Last seven days
- First activity
- Aug 29, 2026
- Last activity
- Aug 29, 2026
- Feed role
- C2
- Host form
- 0 IP / 21 hostnames
Coper
Coper is an Android banking trojan descended from the Exobot/ExobotCompact lineage and is also widely associated with the Octo name in later reporting.
Profile source: Mallory opens in a new tabCoper
Family profile
Coper is an Android banking trojan descended from the Exobot/ExobotCompact lineage and is also widely associated with the Octo name in later reporting. First observed in 2021 targeting Colombian Android users, it evolved into a modular, multi-stage malware family used against banking customers in Europe, Turkey, Australia, parts of South America, and other regions. It is commonly distributed through trojanized Android applications that impersonate banking, security, utility, browser, or Google Play-related apps, including campaigns involving official app marketplaces, fraudulent landing pages, and SMS-based lures.
Coper typically begins as a dropper or loader application that requests extensive permissions and then decrypts and loads additional malicious code at runtime, often through native libraries and encrypted DEX payloads. It heavily abuses Android Accessibility Services to automate user-interface interaction, grant itself privileges, harvest on-screen content, and enable remote fraud. Observed variants also use Device Administration, notification access, SMS permissions, and background execution features to resist removal and maintain control of the device.
Its core functionality centers on banking fraud and credential theft. Capabilities documented across variants include overlay and webinject-based credential harvesting against banking applications, keylogging, interception of SMS messages and push notifications, theft of one-time passwords, collection of installed-app inventories and device metadata, and suppression of notifications to hide malicious activity. More advanced builds support VNC-like remote control or on-device fraud workflows, allowing operators to view screen contents, simulate taps and gestures, launch apps or URLs, lock the device, uninstall applications, and interact with targeted banking sessions in real time.
Coper employs multiple defensive and anti-analysis measures. These include encrypted strings and payloads, encrypted command-and-control traffic, integrity checks, restoration of removed components, repeated prompting for sensitive permissions, hiding launcher icons, monitoring attempts to revoke Accessibility or administrator privileges, and checks for emulators or other analysis environments in some variants. Several analyses also describe server-side victim filtering and geofencing behavior.
The malware has been linked to malware-as-a-service activity, with reporting indicating builder and panel infrastructure and possible overlap with operators active in Turkey. Campaigns have repeatedly targeted financial institutions and their customers, with especially notable activity reported in Turkey. Coper remains one of the more prominent Android banking trojans due to its combination of credential theft, SMS interception, remote device control, persistence, and anti-removal tradecraft.
Capabilities
- Credential Theft
- Defense Evasion
- Exfiltration
- Keylogging
- Persistence
- Post Exploitation
- Session Hijacking
- Spoofing
Observed infrastructure
Samples
Recent associated samples
MITRE ATT&CK
Coper in ATT&CK
38 distinct techniquesTechniques
38 techniques T1204.002 Malicious File T1546 Event Triggered Execution T1566 Phishing T1497 Virtualization/Sandbox Evasion T1528 Steal Application Access Token T1056.001 Keylogging T1204 User Execution T1573 Encrypted Channel T1566.002 Spearphishing Link T1036 Masquerading T1539 Steal Web Session Cookie T1614 System Location Discovery T1140 Deobfuscate/Decode Files or Information T1082 System Information Discovery T1548 Abuse Elevation Control Mechanism T1071 Application Layer Protocol T1113 Screen Capture T1056.003 Web Portal Capture T1027.013 Encrypted/Encoded File T1027 Obfuscated Files or Information T1021.005 VNC T1016 System Network Configuration Discovery T1564 Hide Artifacts T1059 Command and Scripting Interpreter T1614.001 System Language Discovery T1105 Ingress Tool Transfer T1547 Boot or Logon Autostart Execution T1219 Remote Access Tools T1041 Exfiltration Over C2 Channel T1497.001 System Checks T1053 Scheduled Task/Job T1056 Input Capture T1601 Modify System Image T1106 Native API T1070 Indicator Removal T1620 Reflective Code Loading T1027.009 Embedded Payloads T1548.002 Bypass User Account Control
Reporting
