Analysis
-
max time kernel
3463760s -
max time network
152s -
platform
android_x86 -
resource
android-x86-arm-20230831-en -
submitted
25-09-2023 22:25
General
-
Target
8f0284b41c15c0c6745aa86b340f31b5c3f7d5ebc18017eaced95301d39f98d7.apk
-
Size
541KB
-
MD5
c5b77da398a9234ec7a8137fb49981d7
-
SHA1
27ead5af5ecc90dec8481c645ab317c5dcf23655
-
SHA256
8f0284b41c15c0c6745aa86b340f31b5c3f7d5ebc18017eaced95301d39f98d7
-
SHA512
9e15a105e5ee65ce9df8716d8e7fc3390dff77d04fb97e05748922572c6a37f8639f37d4e41f464006a839643422fc796583efe251761a7987e52644219b46d8
-
SSDEEP
12288:+kOkEiUWX4/jo/Ib54fejzv70xB0KiaDMtr+cY49nJ:Cni5X4/joQtXjKiJ1+z0nJ
Malware Config
Extracted
octo
https://waytoupio.click/M2I2NGMzMzk4YzM0/
https://acsmartio.tech/M2I2NGMzMzk4YzM0/
https://apppro.live/M2I2NGMzMzk4YzM0/
https://waytoupio.click/m2i2ngmzmzk4yzm0/M2I2NGMzMzk4YzM0/
https://acsmartio.tech/m2i2ngmzmzk4yzm0/M2I2NGMzMzk4YzM0/
https://apppro.live/m2i2ngmzmzk4yzm0/M2I2NGMzMzk4YzM0/
Signatures
-
Octo
Octo is a banking malware with remote access capabilities first seen in April 2022.
-
Octo payload 3 IoCs
-
Makes use of the framework's Accessibility service. 2 IoCs
-
Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps). 1 IoCs
-
Removes its main activity from the application launcher 1 IoCs
-
Acquires the wake lock. 1 IoCs
-
Loads dropped Dex/Jar 2 IoCs
Runs executable file dropped to the device during analysis.
-
Requests enabling of the accessibility settings. 1 IoCs
-
Reads information about phone network operator.
-
Requests disabling of battery optimizations (often used to enable hiding in the background). 1 IoCs
-
Removes a system notification. 1 IoCs
-
Uses Crypto APIs (Might try to encrypt user data). 1 IoCs
Processes
-
com.simplesun41⤵
- Makes use of the framework's Accessibility service.
- Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps).
- Removes its main activity from the application launcher
- Acquires the wake lock.
- Loads dropped Dex/Jar
- Requests enabling of the accessibility settings.
- Requests disabling of battery optimizations (often used to enable hiding in the background).
- Removes a system notification.
- Uses Crypto APIs (Might try to encrypt user data).
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
48B
MD5046a414913add6f5bb60072c7db819b6
SHA1451ee4f6809260aec622d772fd329c7d0297a842
SHA256b66c1320cb063a1d391c94273572ea6edae76c8c8b0a07f8d75c88686f0df72a
SHA5124e6355f3051ed5e811ab030abde1f5be7f5e1cf33be99cd08477e9b6c015deb1d8bd75a09fb9c7176b8511c5ad0a67abc0902a3531e97564ccb6afc57496a47c
-
Filesize
517B
MD55351df87aa49b4d19ef1cb6e13f36d47
SHA124be0e422b4315432df53638827f77a934bfa9be
SHA256085df4d54b89be4a651c57c9d11c32ff31c2c2f6915a99038dff6470ef6c000c
SHA512ddb7e43999e1bb5d2a6ccedc918d7fbdeceaaa55ad7d06f34d4a8903941ee01fb4add366064dddd5ad988ae265dfeaad9e9464b53ded508c9a071f4bf1553ecc
