octo | 5ebac20a82963408b103b0e53da63fc22a15404321989a090505ee8258095423

Analysis

max time kernel
3629220s
max time network
137s
platform
android_x64
resource
android-x64-20230831-en
submitted
27-09-2023 20:22

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

1.traff23_com.useallrb_Lazada_0_crypt_aligned.apk
Size

1.9MB
MD5

6552b0699c6683b9a7d905d431b14403
SHA1

a40c6bb1990ce78414b64bf9a2f6225e6012ee8e
SHA256

5ebac20a82963408b103b0e53da63fc22a15404321989a090505ee8258095423
SHA512

e488030c5d39ea668f8d8e4b799ce34f54eb2ecd34d1e5c36d88293137d58997bb674533d6be880cd9703ae2c6d5622d521ca8a2194e21dbc7c112f471896834
SSDEEP

24576:MmlR3LHA9i1J6hf+SsmW+c92P4J1dMZAMm7tAme4Z/w5gNlVYRDlYqjaOB04IB3+:zLA816famWaP4yY5RZ/wytEieLRfbfV

Score

10^/10

octo banker evasion infostealer ransomware rat trojan

Malware Config

Extracted

Family

octo

https://cm603lzeyxdw.site/MTU2OWE0NzJjNGY5/

https://cm603lzeyxdw1.site/MTU2OWE0NzJjNGY5/

https://arw2he7x57wp.pw/MTU2OWE0NzJjNGY5/

https://5a9udxg6l6gd.su/MTU2OWE0NzJjNGY5/

https://9r8i1u84t2gp.online/MTU2OWE0NzJjNGY5/

https://cm603lzeyxdw.space/MTU2OWE0NzJjNGY5/

https://cleverk21da912mca.live/MTU2OWE0NzJjNGY5/

https://zazarazgok7215vor1.pro/MTU2OWE0NzJjNGY5/

https://juf18ki1ca15ca1la.info/MTU2OWE0NzJjNGY5/

AES_key

Signatures

Octo
Octo is a banking malware with remote access capabilities first seen in April 2022.
banker trojan infostealer rat octo

Octo payload 3 IoCs

Processes:

resource	yara_rule
/data/data/com.useallrb/cache/wrukfjpo	family_octo
/data/user/0/com.useallrb/cache/wrukfjpo	family_octo
/data/user/0/com.useallrb/cache/wrukfjpo	family_octo

Makes use of the framework's Accessibility service. 2 IoCs

Processes:

com.useallrb

description	ioc	process
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId	com.useallrb
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByViewId	com.useallrb

Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps). 1 IoCs
banker

Processes:

com.useallrb

description ioc process

Framework service call android.content.pm.IPackageManager.getInstalledApplications com.useallrb
Acquires the wake lock. 1 IoCs

Processes:

com.useallrb

description ioc process

Framework service call android.os.IPowerManager.acquireWakeLock com.useallrb

description	ioc	process
Framework service call	android.content.pm.IPackageManager.getInstalledApplications	com.useallrb

description	ioc	process
Framework service call	android.os.IPowerManager.acquireWakeLock	com.useallrb

Loads dropped Dex/Jar 3 IoCs

Runs executable file dropped to the device during analysis.

Processes:

com.useallrb

ioc	pid	process
/data/user/0/com.useallrb/app_DynamicOptDex/FmDsJ.json	5047	com.useallrb
/data/user/0/com.useallrb/cache/wrukfjpo	5047	com.useallrb
/data/user/0/com.useallrb/cache/wrukfjpo	5047	com.useallrb

Reads information about phone network operator.
Removes a system notification. 1 IoCs
evasion

Processes:

com.useallrb

description ioc process

Framework service call android.app.INotificationManager.cancelNotificationWithTag com.useallrb
Uses Crypto APIs (Might try to encrypt user data). 1 IoCs
ransomware

Processes:

com.useallrb

description ioc process

Framework API call javax.crypto.Cipher.doFinal com.useallrb

description	ioc	process
Framework service call	android.app.INotificationManager.cancelNotificationWithTag	com.useallrb

description	ioc	process
Framework API call	javax.crypto.Cipher.doFinal	com.useallrb

com.useallrb
1⤵
- Makes use of the framework's Accessibility service.
- Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps).
- Acquires the wake lock.
- Loads dropped Dex/Jar
- Removes a system notification.
- Uses Crypto APIs (Might try to encrypt user data).
PID:5047

