061e0582e28ecdf2627195
SHA14eb7ea7bcd96bcd553676ed15a841e17a1812cea
SHA2569da14c27fe2da02dd95fc54f76c09a1f77752943fd18ba2ebf42c2ac862389fb
SHA5121b1714ed2ffbe22fabf4d4595328ab44928adb43eb2f7cf358e1fe76e3c026980936395d28ea162779827dc7cbedbb7042e31cf99a082772bb22a48e0df0ac76
-
Filesize
449KB
MD55712cd19b2532170ea43b9248e0f7582
SHA10dc98b341312ad0bbeae349e0c93b08201f56fe5
SHA2564f99c72a25b0cb7442a512768635f0b03bb0a1e28e07663d1b69dd955df872f6
SHA512f9a7c754b4992fdb1c1ba2db9dbf89c9652a07ecaf90335ebbafce269f3f5cca7e7fd9671243e70f368dab95553688cb42cd81807e886e1a8939e9e1cd866784
-
Filesize
28B
MD56311c3fd15588bb5c126e6c28ff5fffe
SHA1ce81d136fce31779f4dd62e20bdaf99c91e2fc57
SHA2568b82f6032e29a2b5c96031a3630fb6173d12ff0295bc20bb21b877d08f0812d8
SHA5122975fe2e94b6a8adc9cfc1a865ad113772b54572883a537b02a16dd2d029c0f7d9cca3b154fd849bdfe978e18b396bcf9fa6e67e7c61f92bdc089a29a9c355c6
-
Filesize
237B
MD52405e987da0d53e27b792160977cc464
SHA10e24be77796bde476e495a496e3878de07fb35da
SHA2560fd8f374c7eb18b8bb62c4c38d906bb89cb68e7e14acd0ef9d1f5a66ab411f60
SHA51269f62d38bdeabc92802ad60e43fb45778dccddd82f8fadbcc73b27fbce46170079ff60356fca4ab51349c8f6758830343f70db0ff9af993d617dea14d03fcd4a
-
Filesize
63B
MD5558832d04b460fe6df05b349a9cfd704
SHA1ed7b97338fc196851bdedfe1892f57e01768babf
SHA2564512bbd3ecdab116e55209359e4b14d295e76a6150f107dafe15c8346a74ec84
SHA5129774d9e80798af06c406ae4f3df29736b984836f9b6539ff5ed0cb3f98fbb1d32d4eb1e3d66dc32559dc8f076b0af082f26fa35717bbfa238b307937f876bbb3
-
Filesize
54B
MD584cd2a908f5ccb064f47fcc4af895e0d
SHA115027281ba9f2f4bd1434ba609bfd233c5cc8c0c
SHA2566c5974b55d5d41d410358f22f24fc8cb38bffcc2fb50d2635738e75992ad3ef2
SHA512fbd4524d2390906bbd3e543425ae0949465788150f6b99b45b05a095760851790495358a95a8a88de59681a4a792cc0e2b68a630c1ddf40354d6bcd4bc300b02
-
Filesize
437B
MD560b73267eb3624e35552cbfc24e436db
SHA1fe79015414eb791013fe9d142555796b89e6c800
SHA2568fcf4013e18370c8726e52ceb80a720d20a7cff47b4925643679aa9e16d502c5
SHA51235056f97e7dd240363e911e4994fae6edd9f9836a07e191973cd205ab7b6990a162a51258e5dc809928f13eddf851a922c31799b2d6c00c860354c605920b2df
-
Filesize
449KB
MD55712cd19b2532170ea43b9248e0f7582
SHA10dc98b341312ad0bbeae349e0c93b08201f56fe5
SHA2564f99c72a25b0cb7442a512768635f0b03bb0a1e28e07663d1b69dd955df872f6
SHA512f9a7c754b4992fdb1c1ba2db9dbf89c9652a07ecaf90335ebbafce269f3f5cca7e7fd9671243e70f368dab95553688cb42cd81807e886e1a8939e9e1cd866784
-
Filesize
449KB
MD55712cd19b2532170ea43b9248e0f7582
SHA10dc98b341312ad0bbeae349e0c93b08201f56fe5
SHA2564f99c72a25b0cb7442a512768635f0b03bb0a1e28e07663d1b69dd955df872f6
SHA512f9a7c754b4992fdb1c1ba2db9dbf89c9652a07ecaf90335ebbafce269f3f5cca7e7fd9671243e70f368dab95553688cb42cd81807e886e1a8939e9e1cd866784