-
Filesize
583B
MD586ef98bf11ee41104947ece12ff0c663
SHA1b5e38805d2262adac42cb4f5da1205b83b295ae5
SHA256ea52ad86f4d4c0eb761410377579cf918f484d93d843aa7898a36e6a08d63c17
SHA512ab685af391ad6d490484248b8c88bad921ee3423de44718693de05548389f017b61c3b02cc62b51e97d13c4d19fcbd4032bb85eec8d0dfeba3c419400e22b3be
-
Filesize
449KB
MD55712cd19b2532170ea43b9248e0f7582
SHA10dc98b341312ad0bbeae349e0c93b08201f56fe5
SHA2564f99c72a25b0cb7442a512768635f0b03bb0a1e28e07663d1b69dd955df872f6
SHA512f9a7c754b4992fdb1c1ba2db9dbf89c9652a07ecaf90335ebbafce269f3f5cca7e7fd9671243e70f368dab95553688cb42cd81807e886e1a8939e9e1cd866784
-
Filesize
28B
MD56311c3fd15588bb5c126e6c28ff5fffe
SHA1ce81d136fce31779f4dd62e20bdaf99c91e2fc57
SHA2568b82f6032e29a2b5c96031a3630fb6173d12ff0295bc20bb21b877d08f0812d8
SHA5122975fe2e94b6a8adc9cfc1a865ad113772b54572883a537b02a16dd2d029c0f7d9cca3b154fd849bdfe978e18b396bcf9fa6e67e7c61f92bdc089a29a9c355c6
-
Filesize
230B
MD578497cb0a3a4a7985bef75cb210f47f9
SHA1d830c8c67ae1bf5a32d350e524c1d04ea62f6575
SHA2566625576d0bfab81a42d6e2fa6987977700bbeaea8f9c65cbc77145fadad7cc0b
SHA512f037d9a31ec6c9636171cca7e60688f6b222e587256ab6f54cbd055215f5bb6081060977bd8abc2e87261cdc53b41d1c2b02cda5457209db9e50fa6d6da39aec
-
Filesize
63B
MD537e61b2ff06ce6f07e873ca2fde49c05
SHA19765e53a8e0c2b22a235a6eb43f72d3d2a874679
SHA256f30d4e906ce682fdd985af31e30328b064b6a4a2d20cbe383cae2482c0a6a12c
SHA512e51249c20ba085ce00f3e5a993eadbaabff5e1cd32d6472e310444540f94c59b8f5078b7375bcd5c907a9636f586c15b8f2c46671fd1566ce5c17d30537d3ac5
-
Filesize
67B
MD5ecf091db10eebff05cb9dd7848a20686
SHA161ccedd3dce9e6e1856bec3781c08019d06ec524
SHA25651d5e1ff0a3a889d361c41bb4b2900ea7572d5b0b364ed737d474d3f30209930
SHA512530761b931eb57482d15aa12bc0083bf7e4550cd3865669ffb68c7115f4cea8cdb6a40d5d32ffb68ef24aced9c29125f513770a688edd5ddfb8f7cf16e67fc15
-
Filesize
437B
MD552b8a7ff228666be7e31380f0d6314aa
SHA1fbc06fcbeb5d7018dc84de15a4f70b989cbfc6b1
SHA256202521be00a1015852fac481d8a983f4a0dcb07eb87e770b030afbb7429db66e
SHA51256615a6c0fe203aff3d43e338693c226f589bb8e0b61e24674eb3859379856ceaa41e7224945f2f83139ef7b504f20cbc193449e47cfa69d1dd11274d9fd6afa
-
Filesize
449KB
MD55712cd19b2532170ea43b9248e0f7582
SHA10dc98b341312ad0bbeae349e0c93b08201f56fe5
SHA2564f99c72a25b0cb7442a512768635f0b03bb0a1e28e07663d1b69dd955df872f6
SHA512f9a7c754b4992fdb1c1ba2db9dbf89c9652a07ecaf90335ebbafce269f3f5cca7e7fd9671243e70f368dab95553688cb42cd81807e886e1a8939e9e1cd866784
-
Filesize
449KB
MD55712cd19b2532170ea43b9248e0f7582
SHA10dc98b341312ad0bbeae349e0c93b08201f56fe5
SHA2564f99c72a25b0cb7442a512768635f0b03bb0a1e28e07663d1b69dd955df872f6
SHA512f9a7c754b4992fdb1c1ba2db9dbf89c9652a07ecaf90335ebbafce269f3f5cca7e7fd9671243e70f368dab95553688cb42cd81807e886e1a8939e9e1cd866784