octo | 8cc901e75b13808b61c77971fea73f1b59c1b8171e9669413d36a31e2f427377

Resubmissions

05-10-2023 12:02

231005-n7m5asah6w 10

01-10-2023 09:19

231001-lakxkahh3v 10

Analysis

max time kernel
3935046s
max time network
155s
platform
android_x64
resource
android-x64-20230831-en
submitted
01-10-2023 09:19

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

chrome-update01231 (1).apk
Size

1.9MB
MD5

d7ccab4750500d52ee48ac9dfcb87f4d
SHA1

52cbb4b76917b3a2aef37328f75bae8b323ead0e
SHA256

8cc901e75b13808b61c77971fea73f1b59c1b8171e9669413d36a31e2f427377
SHA512

90c3e267da4001b6196eb4e15b2eb9a86c6d2e3b6c23e5f941ab43ff0a8aa464fddc4e430143ded6e3cc24fbc0055ad53a057bf05dfb9e2fcb379cf957d8fa8a
SSDEEP

49152:6zpyj+khIWj5PfT3FxyqyUWKuX2ZGZbmqkiCTAE4KoSv:ipqtttmhfX2ZQ/kUW

Score

10^/10

octo banker infostealer ransomware rat trojan

Malware Config

Extracted

Family

octo

https://zaglefolki1.info/MTU2OWE0NzJjNGY5/

https://passajire555.live/MTU2OWE0NzJjNGY5/

https://majestike8ca.top/MTU2OWE0NzJjNGY5/

https://jikugac818v.vip/MTU2OWE0NzJjNGY5/

https://5a9udxg6l6gd.su/MTU2OWE0NzJjNGY5/

https://zazarazgok7215vor1.pro/MTU2OWE0NzJjNGY5/

https://juf18ki1ca15ca1la.info/MTU2OWE0NzJjNGY5/

https://pofvac15camkkecz5.cc/MTU2OWE0NzJjNGY5/

https://makivn58jnid51.live/MTU2OWE0NzJjNGY5/

AES_key

Signatures

Octo
Octo is a banking malware with remote access capabilities first seen in April 2022.
banker trojan infostealer rat octo

Octo payload 3 IoCs

Processes:

resource	yara_rule
/data/data/com.completebe0/cache/bhvbn	family_octo
/data/user/0/com.completebe0/cache/bhvbn	family_octo
/data/user/0/com.completebe0/cache/bhvbn	family_octo

Makes use of the framework's Accessibility service. 2 IoCs

Processes:

com.completebe0

description	ioc	process
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId	com.completebe0
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByViewId	com.completebe0

Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps). 1 IoCs
banker

Processes:

com.completebe0

description ioc process

Framework service call android.content.pm.IPackageManager.getInstalledApplications com.completebe0
Acquires the wake lock. 1 IoCs

Processes:

com.completebe0

description ioc process

Framework service call android.os.IPowerManager.acquireWakeLock com.completebe0

description	ioc	process
Framework service call	android.content.pm.IPackageManager.getInstalledApplications	com.completebe0

description	ioc	process
Framework service call	android.os.IPowerManager.acquireWakeLock	com.completebe0

Loads dropped Dex/Jar 3 IoCs

Runs executable file dropped to the device during analysis.

Processes:

com.completebe0

ioc	pid	process
/data/user/0/com.completebe0/app_DynamicOptDex/XXtM.json	4875	com.completebe0
/data/user/0/com.completebe0/cache/bhvbn	4875	com.completebe0
/data/user/0/com.completebe0/cache/bhvbn	4875	com.completebe0

Reads information about phone network operator.
Uses Crypto APIs (Might try to encrypt user data). 1 IoCs
ransomware

Processes:

com.completebe0

description ioc process

Framework API call javax.crypto.Cipher.doFinal com.completebe0

description	ioc	process
Framework API call	javax.crypto.Cipher.doFinal	com.completebe0

com.completebe0
1⤵
- Makes use of the framework's Accessibility service.
- Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps).
- Acquires the wake lock.
- Loads dropped Dex/Jar
- Uses Crypto APIs (Might try to encrypt user data).
PID:4875

