Overview

overview

10

Static

static

6

7699d62108...03.apk

android-9-x86

10

7699d62108...03.apk

android-13-x64

10

Analysis

  • max time kernel
    2322202s
  • max time network
    160s
  • platform
    android_x64
  • resource
    android-33-x64-arm64-20231215-en
  • resource tags

    androidarch:arm64arch:x64image:android-33-x64-arm64-20231215-enlocale:en-usos:android-13-x64system
  • submitted
    20/12/2023, 00:55

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    7699d62108bc9ae1ccae8dbf1a81325111758a7c65304df5bcd62da78b1f0a03.apk
  • Size 531KB
  • Sample231220-a91aragbg3
  • SHA256 7699d62108bc9ae1ccae8dbf1a81325111758a7c65304df5bcd62da78b1f0a03
  • MD5 SHA1 SHA512 SSDEEP
Score
10/10
octobankerevasioninfostealerrattrojan

Malware Config

Extracted

Family

  • octo

C2

  • https://vntososupplsos.live/ZmEwY2ZmZWYzN2Mw/

  • https://olopokogulya.site/ZmEwY2ZmZWYzN2Mw/

  • https://nbvb3954.fun/ZmEwY2ZmZWYzN2Mw/

  • https://nbvvvb.hair/ZmEwY2ZmZWYzN2Mw/

  • https://nbvbbn.lol/ZmEwY2ZmZWYzN2Mw/

  • https://nbvber.makeup/ZmEwY2ZmZWYzN2Mw/

  • https://nbvbsd.mom/ZmEwY2ZmZWYzN2Mw/

  • https://nbvbwe.monster/ZmEwY2ZmZWYzN2Mw/

  • https://nbvb.one/ZmEwY2ZmZWYzN2Mw/

  • https://vbnbvb.online/ZmEwY2ZmZWYzN2Mw/

  • https://ccnbvb.pics/ZmEwY2ZmZWYzN2Mw/

  • https://xxnbvb.quest/ZmEwY2ZmZWYzN2Mw/

  • https://eenbvb.sbs/ZmEwY2ZmZWYzN2Mw/

  • https://asqwnbvb.shop/ZmEwY2ZmZWYzN2Mw/

  • https://qwnbvb.skin/ZmEwY2ZmZWYzN2Mw/

  • https://qqnbvb.space/ZmEwY2ZmZWYzN2Mw/

  • https://wwerenbvb.store/ZmEwY2ZmZWYzN2Mw/

AES_key

Signatures

  • Octo

    Octo is a banking malware with remote access capabilities first seen in April 2022.

    bankertrojaninfostealerratocto
  • Octo payload 1 IoCs
  • Makes use of the framework's Accessibility service 1 IoCs

    Retrieves information displayed on the phone screen using AccessibilityService.

  • Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 IoCs
    banker
  • Loads dropped Dex/Jar 1 IoCs

    Runs executable file dropped to the device during analysis.

  • Acquires the wake lock 1 IoCs
  • Reads information about phone network operator.
  • Requests disabling of battery optimizations (often used to enable hiding in the background). 1 IoCs
    evasion
  • Uses Crypto APIs (Might try to encrypt user data) 1 IoCs

Processes

  • com.maytensu
    1⤵
    • Makes use of the framework's Accessibility service
    • Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps)
    • Loads dropped Dex/Jar
    • Acquires the wake lock
    • Requests disabling of battery optimizations (often used to enable hiding in the background).
    • Uses Crypto APIs (Might try to encrypt user data)
    PID:4226

Network

        MITRE ATT&CK Matrix

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        wuguwajx.cur.prof
        • Path /data/user/0/com.maytensu/cache/oat/wuguwajx.cur.prof
        • Size 364B
        • SHA256 cd45d999794c421fbb98d58545bdb3a46908c3c5d2bcbf5d3af493db6d49d877
        • MD5 SHA1 SHA512
        Submit Download

        wuguwajx
        • Path /data/user/0/com.maytensu/cache/wuguwajx
        • Size 444KB
        • SHA256 9d6cf81ba5e9daae4ad13c6c6ceaad69a3055a57e872d1977054b2b5d2dd121f
        • MD5 SHA1 SHA512 SSDEEP
        Download

        kl.txt
        • Path /data/user/0/com.maytensu/kl.txt
        • Size 28B
        • SHA256 8b82f6032e29a2b5c96031a3630fb6173d12ff0295bc20bb21b877d08f0812d8
        • MD5 SHA1 SHA512
        Submit Download

        kl.txt
        • Path /data/user/0/com.maytensu/kl.txt
        • Size 64B
        • SHA256 2bddfa4891b35d4077c7d30a14c0b1c8554a180619049501d49e7fdcf0de01ea
        • MD5 SHA1 SHA512
        Submit Download

        kl.txt
        • Path /data/user/0/com.maytensu/kl.txt
        • Size 214B
        • SHA256 a02e878d740d50b65aebf0c0408a4a8a371cea0559892d4cfc349376cecf41db
        • MD5 SHA1 SHA512
        Submit Download

        kl.txt
        • Path /data/user/0/com.maytensu/kl.txt
        • Size 53B
        • SHA256 d47167094266bb7e29f493c089c028e5f1fbd7be4575c2d6875303c03c7b95ca
        • MD5 SHA1 SHA512
        Submit Download

        kl.txt
        • Path /data/user/0/com.maytensu/kl.txt
        • Size 219B
        • SHA256 2bd65457ce78d5b7bcf9a7f6c2be8e5ed04a4d160eb8810e7c31bd7230ec57af
        • MD5 SHA1 SHA512
        Submit Download