General
-
Target
267881e350f43a023f67d859b74a2cfbfddb624e08ebdbe72b12b753c91f95a1.bin
-
Size
509KB
-
Sample
240416-1w1bpsfc5z
-
MD5
4ac402cc8851ed8aaf88552e5e839fbd
-
SHA1
c850f9fdd0cfd059feae236055e6ba8182a980cd
-
SHA256
267881e350f43a023f67d859b74a2cfbfddb624e08ebdbe72b12b753c91f95a1
-
SHA512
11bdde24b6f218f73de52ee98d4828d3a91f77715e7bb163e30a9f8b8381f6c05e84680d3037fc97b9aa466770e068df22cb588acdf5a4069270d23190b42241
-
SSDEEP
12288:VnUNeI9KcLvYhHSHzTZkdMpRkPY8SUHNPSpnznu:ZKX9KcLewTcKkPY9UHNPoznu
Static task
static1
Behavioral task
behavioral1
Sample
267881e350f43a023f67d859b74a2cfbfddb624e08ebdbe72b12b753c91f95a1.apk
Resource
android-x86-arm-20240221-en
Behavioral task
behavioral2
Sample
267881e350f43a023f67d859b74a2cfbfddb624e08ebdbe72b12b753c91f95a1.apk
Resource
android-33-x64-arm64-20240229-en
Malware Config
Extracted
octo
https://kapandayarankal.shop/MjM2YTBkOGJlZjU1/
https://kanepedeyatan.shop/MjM2YTBkOGJlZjU1/
https://kapandayarkarnaval.shop/MjM2YTBkOGJlZjU1/
https://karakasabadakan.online/MjM2YTBkOGJlZjU1/
https://karakamazandar.com/MjM2YTBkOGJlZjU1/
Targets
-
-
Target
267881e350f43a023f67d859b74a2cfbfddb624e08ebdbe72b12b753c91f95a1.bin
-
Size
509KB
-
MD5
4ac402cc8851ed8aaf88552e5e839fbd
-
SHA1
c850f9fdd0cfd059feae236055e6ba8182a980cd
-
SHA256
267881e350f43a023f67d859b74a2cfbfddb624e08ebdbe72b12b753c91f95a1
-
SHA512
11bdde24b6f218f73de52ee98d4828d3a91f77715e7bb163e30a9f8b8381f6c05e84680d3037fc97b9aa466770e068df22cb588acdf5a4069270d23190b42241
-
SSDEEP
12288:VnUNeI9KcLvYhHSHzTZkdMpRkPY8SUHNPSpnznu:ZKX9KcLewTcKkPY9UHNPoznu
-
Octo
Octo is a banking malware with remote access capabilities first seen in April 2022.
-
Octo payload
-
Makes use of the framework's Accessibility service
Retrieves information displayed on the phone screen using AccessibilityService.
-
Makes use of the framework's foreground persistence service
Application may abuse the framework's foreground service to continue running in the foreground.
-
Queries the phone number (MSISDN for GSM devices)
-
Acquires the wake lock
-
Queries the unique device ID (IMEI, MEID, IMSI)
-
Reads information about phone network operator.
-
Requests disabling of battery optimizations (often used to enable hiding in the background).
-