General
- Target bot_wrapped.apk
- Size 6.3MB
- Sample260805-svsapszdrd
- SHA256 655d0dba5fdefb9ec8ffb9e4bee15d9ff9289b2907280f38b0777d8dd944c031
Score
10/10
Malware Config
Targets
-
- Target bot_wrapped.apk
- Size 6.3MB
- SHA256 655d0dba5fdefb9ec8ffb9e4bee15d9ff9289b2907280f38b0777d8dd944c031
Score10/10-
Family: Octo
Octo is a banking malware with remote access capabilities first seen in April 2022.
-
Loads dropped Dex/Jar
Runs executable file dropped to the device during analysis.
-
Makes use of the framework's Accessibility service
Retrieves information displayed on the phone screen using AccessibilityService.
-
Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps)
-
Queries the phone number (MSISDN for GSM devices)
-
Acquires the wake lock
-
Makes use of the framework's foreground persistence service
Application may abuse the framework's foreground service to continue running in the foreground.
-
Queries information about active data network
-
Queries the mobile country code (MCC)
-
Reads information about phone network operator.
-
Requests accessing notifications (often used to intercept notifications before users become aware).
-
Requests disabling of battery optimizations (often used to enable hiding in the background).
-
Requests modifying system settings.
MITRE ATT&CK Mobile v16
Defense Evasion
Download New Code at Runtime
1Foreground Persistence
1Hide Artifacts
1User Evasion
1Input Injection
1Credential Access
Access Notifications
1Input Capture
2GUI Input Capture
1Keylogging
1Discovery
Software Discovery
1Security Software Discovery
1System Network Configuration Discovery
3System Network Connections Discovery
1