octo | bf943e30db49a3e3f6172c3ff7737ea1cf6e7115af8a98d32888609f4c8a8544

General

Target
bf943e30db49a3e3f6172c3ff7737ea1cf6e7115af8a98d32888609f4c8a8544
Size 9.6MB
Sample251027-271bhsay3h
SHA256 bf943e30db49a3e3f6172c3ff7737ea1cf6e7115af8a98d32888609f4c8a8544
MD5 5d5bdc01e860932b70709c8d87ce4216
SHA1 b9f27a7cfe591c6437f6e45c41f4b28c7ab4ac2c
SHA512 ff609380316878ffcde677a2803863fe21eb4baaca85574f8d862a394c5fe2782bd23521e23d7b9d566134549d92a94c2ebf35e0bcf97ffb57cee6f690c500d7
SSDEEP 196608:P6QxPtkowcPnPfbvqbCivnRhgj98NuO+JMYm:jVtktcPnPfWzG9xM/
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

octo

Malware Config

Signatures

Octo family
octo

Octo DGA 4 IoCs

Contains strings associated with the Octo/Coper variant that uses a domain generation algorithm (DGA).

resource	yara_rule
static1/unpack001/base.apk	Coper_DGA_Strings
static1/unpack001/base.apk	Coper_DGA_Strings
static1/unpack001/base.apk	Coper_DGA_Strings
static1/unpack001/base.apk	Coper_DGA_Strings

Attempts to obfuscate APK file format
Applies obfuscation techniques to the APK format in order to hinder analysis

Declares broadcast receivers with permission to handle system events 1 IoCs

description	ioc
Required by device admin receivers to bind with the system. Allows apps to manage device administration features.	android.permission.BIND_DEVICE_ADMIN

Declares services with permission to bind to the system 2 IoCs

description	ioc
Required by accessibility services to bind with the system. Allows apps to access accessibility features.	android.permission.BIND_ACCESSIBILITY_SERVICE
Required by notification listener services to bind with the system. Allows apps to listen to and interact with notifications on the device.	android.permission.BIND_NOTIFICATION_LISTENER_SERVICE

Requests dangerous framework permissions 7 IoCs

description	ioc
Allows an application to read audio files from external storage.	android.permission.READ_MEDIA_AUDIO
Allows an application to read image or video files from external storage that a user has selected via the permission prompt photo picker.	android.permission.READ_MEDIA_VISUAL_USER_SELECTED
Allows an application to read the user's calendar data.	android.permission.READ_CALENDAR
Allows an application to request installing packages.	android.permission.REQUEST_INSTALL_PACKAGES
Allows an application to read image files from external storage.	android.permission.READ_MEDIA_IMAGES
Allows an application to read video files from external storage.	android.permission.READ_MEDIA_VIDEO
Allows an application to read image files from external storage.	android.permission.READ_MEDIA_IMAGES

File Explorer

bf943e30db49a3e3f6172c3ff7737ea1cf6e7115af8a98d32888609f4c8a8544

.apk 9.6MB
base.apk

.apk 7.5MB

bf943e30db49a3e3f6172c3ff7737ea1cf6e7115af8a98d32888609f4c8a8544

SHA256 bf943e30db49a3e3f6172c3ff7737ea1cf6e7115af8a98d32888609f4c8a8544
MD5 5d5bdc01e860932b70709c8d87ce4216
SHA1 b9f27a7cfe591c6437f6e45c41f4b28c7ab4ac2c
SHA512 ff609380316878ffcde677a2803863fe21eb4baaca85574f8d862a394c5fe2782bd23521e23d7b9d566134549d92a94c2ebf35e0bcf97ffb57cee6f690c500d7
SSDEEP 196608:P6QxPtkowcPnPfbvqbCivnRhgj98NuO+JMYm:jVtktcPnPfWzG9xM/
MD5 SHA1 SHA512 SSDEEP

android

com.copy.helmet

base.apk

SHA256 24aa5d5cbd55fd1b06e76c0add845372ec61152f0eaa79a3816fd0f339e4fd98
MD5 7cb349ab3a6de438fc2c33fbb895351a
SHA1 7f4c93dbb4c3cdc1cd1a5862e1938f351d91acba
SHA512 67f1095e1014f7d65e0b8ac4d5859274653142e9f4fb5ffca1cad7d6b5ea8cf864b8c0292fbd4ee676c2feffb7d49ab82b1651a63859ea28a240295c34a15314
SSDEEP 98304:PVKsc5iSRGQ2RsP3Mdij7/GOuB9QfMZXu6Jk:PUNrARqcYj7/Zyoh
MD5 SHA1 SHA512 SSDEEP

android arch:x64 arch:x86 arch:arm64 arch:arm

Octo DGA

Contains strings associated with the Octo/Coper variant that uses a domain generation algorithm (DGA).

