octo | 5ebac20a82963408b103b0e53da63fc22a15404321989a090505ee8258095423

Analysis

max time kernel
3629217s
max time network
132s
platform
android_x86
resource
android-x86-arm-20230831-en
submitted
27-09-2023 20:22

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

1.traff23_com.useallrb_Lazada_0_crypt_aligned.apk
Size

1.9MB
MD5

6552b0699c6683b9a7d905d431b14403
SHA1

a40c6bb1990ce78414b64bf9a2f6225e6012ee8e
SHA256

5ebac20a82963408b103b0e53da63fc22a15404321989a090505ee8258095423
SHA512

e488030c5d39ea668f8d8e4b799ce34f54eb2ecd34d1e5c36d88293137d58997bb674533d6be880cd9703ae2c6d5622d521ca8a2194e21dbc7c112f471896834
SSDEEP

24576:MmlR3LHA9i1J6hf+SsmW+c92P4J1dMZAMm7tAme4Z/w5gNlVYRDlYqjaOB04IB3+:zLA816famWaP4yY5RZ/wytEieLRfbfV

Score

10^/10

octo banker evasion infostealer ransomware rat stealth trojan

Malware Config

Extracted

Family

octo

https://cm603lzeyxdw.site/MTU2OWE0NzJjNGY5/

https://cm603lzeyxdw1.site/MTU2OWE0NzJjNGY5/

https://arw2he7x57wp.pw/MTU2OWE0NzJjNGY5/

https://5a9udxg6l6gd.su/MTU2OWE0NzJjNGY5/

https://9r8i1u84t2gp.online/MTU2OWE0NzJjNGY5/

https://cm603lzeyxdw.space/MTU2OWE0NzJjNGY5/

https://cleverk21da912mca.live/MTU2OWE0NzJjNGY5/

https://zazarazgok7215vor1.pro/MTU2OWE0NzJjNGY5/

https://juf18ki1ca15ca1la.info/MTU2OWE0NzJjNGY5/

AES_key

Signatures

Octo
Octo is a banking malware with remote access capabilities first seen in April 2022.
banker trojan infostealer rat octo

Octo payload 3 IoCs

Processes:

resource	yara_rule
/data/data/com.useallrb/cache/wrukfjpo	family_octo
/data/user/0/com.useallrb/cache/wrukfjpo	family_octo
/data/user/0/com.useallrb/cache/wrukfjpo	family_octo

Makes use of the framework's Accessibility service. 2 IoCs

Processes:

com.useallrb

description	ioc	process
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId	com.useallrb
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByViewId	com.useallrb

Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps). 1 IoCs
banker

Processes:

com.useallrb

description ioc process

Framework service call android.content.pm.IPackageManager.getInstalledApplications com.useallrb
Removes its main activity from the application launcher 1 IoCs
stealth trojan

Processes:

com.useallrb

pid process

4162 com.useallrb
Acquires the wake lock. 1 IoCs

Processes:

com.useallrb

description ioc process

Framework service call android.os.IPowerManager.acquireWakeLock com.useallrb

description	ioc	process
Framework service call	android.content.pm.IPackageManager.getInstalledApplications	com.useallrb

pid	process
4162	com.useallrb

description	ioc	process
Framework service call	android.os.IPowerManager.acquireWakeLock	com.useallrb

Loads dropped Dex/Jar 4 IoCs

Runs executable file dropped to the device during analysis.

Processes:

/system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.useallrb/app_DynamicOptDex/FmDsJ.json --output-vdex-fd=41 --oat-fd=42 --oat-location=/data/user/0/com.useallrb/app_DynamicOptDex/oat/x86/FmDsJ.odex --compiler-filter=quicken --class-loader-context=&com.useallrb

ioc	pid	process
/data/user/0/com.useallrb/app_DynamicOptDex/FmDsJ.json	4197	/system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.useallrb/app_DynamicOptDex/FmDsJ.json --output-vdex-fd=41 --oat-fd=42 --oat-location=/data/user/0/com.useallrb/app_DynamicOptDex/oat/x86/FmDsJ.odex --compiler-filter=quicken --class-loader-context=&
/data/user/0/com.useallrb/app_DynamicOptDex/FmDsJ.json	4162	com.useallrb
/data/user/0/com.useallrb/cache/wrukfjpo	4162	com.useallrb
/data/user/0/com.useallrb/cache/wrukfjpo	4162	com.useallrb

Reads information about phone network operator.
Requests disabling of battery optimizations (often used to enable hiding in the background). 1 IoCs
evasion

Processes:

com.useallrb

description ioc process

Intent action android.settings.REQUEST_IGNORE_BATTERY_OPTIMIZATIONS com.useallrb
Removes a system notification. 1 IoCs
evasion