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

/data/data/com.completebe0/.qcom.completebe0

Filesize
48B

MD5
046a414913add6f5bb60072c7db819b6

SHA1
451ee4f6809260aec622d772fd329c7d0297a842

SHA256
b66c1320cb063a1d391c94273572ea6edae76c8c8b0a07f8d75c88686f0df72a

SHA512
4e6355f3051ed5e811ab030abde1f5be7f5e1cf33be99cd08477e9b6c015deb1d8bd75a09fb9c7176b8511c5ad0a67abc0902a3531e97564ccb6afc57496a47c

Download Submit
/data/data/com.completebe0/app_DynamicOptDex/XXtM.json

Filesize
2KB

MD5
d6da5c5529f474e412cb499403dbf48f

SHA1
26c1de09a30e36bb1fcfc220fb39e93eba25e278

SHA256
a2c64094c5803a5e83ebc4c2286c30463735a727443ee93bd0628dd2056b5279

SHA512
39ce9d281fd1f3455936882cbd63b95347cd931c4ec94c56f5b5311e3a1abf5b3dd00553eeea696ce77215ff01760e90fdf108a3e2268af73dda477a6191fe88

Download Submit
/data/data/com.completebe0/app_DynamicOptDex/XXtM.json

Filesize
2KB

MD5
c23b13ee75e62fad156c18baf3307196

SHA1
5fd075e86bb806ce7d703bd94c8179a622250633

SHA256
755d90dbde099e849869c2838ab3854ce85db818319d9a9ede0f66319e44fd0b

SHA512
4832845b05e2be6cd7d6f510df170348415afba3cccfa9a1723fa2b13734905d153d55d1e634c1b7553aaf7b2e0500dcb21cdfa2c5d1c1bbb3b28dd6920195d8

Download Submit
/data/data/com.completebe0/cache/bhvbn

Filesize
457KB

MD5
0f298b4d05ac13449acd725c06fa6115

SHA1
da53ed2eb6952b54799328a33fd5275e60a0fcc9

SHA256
773a283d03ea5440eebcbb72b3f98988dc66342f0a8ab6415d9a01346aa407ac

SHA512
5d12aad043cf6a5b879a8285896c9eb73ff96c4ca29de6170db77937e83edf26ebe6aae3ebbd1f8208830f7886e8ce1d64f9fa4c4eccf75f6c86e4ae99b086a5

Download Submit
/data/data/com.completebe0/cache/oat/bhvbn.cur.prof

Filesize
472B

MD5
7102e598b1aba09d3d1c2bac1f007e4f

SHA1
58448e74810e61e1997ce2dfa194481d8138c71e

SHA256
bff059b7885ba1b97fc83b574cd7245ab61bd3d817fdd25690f449213eb83279

SHA512
117af9296035ae9775a38fb4fe3836967fbdd2b3fdf1006bb223efb3e92fea237a9f191046100dbb39e9102152e2ae52866ca3d0d12c7bf917bd8a3e95e3eddb

Download Submit
/data/data/com.completebe0/kl.txt

Filesize
423B

MD5
804e4a3ac820fc4f14f693c6b6967b49

SHA1
8486d749e4b8b11780710f664c79a69ebada05ec

SHA256
c9043af82ce24f4a1a1049b92153e0d50435b9556f8b75a8d922d8ea81d19410

SHA512
fb824b599419f0f1cd6cc3bc5fd1e69c741454357064785bbde4aaeaf0a6fe2b016019f6f7762e84a2105e70db3c4b7651c6d6790ded21fbef4f5b75fa4a75cb

