Overview

overview

10

Static

static

7

chrome-upd...1).apk

android-9-x86

10

chrome-upd...1).apk

android-10-x64

10

license.html

windows7-x64

1

license.html

windows10-2004-x64

1

Resubmissions

05-10-2023 12:02

231005-n7m5asah6w 10

01-10-2023 09:19

231001-lakxkahh3v 10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    chrome-update01231 (1).apk

  • Size

    1.9MB

  • Sample

    231001-lakxkahh3v

  • MD5

    d7ccab4750500d52ee48ac9dfcb87f4d

  • SHA1

    52cbb4b76917b3a2aef37328f75bae8b323ead0e

  • SHA256

    8cc901e75b13808b61c77971fea73f1b59c1b8171e9669413d36a31e2f427377

  • SHA512

    90c3e267da4001b6196eb4e15b2eb9a86c6d2e3b6c23e5f941ab43ff0a8aa464fddc4e430143ded6e3cc24fbc0055ad53a057bf05dfb9e2fcb379cf957d8fa8a

  • SSDEEP

    49152:6zpyj+khIWj5PfT3FxyqyUWKuX2ZGZbmqkiCTAE4KoSv:ipqtttmhfX2ZQ/kUW

Score
10/10
octoandroidbankerevasioninfostealerransomwareratstealthtrojan

Malware Config

Extracted

Family

octo

C2

https://zaglefolki1.info/MTU2OWE0NzJjNGY5/

https://passajire555.live/MTU2OWE0NzJjNGY5/

https://majestike8ca.top/MTU2OWE0NzJjNGY5/

https://jikugac818v.vip/MTU2OWE0NzJjNGY5/

https://5a9udxg6l6gd.su/MTU2OWE0NzJjNGY5/

https://zazarazgok7215vor1.pro/MTU2OWE0NzJjNGY5/

https://juf18ki1ca15ca1la.info/MTU2OWE0NzJjNGY5/

https://pofvac15camkkecz5.cc/MTU2OWE0NzJjNGY5/

https://makivn58jnid51.live/MTU2OWE0NzJjNGY5/
AES_key

Targets

    • Target

      chrome-update01231 (1).apk

    • Size

      1.9MB

    • MD5

      d7ccab4750500d52ee48ac9dfcb87f4d

    • SHA1

      52cbb4b76917b3a2aef37328f75bae8b323ead0e

    • SHA256

      8cc901e75b13808b61c77971fea73f1b59c1b8171e9669413d36a31e2f427377

    • SHA512

      90c3e267da4001b6196eb4e15b2eb9a86c6d2e3b6c23e5f941ab43ff0a8aa464fddc4e430143ded6e3cc24fbc0055ad53a057bf05dfb9e2fcb379cf957d8fa8a

    • SSDEEP

      49152:6zpyj+khIWj5PfT3FxyqyUWKuX2ZGZbmqkiCTAE4KoSv:ipqtttmhfX2ZQ/kUW

    Score
    10/10
    octobankerevasioninfostealerransomwareratstealthtrojan

    • Octo

      Octo is a banking malware with remote access capabilities first seen in April 2022.

      bankertrojaninfostealerratocto

    • Octo payload

    • Makes use of the framework's Accessibility service.

    • Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps).

      banker

    • Removes its main activity from the application launcher

      stealthtrojan

    • Acquires the wake lock.

    • Loads dropped Dex/Jar

      Runs executable file dropped to the device during analysis.

    • Reads information about phone network operator.

    • Requests disabling of battery optimizations (often used to enable hiding in the background).

      evasion

    • Uses Crypto APIs (Might try to encrypt user data).

      ransomware
    behavioral1behavioral2

    • Target

      license.html

    • Size

      30KB

    • MD5

      a095d4be2768cb6d37f9aa2de90a8a67

    • SHA1

      2c87de9a26cf1ee17d701c333f088db314b1bce1

    • SHA256

      30d2be0e050b7f1ec5e390326cefedb6e4a6304f5e2a623d0f7678cb67ff308b

    • SHA512

      0ec91a396b39029ec6585215e777495d97e72191438ec37d93e203931a1ac79b1a966e201b9b92982439e3d372f82af98a64914647464d30e1f7f3ab8a558998

    • SSDEEP

      768:/03s/uZ7je9IeMkkEdgC3BOgNMXUgPGaMx6NzJhCgaZpGgPGaxvam:/0c/uZ7je9IeMFIgeOgNMXUg6x6NzJhu

    Score
    1/10
    behavioral3behavioral4

MITRE ATT&CK Enterprise v15

Tasks