General

  • Target

    3e7970a5992aa0a27fb7fb9a9eb482290f50b6a1781844113437f647fc0b73b3.bin

  • Size

    4.8MB

  • Sample

    241122-117atazrbv

  • MD5

    8cc8f36e6e6077541de7358cedc82df7

  • SHA1

    6979bc694aa59fb5e81325439004b99519328f4f

  • SHA256

    3e7970a5992aa0a27fb7fb9a9eb482290f50b6a1781844113437f647fc0b73b3

  • SHA512

    639990b999c44dede8e8afc7e31863ce3f0d8c16bb7a8a05252277e64a83031aed3b1b528084691f316ffd52491fac9f76faa611ad0f851117e57a36957e079c

  • SSDEEP

    98304:eRs94mA93Xr5iSRG4lVKCouMI7J6JX27QxJ:eRILq3XrrrUz0c27QxJ

Malware Config

Extracted

Family

octo

C2

https://b49f61bf4f619dbe7c723f3f45cd0a9e.io

https://71bd4a03ddb94320016f0defd76e1ae1.com

Attributes
  • target_apps

    at.spardat.bcrmobile

    at.spardat.netbanking

    com.bankaustria.android.olb

    com.bmo.mobile

    com.cibc.android.mobi

    com.estsoft.alyac

    com.ahnlab.v3mobilesecurity.soda

    com.rbc.mobile.android

    com.scotiabank.mobile

    com.td

    cz.airbank.android

    eu.inmite.prj.kb.mobilbank

    com.bankinter.launcher

    com.kutxabank.android

    com.rsi

    com.tecnocom.cajalaboral

    es.bancopopular.nbmpopular

    es.evobanco.bancamovil

    es.lacaixa.mobile.android.newwapicon

    com.dbs.hk.dbsmbanking

    com.FubonMobileClient

    com.hangseng.rbmobile

    com.MobileTreeApp

    com.mtel.androidbea

    com.scb.breezebanking.hk

    hk.com.hsbc.hsbchkmobilebanking

    com.aff.otpdirekt

    com.ideomobile.hapoalim

    com.infrasofttech.indianBank

    com.mobikwik_new

AES_key
AES_key
AES_key
AES_key
AES_key
AES_key
AES_key
AES_key
AES_key
AES_key
AES_key
AES_key
AES_key
AES_key
AES_key
AES_key
AES_key
AES_key
AES_key
AES_key
AES_key

Targets

    • Target

      3e7970a5992aa0a27fb7fb9a9eb482290f50b6a1781844113437f647fc0b73b3.bin

    • Size

      4.8MB

    • MD5

      8cc8f36e6e6077541de7358cedc82df7

    • SHA1

      6979bc694aa59fb5e81325439004b99519328f4f

    • SHA256

      3e7970a5992aa0a27fb7fb9a9eb482290f50b6a1781844113437f647fc0b73b3

    • SHA512

      639990b999c44dede8e8afc7e31863ce3f0d8c16bb7a8a05252277e64a83031aed3b1b528084691f316ffd52491fac9f76faa611ad0f851117e57a36957e079c

    • SSDEEP

      98304:eRs94mA93Xr5iSRG4lVKCouMI7J6JX27QxJ:eRILq3XrrrUz0c27QxJ

    • Octo

      Octo is a banking malware with remote access capabilities first seen in April 2022.

    • Octo family

    • Octo payload

    • Loads dropped Dex/Jar

      Runs executable file dropped to the device during analysis.

    • Makes use of the framework's Accessibility service

      Retrieves information displayed on the phone screen using AccessibilityService.

    • Obtains sensitive information copied to the device clipboard

      Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.

    • Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps)

    • Queries the phone number (MSISDN for GSM devices)

    • Acquires the wake lock

    • Makes use of the framework's foreground persistence service

      Application may abuse the framework's foreground service to continue running in the foreground.

    • Performs UI accessibility actions on behalf of the user

      Application may abuse the accessibility service to prevent their removal.

    • Queries the mobile country code (MCC)

    • Queries the unique device ID (IMEI, MEID, IMSI)

    • Reads information about phone network operator.

    • Requests disabling of battery optimizations (often used to enable hiding in the background).

    • Requests modifying system settings.

    • Tries to add a device administrator.

MITRE ATT&CK Mobile v15

Tasks