Download Submit
/data/data/com.completebe0/kl.txt

Filesize
230B

MD5
e082db016e0d79ef6d70b7b7766585f4

SHA1
e9ef606355f914a84673300d8c37b8a1da3966e2

SHA256
bfe60d54e120e4dc75db18e410bff24c2bfc168ebe52cd06120dcea8bf203b51

SHA512
3bab277abb8ed79fbe6bc5195448442105caef5df7d61fc000a8bf9724be720da90616ba26db9cb3bd59f6e9e34d39f5d77f2c97b8db794ba4a5517139dfcd5f

Download Submit
/data/data/com.completebe0/kl.txt

Filesize
45B

MD5
6642a6fa6a6947f3ca1fe888ce13cdf2

SHA1
3ecf080d1c7480e93da5b061936a3c0aa28a72e6

SHA256
ee83dc0c3f9035deb6886a630ba433170923b9ae77c85f1bd8b8d2e24486e240

SHA512
cd05de734ef77cc4d92d927afbe82b2dd6480f56307864b9d325e5523c51316ee1d89e8823acaf7251f70f8685adf25d4d635ca477815d3f669b18c200a06b75

Download Submit
/data/data/com.completebe0/kl.txt

Filesize
63B

MD5
0a0fb9139f7571f38410c2c3455784b7

SHA1
4d226df1b5f498c421b8f513740c0debfe3dc797

SHA256
9ca1f66e2fbb35546407ef9adfccf2fb612e0b7c6358fd217b0c99b6d1ab6cc8

SHA512
8ec5a28cf14f20e112259c0fba1dfad3a1f4ded8b5dd788070a63d38593f99afe41911e7039d339cccb1fad4756a40ac895fa0bfea91939cc42078dddf275dea

Download Submit
/data/data/com.completebe0/kl.txt

Filesize
45B

MD5
e9ac52c7763c1342768538a1dfea30be

SHA1
a6898c03ce284506041014f9ab3036a326afb7d4

SHA256
97f94831621badd7270897e113a064d48897e1c29c64e89877f63f111bd5c73e

SHA512
0fe2c3d0f904175b7dccca7a6b669667d0f831ec52b7508e53b040605378978146ccfe9728dad23e635fcdc915e0ac41cb1207f08619bbf071b6dc4eceae0ea9

Download Submit
/data/user/0/com.completebe0/app_DynamicOptDex/XXtM.json

Filesize
6KB

MD5
8e4612b5633c2f3f03aad82512e10946

SHA1
1ed04da4b21489501338b57999f858d775ff0579

SHA256
863d543d469a91d30fbf78676c5f014496fa2f36f8beda1c6f04a94fa22d6b88

SHA512
f0930dded69c9328957a170df5f78f10668aefd2e7168f6e17214169202750f7e9760dc2f6e6c0dffc593e49ee132fcbecf7597871b57dc71a8ffe958f587312

Download Submit
/data/user/0/com.completebe0/cache/bhvbn

Filesize
457KB

MD5
0f298b4d05ac13449acd725c06fa6115

SHA1
da53ed2eb6952b54799328a33fd5275e60a0fcc9

SHA256
773a283d03ea5440eebcbb72b3f98988dc66342f0a8ab6415d9a01346aa407ac

SHA512
5d12aad043cf6a5b879a8285896c9eb73ff96c4ca29de6170db77937e83edf26ebe6aae3ebbd1f8208830f7886e8ce1d64f9fa4c4eccf75f6c86e4ae99b086a5

Download Submit
/data/user/0/com.completebe0/cache/bhvbn

Filesize
457KB

MD5
0f298b4d05ac13449acd725c06fa6115

SHA1
da53ed2eb6952b54799328a33fd5275e60a0fcc9

SHA256
773a283d03ea5440eebcbb72b3f98988dc66342f0a8ab6415d9a01346aa407ac

SHA512
5d12aad043cf6a5b879a8285896c9eb73ff96c4ca29de6170db77937e83edf26ebe6aae3ebbd1f8208830f7886e8ce1d64f9fa4c4eccf75f6c86e4ae99b086a5

Download Submit