octo | 7e20759f08abe65103dcddf59d637167090110392b532f1a8b9e874c018fa6c3

Analysis

max time kernel
2335465s
max time network
132s
platform
android_x64
resource
android-33-x64-arm64-20231215-en
resource tags

androidarch:arm64arch:x64image:android-33-x64-arm64-20231215-enlocale:en-usos:android-13-x64system
submitted
20/12/2023, 02:41

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

7e20759f08abe65103dcddf59d637167090110392b532f1a8b9e874c018fa6c3.apk
Size

1.7MB
MD5

f94fab5bee29dc65d9daa81e75b4ba8e
SHA1

45998a746fb3083b19f269b49d58c5e440c37b3e
SHA256

7e20759f08abe65103dcddf59d637167090110392b532f1a8b9e874c018fa6c3
SHA512

df15e500ba19aae8b40f1836e10cdb5d6801de66ffb694d8132c5f2ece0f255756bbb64f7c8601b8788a485a72f37e786f8e2b5e45ab2d215f6549f3cdbad7c1
SSDEEP

49152:FUORFg8AG9BFLCGMJpp89+hbgksVtKfgwusT:FUORFg0BgGKM91XQ

Score

10^/10

octo banker evasion infostealer rat trojan

Malware Config

Extracted

Family

octo

https://ashfjuiwef.top/MGUyNjIwZWNlYWYw/

https://efrgtjyrefqwg.top/MGUyNjIwZWNlYWYw/

https://ugidsnvewq.top/MGUyNjIwZWNlYWYw/

https://fvbhfjdkcaasf.top/MGUyNjIwZWNlYWYw/

https://vhjfhvbjvkcvfxz.top/MGUyNjIwZWNlYWYw/

AES_key

Signatures

Octo
Octo is a banking malware with remote access capabilities first seen in April 2022.
banker trojan infostealer rat octo

Octo payload 1 IoCs

resource	yara_rule
behavioral2/files/fstream-1.dat	family_octo

Makes use of the framework's Accessibility service 1 IoCs

Retrieves information displayed on the phone screen using AccessibilityService.

description	ioc	Process
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId	com.shortline9

Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 IoCs

banker

description	ioc	Process
Framework service call	android.content.pm.IPackageManager.getInstalledApplications	com.shortline9

Loads dropped Dex/Jar 1 IoCs

Runs executable file dropped to the device during analysis.

ioc	pid	Process
/data/user/0/com.shortline9/cache/ptkwaalhg	4192	com.shortline9

Acquires the wake lock 1 IoCs

description	ioc	Process
Framework service call	android.os.IPowerManager.acquireWakeLock	com.shortline9

Reads information about phone network operator.

Requests disabling of battery optimizations (often used to enable hiding in the background). 1 IoCs

evasion

description	ioc	Process
Intent action	android.settings.REQUEST_IGNORE_BATTERY_OPTIMIZATIONS	com.shortline9

Uses Crypto APIs (Might try to encrypt user data) 1 IoCs

description	ioc	Process
Framework API call	javax.crypto.Cipher.doFinal	com.shortline9

com.shortline9
1⤵
- Makes use of the framework's Accessibility service
- Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps)
- Loads dropped Dex/Jar
- Acquires the wake lock
- Requests disabling of battery optimizations (often used to enable hiding in the background).
- Uses Crypto APIs (Might try to encrypt user data)
PID:4192

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

/data/user/0/com.shortline9/cache/oat/ptkwaalhg.cur.prof

Filesize
364B

MD5
dfec26615151f5733cc95dd958030ae3

SHA1
bb01f00564a72890345ca5b066221ac159dd1c64

SHA256
b4b6301846445bedcf94d3ebd431dfd0e97f5f224daf432cef0fed73e6d5a598

SHA512
33da0765275afdb90eae2de5917a69829f59d13b4177d667162993729020c357d19ae99a9f420654fd7869dc6617a98bc0b12613f2a6cb157ea9ab5ea4f5535e

Download Submit
/data/user/0/com.shortline9/cache/ptkwaalhg

Filesize
464KB

MD5
e3e0ea846ab8c6b2880ff2f0e2695f58

SHA1
501d7cead4871c7d5f08a425b45c64c26266ac66

SHA256
bd08a06d2cf49b966e415029bec0a6fdd0a076e9ff9b454644a5c132b7f6124c

SHA512
a61b69556c00aa3dc97f82584bda86415b7f9cfcabb911c171c12c3464847b784bb00e5f997a70662c43f2e2a14bc6eb5b3cd1ce9fc412fec2ee6a6b11226682

Download Submit
/data/user/0/com.shortline9/kl.txt

Filesize
28B

MD5
6311c3fd15588bb5c126e6c28ff5fffe

SHA1
ce81d136fce31779f4dd62e20bdaf99c91e2fc57

SHA256
8b82f6032e29a2b5c96031a3630fb6173d12ff0295bc20bb21b877d08f0812d8

SHA512
2975fe2e94b6a8adc9cfc1a865ad113772b54572883a537b02a16dd2d029c0f7d9cca3b154fd849bdfe978e18b396bcf9fa6e67e7c61f92bdc089a29a9c355c6

Download Submit
/data/user/0/com.shortline9/kl.txt

Filesize
76B

MD5
58dbeba5915c3e750af5bfe6d59a1d15

SHA1
7375740e705ca89bf17a2992ece296e891bdd65a

SHA256
52f7aa077d275513f79e1a5fa17fcdf488e5e793232a9db48ed3ee04a17eb4c9

SHA512
6043990f774c3911525bcd9c30dc4ca57fbfaa54af9ab3768173b3e994a659acdc54fe27e25e12fb4d194ea418327f4417da6b0f6caf68115e90a4d8fb4aa5d2

Download Submit
/data/user/0/com.shortline9/kl.txt

Filesize
219B

MD5
e3dc57b891dd87475b379711e812247b

SHA1
8323c1dca9e34d313af17217d07958478384ce19

SHA256
37ec54b65d4c6b811e0f402c71a23ecf3bae12b2cbbc58f5ab63cde076c105f4

SHA512
1976e5af1186b9fd566f05d70b984eacf851b5eab76ba01ad01816b7612279827f773fb3b332ea5d03883166ea367c9968ca9db5e3826f0106b4e440f90d61cb

Download Submit
/data/user/0/com.shortline9/kl.txt

Filesize
59B

MD5
5457a26e295be64ffd88255913f7e3c7

SHA1
e11d58e4438f4974fd5e3647b83956b3a9ca0d5f

SHA256
3181177acc800132a5edd5c6fd8dec8790748aa5d8e7d9a5d7c8f2d1cad1788d

SHA512
630346957a9fcf60e8353a43f8f6daf3f0e43d15deef2cc1f06f1745f74ad1b7ea81ed8501b059bb90ce718a9580617be85943d1ff46fde3dba2de8e52cbff9d

Download Submit
/data/user/0/com.shortline9/kl.txt

Filesize
65B

MD5
550829d20b13b78d6b31b2ef78b10827

SHA1
91c3f615001c7e95a16d300f40f1ec30fa5c20da

SHA256
11883f5703c1c099000c5a3f0ad6d3fae0e2e9d5e17d817fd2e380269ef9f11b

SHA512
3d250212e542517fdf82ebf10f34a5dfdc157065246c064aadcb29f3bc27d93ec16e7e16478ae64f821648021860888940e2e37dceef8c203fc48a9eea3960d2

Download Submit