Extracted

Extracted

• • Target

    da1a62ea4f0c083c7371b869091e7e095ec071d765a78387e9c2a6cfa6c6fe0c

  • Size

    5.5MB

  • MD5

    9d4e632af5782358a9d94e77d9fe3950

  • SHA1

    9646b8f6d899b283e6abf1aea3ef70b15e4cfa3c

  • SHA256

    da1a62ea4f0c083c7371b869091e7e095ec071d765a78387e9c2a6cfa6c6fe0c

  • SHA512

    731b757589ebedd1709aef4d7af7eb43aa6a239eb31a3c72cd566b9c449a92373791125f39f5f0960523e23969a3463d65bfc3fe9842adfd3c2ea62578e4ffb0

  • SSDEEP

    98304:/GY2YCUW49Un5vyyKNHJZ/0d2ZrWdb9KH1Gz3fcWIJpct90VrsmUssD4te3x:T2Y9WyUn5yE9KkSPct9i/EXx

  Score

  10^/10

  tanglebotevasioninfostealerspywaretrojan

  • TangleBot

    TangleBot is an Android SMS malware first seen in September 2021.

    trojaninfostealerspywaretanglebot

  • TangleBot payload

  • Tanglebot family

    tanglebot

  • Loads dropped Dex/Jar

    Runs executable file dropped to the device during analysis.

    evasion
  behavioral1

• • Target

    base.apk

  • Size

    509KB

  • MD5

    07be46f53eb69d25aab65cb7530e7a60

  • SHA1

    26c4f115ff38908d02a22d67016e5f9fcd520a2a

  • SHA256

    a58ebc8a797b2debcfe998b6b3d298abd20cec9c41120ca34e0016fabbeda410

  • SHA512

    728b21b714516b8e8c97553a7d9e31dce9804cdccf04d97b3771263fa6d7b69782fb950be41f1821ac2e925902968e513c21322fa85d45f67b009a80e0b275d2

  • SSDEEP

    12288:T4rQh+ittRQhv13MH77GFMsGq25Mm+N7+uq+ans:T4rI+otRcvFMb7GqV5Mms6uBans

  Score

  10^/10

  octobankercollectioncredential_accessdiscoveryevasionimpactinfostealerpersistenceratstealthtrojan

  • Octo

    Octo is a banking malware with remote access capabilities first seen in April 2022.

    bankertrojaninfostealerratocto

  • Octo family

    octo

  • Octo payload

  • Removes its main activity from the application launcher

    stealthtrojanevasion

  • Loads dropped Dex/Jar

    Runs executable file dropped to the device during analysis.

    evasion

  • Makes use of the framework's Accessibility service

    Retrieves information displayed on the phone screen using AccessibilityService.

    collectionevasioncredential_access

  • Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps)

    bankerdiscovery

  • Queries the phone number (MSISDN for GSM devices)

    discovery

  • Acquires the wake lock

  • Makes use of the framework's foreground persistence service

    Application may abuse the framework's foreground service to continue running in the foreground.

    evasionpersistence

  • Performs UI accessibility actions on behalf of the user

    Application may abuse the accessibility service to prevent their removal.

    evasion

  • Queries the mobile country code (MCC)

    discovery

  • Queries the unique device ID (IMEI, MEID, IMSI)

    discovery

  • Reads information about phone network operator.

    discovery

  • Requests accessing notifications (often used to intercept notifications before users become aware).

    collectioncredential_access

  • Requests disabling of battery optimizations (often used to enable hiding in the background).

    evasion
  behavioral2