Overview

overview

10

Static

static

6

77eee0b721...f2.apk

android-9-x86

10

77eee0b721...f2.apk

android-10-x64

10

Analysis

  • max time kernel
    2285303s
  • max time network
    145s
  • platform
    android_x64
  • resource
    android-x64-20231215-en
  • resource tags

    androidarch:x64arch:x86image:android-x64-20231215-enlocale:en-usos:android-10-x64system
  • submitted
    20/12/2023, 01:17

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    77eee0b72181592e7f06b469224fa01e7fe344756badf68b648b1a637c23e3f2.apk
  • Size 531KB
  • Sample231220-bnq1maeabl
  • SHA256 77eee0b72181592e7f06b469224fa01e7fe344756badf68b648b1a637c23e3f2
  • MD5 SHA1 SHA512 SSDEEP
Score
10/10
octobankerinfostealerrattrojan

Malware Config

Extracted

Family

  • octo

C2

  • https://varibou.top/ZmEwY2ZmZWYzN2Mw/

  • https://zeqexyu.shop/ZmEwY2ZmZWYzN2Mw/

  • https://varibovaribo.top/ZmEwY2ZmZWYzN2Mw/

  • https://varibovarib.top/ZmEwY2ZmZWYzN2Mw/

  • https://varibovavaribova.top/ZmEwY2ZmZWYzN2Mw/

  • https://botbokhj.top/ZmEwY2ZmZWYzN2Mw/

  • https://borklfofj.top/ZmEwY2ZmZWYzN2Mw/

  • https://rugypie.shop/ZmEwY2ZmZWYzN2Mw/

  • https://rugypie.top/ZmEwY2ZmZWYzN2Mw/

  • https://xoboxii.top/ZmEwY2ZmZWYzN2Mw/

  • https://xoboxii.shop/ZmEwY2ZmZWYzN2Mw/

  • https://pokolobnvdos.site/ZmEwY2ZmZWYzN2Mw/

  • https://abas34hkipolot.top/ZmEwY2ZmZWYzN2Mw/

  • https://golovnka33.top/ZmEwY2ZmZWYzN2Mw/

AES_key

Signatures

  • Octo

    Octo is a banking malware with remote access capabilities first seen in April 2022.

    bankertrojaninfostealerratocto
  • Octo payload 1 IoCs
  • Makes use of the framework's Accessibility service 1 IoCs

    Retrieves information displayed on the phone screen using AccessibilityService.

  • Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 IoCs
    banker
  • Loads dropped Dex/Jar 2 IoCs

    Runs executable file dropped to the device during analysis.

  • Acquires the wake lock 1 IoCs
  • Reads information about phone network operator.
  • Uses Crypto APIs (Might try to encrypt user data) 1 IoCs

Processes

  • com.wondermen44
    1⤵
    • Makes use of the framework's Accessibility service
    • Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps)
    • Loads dropped Dex/Jar
    • Acquires the wake lock
    • Uses Crypto APIs (Might try to encrypt user data)
    PID:5109

Network

        MITRE ATT&CK Matrix

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        cjvazslvnqck
        • Path /data/data/com.wondermen44/cache/cjvazslvnqck
        • Size 445KB
        • SHA256 e7fc8ffedf7880175bde611cf6fda68f7da1c9cd204b484fb4228626a94a0797
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        cjvazslvnqck.cur.prof
        • Path /data/data/com.wondermen44/cache/oat/cjvazslvnqck.cur.prof
        • Size 504B
        • SHA256 6353aadbf990a8667fdaf9c37ea57d84e8a0a8a82179098508fdcc498cf7aab2
        • MD5 SHA1 SHA512
        Submit Download

        kl.txt
        • Path /data/data/com.wondermen44/kl.txt
        • Size 28B
        • SHA256 8b82f6032e29a2b5c96031a3630fb6173d12ff0295bc20bb21b877d08f0812d8
        • MD5 SHA1 SHA512
        Submit Download

        kl.txt
        • Path /data/data/com.wondermen44/kl.txt
        • Size 69B
        • SHA256 9cbd485fab02adb55a9e51fe6e25affddf139f1bfb0702b444c7d7fa8363bc5a
        • MD5 SHA1 SHA512
        Submit Download

        kl.txt
        • Path /data/data/com.wondermen44/kl.txt
        • Size 235B
        • SHA256 ae7e0ce50382f5ec05ac247f189f5024f9b1972e7a1fbd0b6108210d1014f5a5
        • MD5 SHA1 SHA512
        Submit Download

        kl.txt
        • Path /data/data/com.wondermen44/kl.txt
        • Size 59B
        • SHA256 56e0ef4ec5baf611d50f5f7459103e67d2f89280c64a8823b988d286b63fd933
        • MD5 SHA1 SHA512
        Submit Download

        kl.txt
        • Path /data/data/com.wondermen44/kl.txt
        • Size 68B
        • SHA256 a95332d38e5f8e07dae5588e5c9396a891e74ae8659f9b3bfea89e393faf33ef
        • MD5 SHA1 SHA512
        Submit Download