Overview

overview

10

Static

static

6

b38019f9e8...fc.apk

android-10-x64

10

b38019f9e8...fc.apk

android-11-x64

10

b38019f9e8...fc.apk

android-13-x64

10

b38019f9e8...fc.apk

android-9-x86

10

Resubmissions

05-08-2024 12:08

240805-pa55aavhjp 10

02-08-2024 15:48

240802-s893nszfkj 10

03-01-2024 17:25

240103-vzshdabae6 10

24-12-2023 19:17

231224-xznwasbhh7 6

14-12-2023 08:27

231214-kclffacdhn 10

03-11-2023 03:07

231103-dmbwesbb4s 10

01-11-2023 22:00

231101-1wx7cadf5y 10

Analysis

  • max time kernel
    1735872s
  • max time network
    309s
  • platform
    android_x64
  • resource
    android-33-x64-arm64-20231211.1-en
  • resource tags

    androidarch:arm64arch:x64image:android-33-x64-arm64-20231211.1-enlocale:en-usos:android-13-x64system
  • submitted
    14-12-2023 08:27

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    b38019f9e80c2166a4e09eed0cd15bad651263f0ff3ea26199a08896ffd8e1fc.apk

  • Size

    509KB

  • MD5

    60609814e43a1c814b30435f15d361ed

  • SHA1

    61431ed485c98b8a291e289a7e17e8d3e6db3660

  • SHA256

    b38019f9e80c2166a4e09eed0cd15bad651263f0ff3ea26199a08896ffd8e1fc

  • SHA512

    8efba5603fd4217b9c9c96e28a69f9f262568f76d43fd959d6914694808488f089f01fa92e2d04f44d5aa0859efcfb34fb080dc7b3a49502469598ab90a662fe

  • SSDEEP

    12288:KwGWfjEhy4pNodk6TZFo9nheT5BQ4YvnAu:KnWf0y4GNIsmRvnAu

Score
10/10
octobankerevasioninfostealerrattrojan

Malware Config

Extracted

Family

octo

C2

https://84.54.50.100/Njk4Zjk4YjdjODY3/

https://pakuxxxnatationclass.net/Njk4Zjk4YjdjODY3/

https://pakuxxxnatationclass2.net/Njk4Zjk4YjdjODY3/

https://pakuxxxnatationclass3.net/Njk4Zjk4YjdjODY3/

https://pakuxxxnatationclass4.net/Njk4Zjk4YjdjODY3/

https://pakuxxxnatationclass5.net/Njk4Zjk4YjdjODY3/

https://pakuxxxnatationclass6.net/Njk4Zjk4YjdjODY3/
AES_key

Signatures

  • Octo

    Octo is a banking malware with remote access capabilities first seen in April 2022.

    bankertrojaninfostealerratocto
  • Octo payload 1 IoCs
  • Makes use of the framework's Accessibility service 2 IoCs

    Retrieves information displayed on the phone screen using AccessibilityService.

  • Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 IoCs
    banker
  • Loads dropped Dex/Jar 1 IoCs

    Runs executable file dropped to the device during analysis.

  • Acquires the wake lock 1 IoCs
  • Reads information about phone network operator.
  • Requests disabling of battery optimizations (often used to enable hiding in the background). 1 IoCs
    evasion
  • Uses Crypto APIs (Might try to encrypt user data) 1 IoCs

Processes

  • com.broughtbluea
    1⤵
    • Makes use of the framework's Accessibility service
    • Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps)
    • Loads dropped Dex/Jar
    • Acquires the wake lock
    • Requests disabling of battery optimizations (often used to enable hiding in the background).
    • Uses Crypto APIs (Might try to encrypt user data)
    PID:4333

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • /data/user/0/com.broughtbluea/cache/oat/pxcpq.cur.prof
    Filesize

