octo | faa05a68cc2a8eaafd950a8e6a7c234f70bf32a2e28245e95c279615e3765253

Analysis

max time kernel
3080504s
max time network
157s
platform
android_x64
resource
android-x64-20231215-en
resource tags

androidarch:x64arch:x86image:android-x64-20231215-enlocale:en-usos:android-10-x64system
submitted
29/12/2023, 22:01

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

faa05a68cc2a8eaafd950a8e6a7c234f70bf32a2e28245e95c279615e3765253.apk
Size

509KB
MD5

b39172807cae90a642f98e47195aac8f
SHA1

c369a04dd613d66abb2524a9b2b54cb48890cd15
SHA256

faa05a68cc2a8eaafd950a8e6a7c234f70bf32a2e28245e95c279615e3765253
SHA512

93bd1178196a4683da36a0ba315c413358789d5f49fab0265eaef36e6ff76e93cb7d1134170a19c7988604378a94a7e5bd54b3da752cf91b8fbcd557103ca6d0
SSDEEP

12288:ZN4CKrvtLQNlj1iWaayx3LEu4BQJoseOmSFM8ns2anM:ZyrvtGj1ieu3o2JBeOmNrnM

Score

10^/10

octo banker infostealer rat trojan

Malware Config

Extracted

Family

octo

https://185.196.9.197/MTQ4MmUxODBhMTVi/

https://xxxpakunatationclass.net/MTQ4MmUxODBhMTVi/

https://xxxpakunatationclass2.net/MTQ4MmUxODBhMTVi/

https://xxxpakunatationclass3.net/MTQ4MmUxODBhMTVi/

https://xxxpakunatationclass4.net/MTQ4MmUxODBhMTVi/

https://xxxpakunatationclass5.net/MTQ4MmUxODBhMTVi/

https://xxxpakunatationclass6.net/MTQ4MmUxODBhMTVi/

AES_key

Signatures

Octo
Octo is a banking malware with remote access capabilities first seen in April 2022.
banker trojan infostealer rat octo

Octo payload 1 IoCs

resource	yara_rule
behavioral2/files/fstream-1.dat	family_octo

Makes use of the framework's Accessibility service 2 IoCs

Retrieves information displayed on the phone screen using AccessibilityService.

description	ioc	Process
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId	com.alsoknewulr
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByViewId	com.alsoknewulr

Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 IoCs

banker

description	ioc	Process
Framework service call	android.content.pm.IPackageManager.getInstalledApplications	com.alsoknewulr

Loads dropped Dex/Jar 2 IoCs

Runs executable file dropped to the device during analysis.

ioc	pid	Process
/data/user/0/com.alsoknewulr/cache/hyplatvcwuvnum	4961	com.alsoknewulr
/data/user/0/com.alsoknewulr/cache/hyplatvcwuvnum	4961	com.alsoknewulr

Acquires the wake lock 1 IoCs

description	ioc	Process
Framework service call	android.os.IPowerManager.acquireWakeLock	com.alsoknewulr

Reads information about phone network operator.

Uses Crypto APIs (Might try to encrypt user data) 1 IoCs

description	ioc	Process
Framework API call	javax.crypto.Cipher.doFinal	com.alsoknewulr

com.alsoknewulr
1⤵
- Makes use of the framework's Accessibility service
- Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps)
- Loads dropped Dex/Jar
- Acquires the wake lock
- Uses Crypto APIs (Might try to encrypt user data)
PID:4961

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

/data/data/com.alsoknewulr/cache/hyplatvcwuvnum

Filesize
449KB

MD5
b7232678a05e3fd7237bf58f5b7143a7

SHA1
d862ccd7a3ca7a4d12a8bc247a34030226e2c36f

SHA256
95d972051bf32967f5d7e96f43519b053db87e9e84c0f078329adab2a0f6a131

SHA512
5c3d042a06b218609213aa684143689714c8b161c8de53b19f8d7379064ba70e8ec5ed76554dc7bc70b669b3d639d016ca157f13c46aa637465214958491b69a

Download Submit
/data/data/com.alsoknewulr/cache/oat/hyplatvcwuvnum.cur.prof

Filesize
488B

MD5
eb754a9f07232e0d5f4bfb6e8170475b

SHA1
a4db0c23eaf93a21e4fbefec24db5bb1b5ddcd14

SHA256
07823280fe89dba52e2d7243a436794a7715f93196f3af5d81b9cc26dc218194

SHA512
f8cca17e65fb3edafd3048a7e9eb210089e5b1d0075770cf37775fcc01a16d434cfca0d59c75f1aeb82d078e4742b6dec01c379376b5c0f69d8dd60bf33f45fb

Download Submit
/data/data/com.alsoknewulr/kl.txt

Filesize
28B

MD5
6311c3fd15588bb5c126e6c28ff5fffe

SHA1
ce81d136fce31779f4dd62e20bdaf99c91e2fc57

SHA256
8b82f6032e29a2b5c96031a3630fb6173d12ff0295bc20bb21b877d08f0812d8

SHA512
2975fe2e94b6a8adc9cfc1a865ad113772b54572883a537b02a16dd2d029c0f7d9cca3b154fd849bdfe978e18b396bcf9fa6e67e7c61f92bdc089a29a9c355c6

Download Submit
/data/data/com.alsoknewulr/kl.txt

Filesize
230B

MD5
622a07b29f1256e0be6ebd61f22f3773

SHA1
2a6287a8856f43ea8bce2ee9cd9454d0a3edd0b7

SHA256
26c0049c343a557ea9bef073ed15f4a620bb40a34f9da7a02eed1158cd658178

SHA512
992862341ca6c54bb896ae02bca4e6f99b15d8a10f0a71355df6da79f9aaaeff600b708fad43bdc801b7cd0d8dd4fd3ee501e58ee6fdf87e00fbf72d94df2868

Download Submit
/data/data/com.alsoknewulr/kl.txt

Filesize
45B

MD5
c9c2d83b790d293eddc52ed61cf01fda

SHA1
1d50ecfe7dfb760e4981e16df020ae49c5ccaa8c

SHA256
acebd961086cbd12c6d8f69c65c0278a1a63898c36111e2ce4c01b7ff4b0d1a3

SHA512
ed6d2a4e83235fa9d2a66ab736a3236f19769875792b16dda3100295b18b9e49176cda743a8e4bbe6019286d498909db330bb51f929484ee2e4a76e44e982562

Download Submit
/data/data/com.alsoknewulr/kl.txt

Filesize
63B

MD5
87cfd727a82052ff91ccf0277abcee03

SHA1
2ed4dd7f634387dac58a427022f77cb538a6319c

SHA256
93db5b90ed315ffe73ad554bf2a1a093000874da553078f7033d1f3c3d2940a6

SHA512
547a05213f0d2d4dd2fb066a9c22074aa5019a54e48ba11f5b9f531c9f615ad7a4c7e44b62fefafa5b58b8387ae1cd3a0a4a7e20c2677087c4fd5b62f03b7e72

Download Submit
/data/data/com.alsoknewulr/kl.txt

Filesize
60B

MD5
16028e545310f39abb64210622affe10

SHA1
59d0d0a80e84e65be33baafc5dbb67814e51c66f

SHA256
6e5c7f49c1897513bff40192f93e30ea47fa74cc0a8be207c928285642f62e5d

SHA512
5496cf437a458b4e1e69bf358cd37379e8f7d57604be6f726dc22afe924f9ae51eea6708e546813ca46f233008eaa2c18b17cc2b55033b2ff3cc44a0547975cc

Download Submit