Extracted

• • Target

    7dd6bd944f7b5d318488c7248eef0963d549541033eba73e70d6f58b2869d946

  • Size

    5.8MB

  • MD5

    3f10ca5f8240436247044ed8acb3cb08

  • SHA1

    fd7853eb8602fabd08bcab771484d6c0d2f9c04f

  • SHA256

    7dd6bd944f7b5d318488c7248eef0963d549541033eba73e70d6f58b2869d946

  • SHA512

    3eb5c59e4fa9111e8e8910a1893c4e257b83b7200f54b21e5128ee5d313ef1bffdb1305285685c205f8f202718105b2a5201343d2865cfd8510746275841340e

  • SSDEEP

    98304:fauSOeSC8xMPw5+m8zwTjBlzVRIRpd2ZrWvyTSb93MSI5UilYxlYX3QH4V4BVbug:Cu3FaPwwmFTjBlRTT+9kDmY44WbudF7w

  Score

  1^/10
  behavioral1

• • Target

    base.apk

  • Size

    4.8MB

  • MD5

    8c58fb2b1793461645d81e42186d77ff

  • SHA1

    f97b64c08ebd1cb85e4821d2e13fb4e21aa23963

  • SHA256

    88b9ad1acb9c83ec9c99a28ca0cc6227cf3715c8dcd69d5c3589bb3aa1c35861

  • SHA512

    76d14120346c18b57062cb60458c17781536456281a522c403c6300474d32f9798147b27acb885227b21ca785ab6246005e065599dc5a9d0c9dd7e40dff98244

  • SSDEEP

    49152:wRsEXm4k45iS7xrG2/8A2aMxKdmj7hjVKSc/FrqAX3tsgMhFhJf7m:wRs6N5iSRGiQYmj75VKHHxMDhBK

  Score

  10^/10

  octobankercollectioncredential_accessdiscoveryevasionimpactinfostealerpersistencerattrojan

  • Octo

    Octo is a banking malware with remote access capabilities first seen in April 2022.

    bankertrojaninfostealerratocto

  • Octo family

    octo

  • Octo payload

  • Loads dropped Dex/Jar

    Runs executable file dropped to the device during analysis.

    evasion

  • Makes use of the framework's Accessibility service

    Retrieves information displayed on the phone screen using AccessibilityService.

    collectionevasioncredential_access

  • Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps)

    bankerdiscovery

  • Queries the phone number (MSISDN for GSM devices)

    discovery

  • Acquires the wake lock

  • Makes use of the framework's foreground persistence service

    Application may abuse the framework's foreground service to continue running in the foreground.

    evasionpersistence

  • Queries the mobile country code (MCC)

    discovery

  • Queries the unique device ID (IMEI, MEID, IMSI)

    discovery

  • Reads information about phone network operator.

    discovery

  • Requests disabling of battery optimizations (often used to enable hiding in the background).

    evasion
  behavioral2