octo | b38019f9e80c2166a4e09eed0cd15bad651263f0ff3ea26199a08896ffd8e1fc

Resubmissions

05-08-2024 12:08

240805-pa55aavhjp 10

02-08-2024 15:48

03-01-2024 17:25

24-12-2023 19:17

14-12-2023 08:27

03-11-2023 03:07

01-11-2023 22:00

Analysis

max time kernel
1735869s
max time network
306s
platform
android_x86
resource
android-x86-arm-20231211-en
resource tags

androidarch:armarch:x86image:android-x86-arm-20231211-enlocale:en-usos:android-9-x86system
submitted
14-12-2023 08:27

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

b38019f9e80c2166a4e09eed0cd15bad651263f0ff3ea26199a08896ffd8e1fc.apk
Size

509KB
MD5

60609814e43a1c814b30435f15d361ed
SHA1

61431ed485c98b8a291e289a7e17e8d3e6db3660
SHA256

b38019f9e80c2166a4e09eed0cd15bad651263f0ff3ea26199a08896ffd8e1fc
SHA512

8efba5603fd4217b9c9c96e28a69f9f262568f76d43fd959d6914694808488f089f01fa92e2d04f44d5aa0859efcfb34fb080dc7b3a49502469598ab90a662fe
SSDEEP

12288:KwGWfjEhy4pNodk6TZFo9nheT5BQ4YvnAu:KnWf0y4GNIsmRvnAu

Score

10^/10

octo banker evasion infostealer rat stealth trojan

Malware Config

Extracted

Family

octo

https://84.54.50.100/Njk4Zjk4YjdjODY3/

https://pakuxxxnatationclass.net/Njk4Zjk4YjdjODY3/

https://pakuxxxnatationclass2.net/Njk4Zjk4YjdjODY3/

https://pakuxxxnatationclass3.net/Njk4Zjk4YjdjODY3/

https://pakuxxxnatationclass4.net/Njk4Zjk4YjdjODY3/

https://pakuxxxnatationclass5.net/Njk4Zjk4YjdjODY3/

https://pakuxxxnatationclass6.net/Njk4Zjk4YjdjODY3/

AES_key

Signatures

Octo
Octo is a banking malware with remote access capabilities first seen in April 2022.
banker trojan infostealer rat octo

Octo payload 1 IoCs

Processes:

resource	yara_rule
/data/data/com.broughtbluea/cache/pxcpq	family_octo

Makes use of the framework's Accessibility service 2 IoCs

Retrieves information displayed on the phone screen using AccessibilityService.

Processes:

com.broughtbluea

description	ioc	process
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId	com.broughtbluea
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByViewId	com.broughtbluea

Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 IoCs
banker

Processes:

com.broughtbluea

description ioc process

Framework service call android.content.pm.IPackageManager.getInstalledApplications com.broughtbluea
Removes its main activity from the application launcher 1 IoCs
stealth trojan

Processes:

com.broughtbluea

pid process

4484 com.broughtbluea
Loads dropped Dex/Jar 2 IoCs
Runs executable file dropped to the device during analysis.

Processes:

com.broughtbluea

ioc pid process

/data/user/0/com.broughtbluea/cache/pxcpq 4484 com.broughtbluea
/data/user/0/com.broughtbluea/cache/pxcpq 4484 com.broughtbluea
Acquires the wake lock 1 IoCs

Processes:

com.broughtbluea

description ioc process

Framework service call android.os.IPowerManager.acquireWakeLock com.broughtbluea
Reads information about phone network operator.
Requests disabling of battery optimizations (often used to enable hiding in the background). 1 IoCs
evasion

Processes:

com.broughtbluea

description ioc process

Intent action android.settings.REQUEST_IGNORE_BATTERY_OPTIMIZATIONS com.broughtbluea
Uses Crypto APIs (Might try to encrypt user data) 1 IoCs

Processes:

com.broughtbluea

description ioc process

Framework API call javax.crypto.Cipher.doFinal com.broughtbluea

description	ioc	process
Framework service call	android.content.pm.IPackageManager.getInstalledApplications	com.broughtbluea

pid	process
4484	com.broughtbluea

ioc	pid	process
/data/user/0/com.broughtbluea/cache/pxcpq	4484	com.broughtbluea
/data/user/0/com.broughtbluea/cache/pxcpq	4484	com.broughtbluea

description	ioc	process
Framework service call	android.os.IPowerManager.acquireWakeLock	com.broughtbluea

description	ioc	process
Intent action	android.settings.REQUEST_IGNORE_BATTERY_OPTIMIZATIONS	com.broughtbluea

description	ioc	process
Framework API call	javax.crypto.Cipher.doFinal	com.broughtbluea

com.broughtbluea
1⤵
- Makes use of the framework's Accessibility service
- Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps)
- Removes its main activity from the application launcher
- Loads dropped Dex/Jar
- Acquires the wake lock
- Requests disabling of battery optimizations (often used to enable hiding in the background).
- Uses Crypto APIs (Might try to encrypt user data)
PID:4484

