Analysis

  • max time kernel
    3734203s
  • max time network
    157s
  • platform
    android_x86
  • resource
    android-x86-arm-20230831-en
  • submitted
    29-09-2023 01:32

General

  • Target

    6552b0699c6683b9a7d905d431b14403.apk

  • Size

    1.9MB

  • MD5

    6552b0699c6683b9a7d905d431b14403

  • SHA1

    a40c6bb1990ce78414b64bf9a2f6225e6012ee8e

  • SHA256

    5ebac20a82963408b103b0e53da63fc22a15404321989a090505ee8258095423

  • SHA512

    e488030c5d39ea668f8d8e4b799ce34f54eb2ecd34d1e5c36d88293137d58997bb674533d6be880cd9703ae2c6d5622d521ca8a2194e21dbc7c112f471896834

  • SSDEEP

    24576:MmlR3LHA9i1J6hf+SsmW+c92P4J1dMZAMm7tAme4Z/w5gNlVYRDlYqjaOB04IB3+:zLA816famWaP4yY5RZ/wytEieLRfbfV

Malware Config

Extracted

Family

octo

C2

https://cm603lzeyxdw.site/MTU2OWE0NzJjNGY5/

https://cm603lzeyxdw1.site/MTU2OWE0NzJjNGY5/

https://arw2he7x57wp.pw/MTU2OWE0NzJjNGY5/

https://5a9udxg6l6gd.su/MTU2OWE0NzJjNGY5/

https://9r8i1u84t2gp.online/MTU2OWE0NzJjNGY5/

https://cm603lzeyxdw.space/MTU2OWE0NzJjNGY5/

https://cleverk21da912mca.live/MTU2OWE0NzJjNGY5/

https://zazarazgok7215vor1.pro/MTU2OWE0NzJjNGY5/

https://juf18ki1ca15ca1la.info/MTU2OWE0NzJjNGY5/

https://pofvac15camkkecz5.cc/MTU2OWE0NzJjNGY5/

AES_key

Signatures

  • Octo

    Octo is a banking malware with remote access capabilities first seen in April 2022.

  • Octo payload 3 IoCs
  • Makes use of the framework's Accessibility service. 2 IoCs
  • Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps). 1 IoCs
  • Removes its main activity from the application launcher 1 IoCs
  • Acquires the wake lock. 1 IoCs
  • Loads dropped Dex/Jar 3 IoCs

    Runs executable file dropped to the device during analysis.

  • Reads information about phone network operator.
  • Requests disabling of battery optimizations (often used to enable hiding in the background). 1 IoCs
  • Removes a system notification. 1 IoCs
  • Uses Crypto APIs (Might try to encrypt user data). 1 IoCs

Processes

  • com.useallrb
    1⤵
    • Makes use of the framework's Accessibility service.
    • Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps).
    • Removes its main activity from the application launcher
    • Acquires the wake lock.
    • Loads dropped Dex/Jar
    • Requests disabling of battery optimizations (often used to enable hiding in the background).
    • Removes a system notification.
    • Uses Crypto APIs (Might try to encrypt user data).
    PID:4132

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • /data/data/com.useallrb/.qcom.useallrb

    Filesize

    48B

    MD5

    046a414913add6f5bb60072c7db819b6

    SHA1

    451ee4f6809260aec622d772fd329c7d0297a842

    SHA256

    b66c1320cb063a1d391c94273572ea6edae76c8c8b0a07f8d75c88686f0df72a

    SHA512

    4e6355f3051ed5e811ab030abde1f5be7f5e1cf33be99cd08477e9b6c015deb1d8bd75a09fb9c7176b8511c5ad0a67abc0902a3531e97564ccb6afc57496a47c

  • /data/data/com.useallrb/app_DynamicOptDex/FmDsJ.json

    Filesize

    2KB

    MD5

    5d64c1889d318ee2bb41d42d4032963a

    SHA1

    09b640c146770ab5fb7c47b96dfa1b62de5ff8f1

    SHA256

    3e1ddfa2cffab71c74fc31d3dd2c57729667854e8dad04b005f8206ff0d1c713

    SHA512

    edc1e710842c1ed407fd37cdbf0c000cc451e41dd6831e39e10657afe23ec7ac387e14e539b1789105681539ce2ce4f164caccdacf8b5d9aac0dfae7fc7836ef

  • /data/data/com.useallrb/app_DynamicOptDex/FmDsJ.json

    Filesize

    2KB

    MD5

    4f60386f43a84e3fcc86291877286d26

    SHA1

    45302eb0bbbfec66c3b7e8a317496450698b570a

    SHA256

    b6267bcfab7d554bbf293a850311bfc4b3cef50d7346e5612ff78ed3d8b8860b

    SHA512

    743e2706bf2d43f395b0b624ccafeeaa269bf604d5bebcad8c5491c7232152f0efdf341729ab397b9a6515f3b963743961aa9ae39d7b971ab7200d87f5e4897d

  • /data/data/com.useallrb/cache/oat/wrukfjpo.cur.prof

    Filesize

    433B

    MD5

    0e147b751bfff9fc5b20976f3eff980e

    SHA1

    4043cbeaa7bf249fa7f90e0cc4745c4691ef4179

    SHA256

    92b69a24a028f9de7919bea031a0233df817e5f32188f245074f4d9962f0a38d

    SHA512

    2da90569cb1f69ece8ac596363e600201cc90fc983bf76cb538d1c97238f4105e2773fbc281d4df9d9ef480b2e3ec1d06ddfdda9cce42a63e4cdd5287a2c0870

