General

  • Target

    a738aea3a2704ceee337a8d6d3a1e2b1da7b9728906a18e97b5e727de9a772ab.bin

  • Size

    509KB

  • Sample

    240501-1wz1yaha8t

  • MD5

    5d1776d9b6104ed352cbb2944fb282e2

  • SHA1

    db1556894d043a10c7419b9508050dc6ae551676

  • SHA256

    a738aea3a2704ceee337a8d6d3a1e2b1da7b9728906a18e97b5e727de9a772ab

  • SHA512

    c0b36aeafc86a60cae6a5fb408b3c092ab3884519b17dfd03fff25203b05d9ad8ac0d03439aa58fa53343d6b72ce3d3511bc9327246929af9beef69655b53a9a

  • SSDEEP

    12288:Gxru9R0xxJkmJ3S9i9H9uKg7o55gHM76ZGRlN+0Gng:ArZJlJ3qKuKMo5OHMOyN+0Gng

Malware Config

Extracted

Family

octo

C2

https://45.88.91.119/Yzg2OGJiOGU5OWQy/

https://agambenikoviyoryav.net/Yzg2OGJiOGU5OWQy/

https://agambeniseviyoryav.com/Yzg2OGJiOGU5OWQy/

https://kardesimbenikoviyoryav.net/Yzg2OGJiOGU5OWQy/

https://kardesimbeniseviyoryav.com/Yzg2OGJiOGU5OWQy/

https://kekembeniseviyoryav.com/Yzg2OGJiOGU5OWQy/

Attributes
  • target_apps

    com.samsung.android.messaging

    com.google.android.apps.messaging

    at.spardat.bcrmobile

    at.spardat.netbanking

    com.bankaustria.android.olb

    com.bmo.mobile

    com.cibc.android.mobi

    com.rbc.mobile.android

    com.scotiabank.mobile

    com.td

    cz.airbank.android

    eu.inmite.prj.kb.mobilbank

    com.bankinter.launcher

    com.kutxabank.android

    com.rsi

    com.tecnocom.cajalaboral

    es.bancopopular.nbmpopular

    es.evobanco.bancamovil

    es.lacaixa.mobile.android.newwapicon

    com.dbs.hk.dbsmbanking

    com.FubonMobileClient

    com.hangseng.rbmobile

    com.MobileTreeApp

    com.mtel.androidbea

    com.scb.breezebanking.hk

    hk.com.hsbc.hsbchkmobilebanking

    com.aff.otpdirekt

    com.ideomobile.hapoalim

    com.infrasofttech.indianBank

    com.mobikwik_new

AES_key

Targets

    • Target

      a738aea3a2704ceee337a8d6d3a1e2b1da7b9728906a18e97b5e727de9a772ab.bin

    • Size

      509KB

    • MD5

      5d1776d9b6104ed352cbb2944fb282e2

    • SHA1

      db1556894d043a10c7419b9508050dc6ae551676

    • SHA256

      a738aea3a2704ceee337a8d6d3a1e2b1da7b9728906a18e97b5e727de9a772ab

    • SHA512

      c0b36aeafc86a60cae6a5fb408b3c092ab3884519b17dfd03fff25203b05d9ad8ac0d03439aa58fa53343d6b72ce3d3511bc9327246929af9beef69655b53a9a

    • SSDEEP

      12288:Gxru9R0xxJkmJ3S9i9H9uKg7o55gHM76ZGRlN+0Gng:ArZJlJ3qKuKMo5OHMOyN+0Gng

    • Octo

      Octo is a banking malware with remote access capabilities first seen in April 2022.

    • Octo payload

    • Makes use of the framework's Accessibility service

      Retrieves information displayed on the phone screen using AccessibilityService.

    • Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps)

    • Removes its main activity from the application launcher

    • Loads dropped Dex/Jar

      Runs executable file dropped to the device during analysis.

    • Makes use of the framework's foreground persistence service

      Application may abuse the framework's foreground service to continue running in the foreground.

    • Queries the mobile country code (MCC)

    • Queries the phone number (MSISDN for GSM devices)

    • Registers a broadcast receiver at runtime (usually for listening for system events)

    • Acquires the wake lock

    • Queries the unique device ID (IMEI, MEID, IMSI)

    • Reads information about phone network operator.

    • Requests disabling of battery optimizations (often used to enable hiding in the background).

MITRE ATT&CK Mobile v15

Tasks