Extracted

Extracted

• • Target
    7630709e4a440549cabb21e025f84d1ab74b582fc13030be544840f494721550
  • Size 3.4MB
  • SHA256 7630709e4a440549cabb21e025f84d1ab74b582fc13030be544840f494721550
  • MD5 91daeaa3c697e8d6be51c68850cdf519
  • SHA1 8d945ed5a09290f5fcc401198672e3ec25216fce
  • SHA512 00ad155413273010a8741709eb3475addd686aa0cfe70d32bc478c5231f567427fb9e6ead62397c84aeb2cfdbd516035e3bdce6cdbd1cab80bbd8659fa447ada
  • SSDEEP 98304:eZHVgp1NmkMUsZZHzUxLz530UMeI7s0WmDHcqw50WYi4nZrSsxMhTnI:ya1ggkjn1S0WYi4nZrS4MVnI
  • TLSH
    T128F50277EDE2929EC5B4963788D89E7261E27B44D3C3490D348CB29A0B396FC4F152B4
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  bankercollectioncredential_accessdefense_evasiondiscoveryevasionoctoimpactinfostealerpersistencerattrojanstealth

  • Family: Octo

    Octo is a banking malware with remote access capabilities first seen in April 2022.

    bankertrojaninfostealerratocto

  • Octo payload

  • Removes its main activity from the application launcher

    stealthtrojanevasion

  • Loads dropped Dex/Jar

    Runs executable file dropped to the device during analysis.

    evasion

  • Makes use of the framework's Accessibility service

    Retrieves information displayed on the phone screen using AccessibilityService.

    collectiondefense_evasioncredential_access

  • Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps)

    bankerdiscovery

  • Queries the phone number (MSISDN for GSM devices)

    discovery

  • Acquires the wake lock

  • Makes use of the framework's foreground persistence service

    Application may abuse the framework's foreground service to continue running in the foreground.

    defense_evasionpersistence

  • Queries the mobile country code (MCC)

    discovery

  • Queries the unique device ID (IMEI, MEID, IMSI)

    discovery

  • Reads information about phone network operator.

    discovery

  • Requests changing the default SMS application.

    collectionimpact

  • Requests disabling of battery optimizations (often used to enable hiding in the background).

    defense_evasion
  behavioral1behavioral2