com.falive98commagnifier

Android Permissions

bf943e30db49a3e3f6172c3ff7737ea1cf6e7115af8a98d32888609f4c8a8544

Permissions

android.permission.READ_SETTINGS

android.permission.READ_MEDIA_AUDIO

android.permission.READ_MEDIA_VISUAL_USER_SELECTED

com.android.launcher.permission.WRITE_SETTINGS

android.permission.BROADCAST_STICKY

android.permission.INTERACT_ACROSS_USERS_FULL

android.permission.READ_CALENDAR

android.permission.REQUEST_INSTALL_PACKAGES

android.permission.CONTROL_REMOTE_APP_TRANSITION_ANIMATIONS

android.permission.ACCESS_ADSERVICES_TOPICS

android.permission.READ_MEDIA_IMAGES

android.permission.READ_DEVICE_CONFIG

android.permission.ACCESS_ADSERVICES_ATTRIBUTION

android.permission.BIND_APPWIDGET

android.permission.KILL_BACKGROUND_PROCESSES

android.permission.READ_MEDIA_VIDEO

android.permission.GET_PACKAGE_SIZE

android.permission.SET_WALLPAPER

android.permission.EXPAND_STATUS_BAR

android.permission.USES_POLICY_FORCE_LOCK

com.android.launcher.permission.READ_SETTINGS

android.permission.BROADCAST_CLOSE_SYSTEM_DIALOGS

android.permission.SAVE_APP_PAIRS

android.permission.READ_MEDIA_IMAGES

android.permission.SET_WALLPAPER_HINTS

bf943e30db49a3e3f6172c3ff7737ea1cf6e7115af8a98d32888609f4c8a8544

com.select.company.Uharborcitizen

androidx.startup.InitializationProvider

base.apk

com.falive98commagnifier.ndk2OvQA14UC

com.falive98commagnifier.lFr50AX7

com.falive98commagnifier.zjiWGToCPvSKe

com.falive98commagnifier.csoDFBKKweVrC

com.falive98commagnifier.ewlomSETWLgn

com.falive98commagnifier.kktnkoH

com.falive98commagnifier.dcnycrtXV

com.falive98commagnifier.ki83Z3W

com.falive98commagnifier.pvhCGru

com.falive98commagnifier.mulEeni3b

com.falive98commagnifier.ffhYWGR

com.falive98commagnifier.wrpNAPf1dPP5

com.falive98commagnifier.uvTD3hGrIS

com.falive98commagnifier.xJcVD

com.falive98commagnifier.vyynDu3lHi

com.falive98commagnifier.lBAHsIqux

com.falive98commagnifier.nof6MMnZY

com.falive98commagnifier.klxFF9R9

com.falive98commagnifier.r4K5NQZ

com.falive98commagnifier.cixBNO

com.falive98commagnifier.dbtNWMvY

com.falive98commagnifier.vua7gmpvSTCN

Resubmissions

Sharing

General

Malware Config

Signatures

File Explorer

bf943e30db49a3e3f6172c3ff7737ea1cf6e7115af8a98d32888609f4c8a8544

com.select.company.Uharborcitizen

androidx.startup.InitializationProvider

base.apk

com.falive98commagnifier.ndk2OvQA14UC

com.falive98commagnifier.lFr50AX7

com.falive98commagnifier.zjiWGToCPvSKe

com.falive98commagnifier.csoDFBKKweVrC

com.falive98commagnifier.ewlomSETWLgn

com.falive98commagnifier.kktnkoH

com.falive98commagnifier.dcnycrtXV

com.falive98commagnifier.ki83Z3W

com.falive98commagnifier.pvhCGru

com.falive98commagnifier.mulEeni3b

com.falive98commagnifier.ffhYWGR

com.falive98commagnifier.wrpNAPf1dPP5

com.falive98commagnifier.uvTD3hGrIS

com.falive98commagnifier.xJcVD

com.falive98commagnifier.vyynDu3lHi

com.falive98commagnifier.lBAHsIqux

com.falive98commagnifier.nof6MMnZY

com.falive98commagnifier.klxFF9R9

com.falive98commagnifier.r4K5NQZ

com.falive98commagnifier.cixBNO

com.falive98commagnifier.dbtNWMvY

com.falive98commagnifier.vua7gmpvSTCN

Android Permissions

bf943e30db49a3e3f6172c3ff7737ea1cf6e7115af8a98d32888609f4c8a8544