  • /data/data/com.useallrb/cache/wrukfjpo

    Filesize

    457KB

    MD5

    84f2ba6d209895ee87990060f93615a7

    SHA1

    56ec69e59a47433f0948fa349de4efed92d02b3d

    SHA256

    b304fa8c4aaa44d548cc580f2af9a9df0dd6cc6dd2e7f8505fe5b91853ca080b

    SHA512

    ea03e036ad90ca4dd605a9cf2ec08aae237f1fdc100f6381c74089f848587fed2d428d5258dc9e809cc556e16c1758fa5547ff26ad84d085fadfedc2847455cf

  • /data/data/com.useallrb/kl.txt

    Filesize

    28B

    MD5

    6311c3fd15588bb5c126e6c28ff5fffe

    SHA1

    ce81d136fce31779f4dd62e20bdaf99c91e2fc57

    SHA256

    8b82f6032e29a2b5c96031a3630fb6173d12ff0295bc20bb21b877d08f0812d8

    SHA512

    2975fe2e94b6a8adc9cfc1a865ad113772b54572883a537b02a16dd2d029c0f7d9cca3b154fd849bdfe978e18b396bcf9fa6e67e7c61f92bdc089a29a9c355c6

  • /data/data/com.useallrb/kl.txt

    Filesize

    230B

    MD5

    03e4b51330f5fd396ccdbedc64c7d8ec

    SHA1

    00b8eda65b27e3ed4222a070439c98112962b507

    SHA256

    bd24d06dcc35b43e3268580cbd0c80ed7a8bf0e29227ac0894e6f987f16221d8

    SHA512

    6dedb5eb9cdb117dbb6133795c476e74a67f8a2fcbaef0c0104f517ce77f85b941b6b62e77ac45f0acb694d06a1458c506f30a5a930132912f7b412e357413ff

  • /data/data/com.useallrb/kl.txt

    Filesize

    54B

    MD5

    d782b7438c53efd76ecbaa61f63822f5

    SHA1

    77df68fb62a21c8111dff32472ac1a2d6f543f8e

    SHA256

    3f77a1f7e2a0cd1a44aec3c94b00b67d2cb4e67659e0872892086694562204b2

    SHA512

    27bfcb9ca5c7be6560be9dbf6ecc6c762f9c6f3c2065666493e39ed59d82bd6bf957c6eeeb8d0b6510eff6dee3a356a37c3013d8c960ae1660b73ec3b3c55758

  • /data/data/com.useallrb/kl.txt

    Filesize

    63B

    MD5

    7f1273cfe018b4c9c3e608b32b9369e5

    SHA1

    729453c9bec50a01e5e3977283e13dd375ac0b58

    SHA256

    021989ca5fe5f7b5321df5a48cdc4ccb6addf44d57c147d4d2b9810d7e0d028b

    SHA512

    96bfc0c200ce195d22cb96b45a38ea0993b2c453b3daab282fb4564a6952cc1208de21a795539a1ea2181c1814291c9c6f0de8b75ed46f82b9d89098533fd4b2

  • /data/data/com.useallrb/kl.txt

    Filesize

    423B

    MD5

    45f36b2756f560c07225b46153d0b0e1

    SHA1

    036fa879f473dc6636e4cab0df5ed083707f3a7a

    SHA256

    fa58d7d30671f6facfe550291ac569a1eee2d23d303f84d6f4c13d03e4accbb2

    SHA512

    d584fb9bb515536700ffd25acdbf192014d16db81e4846f49adc565d8a2799f03cd35ec72509d1721bf38a0d0b4859eb60015c8e421086f3fbd0c36dbc71507b

  • /data/user/0/com.useallrb/app_DynamicOptDex/FmDsJ.json

    Filesize

    6KB

    MD5

    3b5a8de6c5a04653a94a278d48e7c76b

    SHA1

    1f499f079b2d2a2d0df98e741638f60048d0e94b

    SHA256

    58f512fc54d2207a37d9b8821eb94bead5624d4d024952248c24eaf9803b08b9

    SHA512

    65aa5de6557c2eed68fc10f05eb0177109b0387266af6ee142ec14ed53f9c017819df38c9e12efffbfbf893f4a8100d94de7359f67fec3c7f658b226d7111ac8

  • /data/user/0/com.useallrb/cache/wrukfjpo

    Filesize

    457KB

    MD5

    84f2ba6d209895ee87990060f93615a7

    SHA1

    56ec69e59a47433f0948fa349de4efed92d02b3d

    SHA256

    b304fa8c4aaa44d548cc580f2af9a9df0dd6cc6dd2e7f8505fe5b91853ca080b

    SHA512

    ea03e036ad90ca4dd605a9cf2ec08aae237f1fdc100f6381c74089f848587fed2d428d5258dc9e809cc556e16c1758fa5547ff26ad84d085fadfedc2847455cf

  • /data/user/0/com.useallrb/cache/wrukfjpo

    Filesize

    457KB

    MD5

    84f2ba6d209895ee87990060f93615a7

    SHA1

    56ec69e59a47433f0948fa349de4efed92d02b3d

    SHA256

    b304fa8c4aaa44d548cc580f2af9a9df0dd6cc6dd2e7f8505fe5b91853ca080b

    SHA512

    ea03e036ad90ca4dd605a9cf2ec08aae237f1fdc100f6381c74089f848587fed2d428d5258dc9e809cc556e16c1758fa5547ff26ad84d085fadfedc2847455cf