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

/data/data/com.useallrb/.qcom.useallrb

Filesize
48B

MD5
046a414913add6f5bb60072c7db819b6

SHA1
451ee4f6809260aec622d772fd329c7d0297a842

SHA256
b66c1320cb063a1d391c94273572ea6edae76c8c8b0a07f8d75c88686f0df72a

SHA512
4e6355f3051ed5e811ab030abde1f5be7f5e1cf33be99cd08477e9b6c015deb1d8bd75a09fb9c7176b8511c5ad0a67abc0902a3531e97564ccb6afc57496a47c

Download Submit
/data/data/com.useallrb/app_DynamicOptDex/FmDsJ.json

Filesize
2KB

MD5
5d64c1889d318ee2bb41d42d4032963a

SHA1
09b640c146770ab5fb7c47b96dfa1b62de5ff8f1

SHA256
3e1ddfa2cffab71c74fc31d3dd2c57729667854e8dad04b005f8206ff0d1c713

SHA512
edc1e710842c1ed407fd37cdbf0c000cc451e41dd6831e39e10657afe23ec7ac387e14e539b1789105681539ce2ce4f164caccdacf8b5d9aac0dfae7fc7836ef

Download Submit
/data/data/com.useallrb/app_DynamicOptDex/FmDsJ.json

Filesize
2KB

MD5
4f60386f43a84e3fcc86291877286d26

SHA1
45302eb0bbbfec66c3b7e8a317496450698b570a

SHA256
b6267bcfab7d554bbf293a850311bfc4b3cef50d7346e5612ff78ed3d8b8860b

SHA512
743e2706bf2d43f395b0b624ccafeeaa269bf604d5bebcad8c5491c7232152f0efdf341729ab397b9a6515f3b963743961aa9ae39d7b971ab7200d87f5e4897d

Download Submit
/data/data/com.useallrb/cache/oat/wrukfjpo.cur.prof

Filesize
548B

MD5
314a0ee142ddb36c536d508fc440eb9f

SHA1
49aa85fe780b84d5cd5965d02329c144b96a7daf

SHA256
5897baf4d03c29cbb84c557596b06dc854715d121b5a2ab34cf0f29748db52de

SHA512
bb11a77e7cec1d1e7977107adf027b7fcfa8f7da447004cefd934aab3862decd3528ccf80e45a408f8be88291d21f47521747f1dffd8becb604955af58f99127

Download Submit
/data/data/com.useallrb/cache/oat/wrukfjpo.cur.prof

Filesize
572B

MD5
48e0ad0ceb27545e42504219af50a6b5

SHA1
18ae0e5079f57f2642b1d08d06df81494fab64a4

SHA256
4e59669d7ee6d93cebed31c2ee69a8a526d74c3f14ec714fcb33288483bdf72f

SHA512
968d40da812934d23a195dbddd48073083c26f19658546b6b46ed0ec3a32ac34ea83d6465ba9649b87600b5672e452dbdc030599e64c16f425ac03e8bab59af2

Download Submit
/data/data/com.useallrb/cache/wrukfjpo

Filesize
457KB

MD5
84f2ba6d209895ee87990060f93615a7

SHA1
56ec69e59a47433f0948fa349de4efed92d02b3d

SHA256
b304fa8c4aaa44d548cc580f2af9a9df0dd6cc6dd2e7f8505fe5b91853ca080b

SHA512
ea03e036ad90ca4dd605a9cf2ec08aae237f1fdc100f6381c74089f848587fed2d428d5258dc9e809cc556e16c1758fa5547ff26ad84d085fadfedc2847455cf

Download Submit
/data/data/com.useallrb/kl.txt

Filesize
423B

MD5
92af0c311f2a38bc951442dc326ec679

SHA1
e3536294cc4e8c9ee039c94d0ff5816e1a60eb55

SHA256
67381926f45c9c37ae6c8595e407764e492d0b9a1811da95255bbd35b82d7c5b

SHA512
30a0bcc673a697257782eb81a9557a0eaa0b8e8684498d7561739391f2ec17dbcb124052ee0e2fd6995fc9a56c40b27bd81a3bbef881a7026b93769d49b46a0a

