Overview

overview

10

Static

static

6

b38019f9e8...fc.apk

android-9-x86

10

b38019f9e8...fc.apk

android-11-x64

10

Resubmissions

05-08-2024 12:08

240805-pa55aavhjp 10

02-08-2024 15:48

240802-s893nszfkj 10

03-01-2024 17:25

240103-vzshdabae6 10

24-12-2023 19:17

231224-xznwasbhh7 6

14-12-2023 08:27

231214-kclffacdhn 10

03-11-2023 03:07

231103-dmbwesbb4s 10

01-11-2023 22:00

231101-1wx7cadf5y 10

Analysis

  • max time kernel
    3496063s
  • max time network
    307s
  • platform
    android_x64
  • resource
    android-x64-arm64-20231215-en
  • resource tags

    androidarch:armarch:arm64arch:x64arch:x86image:android-x64-arm64-20231215-enlocale:en-usos:android-11-x64system
  • submitted
    03-01-2024 17:25

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    b38019f9e80c2166a4e09eed0cd15bad651263f0ff3ea26199a08896ffd8e1fc.apk

  • Size

    509KB

  • MD5

    60609814e43a1c814b30435f15d361ed

  • SHA1

    61431ed485c98b8a291e289a7e17e8d3e6db3660

  • SHA256

    b38019f9e80c2166a4e09eed0cd15bad651263f0ff3ea26199a08896ffd8e1fc

  • SHA512

    8efba5603fd4217b9c9c96e28a69f9f262568f76d43fd959d6914694808488f089f01fa92e2d04f44d5aa0859efcfb34fb080dc7b3a49502469598ab90a662fe

  • SSDEEP

    12288:KwGWfjEhy4pNodk6TZFo9nheT5BQ4YvnAu:KnWf0y4GNIsmRvnAu

Score
10/10
octobankerevasioninfostealerrattrojan

Malware Config

Extracted

Family

octo

C2

https://84.54.50.100/Njk4Zjk4YjdjODY3/

https://pakuxxxnatationclass.net/Njk4Zjk4YjdjODY3/

https://pakuxxxnatationclass2.net/Njk4Zjk4YjdjODY3/

https://pakuxxxnatationclass3.net/Njk4Zjk4YjdjODY3/

https://pakuxxxnatationclass4.net/Njk4Zjk4YjdjODY3/

https://pakuxxxnatationclass5.net/Njk4Zjk4YjdjODY3/

https://pakuxxxnatationclass6.net/Njk4Zjk4YjdjODY3/
AES_key

Signatures

  • Octo

    Octo is a banking malware with remote access capabilities first seen in April 2022.

    bankertrojaninfostealerratocto
  • Octo payload 1 IoCs
  • Makes use of the framework's Accessibility service 3 IoCs

    Retrieves information displayed on the phone screen using AccessibilityService.

  • Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 IoCs
    banker
  • Loads dropped Dex/Jar 2 IoCs

    Runs executable file dropped to the device during analysis.

  • Acquires the wake lock 1 IoCs
  • Reads information about phone network operator.
  • Requests disabling of battery optimizations (often used to enable hiding in the background). 1 IoCs
    evasion
  • Uses Crypto APIs (Might try to encrypt user data) 1 IoCs

Processes

  • com.broughtbluea
    1⤵
    • Makes use of the framework's Accessibility service
    • Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps)
    • Loads dropped Dex/Jar
    • Acquires the wake lock
    • Requests disabling of battery optimizations (often used to enable hiding in the background).
    • Uses Crypto APIs (Might try to encrypt user data)
    PID:4597

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • /data/user/0/com.broughtbluea/cache/oat/pxcpq.cur.prof
    Filesize

