Extracted

• • Target
    bf781f7d66a8ced4929674ea81a87c814f617ef677301b5ee4b4d32c04287b68.apk
  • Size 8.8MB
  • SHA256 bf781f7d66a8ced4929674ea81a87c814f617ef677301b5ee4b4d32c04287b68
  • MD5 4af6a9fde14f9ef1e4781449f38aa233
  • SHA1 ef04b7cff12253e317251e49bd897dbb16f1b971
  • SHA512 9177e7b7c8f2875127006c19263652e5021e919c20695e1476eb8b42b97a3e78cd69b43908ca22e9eaf55a92d54947cd98faf38d736de0f2c17fc1f8c5812f38
  • SSDEEP 196608:+Bjqd/PwLKbRj9J/Ygr2RzihzvIIlQo2L/hVt7c5oEdnT0sSWKS5:+BknrjjggrAzihjIHDt74uts
  • TLSH
    T1129601BBF744B85EC4F3533356B59A2251476C268B43DAC31844B63C58BB6EC0E5ABC8
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  9^/10

  dropperevasionobfuscated

  • Encrypted or packed staged payload inside Android package

    Extracted asset shows near-random entropy without a recognised container header, indicating an encrypted secondary payload staged for runtime decryption and loading. Correlate with any runtime class-loading detection on the same sample.

    obfuscateddropper

  • Loads dropped Dex/Jar

    Runs executable file dropped to the device during analysis.

    evasion
  behavioral1behavioral2behavioral3
• • Target
    base.apk
  • Size 7.3MB
  • SHA256 e9a117132c98ebd3e4a3f0a7a3259d8d66a897ede18bc2b4ce3b40a757bda46a
  • MD5 746299344b1a5cbd3f2ac9b983bd49e9
  • SHA1 b470950527cfc601cb293d72b5c340893adddad0
  • SHA512 8161f071ba5e917fd8083611e5883bd0e716618debf34766eb2657ffaf9b95eb6abb7db5707d48d2951d71348ed9655185a85e335c651cf1fb3d2287fb7960a3
  • SSDEEP 98304:fzs3XIVKta5iSRGEkpRsTAEdNVvaCaH7hsvgmVuwSiC:fY3XIUwrupRybdNVviliC
  • TLSH
    T11276BF52B74A4939D8DD76B960BB5764F6347C8CE3826AC70905E2206C272F87F397C2
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  bankerc2collectioncredential_accessdefense_evasiondiscoverydropperevasionexfiltrationoctoimpactinfostealerobfuscatedotpoverlaypersistenceratsmsspywarestealertrojan

  • Family: Octo

    Octo is a banking malware with remote access capabilities first seen in April 2022.

    bankertrojaninfostealerratocto

  • Octo payload

  • Accessibility-driven UI automation to self-grant permissions

    Locates nodes in the Settings or package-installer user interface by text or view identifier and dispatches synthetic clicks. This lets the application approve its own permission dialogs, complete side-loading, and intercept attempts to reach the uninstall screen without any real user consent.

    evasionpersistencedropper

  • Android SMS interception and OTP exfiltration

    Registers a high-priority SMS_RECEIVED receiver, parses inbound message bodies and aborts the broadcast to hide messages from the user, alongside network exfiltration primitives. This is the standard 2FA/OTP theft pattern used to complete fraudulent transactions.

    stealersmsotp

  • Android banker: accessibility service abuse with overlay injection

    DEX references AccessibilityService event hooks together with window-overlay creation and credential-capture primitives. This combination is the canonical Android banking-trojan pattern: the app reads screen content and injects fake login windows over legitimate banking apps.

    bankertrojanoverlay

  • Boot-triggered restart with disguised foreground service

    Restarts itself on device boot and holds a foreground service with a low-visibility notification channel, keeping the process alive across reboots and outside normal background limits. Malicious use is distinguished by pairing this with surveillance or remote-control primitives.

    persistence

  • Contact harvesting with SMS self-propagation

    Reads the device contact list and sends messages to the retrieved numbers, the distribution mechanism behind SMS worm campaigns. The victim's own address book becomes the delivery channel, which is why these campaigns spread rapidly within a region.

    smstrojanexfiltration

  • Keylogging via accessibility text-change events

    Subscribes to text-change and view-focus accessibility events and reads the text of nodes belonging to other applications, capturing everything typed on the device including passwords entered into unrelated apps. Password-field flags are typically inspected so credential entry can be prioritised.

    stealerspywarebanker

  • Notification listener abuse for OTP and message theft

    Binds a notification listener service and reads posted notification content, optionally dismissing notifications afterwards to hide them. This harvests one-time passcodes and private messages without ever requesting SMS permissions, which is why it has largely replaced SMS interception in modern ban

    stealerotpbanker

  • Persistent WebSocket channel used for remote tasking

    Bundles a WebSocket client and opens a long-lived bidirectional connection, the transport typically used by Android remote-access tooling for live command dispatch and streaming. Suspicious when paired with surveillance capabilities rather than an obvious in-app messaging feature.

    c2rat

  • Runtime string decryption with reflective method dispatch

    Combines symmetric decryption or base64 decoding of embedded string tables with reflective class and method resolution, so sensitive API names never appear in plaintext. This defeats naive string-based detection and indicates deliberate anti-analysis engineering.

    obfuscatedevasion

  • Scripted prompt coaching the user to enable Accessibility

    Contains step-by-step instructional text walking the victim through enabling an accessibility service. Because Android deliberately makes this flow difficult, malware ships explicit coaching copy; the presence of such a script alongside an accessibility service is a strong abuse indicator.

    bankerratoverlay

  • Loads dropped Dex/Jar

    Runs executable file dropped to the device during analysis.

    evasion

  • Makes use of the framework's Accessibility service

    Retrieves information displayed on the phone screen using AccessibilityService.

    collectiondefense_evasioncredential_access

  • Obtains sensitive information copied to the device clipboard

    Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.

    collectioncredential_accessimpact

  • Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps)

    bankerdiscovery

  • Queries the phone number (MSISDN for GSM devices)

    discovery

  • Acquires the wake lock

  • Makes use of the framework's foreground persistence service

    Application may abuse the framework's foreground service to continue running in the foreground.

    defense_evasionpersistence

  • Queries the mobile country code (MCC)

    discovery

  • Reads information about phone network operator.

    discovery
  behavioral4