Extracted

• • Target

    d6bb85aca7bd7540f32d0a4a41692dea3947a41a4e7dbf7f438882cdaafe888a.bin

  • Size

    4.8MB

  • MD5

    6fe5d5e9e03738fc3191167ba5d07c76

  • SHA1

    24208d31ec6ca363f934fc23fb30f91636a63e22

  • SHA256

    d6bb85aca7bd7540f32d0a4a41692dea3947a41a4e7dbf7f438882cdaafe888a

  • SHA512

    53e5e6607b093d9c5de6228026b20307787bc7d009113fbeae26370dd398ea14749e798607cbde0b6860034617922d4e495eb73cf72e3126fa4c8ca2b57703f7

  • SSDEEP

    49152:jRsEX9p6LvKphj7v45iS7xrGzrUugTBjVKScYZcDqaIOI2X3dpj3asx2P:jRsIavshj7Q5iSRGcZVKPAOI2HdxlkP

  Score

  10^/10

  octobankercollectioncredential_accessdiscoveryevasionimpactinfostealerpersistencerattrojan

  • Octo

    Octo is a banking malware with remote access capabilities first seen in April 2022.

    bankertrojaninfostealerratocto

  • Octo family

    octo

  • Octo payload

  • Loads dropped Dex/Jar

    Runs executable file dropped to the device during analysis.

    evasion

  • Makes use of the framework's Accessibility service

    Retrieves information displayed on the phone screen using AccessibilityService.

    collectionevasioncredential_access

  • Obtains sensitive information copied to the device clipboard

    Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.

    collectioncredential_accessimpact

  • Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps)

    bankerdiscovery

  • Queries the phone number (MSISDN for GSM devices)

    discovery

  • Acquires the wake lock

  • Makes use of the framework's foreground persistence service

    Application may abuse the framework's foreground service to continue running in the foreground.

    evasionpersistence

  • Queries the mobile country code (MCC)

    discovery

  • Queries the unique device ID (IMEI, MEID, IMSI)

    discovery

  • Reads information about phone network operator.

    discovery

  • Requests disabling of battery optimizations (often used to enable hiding in the background).

    evasion
  behavioral1behavioral2