Overview

overview

10

Static

static

7

chrome-upd...14.apk

android-9-x86

10

chrome-upd...14.apk

android-10-x64

10

Analysis

  • max time kernel
    4276761s
  • max time network
    162s
  • platform
    android_x64
  • resource
    android-x64-20230831-en
  • submitted
    05/10/2023, 07:44

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    chrome-update01414.apk
  • Size 1.5MB
  • Sample231005-jk5nlsbd22
  • SHA256 0f03990f3617b47789c14428278d0750901129eced4d6e9291ded68e8b2bc190
  • MD5 SHA1 SHA512 SSDEEP
Score
10/10
octobankerevasioninfostealerransomwarerattrojan

Malware Config

Extracted

Family

  • octo

C2

  • https://musherpicka.live/MTU2OWE0NzJjNGY5/

  • https://golevasi800.top/MTU2OWE0NzJjNGY5/

  • https://cm603lzeyxdw.site/MTU2OWE0NzJjNGY5/

  • https://cm603lzeyxdw1.site/MTU2OWE0NzJjNGY5/

  • https://arw2he7x57wp.pw/MTU2OWE0NzJjNGY5/

  • https://9r8i1u84t2gp.online/MTU2OWE0NzJjNGY5/

  • https://cm603lzeyxdw.biz/MTU2OWE0NzJjNGY5/

  • https://arw2he7x57wp1.pw/MTU2OWE0NzJjNGY5/

  • https://9r8i1u84t2gp1.online/MTU2OWE0NzJjNGY5/

  • https://cm603lzeyxdw.space/MTU2OWE0NzJjNGY5/

  • https://5a9udxg6l6gd.su/MTU2OWE0NzJjNGY5/

  • https://zazarazgok7215vor1.pro/MTU2OWE0NzJjNGY5/

  • https://juf18ki1ca15ca1la.info/MTU2OWE0NzJjNGY5/

  • https://pofvac15camkkecz5.cc/MTU2OWE0NzJjNGY5/

  • https://makivn58jnid51.live/MTU2OWE0NzJjNGY5/

AES_key

Signatures

  • Octo

    Octo is a banking malware with remote access capabilities first seen in April 2022.

    bankertrojaninfostealerratocto
  • Octo payload 3 IoCs
  • Makes use of the framework's Accessibility service. 2 IoCs
  • Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps). 1 IoCs
    banker
  • Acquires the wake lock. 1 IoCs
  • Loads dropped Dex/Jar 3 IoCs

    Runs executable file dropped to the device during analysis.

  • Reads information about phone network operator.
  • Removes a system notification. 1 IoCs
    evasion
  • Uses Crypto APIs (Might try to encrypt user data). 1 IoCs
    ransomware

Processes

  • com.changecome6
    1⤵
    • Makes use of the framework's Accessibility service.
    • Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps).
    • Acquires the wake lock.
    • Loads dropped Dex/Jar
    • Removes a system notification.
    • Uses Crypto APIs (Might try to encrypt user data).
    PID:5049

Network

        MITRE ATT&CK Matrix

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        .qcom.changecome6
        • Path /data/data/com.changecome6/.qcom.changecome6
        • Size 48B
        • SHA256 b66c1320cb063a1d391c94273572ea6edae76c8c8b0a07f8d75c88686f0df72a
        • MD5 SHA1 SHA512
        Submit Download

        KdMoZmd.json
        • Path /data/data/com.changecome6/app_DynamicOptDex/KdMoZmd.json
        • Size 2KB
        • SHA256 eca1fa1353df1b5a451108258d9562350babf4f6f2c27b4014b87a4e353bbf5d
        • MD5 SHA1 SHA512
        Submit Download

        KdMoZmd.json
        • Path /data/data/com.changecome6/app_DynamicOptDex/KdMoZmd.json
        • Size 2KB
        • SHA256 64bb9abbba83b5bb33def2bddeed669783676a0a7aaba692b0354433a10d8189
        • MD5 SHA1 SHA512
        Submit Download

        zubvgztalpocu.cur.prof
        • Path /data/data/com.changecome6/cache/oat/zubvgztalpocu.cur.prof
        • Size 448B
        • SHA256 9dabc633da67ca0c3eaf3f3d301d93c2e52761aa81fd91900ba94d9c9f44cc60
        • MD5 SHA1 SHA512
        Submit Download

        zubvgztalpocu
        • Path /data/data/com.changecome6/cache/zubvgztalpocu
        • Size 272KB
        • SHA256 f130ea4eb467d7a7a0b7f9767555f96afc3b1a69b7f7634475b0b8bcaa2dac7f
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        kl.txt
        • Path /data/data/com.changecome6/kl.txt
        • Size 76B
        • SHA256 74b8a904add26fd500fbd417acd8b9cbb4e9b2efde6171616ffc692f4c593464
        • MD5 SHA1 SHA512
        Submit Download

        kl.txt
        • Path /data/data/com.changecome6/kl.txt
        • Size 28B
        • SHA256 8b82f6032e29a2b5c96031a3630fb6173d12ff0295bc20bb21b877d08f0812d8
        • MD5 SHA1 SHA512
        Submit Download

        kl.txt
        • Path /data/data/com.changecome6/kl.txt
        • Size 230B
        • SHA256 3f2043ae847757e6278a37292c18b7e11f6c7fd7ba95794fe09819fc798e8cb1
        • MD5 SHA1 SHA512
        Submit Download

        kl.txt
        • Path /data/data/com.changecome6/kl.txt
        • Size 45B
        • SHA256 e00102164638980b7fce7768d59cfe414d940885da6f0d2cba9526135e5c7824
        • MD5 SHA1 SHA512
        Submit Download

        kl.txt
        • Path /data/data/com.changecome6/kl.txt
        • Size 68B
        • SHA256 5d8fc3ee227cd36cfd286321dd8e07b7c46a2200e9cc348de45702e59e2ab912
        • MD5 SHA1 SHA512
        Submit Download

        KdMoZmd.json
        • Path /data/user/0/com.changecome6/app_DynamicOptDex/KdMoZmd.json
        • Size 6KB
        • SHA256 469a22794f429f36912fff701787d874836eead4cd4005784e6adc30927134d4
        • MD5 SHA1 SHA512 SSDEEP
        Download

        zubvgztalpocu
        • Path /data/user/0/com.changecome6/cache/zubvgztalpocu
        • Size 272KB
        • SHA256 f130ea4eb467d7a7a0b7f9767555f96afc3b1a69b7f7634475b0b8bcaa2dac7f
        • MD5 SHA1 SHA512 SSDEEP
        Download

        zubvgztalpocu
        • Path /data/user/0/com.changecome6/cache/zubvgztalpocu
        • Size 272KB
        • SHA256 f130ea4eb467d7a7a0b7f9767555f96afc3b1a69b7f7634475b0b8bcaa2dac7f
        • MD5 SHA1 SHA512 SSDEEP
        Download