Extracted

• • Target
    31b9511b3d9e5b891071ba6490eb8ed1d8bc197e74e641b96d8d32cdd064ede7.apk
  • Size 21.6MB
  • SHA256 31b9511b3d9e5b891071ba6490eb8ed1d8bc197e74e641b96d8d32cdd064ede7
  • MD5 04172579e214e11db1c7011aa6cda228
  • SHA1 fe21820d6bfd03b9f028f3c4e0de7632ab43dd9f
  • SHA512 820ce672956e3e4f423c34e889fc33ece66c23cb8bc81c58276ffaadaf1acf52f04833cef9b116dfabfd59bb9b9bcf98a9685d98aba81664ebba378736aef6a2
  • SSDEEP 393216:K8FFrQute2NDdn4tgBEP67tsKEJXcMri0watNmZsguO:JFTe2NF4y2PGtsKYcMG03NmH
  • TLSH
    T1B937D01A37418F39E46D2931C04F13674117BE055EA152D729AAF20CEA3F6F36EF5A82
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  9^/10

  bankerdefense_evasiondropperevasionobfuscatedotppersistencestealer

  • Encrypted or packed staged payload inside Android package

    Extracted asset shows near-random entropy without a recognised container header, indicating an encrypted secondary payload staged for runtime decryption and loading. Correlate with any runtime class-loading detection on the same sample.

    obfuscateddropper

  • Notification listener abuse for OTP and message theft

    Binds a notification listener service and reads posted notification content, optionally dismissing notifications afterwards to hide them. This harvests one-time passcodes and private messages without ever requesting SMS permissions, which is why it has largely replaced SMS interception in modern ban

    stealerotpbanker

  • Loads dropped Dex/Jar

    Runs executable file dropped to the device during analysis.

    evasion

  • Makes use of the framework's foreground persistence service

    Application may abuse the framework's foreground service to continue running in the foreground.

    defense_evasionpersistence
  behavioral1behavioral2behavioral3
• • Target
    app
  • Size 10.4MB
  • SHA256 08472e8c4b2b01485cec86c08791d4a02472a2df6912dd861ec51297629d467b
  • MD5 e9c0c6a7f7262725a0542f52b5d7f39f
  • SHA1 c9da9a6bb2d4d9f13f7b6bd0c97ac55b1251f886
  • SHA512 70d72fb013fc579f7854e20133e72f460c0d4f1d3b8b523d811d942b93e764fa717ac3690a02d7e92af04067c04b4da3fb310245999693545a418a0309bfb9b6
  • SSDEEP 196608:bFv0RUrQUylj7E9uQe2nNDdn4tgBXUNFYyn6fTtKz9:bFFrQute2NDdn4tgBEP67ts9
  • TLSH
    T1C0B6DF1777864F38F88D3934814F13278617B94957A152DB09ABC104EE1EBF3AEB5B82
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  bankerc2collectioncredential_accessdefense_evasiondiscoverydropperevasionexfiltrationoctoimpactinfostealerobfuscatedotpoverlaypersistenceratsmsspywarestealertrojan

  • Family: Octo

    Octo is a banking malware with remote access capabilities first seen in April 2022.

    bankertrojaninfostealerratocto

  • Octo payload

  • Accessibility-driven UI automation to self-grant permissions

    Locates nodes in the Settings or package-installer user interface by text or view identifier and dispatches synthetic clicks. This lets the application approve its own permission dialogs, complete side-loading, and intercept attempts to reach the uninstall screen without any real user consent.

    evasionpersistencedropper

  • Android SMS interception and OTP exfiltration

    Registers a high-priority SMS_RECEIVED receiver, parses inbound message bodies and aborts the broadcast to hide messages from the user, alongside network exfiltration primitives. This is the standard 2FA/OTP theft pattern used to complete fraudulent transactions.

    stealersmsotp

  • Android banker: accessibility service abuse with overlay injection

    DEX references AccessibilityService event hooks together with window-overlay creation and credential-capture primitives. This combination is the canonical Android banking-trojan pattern: the app reads screen content and injects fake login windows over legitimate banking apps.

    bankertrojanoverlay

  • Boot-triggered restart with disguised foreground service

    Restarts itself on device boot and holds a foreground service with a low-visibility notification channel, keeping the process alive across reboots and outside normal background limits. Malicious use is distinguished by pairing this with surveillance or remote-control primitives.

    persistence

  • Contact harvesting with SMS self-propagation

    Reads the device contact list and sends messages to the retrieved numbers, the distribution mechanism behind SMS worm campaigns. The victim's own address book becomes the delivery channel, which is why these campaigns spread rapidly within a region.

    smstrojanexfiltration

  • Keylogging via accessibility text-change events

    Subscribes to text-change and view-focus accessibility events and reads the text of nodes belonging to other applications, capturing everything typed on the device including passwords entered into unrelated apps. Password-field flags are typically inspected so credential entry can be prioritised.

    stealerspywarebanker

  • Notification listener abuse for OTP and message theft

    Binds a notification listener service and reads posted notification content, optionally dismissing notifications afterwards to hide them. This harvests one-time passcodes and private messages without ever requesting SMS permissions, which is why it has largely replaced SMS interception in modern ban

    stealerotpbanker

  • Persistent WebSocket channel used for remote tasking

    Bundles a WebSocket client and opens a long-lived bidirectional connection, the transport typically used by Android remote-access tooling for live command dispatch and streaming. Suspicious when paired with surveillance capabilities rather than an obvious in-app messaging feature.

    c2rat

  • Runtime string decryption with reflective method dispatch

    Combines symmetric decryption or base64 decoding of embedded string tables with reflective class and method resolution, so sensitive API names never appear in plaintext. This defeats naive string-based detection and indicates deliberate anti-analysis engineering.

    obfuscatedevasion

  • Scripted prompt coaching the user to enable Accessibility

    Contains step-by-step instructional text walking the victim through enabling an accessibility service. Because Android deliberately makes this flow difficult, malware ships explicit coaching copy; the presence of such a script alongside an accessibility service is a strong abuse indicator.

    bankerratoverlay

  • Loads dropped Dex/Jar

    Runs executable file dropped to the device during analysis.

    evasion

  • Makes use of the framework's Accessibility service

    Retrieves information displayed on the phone screen using AccessibilityService.

    collectiondefense_evasioncredential_access

  • Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps)

    bankerdiscovery

  • Queries the phone number (MSISDN for GSM devices)

    discovery

  • Acquires the wake lock

  • Makes use of the framework's foreground persistence service

    Application may abuse the framework's foreground service to continue running in the foreground.

    defense_evasionpersistence

  • Performs UI accessibility actions on behalf of the user

    Application may abuse the accessibility service to prevent their removal.

    evasion

  • Queries the mobile country code (MCC)

    discovery

  • Reads information about phone network operator.

    discovery

  • Requests enabling of the accessibility settings.

  behavioral4