Extracted

• • Target

    b321719ebcb565c70ee1c7b6505b72aa4adc4308b6e61a64d3a21f9c9d52273e

  • Size

    9.4MB

  • MD5

    855d32b7bed8432df4132ce328d32dc1

  • SHA1

    4c5c3717d3a56f004b71673ec1ebb610e6396920

  • SHA256

    b321719ebcb565c70ee1c7b6505b72aa4adc4308b6e61a64d3a21f9c9d52273e

  • SHA512

    37bc99458813d592c477c7ad583540d67f9c655655a2c66126cd56dbc67832bd0719774b5b0cf639d088e3b6dc5d35d7dd5dca52d837dddd5823092b9fa614c7

  • SSDEEP

    196608:M+uJPAWDGAIwBpLKthDCHE77CyZOAUPcqslE83de:M+uJZlIw0RSPlrh

  Score

  10^/10

  tanglebotevasioninfostealerspywaretrojan

  • TangleBot

    TangleBot is an Android SMS malware first seen in September 2021.

    trojaninfostealerspywaretanglebot

  • TangleBot payload

  • Tanglebot family

    tanglebot

  • Loads dropped Dex/Jar

    Runs executable file dropped to the device during analysis.

    evasion
  behavioral1

• • Target

    base.apk

  • Size

    8.9MB

  • MD5

    e7962f6e28ffee1b2a0f792c48e6705c

  • SHA1

    bf245d5c32bb0cdb710c9c7dd4e994c5c783144f

  • SHA256

    6661a3543ad38bb71f8b780b20fdc6479c91a12c37062a28dfd40045a2d9d9aa

  • SHA512

    09199fd843949480eac1818d9731ef533b576399b7d3a7dce69923578f57de5e62fd4bdcd24fc3538dc206d698bbaec8af4a094c903b6a427c3be4866ffa7e68

  • SSDEEP

    98304:DnH3yRsXB925kxj+XXUK3P/7F5iSRGNdVKlVCFj7ODCvpDK95:b3yR2P2Vxpr+UTQj7Zs

  Score

  10^/10

  octobankercollectioncredential_accessdiscoveryevasionimpactinfostealerpersistencerattrojan

  • Octo

    Octo is a banking malware with remote access capabilities first seen in April 2022.

    bankertrojaninfostealerratocto

  • Octo family

    octo

  • Octo payload

  • Loads dropped Dex/Jar

    Runs executable file dropped to the device during analysis.

    evasion

  • Makes use of the framework's Accessibility service

    Retrieves information displayed on the phone screen using AccessibilityService.

    collectionevasioncredential_access

  • Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps)

    bankerdiscovery

  • Queries the phone number (MSISDN for GSM devices)

    discovery

  • Acquires the wake lock

  • Makes use of the framework's foreground persistence service

    Application may abuse the framework's foreground service to continue running in the foreground.

    evasionpersistence

  • Queries the mobile country code (MCC)

    discovery

  • Queries the unique device ID (IMEI, MEID, IMSI)

    discovery

  • Reads information about phone network operator.

    discovery

  • Requests disabling of battery optimizations (often used to enable hiding in the background).

    evasion
  behavioral2