General
-
Target
1d5f035404729719ad632265e128c4d669ce4b43a46ed1fb1487ff662abcfd17.bin
-
Size
509KB
-
Sample
240416-1w3f3adg56
-
MD5
e25fd41f9ac4e032de30a73c9e701ccd
-
SHA1
228a6a1923de37dff6405634e8f5e85d715486ba
-
SHA256
1d5f035404729719ad632265e128c4d669ce4b43a46ed1fb1487ff662abcfd17
-
SHA512
d1a3e9945126ddd414a511220d43fd5cadb6d5aa7e0b1f472dc88547e7d8a9791f97b087741233a81553a995cd698053618b22e6eaa370564c452a9a89ff157c
-
SSDEEP
12288:dddQoTFGifuIApBxHKxmi2k5ezrQmdB9xBSewsgeetqpwU85+f/CwgOnXsq:JQoTfuNBxH8myezTzBSetfpO5+f/Cwgm
Static task
static1
Behavioral task
behavioral1
Sample
1d5f035404729719ad632265e128c4d669ce4b43a46ed1fb1487ff662abcfd17.apk
Resource
android-x86-arm-20240221-en
Behavioral task
behavioral2
Sample
1d5f035404729719ad632265e128c4d669ce4b43a46ed1fb1487ff662abcfd17.apk
Resource
android-x64-arm64-20240221-en
Malware Config
Extracted
octo
https://kapandayarankal.shop/MjM2YTBkOGJlZjU1/
https://kanepedeyatan.shop/MjM2YTBkOGJlZjU1/
https://kapandayarkarnaval.shop/MjM2YTBkOGJlZjU1/
https://karakasabadakan.online/MjM2YTBkOGJlZjU1/
https://karakamazandar.com/MjM2YTBkOGJlZjU1/
Targets
-
-
Target
1d5f035404729719ad632265e128c4d669ce4b43a46ed1fb1487ff662abcfd17.bin
-
Size
509KB
-
MD5
e25fd41f9ac4e032de30a73c9e701ccd
-
SHA1
228a6a1923de37dff6405634e8f5e85d715486ba
-
SHA256
1d5f035404729719ad632265e128c4d669ce4b43a46ed1fb1487ff662abcfd17
-
SHA512
d1a3e9945126ddd414a511220d43fd5cadb6d5aa7e0b1f472dc88547e7d8a9791f97b087741233a81553a995cd698053618b22e6eaa370564c452a9a89ff157c
-
SSDEEP
12288:dddQoTFGifuIApBxHKxmi2k5ezrQmdB9xBSewsgeetqpwU85+f/CwgOnXsq:JQoTfuNBxH8myezTzBSetfpO5+f/Cwgm
-
Octo
Octo is a banking malware with remote access capabilities first seen in April 2022.
-
Octo payload
-
Makes use of the framework's Accessibility service
Retrieves information displayed on the phone screen using AccessibilityService.
-
Makes use of the framework's foreground persistence service
Application may abuse the framework's foreground service to continue running in the foreground.
-
Queries the phone number (MSISDN for GSM devices)
-
Acquires the wake lock
-
Queries the unique device ID (IMEI, MEID, IMSI)
-
Reads information about phone network operator.
-
Requests disabling of battery optimizations (often used to enable hiding in the background).
-