General

  • Target

    4777bd6daecf665d85db5226d1caf5ba7213cd0688277564ee60a8483389f6ed.bin

  • Size

    339KB

  • Sample

    240224-1x5mtafe52

  • MD5

    94a2fd923a51bf9bd31c97324676f794

  • SHA1

    6b14816f0ee9cd276faddeb12be809e39dcdc6ed

  • SHA256

    4777bd6daecf665d85db5226d1caf5ba7213cd0688277564ee60a8483389f6ed

  • SHA512

    47c95a98cdcbbaa4d344fc3846f3aec52f61350d5a1841dbaf58e275513bb1ea443125924ce5fcb09815f8e8b21444a9b28274ac87e49a45140cf21b1a26e865

  • SSDEEP

    6144:D27ud88efAnd17/Ty8VMZtV0DCkXOjy/8K9moFxd0mW/vb6:DTE8XStVGvOjy3HFn03O

Malware Config

Extracted

Family

octo

C2

https://193.233.254.67:7117/gate/

AES_key
AES_key
AES_key
AES_key
AES_key
AES_key
AES_key
AES_key
AES_key
AES_key

Targets

    • Target

      4777bd6daecf665d85db5226d1caf5ba7213cd0688277564ee60a8483389f6ed.bin

    • Size

      339KB

    • MD5

      94a2fd923a51bf9bd31c97324676f794

    • SHA1

      6b14816f0ee9cd276faddeb12be809e39dcdc6ed

    • SHA256

      4777bd6daecf665d85db5226d1caf5ba7213cd0688277564ee60a8483389f6ed

    • SHA512

      47c95a98cdcbbaa4d344fc3846f3aec52f61350d5a1841dbaf58e275513bb1ea443125924ce5fcb09815f8e8b21444a9b28274ac87e49a45140cf21b1a26e865

    • SSDEEP

      6144:D27ud88efAnd17/Ty8VMZtV0DCkXOjy/8K9moFxd0mW/vb6:DTE8XStVGvOjy3HFn03O

    • Octo

      Octo is a banking malware with remote access capabilities first seen in April 2022.

    • Octo payload

    • Makes use of the framework's Accessibility service

      Retrieves information displayed on the phone screen using AccessibilityService.

    • Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps)

    • Removes its main activity from the application launcher

    • Loads dropped Dex/Jar

      Runs executable file dropped to the device during analysis.

    • Acquires the wake lock

    • Reads information about phone network operator.

    • Requests disabling of battery optimizations (often used to enable hiding in the background).

MITRE ATT&CK Mobile v15

Tasks