Overview

overview

10

Static

static

6

bece14b4e9...bf.apk

android-9-x86

10

bece14b4e9...bf.apk

android-10-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    bece14b4e9fd1fd8b237fdee2b0c2739a8de0f84f72c7770d90d0250fd21acbf.bin

  • Size

    298KB

  • Sample

    240313-1wxwkscd98

  • MD5

    0cdf9620bee1ded109c511b160cfe4a3

  • SHA1

    67e865c6420fa12215eb732bd180dfc6ecea8a46

  • SHA256

    bece14b4e9fd1fd8b237fdee2b0c2739a8de0f84f72c7770d90d0250fd21acbf

  • SHA512

    9f54a98821effe043cd4c2c58dd3cd53de4f443ab07c96c1caf5e6d2d48863efcfb4c0750227deff7f74c9f707b75f912cb94fc7f08a96237af28440767d2f47

  • SSDEEP

    6144:C+SKpd5ol4JgS3r0JrkuUbHpDddCOdNR8pbNGbszlKrPI:C+SKpPoGmc0IumHpDddCOSpkslkw

Score
10/10
octoandroidbankercollectiondiscoveryevasioninfostealerratstealthtrojan

Malware Config

Extracted

Family

octo

C2

https://2.57.149.238:7117/gate/

AES_key

Targets

    • Target

      bece14b4e9fd1fd8b237fdee2b0c2739a8de0f84f72c7770d90d0250fd21acbf.bin

    • Size

      298KB

    • MD5

      0cdf9620bee1ded109c511b160cfe4a3

    • SHA1

      67e865c6420fa12215eb732bd180dfc6ecea8a46

    • SHA256

      bece14b4e9fd1fd8b237fdee2b0c2739a8de0f84f72c7770d90d0250fd21acbf

    • SHA512

      9f54a98821effe043cd4c2c58dd3cd53de4f443ab07c96c1caf5e6d2d48863efcfb4c0750227deff7f74c9f707b75f912cb94fc7f08a96237af28440767d2f47

    • SSDEEP

      6144:C+SKpd5ol4JgS3r0JrkuUbHpDddCOdNR8pbNGbszlKrPI:C+SKpPoGmc0IumHpDddCOSpkslkw

    Score
    10/10
    octobankercollectiondiscoveryevasioninfostealerratstealthtrojan

    • Octo

      Octo is a banking malware with remote access capabilities first seen in April 2022.

      bankertrojaninfostealerratocto

    • Makes use of the framework's Accessibility service

      Retrieves information displayed on the phone screen using AccessibilityService.

      collectionevasion

    • Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps)

      bankerdiscovery

    • Removes its main activity from the application launcher

      stealthtrojanevasion

    • Acquires the wake lock

    • Reads information about phone network operator.

      discovery

    • Requests disabling of battery optimizations (often used to enable hiding in the background).

      evasion
    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks