General
-
Target
chrome-update01231 (1).apk
-
Size
1.9MB
-
Sample
231005-n7m5asah6w
-
MD5
d7ccab4750500d52ee48ac9dfcb87f4d
-
SHA1
52cbb4b76917b3a2aef37328f75bae8b323ead0e
-
SHA256
8cc901e75b13808b61c77971fea73f1b59c1b8171e9669413d36a31e2f427377
-
SHA512
90c3e267da4001b6196eb4e15b2eb9a86c6d2e3b6c23e5f941ab43ff0a8aa464fddc4e430143ded6e3cc24fbc0055ad53a057bf05dfb9e2fcb379cf957d8fa8a
-
SSDEEP
49152:6zpyj+khIWj5PfT3FxyqyUWKuX2ZGZbmqkiCTAE4KoSv:ipqtttmhfX2ZQ/kUW
Static task
static1
Behavioral task
behavioral1
Sample
chrome-update01231 (1).apk
Resource
android-x64-20230831-en
Behavioral task
behavioral2
Sample
chrome-update01231 (1).apk
Resource
android-x64-arm64-20230831-en
Behavioral task
behavioral3
Sample
chrome-update01231 (1).apk
Resource
android-x86-arm-20230831-en
Malware Config
Extracted
octo
https://zaglefolki1.info/MTU2OWE0NzJjNGY5/
https://passajire555.live/MTU2OWE0NzJjNGY5/
https://majestike8ca.top/MTU2OWE0NzJjNGY5/
https://jikugac818v.vip/MTU2OWE0NzJjNGY5/
https://5a9udxg6l6gd.su/MTU2OWE0NzJjNGY5/
https://zazarazgok7215vor1.pro/MTU2OWE0NzJjNGY5/
https://juf18ki1ca15ca1la.info/MTU2OWE0NzJjNGY5/
https://pofvac15camkkecz5.cc/MTU2OWE0NzJjNGY5/
https://makivn58jnid51.live/MTU2OWE0NzJjNGY5/
Targets
-
-
Target
chrome-update01231 (1).apk
-
Size
1.9MB
-
MD5
d7ccab4750500d52ee48ac9dfcb87f4d
-
SHA1
52cbb4b76917b3a2aef37328f75bae8b323ead0e
-
SHA256
8cc901e75b13808b61c77971fea73f1b59c1b8171e9669413d36a31e2f427377
-
SHA512
90c3e267da4001b6196eb4e15b2eb9a86c6d2e3b6c23e5f941ab43ff0a8aa464fddc4e430143ded6e3cc24fbc0055ad53a057bf05dfb9e2fcb379cf957d8fa8a
-
SSDEEP
49152:6zpyj+khIWj5PfT3FxyqyUWKuX2ZGZbmqkiCTAE4KoSv:ipqtttmhfX2ZQ/kUW
-
Octo
Octo is a banking malware with remote access capabilities first seen in April 2022.
-
Octo payload
-
Makes use of the framework's Accessibility service.
-
Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps).
-
Acquires the wake lock.
-
Loads dropped Dex/Jar
Runs executable file dropped to the device during analysis.
-
Reads information about phone network operator.
-
Requests disabling of battery optimizations (often used to enable hiding in the background).
-
Removes a system notification.
-
Uses Crypto APIs (Might try to encrypt user data).
-