Extracted

Extracted

• • Target
    _cac4a6a67213b3ddf66647c62db64f918132f8e21ee6bc1def13b82b2d6d6d1b.zip
  • Size 1.1MB
  • SHA256 cac4a6a67213b3ddf66647c62db64f918132f8e21ee6bc1def13b82b2d6d6d1b
  • MD5 c11ff1a0b8be80cac7d838b5f4237822
  • SHA1 826976a6e5f248002c8e630ca010b3cc1c11e2f8
  • SHA512 5849b0775fa2945d3c78966d5feccff2fbd98d25d0f2fa3b1a4b9c6c79212bc2e5578005a6f440019c5cdeaf3eec2fc1904518f1f7299f62aadecd325d23a9ed
  • SSDEEP 24576:8CW/LO0MFI+3ICKKWwcwFHWvNXvhkNUGGBQHnRWC8hia7oDHnlwSEU0:8CxjICvWVwYFBa2iaEDFfP0
  • TLSH
    T12F451243F39C8B13D8AE97748E5BC690A6357E44CF1267676A40731E0CB37889E22F56
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  bankerdefense_evasiondiscoveryevasionexecutionoctoimpactinfostealerpersistencerattrojan

  • Octo

    Octo is a banking malware with remote access capabilities first seen in April 2022.

    bankertrojaninfostealerratocto

  • Octo family

    octo

  • Octo payload

  • Loads dropped Dex/Jar

    Runs executable file dropped to the device during analysis.

    evasion

  • Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps)

    bankerdiscovery

  • Queries the phone number (MSISDN for GSM devices)

    discovery

  • Acquires the wake lock

  • Makes use of the framework's foreground persistence service

    Application may abuse the framework's foreground service to continue running in the foreground.

    defense_evasionpersistence

  • Queries the mobile country code (MCC)

    discovery

  • Reads information about phone network operator.

    discovery
  behavioral1