Extracted

• • Target

    5610bfeab76710ba02decfb28e7685fd7ab02b48b78ae63548c387f63288d036

  • Size

    8.5MB

  • MD5

    368d70d254f488bafb87fa4293fc048a

  • SHA1

    4764d5e82a267047f11a1d1d8cdd8084546fc035

  • SHA256

    5610bfeab76710ba02decfb28e7685fd7ab02b48b78ae63548c387f63288d036

  • SHA512

    6b1b4123c6850690ba129c18192decd6e19879f29079390701a395cd78d25b051243fb1347da1c0150451214df8e0ca3c678c9094c77e9066ecdf51f41e5fd5b

  • SSDEEP

    98304:imISrQZbMhbULwKbTciYMoI57VKpN5iSRGLFEGfkk23y2j7uCY8XKP2R7oRsq+gy:hSiIxU3rBGfk1Lj7f4k7oRSv

  Score

  10^/10

  octobankercollectioncredential_accessdiscoveryevasionimpactinfostealerpersistencerattrojan

  • Octo

    Octo is a banking malware with remote access capabilities first seen in April 2022.

    bankertrojaninfostealerratocto

  • Octo family

    octo

  • Octo payload

  • Loads dropped Dex/Jar

    Runs executable file dropped to the device during analysis.

    evasion

  • Makes use of the framework's Accessibility service

    Retrieves information displayed on the phone screen using AccessibilityService.

    collectionevasioncredential_access

  • Obtains sensitive information copied to the device clipboard

    Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.

    collectioncredential_accessimpact

  • Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps)

    bankerdiscovery

  • Queries the phone number (MSISDN for GSM devices)

    discovery

  • Acquires the wake lock

  • Makes use of the framework's foreground persistence service

    Application may abuse the framework's foreground service to continue running in the foreground.

    evasionpersistence

  • Queries the mobile country code (MCC)

    discovery

  • Queries the unique device ID (IMEI, MEID, IMSI)

    discovery

  • Reads information about phone network operator.

    discovery

  • Requests disabling of battery optimizations (often used to enable hiding in the background).

    evasion
  behavioral1behavioral2