octo | b38019f9e80c2166a4e09eed0cd15bad651263f0ff3ea26199a08896ffd8e1fc

Resubmissions

05-08-2024 12:08

240805-pa55aavhjp 10

02-08-2024 15:48

03-01-2024 17:25

24-12-2023 19:17

14-12-2023 08:27

03-11-2023 03:07

01-11-2023 22:00

Analysis

max time kernel
2469457s
max time network
303s
platform
android_x86
resource
android-x86-arm-20231023-en
resource tags

androidarch:armarch:x86image:android-x86-arm-20231023-enlocale:en-usos:android-9-x86system
submitted
03-11-2023 03:07

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

b38019f9e80c2166a4e09eed0cd15bad651263f0ff3ea26199a08896ffd8e1fc.apk
Size

509KB
MD5

60609814e43a1c814b30435f15d361ed
SHA1

61431ed485c98b8a291e289a7e17e8d3e6db3660
SHA256

b38019f9e80c2166a4e09eed0cd15bad651263f0ff3ea26199a08896ffd8e1fc
SHA512

8efba5603fd4217b9c9c96e28a69f9f262568f76d43fd959d6914694808488f089f01fa92e2d04f44d5aa0859efcfb34fb080dc7b3a49502469598ab90a662fe
SSDEEP

12288:KwGWfjEhy4pNodk6TZFo9nheT5BQ4YvnAu:KnWf0y4GNIsmRvnAu

Score

10^/10

octo banker evasion infostealer ransomware rat stealth trojan

Malware Config

Extracted

Family

octo

https://84.54.50.100/Njk4Zjk4YjdjODY3/

https://pakuxxxnatationclass.net/Njk4Zjk4YjdjODY3/

https://pakuxxxnatationclass2.net/Njk4Zjk4YjdjODY3/

https://pakuxxxnatationclass3.net/Njk4Zjk4YjdjODY3/

https://pakuxxxnatationclass4.net/Njk4Zjk4YjdjODY3/

https://pakuxxxnatationclass5.net/Njk4Zjk4YjdjODY3/

https://pakuxxxnatationclass6.net/Njk4Zjk4YjdjODY3/

AES_key

Signatures

Octo
Octo is a banking malware with remote access capabilities first seen in April 2022.
banker trojan infostealer rat octo

Octo payload 3 IoCs

Processes:

resource	yara_rule
/data/data/com.broughtbluea/cache/pxcpq	family_octo
/data/user/0/com.broughtbluea/cache/pxcpq	family_octo
/data/user/0/com.broughtbluea/cache/pxcpq	family_octo

Makes use of the framework's Accessibility service. 2 IoCs

Processes:

com.broughtbluea

description	ioc	process
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId	com.broughtbluea
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByViewId	com.broughtbluea

Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps). 1 IoCs
banker

Processes:

com.broughtbluea

description ioc process

Framework service call android.content.pm.IPackageManager.getInstalledApplications com.broughtbluea
Removes its main activity from the application launcher 1 IoCs
stealth trojan

Processes:

com.broughtbluea

pid process

4239 com.broughtbluea
Acquires the wake lock. 1 IoCs

Processes:

com.broughtbluea

description ioc process

Framework service call android.os.IPowerManager.acquireWakeLock com.broughtbluea
Loads dropped Dex/Jar 2 IoCs
Runs executable file dropped to the device during analysis.

Processes:

com.broughtbluea

ioc pid process

/data/user/0/com.broughtbluea/cache/pxcpq 4239 com.broughtbluea
/data/user/0/com.broughtbluea/cache/pxcpq 4239 com.broughtbluea
Reads information about phone network operator.
Requests disabling of battery optimizations (often used to enable hiding in the background). 1 IoCs
evasion

Processes:

com.broughtbluea

description ioc process

Intent action android.settings.REQUEST_IGNORE_BATTERY_OPTIMIZATIONS com.broughtbluea
Removes a system notification. 1 IoCs
evasion

Processes:

com.broughtbluea

description ioc process

Framework service call android.app.INotificationManager.cancelNotificationWithTag com.broughtbluea
Uses Crypto APIs (Might try to encrypt user data). 1 IoCs
ransomware

Processes:

com.broughtbluea

description ioc process

Framework API call javax.crypto.Cipher.doFinal com.broughtbluea

description	ioc	process
Framework service call	android.content.pm.IPackageManager.getInstalledApplications	com.broughtbluea

pid	process
4239	com.broughtbluea

description	ioc	process
Framework service call	android.os.IPowerManager.acquireWakeLock	com.broughtbluea

ioc	pid	process
/data/user/0/com.broughtbluea/cache/pxcpq	4239	com.broughtbluea
/data/user/0/com.broughtbluea/cache/pxcpq	4239	com.broughtbluea

description	ioc	process
Intent action	android.settings.REQUEST_IGNORE_BATTERY_OPTIMIZATIONS	com.broughtbluea

description	ioc	process
Framework service call	android.app.INotificationManager.cancelNotificationWithTag	com.broughtbluea

description	ioc	process
Framework API call	javax.crypto.Cipher.doFinal	com.broughtbluea

com.broughtbluea
1⤵
- Makes use of the framework's Accessibility service.
- Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps).
- Removes its main activity from the application launcher
- Acquires the wake lock.
- Loads dropped Dex/Jar
- Requests disabling of battery optimizations (often used to enable hiding in the background).
- Removes a system notification.
- Uses Crypto APIs (Might try to encrypt user data).
PID:4239

