Extracted

• • Target
    2f2c22fab0c2ea3c7ce462a47af13578643bb06241855642d86379926c67541a
  • Size 8.4MB
  • SHA256 2f2c22fab0c2ea3c7ce462a47af13578643bb06241855642d86379926c67541a
  • MD5 c60d5119966da210a00dd5d084773de2
  • SHA1 3ee356b9364d95feb6262396b1ef17b6fd3ee296
  • SHA512 706ceb1204fe5b43ef9b9d4fcd5a35c402bc45c8df1b3c9deee901a6b01d66046ba9f6c44823a83ac8028d5ce729fff1c4b45a7e44e63ff87d54e962a867fd39
  • SSDEEP 98304:E0VKqG5iSRGAJTKSj7RbRsuKYgfvcE/waI4vWoe:E0U1rfnj7RbRVgHQb
  • TLSH
    T114968C52B78A8D65D8DD7A3864BAA350F739284CE78367D70109DA70AD533F17F28382
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  bankercollectioncredential_accessdefense_evasiondiscoveryevasionoctoimpactinfostealerpersistencerattrojanstealth

  • Family: Octo

    Octo is a banking malware with remote access capabilities first seen in April 2022.

    bankertrojaninfostealerratocto

  • Octo payload

  • Removes its main activity from the application launcher

    stealthtrojanevasion

  • Checks Android system properties for emulator presence.

    defense_evasion

  • Loads dropped Dex/Jar

    Runs executable file dropped to the device during analysis.

    evasion

  • Makes use of the framework's Accessibility service

    Retrieves information displayed on the phone screen using AccessibilityService.

    collectiondefense_evasioncredential_access

  • Obtains sensitive information copied to the device clipboard

    Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.

    collectioncredential_accessimpact

  • Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps)

    bankerdiscovery

  • Queries the phone number (MSISDN for GSM devices)

    discovery

  • Acquires the wake lock

  • Makes use of the framework's foreground persistence service

    Application may abuse the framework's foreground service to continue running in the foreground.

    defense_evasionpersistence

  • Queries the mobile country code (MCC)

    discovery

  • Queries the unique device ID (IMEI, MEID, IMSI)

    discovery

  • Reads information about phone network operator.

    discovery
  behavioral1behavioral2