Overview

overview

10

Static

static

7

7a3bfd367a...ce.apk

android-9-x86

10

7a3bfd367a...ce.apk

android-11-x64

10

Analysis

  • max time kernel
    3635261s
  • max time network
    163s
  • platform
    android_x64
  • resource
    android-x64-arm64-20230831-en
  • submitted
    27-09-2023 22:01

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    7a3bfd367a66e2ad2779f04ebfb7e565b777b31bf96dc6fb4df4043ab1df9ace.apk

  • Size

    661KB

  • MD5

    3856919e570d52c891995e8c7dbbf1b9

  • SHA1

    f093add2e13b8f9472f38ee041e8b73b953818f0

  • SHA256

    7a3bfd367a66e2ad2779f04ebfb7e565b777b31bf96dc6fb4df4043ab1df9ace

  • SHA512

    d4f14827a499d1c16ea9cc92ab106ba460ade82f6196d7b5a2e0c7fb5e3fa449c3413d2e99cd6da4968301180bce88321fff9c5eed584c030cdd03cfb86728ca

  • SSDEEP

    12288:dTRc4Xb/Jtgkp4S9CeyPbBsg/PTDjclF8JqMSOk1S2CpehCOYIBodw3xqrDTLHd:dzbLgkp46CeazclF8OpQ23w1whql

Score
10/10
octobankerevasioninfostealerransomwarerattrojan

Malware Config

Extracted

Family

octo

C2

https://185.225.75.19/YjRkZjE0NTUyNzZm/

https://otakikotaik4234234.net/YjRkZjE0NTUyNzZm/

https://otakikotaik3234234.net/YjRkZjE0NTUyNzZm/

https://otakikotaik1334534.net/YjRkZjE0NTUyNzZm/

https://otakikotaik1224634.net/YjRkZjE0NTUyNzZm/

https://otakikotaik6423234.net/YjRkZjE0NTUyNzZm/
AES_key

Signatures

  • Octo

    Octo is a banking malware with remote access capabilities first seen in April 2022.

    bankertrojaninfostealerratocto
  • Octo payload 3 IoCs
  • Makes use of the framework's Accessibility service. 2 IoCs
  • Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps). 1 IoCs
    banker
  • Acquires the wake lock. 1 IoCs
  • Loads dropped Dex/Jar 2 IoCs

    Runs executable file dropped to the device during analysis.

  • Reads information about phone network operator.
  • Requests disabling of battery optimizations (often used to enable hiding in the background). 1 IoCs
    evasion
  • Uses Crypto APIs (Might try to encrypt user data). 1 IoCs
    ransomware

Processes

  • com.unitunder50
    1⤵
    • Makes use of the framework's Accessibility service.
    • Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps).
    • Acquires the wake lock.
    • Loads dropped Dex/Jar
    • Requests disabling of battery optimizations (often used to enable hiding in the background).
    • Uses Crypto APIs (Might try to encrypt user data).
    PID:4567

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • /data/user/0/com.unitunder50/cache/iaxzsqswjkpcwi
    Filesize

    450KB

    MD5

    9b31359ab587d725241bf52809e381d9

    SHA1

    35390f619853b45a4e53eb3f0196c62768c6f6b4

    SHA256

    c04c9697df04ba47428b2ed901df6752cd57afe08aff144b0543206215bbb7c3

    SHA512

    c718309fe43fc77db0d33b783c05a80a7b5333a371c5d67ddb9aadf0ebed39be091dd9e6c9631c179b34569d50c4d5ef7671cc524281316f57ae5a84a6ed98fa

    Download Submit

  • /data/user/0/com.unitunder50/cache/iaxzsqswjkpcwi
    Filesize

    450KB

    MD5

    9b31359ab587d725241bf52809e381d9

    SHA1

    35390f619853b45a4e53eb3f0196c62768c6f6b4

    SHA256

    c04c9697df04ba47428b2ed901df6752cd57afe08aff144b0543206215bbb7c3

    SHA512

    c718309fe43fc77db0d33b783c05a80a7b5333a371c5d67ddb9aadf0ebed39be091dd9e6c9631c179b34569d50c4d5ef7671cc524281316f57ae5a84a6ed98fa

    Download Submit

  • /data/user/0/com.unitunder50/cache/iaxzsqswjkpcwi
    Filesize

    450KB

    MD5

    9b31359ab587d725241bf52809e381d9

    SHA1

    35390f619853b45a4e53eb3f0196c62768c6f6b4

    SHA256

    c04c9697df04ba47428b2ed901df6752cd57afe08aff144b0543206215bbb7c3

    SHA512

    c718309fe43fc77db0d33b783c05a80a7b5333a371c5d67ddb9aadf0ebed39be091dd9e6c9631c179b34569d50c4d5ef7671cc524281316f57ae5a84a6ed98fa

    Download Submit

  • /data/user/0/com.unitunder50/cache/oat/iaxzsqswjkpcwi.cur.prof
    Filesize

    333B

    MD5

    44efcc7b2fa39b3ce75ea1cf3a73fd32

    SHA1

    73b1c7acfc7ec56f6a87315995381849787432a5

    SHA256

    c3c2df50f0a2441e91a64e387ebe056d455613aaad41879839c632ead8ea0576

    SHA512

    27ee59509eca0be3ca98c00148347c0b1f4c12f59eaaa4099020fc6c34719954de410256461e5482f08568562f150195b920d630d99571e39d8b600faa01dedf

    Download Submit

  • /data/user/0/com.unitunder50/kl.txt
    Filesize

    28B

    MD5

    6311c3fd15588bb5c126e6c28ff5fffe

    SHA1

    ce81d136fce31779f4dd62e20bdaf99c91e2fc57

    SHA256

    8b82f6032e29a2b5c96031a3630fb6173d12ff0295bc20bb21b877d08f0812d8

    SHA512

    2975fe2e94b6a8adc9cfc1a865ad113772b54572883a537b02a16dd2d029c0f7d9cca3b154fd849bdfe978e18b396bcf9fa6e67e7c61f92bdc089a29a9c355c6

    Download Submit

  • /data/user/0/com.unitunder50/kl.txt
    Filesize

    233B

    MD5

    da762e049edc1fd402b35caf4dd403ea

    SHA1

    759988bebe7d43d8f71481e79d1ec93d7247e164

    SHA256

    c8356806a3087d090e0562c2b494e22e2006f31cee413ef80582783e34842dec

    SHA512

    b6138a14d8e4daf27f9863d06961ac6b06647d3edd9edd91b2170ad75c9c5484366bd58ab7245c53ef801e4112e7f0c70ee06cf93b24f2679cb2c703812d662e

    Download Submit

  • /data/user/0/com.unitunder50/kl.txt
    Filesize

    68B

    MD5

    683373f3154814ac475e10ac702d63ce

    SHA1

    62cd5eda2b98830b56c1cb75ac3948d6daa50438

    SHA256

    48eca174edcf1cabe15b07f1a4588b48c240954ed73fbe36c74916ed926bcc56

    SHA512

    5bf51e50820117ebbd44fcd41ec47e80702331418c462239751a95a98575e558379c5c8cd0e1b9b072bf08e4ec1b48e36e34bd262b52ea2ec01b1f30e8ab57f5

    Download Submit

  • /data/user/0/com.unitunder50/kl.txt
    Filesize

    76B

    MD5

    e10487f1ceb832269c9a7a513cc4c2d4

    SHA1

    8f78dfd3131855735e3c1ec3563e7c543a9f39a6

    SHA256

    30d46e597b2e12f142b4e0e13c89ef301c171dccd631fe91ea39eb595f1923cf

    SHA512

    c89e43d163cfe4dd2f4930a722bc157f6a8eb0e25094b6a234ac6ab16f550db5a0c398d45ca35ca95c1d86975ac57a72b5ec2eb64b95569fbd328100eceb12b7

    Download Submit