General
-
Target
ae09f0b00bb4f4e24c32084becb3b8a6de9b691dcadeda5eca3a30b5d1b97b06.bin
-
Size
509KB
-
Sample
240416-1ycnesdh34
-
MD5
393f785fea232992382558f82007dbe5
-
SHA1
0f3484ce94593432d04d8ab8486db21489044063
-
SHA256
ae09f0b00bb4f4e24c32084becb3b8a6de9b691dcadeda5eca3a30b5d1b97b06
-
SHA512
413442b21b138b2f46cfc76f84d4998183daa9d3ffbf778d146bf1b0d4407cfaee1f9d6763a2f5ccbd2fe2e4ae36f9d3e2152c391dcc3192c579f48bf7098637
-
SSDEEP
12288:/W9OQn63cT9PnI+lPB2hClkOz+F5e2DyWV3yL3Wn/vb:e4QJTlvtBT1251mW8L3WnL
Static task
static1
Behavioral task
behavioral1
Sample
ae09f0b00bb4f4e24c32084becb3b8a6de9b691dcadeda5eca3a30b5d1b97b06.apk
Resource
android-x86-arm-20240221-en
Behavioral task
behavioral2
Sample
ae09f0b00bb4f4e24c32084becb3b8a6de9b691dcadeda5eca3a30b5d1b97b06.apk
Resource
android-x64-arm64-20240221-en
Malware Config
Extracted
octo
https://kapandayarankal.shop/MjM2YTBkOGJlZjU1/
https://kanepedeyatan.shop/MjM2YTBkOGJlZjU1/
https://kapandayarkarnaval.shop/MjM2YTBkOGJlZjU1/
https://karakasabadakan.online/MjM2YTBkOGJlZjU1/
https://karakamazandar.com/MjM2YTBkOGJlZjU1/
Targets
-
-
Target
ae09f0b00bb4f4e24c32084becb3b8a6de9b691dcadeda5eca3a30b5d1b97b06.bin
-
Size
509KB
-
MD5
393f785fea232992382558f82007dbe5
-
SHA1
0f3484ce94593432d04d8ab8486db21489044063
-
SHA256
ae09f0b00bb4f4e24c32084becb3b8a6de9b691dcadeda5eca3a30b5d1b97b06
-
SHA512
413442b21b138b2f46cfc76f84d4998183daa9d3ffbf778d146bf1b0d4407cfaee1f9d6763a2f5ccbd2fe2e4ae36f9d3e2152c391dcc3192c579f48bf7098637
-
SSDEEP
12288:/W9OQn63cT9PnI+lPB2hClkOz+F5e2DyWV3yL3Wn/vb:e4QJTlvtBT1251mW8L3WnL
-
Octo
Octo is a banking malware with remote access capabilities first seen in April 2022.
-
Octo payload
-
Makes use of the framework's Accessibility service
Retrieves information displayed on the phone screen using AccessibilityService.
-
Makes use of the framework's foreground persistence service
Application may abuse the framework's foreground service to continue running in the foreground.
-
Queries the phone number (MSISDN for GSM devices)
-
Acquires the wake lock
-
Queries the unique device ID (IMEI, MEID, IMSI)
-
Reads information about phone network operator.
-
Requests disabling of battery optimizations (often used to enable hiding in the background).
-