Loading story…
CERT-AgID published a reverse-engineering analysis of Coper, an Android banking trojan built to compromise mobile devices through a small loader APK and a native library that decrypts and loads an additional DEX payload at runtime. The malware requests broad Android permissions and abuses Accessibility Service, Device Admin, SMS access, notification access, and background execution to steal messages and notifications, capture credentials through injects and keylogging, lock infected devices, and maintain persistence on the handset.
The analysis found that Coper communicates with multiple hard-coded command-and-control domains over HTTP POST, protecting JSON data with AES-128-ECB while using RC4 to decrypt components embedded in the app. Operators can issue commands to enable banking injects, send SMS messages, place calls, uninstall applications, suppress notifications, activate VNC-like remote control, and remove the malware itself. CERT-AgID also reported that some intrusive functions are delayed until after initial registration with the C2 infrastructure, suggesting the attackers selectively activate capabilities based on victim language or geography.
Pull IOCs and campaign context straight into your stack.
1 event from the most recent confirmed update back to the earliest known activity.
CERT-AgID identified the analyzed sample of the Android banking malware Coper in May 2022. The sample was later used for a technical reverse-engineering analysis of its loader, dynamic DEX decryption, permissions abuse, and C2 communications.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. View all 10 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
Pull the IOCs, campaigns, and victimology behind this family, ready to push into your SIEM and EDR.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Doctor Web disclosed a new Android banking trojan family, **`Android.BankBot.Coper`**, that masqueraded as the official **Bancolombia Personas** app and targeted users in Colombia. The malware used a modular, multi-stage infection chain in which a dropper decrypted and installed additional components, abused Android Accessibility Services for device control, attempted to disable Google Play Protect, and deployed its main payload disguised as a system app named **Cache plugin**. Once active, Coper maintained contact with command-and-control servers and supported banking fraud and device takeover functions including phishing overlays, interception of notifications and SMS messages, sending SMS and USSD requests, keylogging, and lock-screen manipulation. Doctor Web also reported strong self-protection features that monitored attempts to uninstall the app or revoke privileges and simulated button presses to block removal; published IoCs linked the campaign to malicious APKs, DEX files, package names, domains such as **`sportsstyle.club`**, **`fitnessstyle.xyz`**, and **`4-u.wtf`**, and IP addresses **`18.217.36.170`** and **`45.76.35.31`**.
Aug 15, 2026
Researchers linked **Octo** and **Coper** to the Exobot malware lineage and described them as Android banking trojans built for large-scale **on-device fraud**. The malware abuses Android **Accessibility Services** and screen-capture features such as **MediaProjection** or VNC-style remote access to let operators view screens, steal credentials, intercept SMS and push notifications, log keystrokes, deploy overlay attacks, and remotely control infected devices while hiding activity with black-screen overlays, disabled notifications, and anti-removal tricks. Reports tied Octo’s rental operation to the actor known as **"Architect"** or **"goodluck"**, while later infrastructure analysis connected active C2 servers to broad international campaigns with tens of thousands of bots and hundreds of thousands of intercepted SMS messages. The trojans were distributed through malicious landing pages and rogue Android apps, including droppers published on **Google Play** that impersonated cleaners, screen recorders, Play Store installers, PDF viewers, and security tools. Observed campaigns used apps such as **Fast Cleaner**, **Pocket Screencaster**, **UniFile manager – PDF viewer**, and DawDropper-hosted utilities that fetched payloads from services like **GitHub** and **Firebase**. Initial Coper activity targeted Colombian banking users, but later campaigns expanded across Europe, the United States, Turkey, and other regions, with notable targeting of Spain, Portugal, Italy, Germany, Austria, Belgium, and Hungary.
Aug 15, 2026
Researchers and Italy’s CERT-AGID reported that the Android banking trojan **Oscorp**, later tracked as **UBEL**, was distributed through a malicious APK site in Italy and evolved into a broader global campaign targeting more than 150 applications, including banking apps. The malware abused Android’s **Accessibility Service** to gain extensive control over infected devices, repeatedly coercing victims to grant accessibility, usage statistics, battery optimization exemptions, and sometimes device administrator privileges to maintain persistence and expand access. Once active, UBEL/Oscorp could steal credentials through phishing overlays rendered in a `WebView`, intercept SMS messages, place calls, trigger call forwarding, execute USSD requests, launch or remove apps, and block legitimate applications. Analysts also documented screen and audio capture via **WebRTC/STUN**, HTTP POST communications with command-and-control servers, and specialized theft functions including replacement of cryptocurrency wallet addresses and harvesting of Google Authenticator one-time codes; published indicators included malware hashes, package names, C2 domains, injection paths, and AES keys tied to the operation.
Aug 15, 2026