General

  • Target

    7e8f5ecaacfd1d2eb2c904bc9ce2a7f2366e0b5da4a0685a77b8f126e313793a

  • Size

    199KB

  • Sample

    231220-dacxyshabm

  • MD5

    368f4b4d74a749ff55d76e929b52fedd

  • SHA1

    313066dc7a5cd5514eaede9e709ca1ee161c74c9

  • SHA256

    7e8f5ecaacfd1d2eb2c904bc9ce2a7f2366e0b5da4a0685a77b8f126e313793a

  • SHA512

    7e32bad0c2c45b4828fd889aa81e6251151566b48a32165bba5ffd1a8c267f8dfd59a25737460cab5528e5907ed555ed26f01127d529032802ea79fae9e05410

  • SSDEEP

    6144:nADJ+dIt4n5FQgG9gTu5grC8mJHbdjm+Ax5oNNZox1AI4h7:AdMn54i65qmJkpqPIA7

Malware Config

Extracted

Family

octo

C2

https://s22231232fdnsjds.top/PArhFzp5sG2sN/

https://s32231232fdnsjds.top/PArhFzp5sG2sN/

https://s42231232fdnsjds.top/PArhFzp5sG2sN/

AES_key

Targets

    • Target

      7e8f5ecaacfd1d2eb2c904bc9ce2a7f2366e0b5da4a0685a77b8f126e313793a

    • Size

      199KB

    • MD5

      368f4b4d74a749ff55d76e929b52fedd

    • SHA1

      313066dc7a5cd5514eaede9e709ca1ee161c74c9

    • SHA256

      7e8f5ecaacfd1d2eb2c904bc9ce2a7f2366e0b5da4a0685a77b8f126e313793a

    • SHA512

      7e32bad0c2c45b4828fd889aa81e6251151566b48a32165bba5ffd1a8c267f8dfd59a25737460cab5528e5907ed555ed26f01127d529032802ea79fae9e05410

    • SSDEEP

      6144:nADJ+dIt4n5FQgG9gTu5grC8mJHbdjm+Ax5oNNZox1AI4h7:AdMn54i65qmJkpqPIA7

    • Octo

      Octo is a banking malware with remote access capabilities first seen in April 2022.

    • Octo payload

    • Makes use of the framework's Accessibility service

      Retrieves information displayed on the phone screen using AccessibilityService.

    • Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps)

    • Removes its main activity from the application launcher

    • Loads dropped Dex/Jar

      Runs executable file dropped to the device during analysis.

    • Acquires the wake lock

    • Reads information about phone network operator.

    • Requests disabling of battery optimizations (often used to enable hiding in the background).

MITRE ATT&CK Matrix

Tasks