Processes:

com.useallrb

description ioc process

Framework service call android.app.INotificationManager.cancelNotificationWithTag com.useallrb
Uses Crypto APIs (Might try to encrypt user data). 1 IoCs
ransomware

Processes:

com.useallrb

description ioc process

Framework API call javax.crypto.Cipher.doFinal com.useallrb

description	ioc	process
Intent action	android.settings.REQUEST_IGNORE_BATTERY_OPTIMIZATIONS	com.useallrb

description	ioc	process
Framework service call	android.app.INotificationManager.cancelNotificationWithTag	com.useallrb

description	ioc	process
Framework API call	javax.crypto.Cipher.doFinal	com.useallrb

com.useallrb
1⤵
- Makes use of the framework's Accessibility service.
- Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps).
- Removes its main activity from the application launcher
- Acquires the wake lock.
- Loads dropped Dex/Jar
- Requests disabling of battery optimizations (often used to enable hiding in the background).
- Removes a system notification.
- Uses Crypto APIs (Might try to encrypt user data).
PID:4162
- /system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.useallrb/app_DynamicOptDex/FmDsJ.json --output-vdex-fd=41 --oat-fd=42 --oat-location=/data/user/0/com.useallrb/app_DynamicOptDex/oat/x86/FmDsJ.odex --compiler-filter=quicken --class-loader-context=&
  2⤵
  - Loads dropped Dex/Jar
  PID:4197

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

/data/data/com.useallrb/.qcom.useallrb

Filesize
48B

MD5
046a414913add6f5bb60072c7db819b6

SHA1
451ee4f6809260aec622d772fd329c7d0297a842

SHA256
b66c1320cb063a1d391c94273572ea6edae76c8c8b0a07f8d75c88686f0df72a

SHA512
4e6355f3051ed5e811ab030abde1f5be7f5e1cf33be99cd08477e9b6c015deb1d8bd75a09fb9c7176b8511c5ad0a67abc0902a3531e97564ccb6afc57496a47c

Download Submit
/data/data/com.useallrb/app_DynamicOptDex/FmDsJ.json

Filesize
2KB

MD5
5d64c1889d318ee2bb41d42d4032963a

SHA1
09b640c146770ab5fb7c47b96dfa1b62de5ff8f1

SHA256
3e1ddfa2cffab71c74fc31d3dd2c57729667854e8dad04b005f8206ff0d1c713

SHA512
edc1e710842c1ed407fd37cdbf0c000cc451e41dd6831e39e10657afe23ec7ac387e14e539b1789105681539ce2ce4f164caccdacf8b5d9aac0dfae7fc7836ef

Download Submit
/data/data/com.useallrb/app_DynamicOptDex/FmDsJ.json

Filesize
2KB

MD5
4f60386f43a84e3fcc86291877286d26

SHA1
45302eb0bbbfec66c3b7e8a317496450698b570a

SHA256
b6267bcfab7d554bbf293a850311bfc4b3cef50d7346e5612ff78ed3d8b8860b

SHA512
743e2706bf2d43f395b0b624ccafeeaa269bf604d5bebcad8c5491c7232152f0efdf341729ab397b9a6515f3b963743961aa9ae39d7b971ab7200d87f5e4897d

Download Submit
/data/data/com.useallrb/cache/oat/wrukfjpo.cur.prof

Filesize
466B

MD5
4188e9ca2af91202724fca2a3b4c3190

SHA1
e50e7ab6d9df767edc1fdd3d25cfc125e3360243

SHA256
9179e004ac78c909d4ffbf27c849d7b0cc508a9d52707f13819e67e3deb1eb0c

SHA512
7303fcd063a42667821a89ae6b419e4089893572d694a9b80858fed940b991f69f27253b2478fd435702cf05d03d44f29b8e613e1ae6059bdbb57dbd0ebc2914

Download Submit
/data/data/com.useallrb/cache/wrukfjpo

Filesize
457KB

MD5
84f2ba6d209895ee87990060f93615a7

SHA1
56ec69e59a47433f0948fa349de4efed92d02b3d

SHA256
b304fa8c4aaa44d548cc580f2af9a9df0dd6cc6dd2e7f8505fe5b91853ca080b

SHA512
ea03e036ad90ca4dd605a9cf2ec08aae237f1fdc100f6381c74089f848587fed2d428d5258dc9e809cc556e16c1758fa5547ff26ad84d085fadfedc2847455cf

Download Submit
/data/data/com.useallrb/kl.txt

Filesize
28B

MD5
6311c3fd15588bb5c126e6c28ff5fffe

SHA1
ce81d136fce31779f4dd62e20bdaf99c91e2fc57

SHA256
8b82f6032e29a2b5c96031a3630fb6173d12ff0295bc20bb21b877d08f0812d8

SHA512
2975fe2e94b6a8adc9cfc1a865ad113772b54572883a537b02a16dd2d029c0f7d9cca3b154fd849bdfe978e18b396bcf9fa6e67e7c61f92bdc089a29a9c355c6

