General

  • Target

    ae957f043d9e0517dd50d38bc9b7f8f298057278d4f4f905299ff38b017e608a.bin

  • Size

    4.8MB

  • Sample

    241021-1w9v5s1ekq

  • MD5

    83ba16f6348b528b8244fa6eff3f3a8e

  • SHA1

    07e5fff34ffc326754dbfca48cf120a2cf5c1c16

  • SHA256

    ae957f043d9e0517dd50d38bc9b7f8f298057278d4f4f905299ff38b017e608a

  • SHA512

    787da8383ef6e1f60222d2ce0f6edc262c8cb195c75a30262d896c8545b40cf9619eef75c2ff1b01cefaf6951ae9e51374dc491507b384fff329971c463f7ad4

  • SSDEEP

    49152:i5RsEXr6c7Kozj76Q45iS7xrGZrN+UiR8jVKScZNk+OCXEm1x6WnRUoffA:6Rstalzj76J5iSRGMMVK+2Em1x1pA

Malware Config

Extracted

Family

octo

C2

https://e4449ba9b8fb4b68b8fb548d0fe0c812.net

Attributes
  • target_apps

    at.spardat.bcrmobile

    com.samsung.android.messaging

    com.google.android.apps.messaging

    at.spardat.netbanking

    com.bankaustria.android.olb

    com.bmo.mobile

    com.cibc.android.mobi

    com.rbc.mobile.android

    com.scotiabank.mobile

    com.td

    cz.airbank.android

    eu.inmite.prj.kb.mobilbank

    com.bankinter.launcher

    com.kutxabank.android

    com.rsi

    com.tecnocom.cajalaboral

    es.bancopopular.nbmpopular

    es.evobanco.bancamovil

    es.lacaixa.mobile.android.newwapicon

    com.dbs.hk.dbsmbanking

    com.FubonMobileClient

    com.hangseng.rbmobile

    com.MobileTreeApp

    com.mtel.androidbea

    com.scb.breezebanking.hk

    hk.com.hsbc.hsbchkmobilebanking

    com.aff.otpdirekt

    com.ideomobile.hapoalim

    com.infrasofttech.indianBank

    com.mobikwik_new

AES_key
AES_key
AES_key
AES_key
AES_key
AES_key
AES_key
AES_key
AES_key
AES_key
AES_key
AES_key
AES_key

Targets

    • Target

      ae957f043d9e0517dd50d38bc9b7f8f298057278d4f4f905299ff38b017e608a.bin

    • Size

      4.8MB

    • MD5

      83ba16f6348b528b8244fa6eff3f3a8e

    • SHA1

      07e5fff34ffc326754dbfca48cf120a2cf5c1c16

    • SHA256

      ae957f043d9e0517dd50d38bc9b7f8f298057278d4f4f905299ff38b017e608a

    • SHA512

      787da8383ef6e1f60222d2ce0f6edc262c8cb195c75a30262d896c8545b40cf9619eef75c2ff1b01cefaf6951ae9e51374dc491507b384fff329971c463f7ad4

    • SSDEEP

      49152:i5RsEXr6c7Kozj76Q45iS7xrGZrN+UiR8jVKScZNk+OCXEm1x6WnRUoffA:6Rstalzj76J5iSRGMMVK+2Em1x1pA

    • Octo

      Octo is a banking malware with remote access capabilities first seen in April 2022.

    • Octo payload

    • Loads dropped Dex/Jar

      Runs executable file dropped to the device during analysis.

    • Makes use of the framework's Accessibility service

      Retrieves information displayed on the phone screen using AccessibilityService.

    • Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps)

    • Queries the phone number (MSISDN for GSM devices)

    • Acquires the wake lock

    • Makes use of the framework's foreground persistence service

      Application may abuse the framework's foreground service to continue running in the foreground.

    • Queries the mobile country code (MCC)

    • Queries the unique device ID (IMEI, MEID, IMSI)

    • Reads information about phone network operator.

    • Requests disabling of battery optimizations (often used to enable hiding in the background).

MITRE ATT&CK Mobile v15

Tasks