    322B

    MD5

    99337091e3eae3ed36dfc9843ea89768

    SHA1

    3045482f17decdee002b0ca7d2a531a863a691aa

    SHA256

    c0efbdd0311a94de7eb31cfa08fa087f5b38af16bcd9ff6f5e09a55537e37b1c

    SHA512

    fe23bc972963ca9cb2617e13bf5d800dccb27e22dc7932324be9b1c7f802b3b2ad477bfda0efaa9d8ed15d4263c390c70b29e331d965ad20bfe8c49f577b51c0

    Download Submit

  • /data/user/0/com.broughtbluea/cache/pxcpq
    Filesize

    449KB

    MD5

    fb15ea8794c6547c5ca8f58577e433a6

    SHA1

    47c530ac1858cbc7584429190a07c3c4313857ac

    SHA256

    908588c8de2b52b69f30917583d91ac67f96c7682c017df3943d3979c9fc6095

    SHA512

    9cb724a385917e949052b84be546cd61a952474ee8671743034463b356de4c5bc60732b07287c326da65c4cced7f8c8247b348bbb5abb436c86fedbcb4da90c9

    Download Submit

  • /data/user/0/com.broughtbluea/kl.txt
    Filesize

    28B

    MD5

    6311c3fd15588bb5c126e6c28ff5fffe

    SHA1

    ce81d136fce31779f4dd62e20bdaf99c91e2fc57

    SHA256

    8b82f6032e29a2b5c96031a3630fb6173d12ff0295bc20bb21b877d08f0812d8

    SHA512

    2975fe2e94b6a8adc9cfc1a865ad113772b54572883a537b02a16dd2d029c0f7d9cca3b154fd849bdfe978e18b396bcf9fa6e67e7c61f92bdc089a29a9c355c6

    Download Submit

  • /data/user/0/com.broughtbluea/kl.txt
    Filesize

    230B

    MD5

    4afb406c073c50974253c43e208dcca5

    SHA1

    53b3b86cb4d652adf5a1aa2220d6cfef25031842

    SHA256

    ffc0ecf37742ab7b09642751fbd8c35c7871f45881c52d2b2acb815fc78275f6

    SHA512

    c17e574445c7ec549cdeb0f9d9390f2cd013736c1338770114351a80d534337bcde287aea25978b2efa3974558da7f4bddd9b6b1a9a1e156f3c3b3911707164d

    Download Submit

  • /data/user/0/com.broughtbluea/kl.txt
    Filesize

    64B

    MD5

    f14eb09615b94022c450329a9366c36b

    SHA1

    918d614a60817d781f0aff1cea43f6c53f4a9257

    SHA256

    89510c15991c6c1fa00f9cecf1fbd92029775511e02aeba3332bb15ac88997ca

    SHA512

    1469ebfa053f8368088f645aaf90569f948c146ce41135b189e198e44cedbcd07adb8f9cba524964fc71ab82d9b6fa7dc56bcc81eefc9f5d31fa62ac74b773f2

    Download Submit

  • /data/user/0/com.broughtbluea/kl.txt
    Filesize

    63B

    MD5

    a80ea95c876841b359144c467109d072

    SHA1

    9cee365929df9eb99edacd30a6294291e6523038

    SHA256

    cb217d2077a33dd56c1b406ca04dd732f4721aee273369669c0e47a956c96fa2

    SHA512

    6b584ebcc87bd9d4c6ae998a426dce2c66372a8d31b51fd4ab444f08b90e92570c9136f432eadc55b279815cc45cf352d3994c19968ebd57cc232d15ce121f25

    Download Submit

  • /data/user/0/com.broughtbluea/kl.txt
    Filesize

    68B

    MD5

    1b04aad69e5d97e26d691fc282cd8ceb

    SHA1

    ba1fa95130460cf87adccf381fdcb0b93d38e54c

    SHA256

    296ea9229a45722de99b49535f2130a74bf7e930894ec64cc6aa5e82d8fc39a8

    SHA512

    7a4ff1274678c74bfb4fbf3c65f0d4df2fed4180385c316a65b18a12d5cd6d56bde5f20035ea072fd37ee63742075712c984b358e4168656c9b4df8b9002e1bc

    Download Submit