Overview

overview

10

Static

static

6

77509e714b...5a.apk

android-9-x86

10

77509e714b...5a.apk

android-10-x64

10

Analysis

  • max time kernel
    2282597s
  • max time network
    153s
  • platform
    android_x64
  • resource
    android-x64-20231215-en
  • resource tags

    androidarch:x64arch:x86image:android-x64-20231215-enlocale:en-usos:android-10-x64system
  • submitted
    20/12/2023, 01:05

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    77509e714b925cbd657145157246e995f80ac51d4582733497bb6c25f3bed75a.apk
  • Size 1.7MB
  • Sample231220-bfvnvadegk
  • SHA256 77509e714b925cbd657145157246e995f80ac51d4582733497bb6c25f3bed75a
  • MD5 SHA1 SHA512 SSDEEP
Score
10/10
octobankerinfostealerrattrojan

Malware Config

Extracted

Family

  • octo

C2

  • https://ssgsjhfsdfdsjhd.info/ZTYxYWI2NWNmYTA3/

  • https://dfdfdfdgdffjdhbf.org/ZTYxYWI2NWNmYTA3/

  • https://sdhfsdbfbjhsdhff.com/ZTYxYWI2NWNmYTA3/

  • https://dfhghfdewsfdffffdf.kozow.com/ZTYxYWI2NWNmYTA3/

AES_key

Signatures

  • Octo

    Octo is a banking malware with remote access capabilities first seen in April 2022.

    bankertrojaninfostealerratocto
  • Octo payload 1 IoCs
  • Makes use of the framework's Accessibility service 2 IoCs

    Retrieves information displayed on the phone screen using AccessibilityService.

  • Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 IoCs
    banker
  • Loads dropped Dex/Jar 2 IoCs

    Runs executable file dropped to the device during analysis.

  • Acquires the wake lock 1 IoCs
  • Reads information about phone network operator.
  • Uses Crypto APIs (Might try to encrypt user data) 1 IoCs

Processes

  • com.decidelovehxx
    1⤵
    • Makes use of the framework's Accessibility service
    • Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps)
    • Loads dropped Dex/Jar
    • Acquires the wake lock
    • Uses Crypto APIs (Might try to encrypt user data)
    PID:4911

Network

        MITRE ATT&CK Matrix

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        xilvvxgxemjb.cur.prof
        • Path /data/data/com.decidelovehxx/cache/oat/xilvvxgxemjb.cur.prof
        • Size 478B
        • SHA256 2e2a0a679255842d76ba66ed636b9d9205d9df492a9c1fab73aa60cc7760a6d1
        • MD5 SHA1 SHA512
        Submit Download

        xilvvxgxemjb
        • Path /data/data/com.decidelovehxx/cache/xilvvxgxemjb
        • Size 463KB
        • SHA256 b6491f185bf42bd45ac6acb6cfc128ba6c357c175bf19b53c3a675be76806640
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        kl.txt
        • Path /data/data/com.decidelovehxx/kl.txt
        • Size 28B
        • SHA256 8b82f6032e29a2b5c96031a3630fb6173d12ff0295bc20bb21b877d08f0812d8
        • MD5 SHA1 SHA512
        Submit Download

        kl.txt
        • Path /data/data/com.decidelovehxx/kl.txt
        • Size 69B
        • SHA256 bc4832907ae29c689b3cc95495c2cd5a048ae1398b0e8f82eba391de000967d4
        • MD5 SHA1 SHA512
        Submit Download

        kl.txt
        • Path /data/data/com.decidelovehxx/kl.txt
        • Size 256B
        • SHA256 5ae3e87c9684bc35b5e3c9e46032cddb30714301b631f5d652938a83971fa154
        • MD5 SHA1 SHA512
        Submit Download

        kl.txt
        • Path /data/data/com.decidelovehxx/kl.txt
        • Size 465B
        • SHA256 88410b1d4f90d031d6c18ee52a8520260f195025c534111f97bb2404479e6a2b
        • MD5 SHA1 SHA512
        Submit Download