Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
2118442s -
max time network
46s -
platform
android_x86 -
resource
android-x86-arm-20230621-en -
submitted
22/07/2023, 15:36
General
-
Target
35d19c060b8d8b0c1114f161a208ac61596723a69f17126f054e58aa476ac556.apk
-
Size
541KB
-
MD5
6c668c1d0504ca948d7fd641ce93cb9c
-
SHA1
eddd6bbca6116ef83701406a6ba1b6b756bd98b9
-
SHA256
35d19c060b8d8b0c1114f161a208ac61596723a69f17126f054e58aa476ac556
-
SHA512
f6cc943332d4286e463daf471ab4624e99433c1fe54b3e69dbbdb758425ea4b372f301b06b180cf6019653e2c2b4ea340b5a4055a00cb4e5e622ccece6cef5fe
-
SSDEEP
12288:A2OUOX+5gCB33r6+28FGiVW5E6zKO9KqfAiMAGKn7OgsNKA:A2Cu55Bnv2ALGEDyfWATn7i
Malware Config
Extracted
octo
https://193.42.32.180/ZjU3NWNhYzE5Mzhm/
https://saldirmorukss222.net/ZjU3NWNhYzE5Mzhm/
https://saldirmorukss122.net/ZjU3NWNhYzE5Mzhm/
https://saldirmoruk4ss22.net/ZjU3NWNhYzE5Mzhm/
https://saldirmoruks6s22.net/ZjU3NWNhYzE5Mzhm/
https://saldirmoruk7ss22.net/ZjU3NWNhYzE5Mzhm/
https://saldirmoruks8s22.net/ZjU3NWNhYzE5Mzhm/
https://saldirmorukss2322.net/ZjU3NWNhYzE5Mzhm/
https://saldirmoruksas282.net/ZjU3NWNhYzE5Mzhm/
Signatures
-
Octo
Octo is a banking malware with remote access capabilities first seen in April 2022.
-
Octo payload 3 IoCs
-
Makes use of the framework's Accessibility service. 2 IoCs
-
Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps). 1 IoCs
-
Acquires the wake lock. 1 IoCs
-
Loads dropped Dex/Jar 2 IoCs
Runs executable file dropped to the device during analysis.
-
Reads information about phone network operator.
-
Requests disabling of battery optimizations (often used to enable hiding in the background). 1 IoCs
-
Uses Crypto APIs (Might try to encrypt user data). 1 IoCs
Processes
-
com.crossthinkdmsx1⤵
- Makes use of the framework's Accessibility service.
- Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps).
- Acquires the wake lock.
- Loads dropped Dex/Jar
- Requests disabling of battery optimizations (often used to enable hiding in the background).
- Uses Crypto APIs (Might try to encrypt user data).
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
450KB
MD518d6d6287c8c13b3f38a17b411126902
SHA1031d9ace93b685ba7b8266c168daa8d655b207e2
SHA256ff815eb64df98121fdb52d96334079db90adc279a1e850824d6bd293d974d4d0
SHA51206da9fe8d508eaf1b69189c53d501d8ddaa04b689a3fea86415d92c88ff7ceb8535d4615ffc3ed65b996864845ea2b234ee90284733df2e224713dce7fa16b72
-
Filesize
450KB
MD518d6d6287c8c13b3f38a17b411126902
SHA1031d9ace93b685ba7b8266c168daa8d655b207e2
SHA256ff815eb64df98121fdb52d96334079db90adc279a1e850824d6bd293d974d4d0
SHA51206da9fe8d508eaf1b69189c53d501d8ddaa04b689a3fea86415d92c88ff7ceb8535d4615ffc3ed65b996864845ea2b234ee90284733df2e224713dce7fa16b72
-
Filesize
450KB
MD518d6d6287c8c13b3f38a17b411126902
SHA1031d9ace93b685ba7b8266c168daa8d655b207e2
SHA256ff815eb64df98121fdb52d96334079db90adc279a1e850824d6bd293d974d4d0
SHA51206da9fe8d508eaf1b69189c53d501d8ddaa04b689a3fea86415d92c88ff7ceb8535d4615ffc3ed65b996864845ea2b234ee90284733df2e224713dce7fa16b72
-
Filesize
136B
MD58bdb64657dc1607fea02deac9859ae99
SHA144ee8c935b971be0c200da0bd927ee61e429deb6
SHA256415065709b3578f8a4b67a559e96da402d64f62f81d858d269555575fc4b00c1
SHA512acee5c98d2a4f239f50abcaee5cdf62982f1f720b1e35b585509692c067616827c5e022369b4013844844c594941e245684a28b406fb9cc462a6f80b084adea8
-
Filesize
3KB
MD5935f1e3ef0b99c2356763fb9d8730a57
SHA1c3ce114f51e78d046e7aba6bad8a54ff547f613f
SHA2565c42a18abfacf078b58ad1abb89b412547f503d6f3f7856a4265d69a969a5858
SHA512ab41d3033d229bf83d9dd6cd56217350a1ef2313076751b469465c01af334fc46e7247db3cc98f3c01604b34c30c4a6bf582a5d007e4ece1efaebd30ea57aa22