Overview

overview

10

Static

static

7

7a3bfd367a...ce.apk

android-9-x86

10

7a3bfd367a...ce.apk

android-10-x64

10

Analysis

  • max time kernel
    533412s
  • max time network
    154s
  • platform
    android_x64
  • resource
    android-x64-20230831-en
  • submitted
    11/10/2023, 10:38

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    7a3bfd367a66e2ad2779f04ebfb7e565b777b31bf96dc6fb4df4043ab1df9ace.apk
  • Size 661KB
  • Sample231011-mpsrdsbb84
  • SHA256 7a3bfd367a66e2ad2779f04ebfb7e565b777b31bf96dc6fb4df4043ab1df9ace
  • MD5 SHA1 SHA512 SSDEEP
Score
10/10
octobankerevasioninfostealerransomwarerattrojan

Malware Config

Extracted

Family

  • octo

C2

  • https://185.225.75.19/YjRkZjE0NTUyNzZm/

  • https://otakikotaik4234234.net/YjRkZjE0NTUyNzZm/

  • https://otakikotaik3234234.net/YjRkZjE0NTUyNzZm/

  • https://otakikotaik1334534.net/YjRkZjE0NTUyNzZm/

  • https://otakikotaik1224634.net/YjRkZjE0NTUyNzZm/

  • https://otakikotaik6423234.net/YjRkZjE0NTUyNzZm/

AES_key

Signatures

  • Octo

    Octo is a banking malware with remote access capabilities first seen in April 2022.

    bankertrojaninfostealerratocto
  • Octo payload 3 IoCs
  • Makes use of the framework's Accessibility service. 2 IoCs
  • Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps). 1 IoCs
    banker
  • Acquires the wake lock. 1 IoCs
  • Loads dropped Dex/Jar 2 IoCs

    Runs executable file dropped to the device during analysis.

  • Reads information about phone network operator.
  • Removes a system notification. 1 IoCs
    evasion
  • Uses Crypto APIs (Might try to encrypt user data). 1 IoCs
    ransomware

Processes

  • com.unitunder50
    1⤵
    • Makes use of the framework's Accessibility service.
    • Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps).
    • Acquires the wake lock.
    • Loads dropped Dex/Jar
    • Removes a system notification.
    • Uses Crypto APIs (Might try to encrypt user data).
    PID:5012

Network

        MITRE ATT&CK Matrix

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        iaxzsqswjkpcwi
        • Path /data/data/com.unitunder50/cache/iaxzsqswjkpcwi
        • Size 450KB
        • SHA256 c04c9697df04ba47428b2ed901df6752cd57afe08aff144b0543206215bbb7c3
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        iaxzsqswjkpcwi.cur.prof
        • Path /data/data/com.unitunder50/cache/oat/iaxzsqswjkpcwi.cur.prof
        • Size 430B
        • SHA256 a0a40bec376dd3164019b2b46aa50721be165f118d846e1eeb1419a66b6ade56
        • MD5 SHA1 SHA512
        Submit Download

        kl.txt
        • Path /data/data/com.unitunder50/kl.txt
        • Size 28B
        • SHA256 8b82f6032e29a2b5c96031a3630fb6173d12ff0295bc20bb21b877d08f0812d8
        • MD5 SHA1 SHA512
        Submit Download

        kl.txt
        • Path /data/data/com.unitunder50/kl.txt
        • Size 233B
        • SHA256 3a41bad5fda6be057047e1981e61e5d45342db3ee37f1e4fa3c415eb073bce29
        • MD5 SHA1 SHA512
        Submit Download

        kl.txt
        • Path /data/data/com.unitunder50/kl.txt
        • Size 68B
        • SHA256 3761c39bf3f3593b2e709b0645db6e065e5a83bfc778800663bb6d25219bd1e6
        • MD5 SHA1 SHA512
        Submit Download

        kl.txt
        • Path /data/data/com.unitunder50/kl.txt
        • Size 76B
        • SHA256 27c60fab02aa2a79696c84b8347ff15abb18ce50bf9b2ef6b380e859a90bfa5c
        • MD5 SHA1 SHA512
        Submit Download

        iaxzsqswjkpcwi
        • Path /data/user/0/com.unitunder50/cache/iaxzsqswjkpcwi
        • Size 450KB
        • SHA256 c04c9697df04ba47428b2ed901df6752cd57afe08aff144b0543206215bbb7c3
        • MD5 SHA1 SHA512 SSDEEP
        Download

        iaxzsqswjkpcwi
        • Path /data/user/0/com.unitunder50/cache/iaxzsqswjkpcwi
        • Size 450KB
        • SHA256 c04c9697df04ba47428b2ed901df6752cd57afe08aff144b0543206215bbb7c3
        • MD5 SHA1 SHA512 SSDEEP
        Download