Extracted

• • Target
    339c5d83068577cb1f37c15f0fa1a5e57d813eb4b950ee3fe2c04769a97349c4.apk
  • Size 9.0MB
  • SHA256 339c5d83068577cb1f37c15f0fa1a5e57d813eb4b950ee3fe2c04769a97349c4
  • MD5 96cbf811730ce3ef8e36e7679903415e
  • SHA1 4149b44d9e75f74e5ef0f32f38087d49c8fca44a
  • SHA512 e2d6581bd213e40fbd7113533c17170cf03bee45d8ccc126ed23a14fd2789d14acbad059bfb5f7f7b12370df1fd27c1dfa35195ee9e03085764e91d2ad4b13c3
  • SSDEEP 98304:Cj7ox5iSRGxAVKJ59wjcRgUB/97jgsWDVTij7URslaAu62a0T:+oxrDUFwjcRgNOj7URxAGT
  • TLSH
    T17F96AE53B7068D35C4CDB77964BA5B24B734685CA78763CB0904D2B0ADA32E1BEB83C5
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  bankercollectioncredential_accessdefense_evasiondiscoverydropperevasionoctoimpactinfostealerobfuscatedotpoverlaypersistenceratsmsspywarestealertrojan

  • Family: Octo

    Octo is a banking malware with remote access capabilities first seen in April 2022.

    bankertrojaninfostealerratocto

  • Octo payload

  • Custom signature

    Accessibility-driven UI automation to self-grant permissions

    Locates nodes in the Settings or package-installer user interface by text or view identifier and dispatches synthetic clicks. This lets the application approve its own permission dialogs, complete side-loading, and intercept attempts to reach the uninstall screen without any real user consent.

    evasionpersistencedropper
  • Custom signature

    Android SMS interception and OTP exfiltration

    Registers a high-priority SMS_RECEIVED receiver, parses inbound message bodies and aborts the broadcast to hide messages from the user, alongside network exfiltration primitives. This is the standard 2FA/OTP theft pattern used to complete fraudulent transactions.

    stealersmsotp
  • Custom signature

    Android banker: accessibility service abuse with overlay injection

    DEX references AccessibilityService event hooks together with window-overlay creation and credential-capture primitives. This combination is the canonical Android banking-trojan pattern: the app reads screen content and injects fake login windows over legitimate banking apps.

    bankertrojanoverlay
  • Custom signature

    Boot-triggered restart with disguised foreground service

    Restarts itself on device boot and holds a foreground service with a low-visibility notification channel, keeping the process alive across reboots and outside normal background limits. Malicious use is distinguished by pairing this with surveillance or remote-control primitives.

    persistence
  • Custom signature

    Keylogging via accessibility text-change events

    Subscribes to text-change and view-focus accessibility events and reads the text of nodes belonging to other applications, capturing everything typed on the device including passwords entered into unrelated apps. Password-field flags are typically inspected so credential entry can be prioritised.

    stealerspywarebanker
  • Custom signature

    Notification listener abuse for OTP and message theft

    Binds a notification listener service and reads posted notification content, optionally dismissing notifications afterwards to hide them. This harvests one-time passcodes and private messages without ever requesting SMS permissions, which is why it has largely replaced SMS interception in modern ban

    stealerotpbanker
  • Custom signature

    Runtime string decryption with reflective method dispatch

    Combines symmetric decryption or base64 decoding of embedded string tables with reflective class and method resolution, so sensitive API names never appear in plaintext. This defeats naive string-based detection and indicates deliberate anti-analysis engineering.

    obfuscatedevasion
  • Custom signature

    Scripted prompt coaching the user to enable Accessibility

    Contains step-by-step instructional text walking the victim through enabling an accessibility service. Because Android deliberately makes this flow difficult, malware ships explicit coaching copy; the presence of such a script alongside an accessibility service is a strong abuse indicator.

    bankerratoverlay

  • Loads dropped Dex/Jar

    Runs executable file dropped to the device during analysis.

    evasion

  • Makes use of the framework's Accessibility service

    Retrieves information displayed on the phone screen using AccessibilityService.

    collectiondefense_evasioncredential_access

  • Obtains sensitive information copied to the device clipboard

    Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.

    collectioncredential_accessimpact

  • Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps)

    bankerdiscovery

  • Queries the phone number (MSISDN for GSM devices)

    discovery

  • Acquires the wake lock

  • Makes use of the framework's foreground persistence service

    Application may abuse the framework's foreground service to continue running in the foreground.

    defense_evasionpersistence

  • Queries the mobile country code (MCC)

    discovery

  • Reads information about phone network operator.

    discovery

  • Requests disabling of battery optimizations (often used to enable hiding in the background).

    defense_evasion
  behavioral1