octo | Chrome[.]apk

General

Target
Chrome.apk
Size 292KB
Sample260910-akj78sec46
SHA256 f61fecff25cade2b48ced3e704decafe4595ad8123a80921371dad4df8318d56
MD5 5ddb8df0994b4ffc7747c246020f324a
SHA1 58cd1e8ab0a8d895059dd87a1b61202270cfe2cc
SHA512 2efde7565a62fcb23a767c06e18386ab94f913ebae87a15aecb5203bf1f05fd29ebfbb8c45090ce2183ac4a1013d07ca79520d4359464c227ae8a2320dfceff6
SSDEEP 6144:4RCrETkkkkkkl6Rg0Ra9NUTrWyTmrRcI1YXXuaw8hVbgH9NB2/EuGZ:4RCrETkkkkkkyg0w9NIWy4JWXXuaw8hQ
TLSH
T15954E05436B8E706E87E9B390EF9E6D1953DBE95CE08934B3042730C0A727C15D6A63B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

banker trojan infostealer rat octo

Malware Config

Extracted

Family

octo

C2

https://varburalar436.top/OWRmM2UzMTBiNjg4/
https://kanderasd2.top/OWRmM2UzMTBiNjg4/
https://hamkarada24.top/OWRmM2UzMTBiNjg4/
https://gacahyat75.top/OWRmM2UzMTBiNjg4/
https://hasberhdsf23.top/OWRmM2UzMTBiNjg4/
https://f4nasder1.top/OWRmM2UzMTBiNjg4/
https://haxklm45.top/OWRmM2UzMTBiNjg4/
https://naksarhpkd34.top/OWRmM2UzMTBiNjg4/
https://kulambah234.top/OWRmM2UzMTBiNjg4/
https://geretereyk3.top/OWRmM2UzMTBiNjg4/
https://kazanmkadar23.top/OWRmM2UzMTBiNjg4/
https://s4zartuk4.top/OWRmM2UzMTBiNjg4/

rc4.plain

Signatures

Family: Octo
Octo is a banking malware with remote access capabilities first seen in April 2022.
banker trojan infostealer rat octo

Octo payload 1 IoCs

resource	yara_rule
sample	family_octo

Attempts to obfuscate APK file format
Applies obfuscation techniques to the APK format in order to hinder analysis

Declares broadcast receivers with permission to handle system events 1 IoCs

description	ioc
Required by device admin receivers to bind with the system. Allows apps to manage device administration features.	android.permission.BIND_DEVICE_ADMIN

Declares services with permission to bind to the system 2 IoCs

description	ioc
Required by accessibility services to bind with the system. Allows apps to access accessibility features.	android.permission.BIND_ACCESSIBILITY_SERVICE
Required by notification listener services to bind with the system. Allows apps to listen to and interact with notifications on the device.	android.permission.BIND_NOTIFICATION_LISTENER_SERVICE

Requests dangerous framework permissions 8 IoCs

description	ioc
Allows an application to read from external storage.	android.permission.READ_EXTERNAL_STORAGE
Allows an application to write to external storage.	android.permission.WRITE_EXTERNAL_STORAGE
Allows an application to receive SMS messages.	android.permission.RECEIVE_SMS
Allows an application to read SMS messages.	android.permission.READ_SMS
Allows an application to send SMS messages.	android.permission.SEND_SMS
Allows read only access to phone state, including the current cellular network information, the status of any ongoing calls, and a list of any PhoneAccounts registered on the device.	android.permission.READ_PHONE_STATE
Allows an application to initiate a phone call without going through the Dialer user interface for the user to confirm the call.	android.permission.CALL_PHONE
Allows an application to read or write the system settings.	android.permission.WRITE_SETTINGS

Untrusted Codesign Signers 1 IoCs

Codesigned file was signed by an untrusted entity.

resource
Chrome.apk

File Explorer

Chrome.apk

.apk 292KB

Chrome.apk

SHA256 f61fecff25cade2b48ced3e704decafe4595ad8123a80921371dad4df8318d56
MD5 5ddb8df0994b4ffc7747c246020f324a
SHA1 58cd1e8ab0a8d895059dd87a1b61202270cfe2cc
SHA512 2efde7565a62fcb23a767c06e18386ab94f913ebae87a15aecb5203bf1f05fd29ebfbb8c45090ce2183ac4a1013d07ca79520d4359464c227ae8a2320dfceff6
SSDEEP 6144:4RCrETkkkkkkl6Rg0Ra9NUTrWyTmrRcI1YXXuaw8hVbgH9NB2/EuGZ:4RCrETkkkkkkyg0w9NIWy4JWXXuaw8hQ
TLSH
T15954E05436B8E706E87E9B390EF9E6D1953DBE95CE08934B3042730C0A727C15D6A63B
MD5 SHA1 SHA512 SSDEEP TLSH

android arch:arm64 arch:x86 arch:x64 arch:arm

Octo payload
Untrusted Codesign Signers

Codesigned file was signed by an untrusted entity.

