octo | e4da0d55ef12c2fb37b36332c40d0a552e89057426badc038346da6a0ad358b7[.]bin

General

Target
e4da0d55ef12c2fb37b36332c40d0a552e89057426badc038346da6a0ad358b7.bin
Size 220KB
Sample240806-dctcqa1fkb
SHA256 e4da0d55ef12c2fb37b36332c40d0a552e89057426badc038346da6a0ad358b7
MD5 53484072c51314f47c69c490eeff8549
SHA1 9120a17708b1f0b401651bc5c5d42fbaecd7fbde
SHA512 a0e67b5e0e0d3325675ba46c511151b381e5645aeaf25bce985418a9c6c2c9795c9b74c36169551d1b0944640b9d16e21fe94199d86cc4368ecd3f07e326262a
SSDEEP 3072:tas7jCEvDkwWrGZd3TizKgEvjE8BcPI/4sJ0NnrnmQ4bKRivOzAZfOBgGOz1L1c5:ttmE7oWd3EEu7m1bKRivSiGc11O2R0
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

octo

Malware Config

Extracted

Family

octo

C2

https://91.92.242.11:7117/gate/

rc4.plain

Signatures

Octo family
octo

Octo payload 1 IoCs

resource	yara_rule
sample	family_octo

Declares broadcast receivers with permission to handle system events 1 IoCs

description	ioc
Required by device admin receivers to bind with the system. Allows apps to manage device administration features.	android.permission.BIND_DEVICE_ADMIN

Declares services with permission to bind to the system 2 IoCs

description	ioc
Required by accessibility services to bind with the system. Allows apps to access accessibility features.	android.permission.BIND_ACCESSIBILITY_SERVICE
Required by notification listener services to bind with the system. Allows apps to listen to and interact with notifications on the device.	android.permission.BIND_NOTIFICATION_LISTENER_SERVICE

Requests dangerous framework permissions 7 IoCs

description	ioc
Allows an application to write to external storage.	android.permission.WRITE_EXTERNAL_STORAGE
Allows an application to receive SMS messages.	android.permission.RECEIVE_SMS
Allows an application to read SMS messages.	android.permission.READ_SMS
Allows an application to send SMS messages.	android.permission.SEND_SMS
Allows read only access to phone state, including the current cellular network information, the status of any ongoing calls, and a list of any PhoneAccounts registered on the device.	android.permission.READ_PHONE_STATE
Allows an application to initiate a phone call without going through the Dialer user interface for the user to confirm the call.	android.permission.CALL_PHONE
Allows an application to read or write the system settings.	android.permission.WRITE_SETTINGS

File Explorer

e4da0d55ef12c2fb37b36332c40d0a552e89057426badc038346da6a0ad358b7.bin

.apk 220KB

e4da0d55ef12c2fb37b36332c40d0a552e89057426badc038346da6a0ad358b7.bin

SHA256 e4da0d55ef12c2fb37b36332c40d0a552e89057426badc038346da6a0ad358b7
MD5 53484072c51314f47c69c490eeff8549
SHA1 9120a17708b1f0b401651bc5c5d42fbaecd7fbde
SHA512 a0e67b5e0e0d3325675ba46c511151b381e5645aeaf25bce985418a9c6c2c9795c9b74c36169551d1b0944640b9d16e21fe94199d86cc4368ecd3f07e326262a
SSDEEP 3072:tas7jCEvDkwWrGZd3TizKgEvjE8BcPI/4sJ0NnrnmQ4bKRivOzAZfOBgGOz1L1c5:ttmE7oWd3EEu7m1bKRivSiGc11O2R0
MD5 SHA1 SHA512 SSDEEP

android

Octo payload

com.adaxffsfzfada.zbsvxgsvbxhdgs

Android Permissions

e4da0d55ef12c2fb37b36332c40d0a552e89057426badc038346da6a0ad358b7.bin

Permissions

android.permission.WRITE_EXTERNAL_STORAGE

android.permission.ADD_VOICEMAIL

android.permission.GET_PACKAGE_SIZE

android.permission.CLEAR_APP_CACHE

android.permission.ACCESS_NOTIFICATION_POLICY

android.permission.REQUEST_IGNORE_BATTERY_OPTIMIZATIONS

android.permission.FOREGROUND_SERVICE

android.permission.RECEIVE_BOOT_COMPLETED

android.permission.INTERNET

android.permission.RECEIVE_SMS

android.permission.READ_SMS

android.Manifest.permission.READ_PHONE_STATE

android.permission.SEND_SMS

android.permission.WAKE_LOCK

android.permission.READ_PHONE_STATE

android.permission.CALL_PHONE

android.permission.USES_POLICY_FORCE_LOCK

android.permission.VIBRATE

android.permission.REQUEST_COMPANION_RUN_IN_BACKGROUND

android.permission.REQUEST_COMPANION_USE_DATA_IN_BACKGROUND

android.permission.REQUEST_DELETE_PACKAGES

android.permission.MODIFY_AUDIO_SETTINGS

android.permission.ACCESS_WIFI_STATE

android.permission.ACCESS_NETWORK_STATE

android.permission.WRITE_SETTINGS

android.permission.REORDER_TASKS

e4da0d55ef12c2fb37b36332c40d0a552e89057426badc038346da6a0ad358b7.bin

com.beginhigh19.p079j

com.beginhigh19.p025i

com.beginhigh19.p059u

com.beginhigh19.p085x

com.beginhigh19.p036o

com.beginhigh19.p036n

com.beginhigh19.p016j

com.beginhigh19.p049p

com.beginhigh19.p025p

com.beginhigh19.p057t

com.beginhigh19.p059j

com.beginhigh19.p075b

com.beginhigh19.p027d

com.beginhigh19.p041i

com.beginhigh19.p054v

com.beginhigh19.p071p

com.beginhigh19.p067x

com.beginhigh19.p044i

com.beginhigh19.p023w

com.beginhigh19.p025n

com.beginhigh19.p073f

com.beginhigh19.p042w

com.beginhigh19.p095e

com.beginhigh19.p053u

com.beginhigh19.p050i

com.beginhigh19.p077o

com.beginhigh19.p043q

com.beginhigh19.p032o

com.beginhigh19.p086c

com.beginhigh19.p088s

com.beginhigh19.p047t

Resubmissions

Sharing

General

Malware Config

Extracted

Signatures

File Explorer

e4da0d55ef12c2fb37b36332c40d0a552e89057426badc038346da6a0ad358b7.bin

com.beginhigh19.p079j

com.beginhigh19.p025i

com.beginhigh19.p059u

com.beginhigh19.p085x

com.beginhigh19.p036o

com.beginhigh19.p036n

com.beginhigh19.p016j

com.beginhigh19.p049p

com.beginhigh19.p025p

com.beginhigh19.p057t

com.beginhigh19.p059j

com.beginhigh19.p075b

com.beginhigh19.p027d

com.beginhigh19.p041i

com.beginhigh19.p054v

com.beginhigh19.p071p

com.beginhigh19.p067x

com.beginhigh19.p044i

com.beginhigh19.p023w

com.beginhigh19.p025n

com.beginhigh19.p073f

com.beginhigh19.p042w

com.beginhigh19.p095e

com.beginhigh19.p053u

com.beginhigh19.p050i

com.beginhigh19.p077o

com.beginhigh19.p043q

com.beginhigh19.p032o

com.beginhigh19.p086c

com.beginhigh19.p088s

com.beginhigh19.p047t

Android Permissions

e4da0d55ef12c2fb37b36332c40d0a552e89057426badc038346da6a0ad358b7.bin