[DETECTION] Octopus ELF obfuscator

[enovella]

https://codevo.com.tr/portfolio/

[0x00022a84]> izzq~+octopus_obf
0x765f 68 67 _ZN11octopus_obf15obfuscated_dataILy10ELy10751603028664370595EED2Ev
0x76a3 68 67 _ZN11octopus_obf15obfuscated_dataILy10ELy16944682998814735159EED2Ev
0x76e7 67 66 _ZN11octopus_obf15obfuscated_dataILy10ELy3532802472303854899EED2Ev
0x772a 67 66 _ZN11octopus_obf15obfuscated_dataILy10ELy9729988665333626351EED2Ev
0x776d 68 67 _ZN11octopus_obf15obfuscated_dataILy16ELy14399094314767468431EED2Ev
0x77b1 67 66 _ZN11octopus_obf15obfuscated_dataILy16ELy2983409589604555257EED2Ev
0x77f4 67 66 _ZN11octopus_obf15obfuscated_dataILy17ELy3115874896556823931EED2Ev
0x7837 66 65 _ZN11octopus_obf15obfuscated_dataILy17ELy664121744444167539EED2Ev
0x7879 67 66 _ZN11octopus_obf15obfuscated_dataILy17ELy8026455978691371931EED2Ev
0x78bc 68 67 _ZN11octopus_obf15obfuscated_dataILy18ELy14630875618259712903EED2Ev
0x7900 67 66 _ZN11octopus_obf15obfuscated_dataILy19ELy9060478605870600497EED2Ev
0x7943 67 66 _ZN11octopus_obf15obfuscated_dataILy20ELy8022544353138530575EED2Ev
0x7986 67 66 _ZN11octopus_obf15obfuscated_dataILy22ELy9297669342482920721EED2Ev
0x79c9 68 67 _ZN11octopus_obf15obfuscated_dataILy24ELy18253073611549908947EED2Ev
0x7a0d 67 66 _ZN11octopus_obf15obfuscated_dataILy29ELy6875107067980908869EED2Ev
0x7a50 67 66 _ZN11octopus_obf15obfuscated_dataILy2ELy14399094314767468431EED2Ev
0x7a93 66 65 _ZN11octopus_obf15obfuscated_dataILy2ELy9729988665333626351EED2Ev
0x7ad5 68 67 _ZN11octopus_obf15obfuscated_dataILy33ELy17677725194571420981EED2Ev
0x7b19 67 66 _ZN11octopus_obf15obfuscated_dataILy35ELy9298096365605444045EED2Ev
0x7b5c 68 67 _ZN11octopus_obf15obfuscated_dataILy45ELy10887805974635079479EED2Ev
0x7ba0 67 66 _ZN11octopus_obf15obfuscated_dataILy4ELy14630875618259712903EED2Ev
0x7be3 66 65 _ZN11octopus_obf15obfuscated_dataILy4ELy9200042382163167677EED2Ev
0x7c25 68 67 _ZN11octopus_obf15obfuscated_dataILy55ELy14399094314767468431EED2Ev
0x7c69 66 65 _ZN11octopus_obf15obfuscated_dataILy5ELy2989059363198142785EED2Ev
0x7cab 66 65 _ZN11octopus_obf15obfuscated_dataILy5ELy9297669342482920721EED2Ev
0x7ced 68 67 _ZN11octopus_obf15obfuscated_dataILy63ELy15829945448465897935EED2Ev
0x7d31 66 65 _ZN11octopus_obf15obfuscated_dataILy6ELy1115623535047550919EED2Ev
0x7d73 65 64 _ZN11octopus_obf15obfuscated_dataILy6ELy520515158038145003EED2Ev

libzvs51fl6m98n.so.zip

[enovella]

$ apkid com.garantiemeklilik.cepsube.apk
[+] APKiD 2.1.5 :: from RedNaga :: rednaga.io
[*] com.garantiemeklilik.cepsube.apk!classes.dex
 |-> anti_vm : Build.BRAND check, Build.DEVICE check, Build.FINGERPRINT check, Build.MANUFACTURER check, Build.MODEL check, Build.PRODUCT check, Build.TAGS check, SIM operator check, possible VM check
 |-> compiler : r8
[*] com.garantiemeklilik.cepsube.apk!classes2.dex
 |-> anti_debug : Debug.isDebuggerConnected() check
 |-> anti_vm : Build.MODEL check, Build.PRODUCT check, Build.TAGS check, possible Build.SERIAL check, possible VM check
 |-> compiler : r8 without marker (suspicious)
 |-> obfuscator : DexGuard
[*] com.garantiemeklilik.cepsube.apk!lib/arm64-v8a/libdgrt.so
 |-> anti_hook : syscalls
 |-> obfuscator : DexGuard
[*] com.garantiemeklilik.cepsube.apk!lib/arm64-v8a/libzvs51fl6m98n.so
 |-> obfuscator : Octopus SDK (Codevo)
[*] com.garantiemeklilik.cepsube.apk!lib/armeabi-v7a/libdgrt.so
 |-> obfuscator : DexGuard
[*] com.garantiemeklilik.cepsube.apk!lib/armeabi-v7a/libzvs51fl6m98n.so
 |-> obfuscator : Octopus SDK (Codevo)