oscorp | 1fb81ff3d18f5c9d75f9c7117dec76ece31c2f80ea7cc3b5d932b8ce58516246 | Triage

Resubmissions

12-10-2023 13:34

231012-qt931sca31 10

Analysis

max time kernel
923318s
max time network
135s
platform
android_x86
resource
android-x86-arm-20230831-en
resource tags

androidarch:armarch:x86image:android-x86-arm-20230831-enlocale:en-usos:android-9-x86system
submitted
12-10-2023 13:34

Sharing

Report Analysis Logs

General

Target

Oscorp.apk
Size

13.2MB
MD5

8daf9ba69c0dcf9224fd1e4006c9dad3
SHA1

3b79553ad9b7310bff447eedd12b84bf1382d573
SHA256

1fb81ff3d18f5c9d75f9c7117dec76ece31c2f80ea7cc3b5d932b8ce58516246
SHA512

4cbd492091e4254768a2817661107458e72d356af2781b28a4bd3d2a79a5986d877a0b397aef74cd53e272db99e6e07d7573067721f68af17b990b32f222d3b5
SSDEEP

393216:DK0depil8+wMg8gjxCOJ/2zTWTV2Vrfns0JWoLK3ZMp5HKtfa:mJ4g8g1C8uzTQ2lslpiwi

Score

10^/10

oscorp 4812kjypd9 banker infostealer rat stealth trojan

Malware Config

Extracted

Family

oscorp

Botnet

4812KJYPD9

Signatures

Oscorp
Oscorp is an Android stealer that targets multiple financial information first seen in Feb 2021.
trojan infostealer rat banker oscorp

Makes use of the framework's Accessibility service. 2 IoCs

description	ioc	Process
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId	com.cosmos.starwarz
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByText	com.cosmos.starwarz

Removes its main activity from the application launcher 1 IoCs

pid	Process
4180	com.cosmos.starwarz

com.cosmos.starwarz
1⤵
- Makes use of the framework's Accessibility service.
- Removes its main activity from the application launcher
PID:4180

.Geny22
1⤵
PID:4210

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads