Coper: recovered C2 indicators & analysis

What Coper is

Coper is an Android banking trojan first observed in July 2021, initially distributed as a fake 'Bancolombia Personas' app targeting customers of the Colombian bank. ThreatFabric assessed it not as a wholly new family but as a descendant of the Exobot/ExobotCompact lineage (Exobot was first seen in 2016).

In January 2022 the ExobotCompact codebase was rebranded to 'Octo' by an actor using the alias 'Architect' and advertised on underground forums as malware-as-a-service. Customers rent access to a builder and control panel to run their own campaigns against specific regions and financial institutions, and multiple distinct operators have been observed. Coper and Octo are widely tracked as the same family under different names.

The trojan's defining capability is on-device fraud: it pairs Android's MediaProjection API for near-real-time screen streaming with abuse of the AccessibilityService to remotely observe and control the device, letting operators initiate fraudulent transactions from the victim's own phone and defeat device- and behavior-based anti-fraud controls.

It is typically delivered through dropper apps that masquerade as utilities such as fake screen recorders, cleaners, and security tools (some historically reaching Google Play) and via SMS phishing links. The droppers coax the victim into granting Accessibility permissions before deploying the payload, which then abuses those permissions to grant itself further access and disable Google Play Protect.

In 2024 the Octo source code leaked, spawning multiple forks, and its developers released the upgraded Octo2 variant. Octo2 added a domain generation algorithm (DGA) for more resilient command-and-control, per-request encryption key generation, and additional anti-analysis in the form of a dynamically loaded native library that handles payload decryption. Earlier classic Coper/Octo builds used hardcoded C2 domains with configured backups rather than a DGA.

Capabilities

• Overlay (web inject) attacks against banking and financial apps to steal login credentials and card data
• Keylogging of keystrokes, PINs, taps, and visited URLs
• Screen streaming / VNC-style remote viewing via the MediaProjection API
• Remote device control and input injection through AccessibilityService abuse (automated clicks and gestures)
• SMS interception, sending, and hiding to capture and relay OTPs / 2FA codes
• Reading and intercepting push notifications to bypass two-factor authentication
• Requests Device Administrator privileges; can lock/unlock the device and block notifications
• Disables Google Play Protect via accessibility abuse
• Resists removal and maintains persistence (e.g., monitoring the battery-optimization allowlist)
• AES-encrypted, Base64-encoded command-and-control traffic
• Native-code obfuscation and packing to hinder analysis
• Octo2 variant: domain generation algorithm (DGA) for C2 and a new encryption key generated per request

Known C2 / channel types: Dropper apps masquerading as legitimate utilities (fake screen recorders, cleaners, and security tools), some historically distributed via Google Play, SMS phishing (smishing) links and sideloading from third-party sites, HTTP(S)-based command-and-control with AES-encrypted, Base64-encoded messages, Hardcoded C2 domains with configured backup domains (classic Coper/Octo); DGA-generated domains introduced in Octo2.

MITRE ATT&CK (Mobile)

Techniques commonly associated with Coper:

What Privara Unmask recovered

Five .shop command-and-control domains were recovered from the payload as dead-drop hosts. These were not previously present in ThreatFox and were contributed as net-new intelligence. The analysis ran on a de-emulated Android 17 device that the sample could not fingerprint as virtual, so it behaved as it would on a real handset.

Indicators of compromise (IOCs)

External references

• Look out for Octo's tentacles! A new on-device fraud Android Banking Trojan with a rich legacy
  ThreatFabric
• Octo2: European Banks Already Under Attack by New Malware Variant
  ThreatFabric
• Coper | Mobile Security Glossary
  Zimperium
• New Octo Banking Trojan Spreading via Fake Apps on Google Play Store
  The Hacker News
• Coper (apk.coper)
  Malpedia (Fraunhofer FKIE)
• Coper / Octo - A Conductor for Mobile Mayhem with Eight Limbs
  Team Cymru

Methodology & honest limits

This sample was obtained from MalwareBazaar and detonated in a controlled, isolated environment. C2 identity was recovered from the executing sample and its configuration. We report only what the analysis established: an offline sample yields a C2 identity, not a live beacon, and we say so. Nothing here is inferred beyond the evidence.