Extracted

• • Target
    file
  • Size 4.9MB
  • SHA256 6cd0fbfb088a95b239e42d139e27354abeb08c6788b6083962943522a870cb98
  • MD5 c508d432e3d521acaa6215934f609b2a
  • SHA1 5e44ba99e81c6673b000519755e041c2d4082ae8
  • SHA512 208269f5bb3ba7d1511ad492fcc6995c1a7a039fffdd5caf221dc6b64f28bc828b593ddccf1a977687ecd84d1375e95680653d82a725174560714808ba69d7bf
  • SSDEEP 49152:itfRsEXIJKj83XqC45iS7xrGo/pwOXkjVKSc7T/B82nwjYWf0hrNFl/J8A5n:qRs5i83XC5iSRG6SVKNFUjYhnJOA5n
  • TLSH
    T17436CF03B79F8979E9C2BEB8528B2376A9106C68A76040DF4B05D6106D733E5AF3D7C1
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  bankercollectioncredential_accessdefense_evasiondiscoveryevasionoctoimpactinfostealerpersistencerattrojan

  • Family: Octo

    Octo is a banking malware with remote access capabilities first seen in April 2022.

    bankertrojaninfostealerratocto

  • Octo payload

  • Checks Android system properties for emulator presence.

    defense_evasion

  • Loads dropped Dex/Jar

    Runs executable file dropped to the device during analysis.

    evasion

  • Makes use of the framework's Accessibility service

    Retrieves information displayed on the phone screen using AccessibilityService.

    collectiondefense_evasioncredential_access

  • Obtains sensitive information copied to the device clipboard

    Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.

    collectioncredential_accessimpact

  • Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps)

    bankerdiscovery

  • Queries the phone number (MSISDN for GSM devices)

    discovery

  • Acquires the wake lock

  • Makes use of the framework's foreground persistence service

    Application may abuse the framework's foreground service to continue running in the foreground.

    defense_evasionpersistence

  • Queries the mobile country code (MCC)

    discovery

  • Reads information about phone network operator.

    discovery

  • Requests enabling of the accessibility settings.

  behavioral1behavioral2behavioral3