Extracted

• • Target
    7dd6bd944f7b5d318488c7248eef0963d549541033eba73e70d6f58b2869d946
  • Size 5.8MB
  • SHA256 7dd6bd944f7b5d318488c7248eef0963d549541033eba73e70d6f58b2869d946
  • MD5 3f10ca5f8240436247044ed8acb3cb08
  • SHA1 fd7853eb8602fabd08bcab771484d6c0d2f9c04f
  • SHA512 3eb5c59e4fa9111e8e8910a1893c4e257b83b7200f54b21e5128ee5d313ef1bffdb1305285685c205f8f202718105b2a5201343d2865cfd8510746275841340e
  • SSDEEP 98304:fauSOeSC8xMPw5+m8zwTjBlzVRIRpd2ZrWvyTSb93MSI5UilYxlYX3QH4V4BVbug:Cu3FaPwwmFTjBlRTT+9kDmY44WbudF7w
  • MD5 SHA1 SHA512 SSDEEP

  Score

  1^/10
  behavioral1
• • Target
    base.apk
  • Size 4.8MB
  • SHA256 88b9ad1acb9c83ec9c99a28ca0cc6227cf3715c8dcd69d5c3589bb3aa1c35861
  • MD5 8c58fb2b1793461645d81e42186d77ff
  • SHA1 f97b64c08ebd1cb85e4821d2e13fb4e21aa23963
  • SHA512 76d14120346c18b57062cb60458c17781536456281a522c403c6300474d32f9798147b27acb885227b21ca785ab6246005e065599dc5a9d0c9dd7e40dff98244
  • SSDEEP 49152:wRsEXm4k45iS7xrG2/8A2aMxKdmj7hjVKSc/FrqAX3tsgMhFhJf7m:wRs6N5iSRGiQYmj75VKHHxMDhBK
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  octobankercollectioncredential_accessdiscoveryevasionimpactinfostealerpersistencerattrojan

  • Octo

    Octo is a banking malware with remote access capabilities first seen in April 2022.

    bankertrojaninfostealerratocto

  • Octo family

    octo

  • Octo payload

  • Loads dropped Dex/Jar

    Runs executable file dropped to the device during analysis.

    evasion

  • Makes use of the framework's Accessibility service

    Retrieves information displayed on the phone screen using AccessibilityService.

    collectionevasioncredential_access

  • Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps)

    bankerdiscovery

  • Queries the phone number (MSISDN for GSM devices)

    discovery

  • Acquires the wake lock

  • Makes use of the framework's foreground persistence service

    Application may abuse the framework's foreground service to continue running in the foreground.

    evasionpersistence

  • Queries the mobile country code (MCC)

    discovery

  • Queries the unique device ID (IMEI, MEID, IMSI)

    discovery

  • Reads information about phone network operator.

    discovery

  • Requests disabling of battery optimizations (often used to enable hiding in the background).

    evasion
  behavioral2