octo | b38019f9e80c2166a4e09eed0cd15bad651263f0ff3ea26199a08896ffd8e1fc

Resubmissions

05-08-2024 12:08

240805-pa55aavhjp 10

02-08-2024 15:48

03-01-2024 17:25

24-12-2023 19:17

14-12-2023 08:27

03-11-2023 03:07

01-11-2023 22:00

Analysis

max time kernel
1735818s
max time network
305s
platform
android_x64
resource
android-x64-20231211-en
resource tags

androidarch:x64arch:x86image:android-x64-20231211-enlocale:en-usos:android-10-x64system
submitted
14-12-2023 08:27

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

b38019f9e80c2166a4e09eed0cd15bad651263f0ff3ea26199a08896ffd8e1fc.apk
Size

509KB
MD5

60609814e43a1c814b30435f15d361ed
SHA1

61431ed485c98b8a291e289a7e17e8d3e6db3660
SHA256

b38019f9e80c2166a4e09eed0cd15bad651263f0ff3ea26199a08896ffd8e1fc
SHA512

8efba5603fd4217b9c9c96e28a69f9f262568f76d43fd959d6914694808488f089f01fa92e2d04f44d5aa0859efcfb34fb080dc7b3a49502469598ab90a662fe
SSDEEP

12288:KwGWfjEhy4pNodk6TZFo9nheT5BQ4YvnAu:KnWf0y4GNIsmRvnAu

Score

10^/10

octo banker infostealer rat trojan

Malware Config

Extracted

Family

octo

https://84.54.50.100/Njk4Zjk4YjdjODY3/

https://pakuxxxnatationclass.net/Njk4Zjk4YjdjODY3/

https://pakuxxxnatationclass2.net/Njk4Zjk4YjdjODY3/

https://pakuxxxnatationclass3.net/Njk4Zjk4YjdjODY3/

https://pakuxxxnatationclass4.net/Njk4Zjk4YjdjODY3/

https://pakuxxxnatationclass5.net/Njk4Zjk4YjdjODY3/

https://pakuxxxnatationclass6.net/Njk4Zjk4YjdjODY3/

AES_key

Signatures

Octo
Octo is a banking malware with remote access capabilities first seen in April 2022.
banker trojan infostealer rat octo

Octo payload 1 IoCs

Processes:

resource	yara_rule
behavioral1/files/fstream-1.dat	family_octo

Makes use of the framework's Accessibility service 2 IoCs

Retrieves information displayed on the phone screen using AccessibilityService.

Processes:

com.broughtbluea

description	ioc	Process
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId	com.broughtbluea
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByViewId	com.broughtbluea

Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 IoCs

banker

Processes:

com.broughtbluea

description	ioc	Process
Framework service call	android.content.pm.IPackageManager.getInstalledApplications	com.broughtbluea

Loads dropped Dex/Jar 2 IoCs

Runs executable file dropped to the device during analysis.

Processes:

com.broughtbluea

ioc	pid	Process
/data/user/0/com.broughtbluea/cache/pxcpq	5031	com.broughtbluea
/data/user/0/com.broughtbluea/cache/pxcpq	5031	com.broughtbluea

Acquires the wake lock 1 IoCs

Processes:

com.broughtbluea

description	ioc	Process
Framework service call	android.os.IPowerManager.acquireWakeLock	com.broughtbluea

Reads information about phone network operator.

Uses Crypto APIs (Might try to encrypt user data) 1 IoCs

Processes:

com.broughtbluea

description	ioc	Process
Framework API call	javax.crypto.Cipher.doFinal	com.broughtbluea

com.broughtbluea
1⤵
- Makes use of the framework's Accessibility service
- Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps)
- Loads dropped Dex/Jar
- Acquires the wake lock
- Uses Crypto APIs (Might try to encrypt user data)
PID:5031

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

/data/data/com.broughtbluea/cache/oat/pxcpq.cur.prof

Filesize
461B

MD5
f3b7adcc0d0b0b5b0cff351d21451d77

SHA1
57cebbca39275c84e70047bd09856185c1f64c77

SHA256
c10c460395a957c89913b1f283874f8ffe8c8ab708c14a27889deba0de617fc7

SHA512
849b133d8e906934cb5a32673a0396707c0118f0fd5154af85d6d68299328f4af377dfd92f83f0be8d3827a36c93d6fd05c6ab3c83c10e0935d9a757d757bc81

Download Submit
/data/data/com.broughtbluea/cache/pxcpq

Filesize
449KB

MD5
fb15ea8794c6547c5ca8f58577e433a6

SHA1
47c530ac1858cbc7584429190a07c3c4313857ac

SHA256
908588c8de2b52b69f30917583d91ac67f96c7682c017df3943d3979c9fc6095

SHA512
9cb724a385917e949052b84be546cd61a952474ee8671743034463b356de4c5bc60732b07287c326da65c4cced7f8c8247b348bbb5abb436c86fedbcb4da90c9

Download Submit
/data/data/com.broughtbluea/kl.txt

Filesize
28B

MD5
6311c3fd15588bb5c126e6c28ff5fffe

SHA1
ce81d136fce31779f4dd62e20bdaf99c91e2fc57

SHA256
8b82f6032e29a2b5c96031a3630fb6173d12ff0295bc20bb21b877d08f0812d8

SHA512
2975fe2e94b6a8adc9cfc1a865ad113772b54572883a537b02a16dd2d029c0f7d9cca3b154fd849bdfe978e18b396bcf9fa6e67e7c61f92bdc089a29a9c355c6

Download Submit
/data/data/com.broughtbluea/kl.txt

Filesize
63B

MD5
c7231439d42b2f765f565e9a61e36383

SHA1
382cc6cc1f1a0ab0279547c60663f0a6916f9999

SHA256
efba833a8ee0b8c19f4b2be164740de15c2ed00de103d99c402db481a2687125

SHA512
70db19121dcd8015d8462b547e7eba8a24ca8c98380f235b43d3383b027f7c15580249ed1142759e763f0651a78a1f88eb544bc67565717131c4f76dfe86c6e6

Download Submit
/data/data/com.broughtbluea/kl.txt

Filesize
45B

MD5
49a387ce4b4af809226478739da422c7

SHA1
66a2dadfcf88aa5a82cabdf850d7455c63856550

SHA256
46852aa210100c4d24659ed7d413c064df62b6df57603b05506cd0df583edff4

SHA512
b4be048a330827df8088e1a5542c323774e5352fd796c240e0f8a77ea1550d54c4171620dd404ed9129affe0740d307d688c05f16d1b2c6468d0b9d0e6dc58a9

Download Submit
/data/data/com.broughtbluea/kl.txt

Filesize
423B

MD5
3bbb2f651625428bd13abfd5b98ed588

SHA1
4200c402a142d0b1e714524836a2fe6edc59426a

SHA256
96880a5d654511c932429f7771aade62aae43cec5530e503dc5281df6b837398

SHA512
c6342df47f75a55772924d35eacc658bea29294f40dfad1bb8760eb51942bf1b2cc54e9b5a19293f0ea67ca9b58536a02fad8bb2736507795ef65664fdd88fa2

Download Submit