Extracted

• • Target

    1a1c44eb08ae0009d56c03349578d2bed5249fecfa4034268e2903d26f5e05b6

  • Size

    12.9MB

  • MD5

    fb53b828d8e37a4731ea1eac502ad293

  • SHA1

    9b7f2687a78c2a1e61ff10429f41c0bbd4585189

  • SHA256

    1a1c44eb08ae0009d56c03349578d2bed5249fecfa4034268e2903d26f5e05b6

  • SHA512

    444b97a0b9a3e99ede5ae969c582fcea2f75965a1228887ae04c1a33adfbc0e87b01a6e05d9de4e8a24b7837a36c6e743afdc395f6c665cadeba9f7a18a6d766

  • SSDEEP

    196608:Gql43raRilMWt3XPUJGZodMHzmfOUBWvYZbEP9dWS7NzDjombmUprZJgB:Gg43rP98GZHzmmUBWcEPjWSZNprZJA

  Score

  7^/10

  collectioncredential_accessevasionimpactdiscoverypersistence

  • Loads dropped Dex/Jar

    Runs executable file dropped to the device during analysis.

    evasion

  • Obtains sensitive information copied to the device clipboard

    Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.

    collectioncredential_accessimpact

  • Queries the mobile country code (MCC)

    discovery
  behavioral1behavioral2

• • Target

    1_d8efd0e44d.cat

  • Size

    8.4MB

  • MD5

    35a1d2116129b916983847efd403521a

  • SHA1

    708b476ab4c579dde5543ef1e8ebfa23f0f601cc

  • SHA256

    a9a3ac83d69afd859727c1865335b84768fb6af3222e317ec01e5b3d743e6f66

  • SHA512

    2f257a743ffc338950cdf60848da5ecaee18d47dd328c6d13ff3e23a55a280d302a491f35d94da37344c634c8b2f4423d6dcbee8021aa494d8ca16955d774e23

  • SSDEEP

    196608:143raRilMWt3XPUJGZodMHzmfOUBWvYZS:143rP98GZHzmmUBWV

  Score

  10^/10

  octobankercollectioncredential_accessdefense_evasiondiscoveryevasionimpactinfostealerpersistencerattrojanstealth

  • Octo

    Octo is a banking malware with remote access capabilities first seen in April 2022.

    bankertrojaninfostealerratocto

  • Octo family

    octo

  • Octo payload

  • Removes its main activity from the application launcher

    stealthtrojanevasion

  • Loads dropped Dex/Jar

    Runs executable file dropped to the device during analysis.

    evasion

  • Makes use of the framework's Accessibility service

    Retrieves information displayed on the phone screen using AccessibilityService.

    collectiondefense_evasioncredential_access

  • Obtains sensitive information copied to the device clipboard

    Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.

    collectioncredential_accessimpact

  • Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps)

    bankerdiscovery

  • Queries the phone number (MSISDN for GSM devices)

    discovery

  • Acquires the wake lock

  • Makes use of the framework's foreground persistence service

    Application may abuse the framework's foreground service to continue running in the foreground.

    defense_evasionpersistence

  • Queries the mobile country code (MCC)

    discovery

  • Queries the unique device ID (IMEI, MEID, IMSI)

    discovery

  • Reads information about phone network operator.

    discovery

  • Requests disabling of battery optimizations (often used to enable hiding in the background).

    defense_evasion
  behavioral3behavioral4