Extracted

• • Target

    2680e0e65fdd8c26eec70f1860ca166a1232b1e4a36b7a256b9fb5130af21e85

  • Size

    7.2MB

  • MD5

    9df85db16c12716a63bcb58b704cac26

  • SHA1

    3e61f7cc8e05f3b03cdaa21d9d2798f7efbcd9ea

  • SHA256

    2680e0e65fdd8c26eec70f1860ca166a1232b1e4a36b7a256b9fb5130af21e85

  • SHA512

    2cd4d771fe9df6ef0e113cda93a38be13ee3c4e4768fc498e3057416b1463b02151f41d91a148c5119451cd7430fc0e776eb6b58f165fa24de49ed6b04989a8f

  • SSDEEP

    98304:8h44r5i5O975iSRGVTVKHhQP0jjOx3XyRsZjLFmQY6KeoJ:a1ik97rsUU0jj83XyRE21

  Score

  10^/10

  octobankercollectioncredential_accessdiscoveryevasionimpactinfostealerpersistencerattrojan

  • Octo

    Octo is a banking malware with remote access capabilities first seen in April 2022.

    bankertrojaninfostealerratocto

  • Octo family

    octo

  • Octo payload

  • Loads dropped Dex/Jar

    Runs executable file dropped to the device during analysis.

    evasion

  • Makes use of the framework's Accessibility service

    Retrieves information displayed on the phone screen using AccessibilityService.

    collectionevasioncredential_access

  • Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps)

    bankerdiscovery

  • Queries the phone number (MSISDN for GSM devices)

    discovery

  • Acquires the wake lock

  • Makes use of the framework's foreground persistence service

    Application may abuse the framework's foreground service to continue running in the foreground.

    evasionpersistence

  • Queries the mobile country code (MCC)

    discovery

  • Queries the unique device ID (IMEI, MEID, IMSI)

    discovery

  • Requests disabling of battery optimizations (often used to enable hiding in the background).

    evasion
  behavioral1