Extracted

• • Target
    Chrome.apk
  • Size 292KB
  • SHA256 f61fecff25cade2b48ced3e704decafe4595ad8123a80921371dad4df8318d56
  • MD5 5ddb8df0994b4ffc7747c246020f324a
  • SHA1 58cd1e8ab0a8d895059dd87a1b61202270cfe2cc
  • SHA512 2efde7565a62fcb23a767c06e18386ab94f913ebae87a15aecb5203bf1f05fd29ebfbb8c45090ce2183ac4a1013d07ca79520d4359464c227ae8a2320dfceff6
  • SSDEEP 6144:4RCrETkkkkkkl6Rg0Ra9NUTrWyTmrRcI1YXXuaw8hVbgH9NB2/EuGZ:4RCrETkkkkkkyg0w9NIWy4JWXXuaw8hQ
  • TLSH
    T15954E05436B8E706E87E9B390EF9E6D1953DBE95CE08934B3042730C0A727C15D6A63B
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  bankercollectioncredential_accessdefense_evasiondiscoveryevasionoctoimpactinfostealerpersistencerattrojan

  • Family: Octo

    Octo is a banking malware with remote access capabilities first seen in April 2022.

    bankertrojaninfostealerratocto

  • Makes use of the framework's Accessibility service

    Retrieves information displayed on the phone screen using AccessibilityService.

    collectiondefense_evasioncredential_access

  • Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps)

    bankerdiscovery

  • Queries the phone number (MSISDN for GSM devices)

    discovery

  • Acquires the wake lock

  • Makes use of the framework's foreground persistence service

    Application may abuse the framework's foreground service to continue running in the foreground.

    defense_evasionpersistence

  • Performs UI accessibility actions on behalf of the user

    Application may abuse the accessibility service to prevent their removal.

    evasion

  • Queries the mobile country code (MCC)

    discovery

  • Reads information about phone network operator.

    discovery

  • Requests accessing notifications (often used to intercept notifications before users become aware).

    collectioncredential_access

  • Requests disabling of battery optimizations (often used to enable hiding in the background).

    defense_evasion

  • Requests modifying system settings.

    defense_evasion
  behavioral1