Extracted

• • Target
    bf943e30db49a3e3f6172c3ff7737ea1cf6e7115af8a98d32888609f4c8a8544
  • Size 9.6MB
  • SHA256 bf943e30db49a3e3f6172c3ff7737ea1cf6e7115af8a98d32888609f4c8a8544
  • MD5 5d5bdc01e860932b70709c8d87ce4216
  • SHA1 b9f27a7cfe591c6437f6e45c41f4b28c7ab4ac2c
  • SHA512 ff609380316878ffcde677a2803863fe21eb4baaca85574f8d862a394c5fe2782bd23521e23d7b9d566134549d92a94c2ebf35e0bcf97ffb57cee6f690c500d7
  • SSDEEP 196608:P6QxPtkowcPnPfbvqbCivnRhgj98NuO+JMYm:jVtktcPnPfWzG9xM/
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  evasiontanglebotinfostealerspywaretrojan

  • TangleBot

    TangleBot is an Android SMS malware first seen in September 2021.

    trojaninfostealerspywaretanglebot

  • TangleBot payload

  • Tanglebot family

    tanglebot

  • Loads dropped Dex/Jar

    Runs executable file dropped to the device during analysis.

    evasion
  behavioral1behavioral2
• • Target
    base.apk
  • Size 7.5MB
  • SHA256 24aa5d5cbd55fd1b06e76c0add845372ec61152f0eaa79a3816fd0f339e4fd98
  • MD5 7cb349ab3a6de438fc2c33fbb895351a
  • SHA1 7f4c93dbb4c3cdc1cd1a5862e1938f351d91acba
  • SHA512 67f1095e1014f7d65e0b8ac4d5859274653142e9f4fb5ffca1cad7d6b5ea8cf864b8c0292fbd4ee676c2feffb7d49ab82b1651a63859ea28a240295c34a15314
  • SSDEEP 98304:PVKsc5iSRGQ2RsP3Mdij7/GOuB9QfMZXu6Jk:PUNrARqcYj7/Zyoh
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  bankercollectioncredential_accessdefense_evasiondiscoveryevasionoctoimpactinfostealerpersistencerattrojanstealth

  • Octo

    Octo is a banking malware with remote access capabilities first seen in April 2022.

    bankertrojaninfostealerratocto

  • Octo family

    octo

  • Octo payload

  • Removes its main activity from the application launcher

    stealthtrojanevasion

  • Loads dropped Dex/Jar

    Runs executable file dropped to the device during analysis.

    evasion

  • Makes use of the framework's Accessibility service

    Retrieves information displayed on the phone screen using AccessibilityService.

    collectiondefense_evasioncredential_access

  • Obtains sensitive information copied to the device clipboard

    Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.

    collectioncredential_accessimpact

  • Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps)

    bankerdiscovery

  • Queries the phone number (MSISDN for GSM devices)

    discovery

  • Acquires the wake lock

  • Makes use of the framework's foreground persistence service

    Application may abuse the framework's foreground service to continue running in the foreground.

    defense_evasionpersistence

  • Queries the mobile country code (MCC)

    discovery

  • Queries the unique device ID (IMEI, MEID, IMSI)

    discovery

  • Reads information about phone network operator.

    discovery

  • Requests disabling of battery optimizations (often used to enable hiding in the background).

    defense_evasion
  behavioral3behavioral4