Download Submit
/data/data/com.useallrb/kl.txt

Filesize
230B

MD5
8f978b8dd73dfe7e13b1065138d9b001

SHA1
ec83491f4c656291b0d63700807d008e44b47ae6

SHA256
13f0989f45f256590a559a70be0c62e5b061c125526de498918f562d7c2883a6

SHA512
41a9e10a6bbea5e00e851d03a1cdec5028f94f8d79cda9264042815909dbd677ab4a125b1b40ca5c12a76f7ac28ce8a6364ef0fc4b6620bbc9578c9a7519a94e

Download Submit
/data/data/com.useallrb/kl.txt

Filesize
63B

MD5
52e46734acf76113d3e1aee54935feb2

SHA1
4ba1db40b55e6d4cf86cba5c7ccc8586ac7cff08

SHA256
13ce60ae1ad209764df966a6869453ac648f49835299b0eea7f233262862c0ce

SHA512
d4f7a3c78cdb13ceb4aae1123790a7c5baf78e90e6a1e4c654a33113ae5813065b55ca51a785f42c7fc71b41a400000a6aba0170b812755559c622da1e5cae20

Download Submit
/data/data/com.useallrb/kl.txt

Filesize
54B

MD5
818e7d7c8317d156681097107411d5ff

SHA1
fa729f005071e65b05dc97147f0dc94d9028f3ac

SHA256
430afae3dec7092fe8b64c446116c2dcd4f16e63d9dbce248864883a0f836f93

SHA512
fcd02341b60f44c4bf97212befd60a0c6091a0827b1f3d21742022df97f5293dca20bd1ec0cb39f534a0ae79c883435f20662307aa49c6a2b6c297ccc903a24f

Download Submit
/data/data/com.useallrb/kl.txt

Filesize
423B

MD5
3fc371e28cd120f2503eb1d2fa6db369

SHA1
967dc0fe70be9bb27029972a1b95c1276d56c995

SHA256
56d6b452f91d65f722f4c2aaa7bcc18c82f9cbd5e22151d65b38c979f9dfcd40

SHA512
47a53665e1db1dde56b5639675d0a985bd266665a108c02833aca931bf7477d86af4a3c5e99180535ecb36a15d9d2d8527937e49e19759d4d23cf77a59c81220

Download Submit
/data/user/0/com.useallrb/app_DynamicOptDex/FmDsJ.json

Filesize
6KB

MD5
842576dd963115c7c362687db2029eb6

SHA1
4cb43d06d3599fa56d40e25e17e11cda795a84d2

SHA256
89da0db3d84104ef14aae64eb6040bbc5b8b75e032408d0f6e34f99edd51a763

SHA512
e9692421d2696c1b54386ca9108cb938e8b4446e8fa187f80c2e047af06b4d40f6bec50188280974f3338052b51aa2ca22c0dd8e34247516ff44e1a390870693

Download Submit
/data/user/0/com.useallrb/app_DynamicOptDex/FmDsJ.json

Filesize
6KB

MD5
3b5a8de6c5a04653a94a278d48e7c76b

SHA1
1f499f079b2d2a2d0df98e741638f60048d0e94b

SHA256
58f512fc54d2207a37d9b8821eb94bead5624d4d024952248c24eaf9803b08b9

SHA512
65aa5de6557c2eed68fc10f05eb0177109b0387266af6ee142ec14ed53f9c017819df38c9e12efffbfbf893f4a8100d94de7359f67fec3c7f658b226d7111ac8

Download Submit
/data/user/0/com.useallrb/cache/wrukfjpo

Filesize
457KB

MD5
84f2ba6d209895ee87990060f93615a7

SHA1
56ec69e59a47433f0948fa349de4efed92d02b3d

SHA256
b304fa8c4aaa44d548cc580f2af9a9df0dd6cc6dd2e7f8505fe5b91853ca080b

SHA512
ea03e036ad90ca4dd605a9cf2ec08aae237f1fdc100f6381c74089f848587fed2d428d5258dc9e809cc556e16c1758fa5547ff26ad84d085fadfedc2847455cf

Download Submit
/data/user/0/com.useallrb/cache/wrukfjpo

Filesize
457KB

MD5
84f2ba6d209895ee87990060f93615a7

SHA1
56ec69e59a47433f0948fa349de4efed92d02b3d

SHA256
b304fa8c4aaa44d548cc580f2af9a9df0dd6cc6dd2e7f8505fe5b91853ca080b

SHA512
ea03e036ad90ca4dd605a9cf2ec08aae237f1fdc100f6381c74089f848587fed2d428d5258dc9e809cc556e16c1758fa5547ff26ad84d085fadfedc2847455cf

Download Submit