Extracted

• • Target

    6661a3543ad38bb71f8b780b20fdc6479c91a12c37062a28dfd40045a2d9d9aa

  • Size

    8.9MB

  • MD5

    e7962f6e28ffee1b2a0f792c48e6705c

  • SHA1

    bf245d5c32bb0cdb710c9c7dd4e994c5c783144f

  • SHA256

    6661a3543ad38bb71f8b780b20fdc6479c91a12c37062a28dfd40045a2d9d9aa

  • SHA512

    09199fd843949480eac1818d9731ef533b576399b7d3a7dce69923578f57de5e62fd4bdcd24fc3538dc206d698bbaec8af4a094c903b6a427c3be4866ffa7e68

  • SSDEEP

    98304:DnH3yRsXB925kxj+XXUK3P/7F5iSRGNdVKlVCFj7ODCvpDK95:b3yR2P2Vxpr+UTQj7Zs

  Score

  10^/10

  octobankercollectioncredential_accessdiscoveryevasionimpactinfostealerpersistencerattrojan

  • Octo

    Octo is a banking malware with remote access capabilities first seen in April 2022.

    bankertrojaninfostealerratocto

  • Octo family

    octo

  • Octo payload

  • Loads dropped Dex/Jar

    Runs executable file dropped to the device during analysis.

    evasion

  • Makes use of the framework's Accessibility service

    Retrieves information displayed on the phone screen using AccessibilityService.

    collectionevasioncredential_access

  • Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps)

    bankerdiscovery

  • Queries the phone number (MSISDN for GSM devices)

    discovery

  • Acquires the wake lock

  • Makes use of the framework's foreground persistence service

    Application may abuse the framework's foreground service to continue running in the foreground.

    evasionpersistence

  • Queries the mobile country code (MCC)

    discovery

  • Queries the unique device ID (IMEI, MEID, IMSI)

    discovery

  • Reads information about phone network operator.

    discovery

  • Requests disabling of battery optimizations (often used to enable hiding in the background).

    evasion
  behavioral1