File Signature issue

Digest

c0e69f21cd5b1ac34ce84b0267fe538fa0804bf617af8b0a2ddbe32de22bc759

Digest Algorithm

sha256

Digest Matches

Trusted

Not trusted

Signer

CN=G7380D,OU=HJ3JS0,O=TVN0SN,L=NKFZ35,ST=O9Y1WD,C=JBPQUF

com.sgakagak.agakagabs

Android Permissions

Chrome.apk

Permissions

android.permission.CLEAR_APP_CACHE

android.permission.USE_FINGERPRINT

android.permission.BATTERY_STATS

android.permission.READ_EXTERNAL_STORAGE

android.permission.WRITE_EXTERNAL_STORAGE

android.permission.ADD_VOICEMAIL

android.permission.INSTALL_SHORTCUT

android.permission.GET_PACKAGE_SIZE

android.permission.ACCESS_NOTIFICATION_POLICY

android.permission.REQUEST_IGNORE_BATTERY_OPTIMIZATIONS

android.permission.FOREGROUND_SERVICE

android.permission.RECEIVE_BOOT_COMPLETED

android.permission.INTERNET

android.permission.RECEIVE_SMS

android.permission.READ_SMS

android.Manifest.permission.READ_PHONE_STATE

android.permission.SEND_SMS

android.permission.WAKE_LOCK

android.permission.READ_PHONE_STATE

android.permission.CALL_PHONE

android.permission.USES_POLICY_FORCE_LOCK

android.permission.VIBRATE

android.permission.REQUEST_COMPANION_RUN_IN_BACKGROUND

android.permission.REQUEST_COMPANION_USE_DATA_IN_BACKGROUND

android.permission.REQUEST_DELETE_PACKAGES

android.permission.MODIFY_AUDIO_SETTINGS

android.permission.ACCESS_WIFI_STATE

android.permission.ACCESS_NETWORK_STATE

android.permission.WRITE_SETTINGS

android.permission.REORDER_TASKS

Sharing

General

Malware Config

Extracted

Signatures

File Explorer

Chrome.apk

File Signature issue

com.nameown12.p045l

com.nameown12.p062m

com.nameown12.p075m

com.nameown12.p045n

com.nameown12.p086v

com.nameown12.p090h

com.nameown12.p041j

com.nameown12.p062p

com.nameown12.p075f

com.nameown12.p078y

com.nameown12.p030x

com.nameown12.tdwjlrqtqhhauqf

com.nameown12.zreuctkootj

com.nameown12.ycpsttrsga

com.nameown12.qwwhvefvya

com.nameown12.tzmjlgjfdqhfc

com.nameown12.p083p

com.nameown12.p064g

com.nameown12.p054j

com.nameown12.LogSrv

com.nameown12.p072y

com.nameown12.p093e

com.nameown12.p032n

com.nameown12.p024l

com.nameown12.p092o

com.nameown12.p020g

com.nameown12.p064q

com.nameown12.p014m

com.nameown12.fiinbmvxzhkuik

com.nameown12.gxmctqsouzqgleg

com.nameown12.vjqrcymgvl

com.nameown12.danxjuclvds

com.nameown12.gvnakeccqmfsdqn

com.nameown12.smbwxmumbvl

com.nameown12.cwdgimnuifj

com.nameown12.p078p

com.nameown12.p082q

com.nameown12.p079x

com.nameown12.p042g

com.nameown12.p070x

com.nameown12.p060d

com.nameown12.p092q

com.nameown12.p085z

com.nameown12.p024f

com.nameown12.toghlfgmwxxr

com.nameown12.wkjqnjoptgg

com.nameown12.chrtwlhxggpeza

com.nameown12.yuaeyllphez

com.nameown12.yzwqkcdnbc

com.nameown12.sivpgfxzodclcf

com.nameown12.jgrceclfqw

Android Permissions

Chrome.apk