Extracted

• • Target

    88f64544e19aecb9061fadb810a11581f359a9273e9a4d135f0897fdd8deb3a7

  • Size

    9.5MB

  • MD5

    54f848f11037b685d15dd3bee422ebd4

  • SHA1

    fc46991898f962423c1c75aee5edd8bc85e4620f

  • SHA256

    88f64544e19aecb9061fadb810a11581f359a9273e9a4d135f0897fdd8deb3a7

  • SHA512

    b0395e7569720aa52156eca66f054ebdbfdc845d452d5d300082ea765053ec09ff9d173b9507e4eb0e9f41a5921157df84b5ed22b65c5714cab1793b794743fa

  • SSDEEP

    196608:A9ME3r+G97KD/6gTGEVTQSXP+wWwZNt7t26vzFx3pXeAflf:iTSG97KDyapnRPFRx3n

  Score

  10^/10

  tanglebotevasioninfostealerspywaretrojan

  • TangleBot

    TangleBot is an Android SMS malware first seen in September 2021.

    trojaninfostealerspywaretanglebot

  • TangleBot payload

  • Tanglebot family

    tanglebot

  • Loads dropped Dex/Jar

    Runs executable file dropped to the device during analysis.

    evasion
  behavioral1

• • Target

    base.apk

  • Size

    8.3MB

  • MD5

    51386ae44b4a92f7dedc94a24903b859

  • SHA1

    7382b09c9ec59228991ed16219f5ed3e74ce2144

  • SHA256

    d5cec3b8027cb372260c406a73024637522feb40cb6565eca1b77d770304f8ec

  • SHA512

    b1ab1446ec798ea53a789cde6d6a6a309f02a2e2569b8392f46aaa1eee81c21550469479c2ca1d6a20977dc0a1b55266bb8df8276490cc14e51a59f2199fd5eb

  • SSDEEP

    196608:t5M6fD4TBKZFKjrdUpje5xNj7AR4pUEKbce:zP8BKZFKjrdj5Zt6ce

  Score

  10^/10

  octobankercollectioncredential_accessdiscoveryevasionimpactinfostealerpersistencerattrojan

  • Octo

    Octo is a banking malware with remote access capabilities first seen in April 2022.

    bankertrojaninfostealerratocto

  • Octo family

    octo

  • Octo payload

  • Loads dropped Dex/Jar

    Runs executable file dropped to the device during analysis.

    evasion

  • Makes use of the framework's Accessibility service

    Retrieves information displayed on the phone screen using AccessibilityService.

    collectionevasioncredential_access

  • Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps)

    bankerdiscovery

  • Queries the phone number (MSISDN for GSM devices)

    discovery

  • Acquires the wake lock

  • Makes use of the framework's foreground persistence service

    Application may abuse the framework's foreground service to continue running in the foreground.

    evasionpersistence

  • Queries the mobile country code (MCC)

    discovery

  • Queries the unique device ID (IMEI, MEID, IMSI)

    discovery

  • Reads information about phone network operator.

    discovery

  • Requests disabling of battery optimizations (often used to enable hiding in the background).

    evasion
  behavioral2