Extracted

• • Target

    5d784e42feb9a6eaf95a50cff924d1f6aee9d61db23548af45160aad52f6c45c

  • Size

    9.7MB

  • MD5

    3c8edc09b6670b1134f50f35ab6531b9

  • SHA1

    98c24c59514bd49770d6d4acdd13dcb892e6c443

  • SHA256

    5d784e42feb9a6eaf95a50cff924d1f6aee9d61db23548af45160aad52f6c45c

  • SHA512

    3d8fad8d1295d7787215021447568681e2fa235c38caf454bca6047004a085cdcf430729ccbfc9e932e518834e1798c4d916c6498c96638aa393131d25379477

  • SSDEEP

    196608:S0edPOXgX65O2PwQpOOctega3COvDFVZIeUJCsnMrExvXNDF+TdGs1M+YMG:beRd2Z3p5ct4ZIeSMKdq5m+Y

  Score

  10^/10

  tanglebotevasioninfostealerspywaretrojan

  • TangleBot

    TangleBot is an Android SMS malware first seen in September 2021.

    trojaninfostealerspywaretanglebot

  • TangleBot payload

  • Tanglebot family

    tanglebot

  • Loads dropped Dex/Jar

    Runs executable file dropped to the device during analysis.

    evasion
  behavioral1

• • Target

    base.apk

  • Size

    7.6MB

  • MD5

    4533b2231f3e08626cf63cdb8555c1ce

  • SHA1

    190a9329fafba8cc1101368020f860c0cde8b730

  • SHA256

    0d1dbbbcf2d9f6e66c931a4e0594322b4c37d4c00b31e88b4b43bcf3295da5d0

  • SHA512

    a9f37d06c6347e1bd1fcd9ccdee725cad2ebac6843324e3e2eb4300455076cbb3e796e21436c36b9c53a18e8e6294cb28153b5b6c74a12f9d8fc4131b9b44ede

  • SSDEEP

    196608:efYmEq3XnRwPrdU0nvLfPFqd9GwrQ01jElY:lLrdLDy3Q1lY

  Score

  10^/10

  octobankercollectioncredential_accessdiscoveryevasionimpactinfostealerpersistencerattrojan

  • Octo

    Octo is a banking malware with remote access capabilities first seen in April 2022.

    bankertrojaninfostealerratocto

  • Octo family

    octo

  • Octo payload

  • Loads dropped Dex/Jar

    Runs executable file dropped to the device during analysis.

    evasion

  • Makes use of the framework's Accessibility service

    Retrieves information displayed on the phone screen using AccessibilityService.

    collectionevasioncredential_access

  • Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps)

    bankerdiscovery

  • Queries the phone number (MSISDN for GSM devices)

    discovery

  • Acquires the wake lock

  • Makes use of the framework's foreground persistence service

    Application may abuse the framework's foreground service to continue running in the foreground.

    evasionpersistence

  • Queries the mobile country code (MCC)

    discovery

  • Queries the unique device ID (IMEI, MEID, IMSI)

    discovery

  • Reads information about phone network operator.

    discovery

  • Requests disabling of battery optimizations (often used to enable hiding in the background).

    evasion
  behavioral2