Extracted

• • Target
    d24e7a0012af00a519a4f877586ed374949ae125cc10b78b010a88c3044f434e
  • Size 8.9MB
  • SHA256 d24e7a0012af00a519a4f877586ed374949ae125cc10b78b010a88c3044f434e
  • MD5 afdf660350a14d9416121d89350031b0
  • SHA1 3006444a3f2cc8d9533c75ad94c3555d9a77eb37
  • SHA512 f86ca21de022aaf4a407707a045b5fc5ab9247e1ee70f921a157e16f93c03d7d68c7932924f0c0ea1832d68b397232aad288fcca5760ff2b471888f953ff3359
  • SSDEEP 98304:lRQVKRau93XB5iSRGXGzDLFqKRsyjdnmDyL5b1K7bV9ZWr8sm5r5QNygD9zJxaeD:7QU0w3XBr3zDLFqKR7Khi8xngDv
  • TLSH
    T1EF969E33F34A883DCDC9B77750965F206A307818A74316DB390DE5609FA32DDAE69782
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  bankercollectioncredential_accessdefense_evasiondiscoveryevasionoctoimpactinfostealerpersistencerattrojan

  • Family: Octo

    Octo is a banking malware with remote access capabilities first seen in April 2022.

    bankertrojaninfostealerratocto

  • Octo payload

  • Loads dropped Dex/Jar

    Runs executable file dropped to the device during analysis.

    evasion

  • Makes use of the framework's Accessibility service

    Retrieves information displayed on the phone screen using AccessibilityService.

    collectiondefense_evasioncredential_access

  • Obtains sensitive information copied to the device clipboard

    Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.

    collectioncredential_accessimpact

  • Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps)

    bankerdiscovery

  • Queries the phone number (MSISDN for GSM devices)

    discovery

  • Acquires the wake lock

  • Makes use of the framework's foreground persistence service

    Application may abuse the framework's foreground service to continue running in the foreground.

    defense_evasionpersistence

  • Queries the mobile country code (MCC)

    discovery

  • Reads information about phone network operator.

    discovery

  • Requests disabling of battery optimizations (often used to enable hiding in the background).

    defense_evasion
  behavioral1