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

/data/data/com.broughtbluea/cache/oat/pxcpq.cur.prof

Filesize
458B

MD5
eebe17e80a31e40b2c7569c33da35143

SHA1
ff724df898069a7c5e6f6931906581b7b12c81bd

SHA256
ca6a874bebbf87c9d6ebaeadf6dd53fc027dd16267a4e990415adebb96be67b8

SHA512
adf26c5095083783fea51b759ab0bbfc18f66215ecc172c6077e5694f6bb686265959bf9e1d3ac0cf56652470f95a03e16f238583c591856a711985cabeddd16

Download Submit
/data/data/com.broughtbluea/cache/pxcpq

Filesize
449KB

MD5
fb15ea8794c6547c5ca8f58577e433a6

SHA1
47c530ac1858cbc7584429190a07c3c4313857ac

SHA256
908588c8de2b52b69f30917583d91ac67f96c7682c017df3943d3979c9fc6095

SHA512
9cb724a385917e949052b84be546cd61a952474ee8671743034463b356de4c5bc60732b07287c326da65c4cced7f8c8247b348bbb5abb436c86fedbcb4da90c9

Download Submit
/data/data/com.broughtbluea/kl.txt

Filesize
28B

MD5
6311c3fd15588bb5c126e6c28ff5fffe

SHA1
ce81d136fce31779f4dd62e20bdaf99c91e2fc57

SHA256
8b82f6032e29a2b5c96031a3630fb6173d12ff0295bc20bb21b877d08f0812d8

SHA512
2975fe2e94b6a8adc9cfc1a865ad113772b54572883a537b02a16dd2d029c0f7d9cca3b154fd849bdfe978e18b396bcf9fa6e67e7c61f92bdc089a29a9c355c6

Download Submit
/data/data/com.broughtbluea/kl.txt

Filesize
230B

MD5
4df6cf351a378d1ba3e6f5e636c314df

SHA1
cccb6cfd61e97afa57cadb6187574b1c3fd09513

SHA256
abc11446197c2c3e2f9a18422381d694b9faa164addc16257873b4fa6b88af26

SHA512
c6b078d8c9ccae871a9b25a4d278e5220cb343c6ff3010af95245d889fe1344e76431aed95bba9bb06ce45fefb35bbd9ee61d60e88e3bf43c8c4e1e13760e10f

Download Submit
/data/data/com.broughtbluea/kl.txt

Filesize
63B

MD5
14d715db9bd5458f50ca446ec729a3c5

SHA1
4dd3345dd895d9ee0f9d5f32f1382a9f5decf8ce

SHA256
e0980a24c9dfca543c77758a1f91a011873f5051ede10cfc2b048ccfb696645c

SHA512
627c5fba46fbb1716af9c33c677f0f7b0dfda9228536a6646bfe78c33bfaa990449477516dfe20e18e91a7aed90bb12e7b2d8e9a4be7ef1f6aaf1065fcb50789

Download Submit
/data/data/com.broughtbluea/kl.txt

Filesize
63B

MD5
c3f96b6f2bbe67765b167816f7572391

SHA1
8678fe196d080b9249d0399d081da23a43f2a312

SHA256
70cbaf97dc3a5236dbdf8ae43397d65e991264619d009d69f4b64dbdf750ba46

SHA512
587d170d78a0b3a926f3fd2f68b3e5bf1bc8665df7a9d847fb97db4e1430336dbddcab5bfdd88e1b87564ecc222b695282a80328e6add7c0e0bfd7bed7e4ef53

Download Submit
/data/data/com.broughtbluea/kl.txt

Filesize
423B

MD5
53e513a9343b1c8b9908bb002b73ce39

SHA1
75072f9c04c535f017cba14e7e2e9bff3af5af58

SHA256
64185bf9f8c73ea6438125f6b942165da9a5c1af6bd0648642d5c3a68838f48d

SHA512
10307d8bb3784eed3937ce12477e0970c9bb111af68fe4bce0c82ff856a7e8a450a443ad5065b0ae9d42a88f91ef27170021a43ca712349717575d6cab2fdb75

Download Submit
/data/user/0/com.broughtbluea/cache/pxcpq

Filesize
449KB

MD5
fb15ea8794c6547c5ca8f58577e433a6

SHA1
47c530ac1858cbc7584429190a07c3c4313857ac

SHA256
908588c8de2b52b69f30917583d91ac67f96c7682c017df3943d3979c9fc6095

SHA512
9cb724a385917e949052b84be546cd61a952474ee8671743034463b356de4c5bc60732b07287c326da65c4cced7f8c8247b348bbb5abb436c86fedbcb4da90c9

Download Submit
/data/user/0/com.broughtbluea/cache/pxcpq

Filesize
449KB

MD5
fb15ea8794c6547c5ca8f58577e433a6

SHA1
47c530ac1858cbc7584429190a07c3c4313857ac

SHA256
908588c8de2b52b69f30917583d91ac67f96c7682c017df3943d3979c9fc6095

SHA512
9cb724a385917e949052b84be546cd61a952474ee8671743034463b356de4c5bc60732b07287c326da65c4cced7f8c8247b348bbb5abb436c86fedbcb4da90c9

Download Submit