    379B

    MD5

    45ca9b73929afd98463b42c6895f95d2

    SHA1

    2a370fe1ea33ff9f02ac69bd631ed68d6abb8893

    SHA256

    b18cbbd3949ed3bd96e252c181e945948b5af5dcccae30888dcd59173f3df85e

    SHA512

    04cc742a42623f397bcff8ce305e3fce0de678b9dcacf85611d4da51d3d5e2edd0a6d6c9170f659cc34203998204f3b7b7d4de716fde6afbdf1c8f269ee7fd32

    Download Submit

  • /data/user/0/com.broughtbluea/cache/pxcpq
    Filesize

    449KB

    MD5

    fb15ea8794c6547c5ca8f58577e433a6

    SHA1

    47c530ac1858cbc7584429190a07c3c4313857ac

    SHA256

    908588c8de2b52b69f30917583d91ac67f96c7682c017df3943d3979c9fc6095

    SHA512

    9cb724a385917e949052b84be546cd61a952474ee8671743034463b356de4c5bc60732b07287c326da65c4cced7f8c8247b348bbb5abb436c86fedbcb4da90c9

    Download Submit

  • /data/user/0/com.broughtbluea/kl.txt
    Filesize

    28B

    MD5

    6311c3fd15588bb5c126e6c28ff5fffe

    SHA1

    ce81d136fce31779f4dd62e20bdaf99c91e2fc57

    SHA256

    8b82f6032e29a2b5c96031a3630fb6173d12ff0295bc20bb21b877d08f0812d8

    SHA512

    2975fe2e94b6a8adc9cfc1a865ad113772b54572883a537b02a16dd2d029c0f7d9cca3b154fd849bdfe978e18b396bcf9fa6e67e7c61f92bdc089a29a9c355c6

    Download Submit

  • /data/user/0/com.broughtbluea/kl.txt
    Filesize

    214B

    MD5

    a618f12e014dc7e707bd38490ac19408

    SHA1

    f548c18a328fa43bb95733d2f20c9eb7552d4109

    SHA256

    950ffcef8871daf0eff95f54e8767a75b980fbde9a4da25bc7b2f517382f1c63

    SHA512

    33539bd0d18192d2f7c5970cb20c60d529db39baa1f343969672ea0bed5429deafbfce4f4ea9e281a4d9ce3c572910d017ac0a2e007b1255c7d78cd3057a6f44

    Download Submit

  • /data/user/0/com.broughtbluea/kl.txt
    Filesize

    54B

    MD5

    954a7a9f64f5fc946cbde2b09f16a4b3

    SHA1

    f816552dbf7f53445fa47c8e36dbdf6d8a97c8d5

    SHA256

    839f2801fb06820d4e99cb2a05f5c443e273549dbfd6103fb1f4df5f92682445

    SHA512

    66640ed6bbf828ce06954564213ec24cf3b1a6dad1144607adc453474b4ccc951374b2cd2f7237742d7d90b598b4a6de9910346839cd1e0d4b46aa5d318973ea

    Download Submit

  • /data/user/0/com.broughtbluea/kl.txt
    Filesize

    60B

    MD5

    b670792eb00b48033800709249a0f0bd

    SHA1

    708d3064daaf0f82194229b94d30f2e6d2e18f71

    SHA256

    247b16cfacf21b9fee2da49ad56c35935981e507c7b005dbea52026d1e70d95b

    SHA512

    a01b040bfb08c7ded1dbb8ecaa762a540ef100e0d4590942534127ef5aabae9e38e94c1e16fb00af5c76f113135b2ee86729064aaddb3b2c329c62135d8cf4ab

    Download Submit

  • /data/user/0/com.broughtbluea/kl.txt
    Filesize

    72B

    MD5

    905101f02aa08ceace9579746b3886a1

    SHA1

    5d32eaa5490fb3b56667a106b82eabdb758c95f2

    SHA256

    dc57625abf79d4e0fc9d468d67ec23421ae5edddb417b212e757e39136d5f920

    SHA512

    96c5f32bcc5a9e516c3863dac4f8de21f2f611701d09b6317a05c7bba4c1ea77d534878c63df2f99b6bbb86fe261f15a62cf6dc333977d36843ee25efa9bd509

    Download Submit