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

/data/data/com.broughtbluea/cache/oat/pxcpq.cur.prof

Filesize
441B

MD5
f5086b4661441f7381bb000fe2fa9e25

SHA1
9a917db374b0613709c51bc2f879c913f36db88e

SHA256
1d7b5c2205f0779f79d47f2ff85a0def161d288979c563f78369f6eb338bb760

SHA512
2fe243d5e42c1f2f319cb512c28a133e2584347ccc164577c960a55b1c8b53ab0b69b9afdcba91ee41b8c7adb7036bfe78055a91d5390708def4ac6ddcee0c7c

Download Submit
/data/data/com.broughtbluea/cache/oat/pxcpq.cur.prof

Filesize
522B

MD5
7db15c1cc8700ad41f480f8486730e3a

SHA1
312e97dd00abca3b471ac4b4df9ee51718275a60

SHA256
388395885adc5cb1bad2857a0a33359c18501edcf453339d7d0875d4fb516e8b

SHA512
3301c8434681239bd7bf6cf4f814a0f28377b31f8d892bed2bb7707514f14a120ceb316a010556f99f57406fd16c25ab6b3274271c4411e26b285a98449490ed

Download Submit
/data/data/com.broughtbluea/cache/pxcpq

Filesize
449KB

MD5
fb15ea8794c6547c5ca8f58577e433a6

SHA1
47c530ac1858cbc7584429190a07c3c4313857ac

SHA256
908588c8de2b52b69f30917583d91ac67f96c7682c017df3943d3979c9fc6095

SHA512
9cb724a385917e949052b84be546cd61a952474ee8671743034463b356de4c5bc60732b07287c326da65c4cced7f8c8247b348bbb5abb436c86fedbcb4da90c9

Download Submit
/data/data/com.broughtbluea/kl.txt

Filesize
28B

MD5
6311c3fd15588bb5c126e6c28ff5fffe

SHA1
ce81d136fce31779f4dd62e20bdaf99c91e2fc57

SHA256
8b82f6032e29a2b5c96031a3630fb6173d12ff0295bc20bb21b877d08f0812d8

SHA512
2975fe2e94b6a8adc9cfc1a865ad113772b54572883a537b02a16dd2d029c0f7d9cca3b154fd849bdfe978e18b396bcf9fa6e67e7c61f92bdc089a29a9c355c6

Download Submit
/data/data/com.broughtbluea/kl.txt

Filesize
230B

MD5
ca5b53a29fb63d49cc5f72fe5f7ed936

SHA1
9824274da22e4333e085cfb82c6a0088b56a200a

SHA256
2a822311cbe2d104c3990dc4181e0cea4158a7accd1adc565db3efec35041005

SHA512
15fc9ac256cbf3da60be6cd68c10c5c1f8c827b959beb177895b83082585529a05da0acfb64ea443b6f85b65ed19dbcefad224c3a407514e748cdc11d3f02633

Download Submit
/data/data/com.broughtbluea/kl.txt

Filesize
63B

MD5
91b90368d3fc4c40bb1ce122637b7e15

SHA1
ea5f2767c6b13ce6a5a3041443dbcebf2d321d0c

SHA256
ad24d0b7919da871adf7f800fcbfa50a5608e42b2fa08fb1a82de8eaa9105ade

SHA512
31c7687eb6abbffe345f7a59fbdca764e791f640174343fde6155c04616150113fff974d1c0f47d915d5bf82424516390eebe9614e0c696f5d43c9c9e2a40099

Download Submit
/data/data/com.broughtbluea/kl.txt

Filesize
54B

MD5
c02ef369483c5aa93fecd3dc5e08ef58

SHA1
6c87e9da559daa9870369b3ed6f64cf98d3484d8

SHA256
fe86665c77a99fd59c1f9821eabe653c18a98b33b03f2e36068dce3cbf5dea3e

SHA512
2c9c2babe5128f14ac7aaca3b74722938c00fe35c8c92f62d001162de5577e3bbb84197ff040b7113649eb37109105d9cfe65cc624a398fbf8e61d3f8deff004

Download Submit
/data/data/com.broughtbluea/kl.txt

Filesize
63B

MD5
06e7616e38e8ec31409f37e95f4eea29

SHA1
dec06b8d2c039ca18f063c26fd31fa58e07651fd

SHA256
a2b547f14568e7a51bf43f332db9c2f9ea7c04196576fdf4c349c66dcd343d4a

SHA512
c7c94a6bc69194f2d8887baafba99a1af092f8ecc4e62b6141d276c4567c630caef1e3b7926004e2b28207e2187cb81bc9a7a9abe0a3ba30576fbab43cc6c37d

Download Submit