Extracted

• • Target
    655d0dba5fdefb9ec8ffb9e4bee15d9ff9289b2907280f38b0777d8dd944c031
  • Size 6.3MB
  • SHA256 655d0dba5fdefb9ec8ffb9e4bee15d9ff9289b2907280f38b0777d8dd944c031
  • MD5 ac6d41a0c054386029f913dec8d08d50
  • SHA1 c286c518127ff080ab30c99c7a4a221e5f67513c
  • SHA512 652e8332138cdf1c5cc156f87a9dda64add20298008784064e25d8fa23398267618081c771f024ff8d1562c08225858a1a183426447029077139c51b8479005b
  • SSDEEP 196608:tgyLhTStmkrIPvQ0ioI91nNvtW5yX9obJBit4LGeH5/VV4U76A:6E8ok8PvQR3rnR5X9GSaLGktV7X
  • TLSH
    T1AD662382FF69C92ED876403B4D6703311266DE5E8A8297079AEC722C2C776C84FD5BD4
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  bankercollectioncredential_accessdefense_evasiondiscoveryevasionoctoinfostealerpersistencerattrojan

  • Family: Octo

    Octo is a banking malware with remote access capabilities first seen in April 2022.

    bankertrojaninfostealerratocto

  • Loads dropped Dex/Jar

    Runs executable file dropped to the device during analysis.

    evasion

  • Makes use of the framework's Accessibility service

    Retrieves information displayed on the phone screen using AccessibilityService.

    collectiondefense_evasioncredential_access

  • Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps)

    bankerdiscovery

  • Acquires the wake lock

  • Makes use of the framework's foreground persistence service

    Application may abuse the framework's foreground service to continue running in the foreground.

    defense_evasionpersistence

  • Queries information about active data network

    discovery

  • Requests accessing notifications (often used to intercept notifications before users become aware).

    collectioncredential_access

  • Requests disabling of battery optimizations (often used to enable hiding in the background).

    defense_evasion

  • Requests modifying system settings.

    defense_evasion
  behavioral1