Coper
Aliases: ExobotCompact, Octo
- First seen
- 2020-06-01 00:00:00
- Malware type
- trojan, rat
- Family
- Malware family
- Last IoC activity
- 2026-07-22 00:39:19
- Profile updated
- 2026-07-07 14:03:31
Targeted industries: financial-services
Targeted regions: country_code:co country_code:es country_code:fr country_code:de country_code:it
Context
Coper is an Android banking trojan and RAT descended from ExobotCompact, itself a rewrite of Exobot. It uses a modular architecture, a multi-stage infection chain and (in some variants) a DGA. First observed in Colombia, it has since spread to Europe.
Reports & references
- resecurity.com — In The Box Mobile Malware Webinjects Marketplace (report)
- malpedia.caad.fkie.fraunhofer.de — Apk.Coper (report)
- labs.k7computing.com — Android Banking Trojan Octov2 Masquerading As Deepseek Ai (report)
- virusbulletin.com — Octopus Prime Didnt Turn Truck Widely Spread Android Botnet (report)
- x.com — 1833145006585987374 (report)
- thehackernews.com — New Octo Banking Trojan Spreading Via (report)
- cert.pl — Aktywacja Aplikacji Iko (report)
- blog.cyble.com — Coper Banking Trojan (report)
- news.drweb.com — Show (report)
- domaintools.com — Uncovering Octo2 Domains (report)
- cert-agid.gov.it — Analisi E Approfondimenti Tecnici Sul Malware Coper Utilizzato Per Attaccare Dispositivi Mobili (report)
- spamhaus.org — Botnet Threat Update January To June 2025 (report)
- Trend Micro — Examining New Dawdropper Banking Dropper And Daas On The Dark We (report)
- intrinsec.com — Tlp Clear Prospero Proton66 Uncovering The Links Between Bulletproof Networks (report)
- threatfabric.com — Octo2 European Banks Already Under Attack By New Malware Variant (report)
- twitter.com — 1541875982684094465 (report)
- info.spamhaus.com — Jul Dec%202024%20Botnet%20Threat%20Update (report)
- labs.k7computing.com — Play Store App Serves Coper Via Github (report)
- threatfabric.com — Octo New Odf Banking Trojan (report)
- intrinsec.com — Prospero Proton66 Tracing Uncovering The Links Between Bulletproof Networks (report)
- team-cymru.com — Coper Octo A Conductor For Mobile Mayhem With Eight Limbs (report)
- spamhaus.org — Botnet Threat Update July To December 2025 (report)
- bleepingcomputer.com — New Android Banking Malware Remotely Takes Control Of Your Device (report)
- info.spamhaus.com — Jan Jun%202024%20Botnet%20Threat%20Update (report)