Download Submit
/data/data/com.useallrb/kl.txt

Filesize
28B

MD5
6311c3fd15588bb5c126e6c28ff5fffe

SHA1
ce81d136fce31779f4dd62e20bdaf99c91e2fc57

SHA256
8b82f6032e29a2b5c96031a3630fb6173d12ff0295bc20bb21b877d08f0812d8

SHA512
2975fe2e94b6a8adc9cfc1a865ad113772b54572883a537b02a16dd2d029c0f7d9cca3b154fd849bdfe978e18b396bcf9fa6e67e7c61f92bdc089a29a9c355c6

Download Submit
/data/data/com.useallrb/kl.txt

Filesize
230B

MD5
964bfa8938232bdaf43603e36aadf00e

SHA1
25584d796ea35b7950daf4f965f28dc8f27e475b

SHA256
d596b35deb4a533daef75c497471db8c335c4b7a6f03ec0af680bd65807e8585

SHA512
9b1552c5d5258f69e01d0d0ef60041e7638aa64f7604f4d37d995d5bdf24279b9a8c2cf44c8939ef8176fb0b2eb6a3bf2a19e45a9df6ad5625d5eef40a6c4ca3

Download Submit
/data/data/com.useallrb/kl.txt

Filesize
54B

MD5
cb5e57630b53ec06ec62db3846904e30

SHA1
6509cd59237fa907ffacbdfa3a5333a44c03c33e

SHA256
06263d04690263191e0e105c667108e3be3a66f902500c8730a25dccd7f2e701

SHA512
121c435c9734646126b30ac51d7d77aebeb606d46f1331999e75a98258a77501c75e264bc9be50027e21cc2dba5ff82672e0df9c2c6276ed9937b0fddb913f82

Download Submit
/data/data/com.useallrb/kl.txt

Filesize
45B

MD5
52dc6d2be3b81ff60c30d88472527ad3

SHA1
188f65568b848bc64d10f3a40a5ecc7c2cf913b2

SHA256
99572952bca27b408a6e9d7d79c6275187248b739889f98d2c580c72e0ae030a

SHA512
6af64ee37975c5d15fcc94f03e762ed8c0ca0af2e7b88e12bd1ab6ae87e37ae6bb06764aa6ebae1c7a492087d458fd59e53df3984d23764bde8a91e800f76399

Download Submit
/data/user/0/com.useallrb/app_DynamicOptDex/FmDsJ.json

Filesize
6KB

MD5
3b5a8de6c5a04653a94a278d48e7c76b

SHA1
1f499f079b2d2a2d0df98e741638f60048d0e94b

SHA256
58f512fc54d2207a37d9b8821eb94bead5624d4d024952248c24eaf9803b08b9

SHA512
65aa5de6557c2eed68fc10f05eb0177109b0387266af6ee142ec14ed53f9c017819df38c9e12efffbfbf893f4a8100d94de7359f67fec3c7f658b226d7111ac8

Download Submit
/data/user/0/com.useallrb/cache/wrukfjpo

Filesize
457KB

MD5
84f2ba6d209895ee87990060f93615a7

SHA1
56ec69e59a47433f0948fa349de4efed92d02b3d

SHA256
b304fa8c4aaa44d548cc580f2af9a9df0dd6cc6dd2e7f8505fe5b91853ca080b

SHA512
ea03e036ad90ca4dd605a9cf2ec08aae237f1fdc100f6381c74089f848587fed2d428d5258dc9e809cc556e16c1758fa5547ff26ad84d085fadfedc2847455cf

Download Submit
/data/user/0/com.useallrb/cache/wrukfjpo

Filesize
457KB

MD5
84f2ba6d209895ee87990060f93615a7

SHA1
56ec69e59a47433f0948fa349de4efed92d02b3d

SHA256
b304fa8c4aaa44d548cc580f2af9a9df0dd6cc6dd2e7f8505fe5b91853ca080b

SHA512
ea03e036ad90ca4dd605a9cf2ec08aae237f1fdc100f6381c74089f848587fed2d428d5258dc9e809cc556e16c1758fa5547ff26ad84d085fadfedc2847455cf

Download Submit