Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

10

Static

static

7

5a509a6504...37.apk

android-9-x86

10

5a509a6504...37.apk

android-11-x64

10

license.html

windows7-x64

1

license.html

windows10-2004-x64

1

Analysis

  • max time kernel
    870760s
  • max time network
    132s
  • platform
    android_x64
  • resource
    android-x64-arm64-20230824-en
  • submitted
    26/08/2023, 22:04

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    5a509a6504bfb7d09682ec44554c45e660bf5e20dc756360c052f97df55a3a37.apk

  • Size

    1.5MB

  • MD5

    2380a8c53a3e15b004a06ab048f4153a

  • SHA1

    36037bf8ef71c415d0ea7a88f5fe1296fd3f9207

  • SHA256

    5a509a6504bfb7d09682ec44554c45e660bf5e20dc756360c052f97df55a3a37

  • SHA512

    43ace8077d8b00617479042c977f0651d30e12e461da7f266d1a44040bdc925e6e9aa074cd2c3b05ddfa15c8458774b5f389f13e66a0feab8e6e5436f539a636

  • SSDEEP

    49152:YwHhzKBkVJK4j/nspDwQFXWZGZbmqViK0AE4KoSi:YwBzKBkVJKafYJFXWZQ/Vb7

Score
10/10
octobankerevasioninfostealerransomwarerattrojan

Malware Config

Extracted

Family

octo

C2

https://superjunggvbvqq.com/M2EyOTM2M2FlY2My/

https://junggvbvqqqqqq.com/M2EyOTM2M2FlY2My/

https://lajunggvbvqq.com/M2EyOTM2M2FlY2My/

https://junggvbvqqgroup.com/M2EyOTM2M2FlY2My/

https://junggvbvqqnet.com/M2EyOTM2M2FlY2My/

https://abgggpoh.com/M2EyOTM2M2FlY2My/

https://nisiqniqqsiq.com/M2EyOTM2M2FlY2My/

https://nisiqnisiq.top/M2EyOTM2M2FlY2My/

https://abgggpoh.top/M2EyOTM2M2FlY2My/
AES_key

Signatures

  • Octo

    Octo is a banking malware with remote access capabilities first seen in April 2022.

    bankertrojaninfostealerratocto
  • Octo payload 3 IoCs
  • Makes use of the framework's Accessibility service. 2 IoCs
  • Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps). 1 IoCs
    banker
  • Acquires the wake lock. 1 IoCs
  • Loads dropped Dex/Jar 3 IoCs

    Runs executable file dropped to the device during analysis.

  • Reads information about phone network operator.
  • Requests disabling of battery optimizations (often used to enable hiding in the background). 1 IoCs
    evasion
  • Uses Crypto APIs (Might try to encrypt user data). 1 IoCs
    ransomware

Processes

  • com.doorusualam
    1⤵
    • Makes use of the framework's Accessibility service.
    • Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps).
    • Acquires the wake lock.
    • Loads dropped Dex/Jar
    • Requests disabling of battery optimizations (often used to enable hiding in the background).
    • Uses Crypto APIs (Might try to encrypt user data).
    PID:4705

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • /data/user/0/com.doorusualam/app_DynamicOptDex/WeYO.json
    Filesize

    2KB

    MD5

    c53429e4a42520106604453f96a16762

    SHA1

    1cda2588ac82970533ed9c9cf606425f9bc7fa20

    SHA256

    472e9d4c8e7965b71b01ca2af6cf6aed0441a82acbf3a37127816b5fb3809f01

    SHA512

    0c0c86959c115fa2d06f8bce9e5e780ddd9b448f189efdda856f3edb3299c7dfe4529a40b223be3fb5235a9338d4e2e7501d2e24b6547d8b3245a7e3d544560e

    Download Submit

  • /data/user/0/com.doorusualam/app_DynamicOptDex/WeYO.json
    Filesize

    2KB

    MD5

    e39b791bd93a52612426e2f1f091cbfa

    SHA1

    ce5c902412ff9579428863b54f07132304354ae8

    SHA256

    fe5a395be9c8acb2424e53895d1ed2e4841dda251a2b0a0862964182bcf00380

    SHA512

    2cec39b3df9ed1696716a7d409b132bac621de0272134cf305b88a0843719d1ea07087e7aebea27dddcddfa88ce23d85b6b758b3c733de7cb3d8cdace4cac2f4

    Download Submit

  • /data/user/0/com.doorusualam/app_DynamicOptDex/WeYO.json
    Filesize

    5KB

    MD5

    62ff2762f9263cdb658369e17eb93296

    SHA1

    05ec5da751175b01a2551634d4feb65f25453a81

    SHA256

    058dc0e4b6f33f7c066dfaecd7b5b4e22662c34dfb3d35e9174cb07e30d4d051

    SHA512

    a3283a30a033bc9ee7972f21ae9f761b207a1d6c7f208fccda9cf2c08155e97907928a78c84853fe28dc424829eb607be7194287942f80532320fb99fc8e4280

    Download Submit

  • /data/user/0/com.doorusualam/cache/oat/vzitddbzie.cur.prof
    Filesize

    320B

    MD5

    01f568b2cdcdd3e32dabdc352778a73f

    SHA1

    22c7668dd6be08f964d68ef7789cd082b9ebaa37

    SHA256

    f50f8d964a839ab82fe57aca29a14d60be60a2badff1fb065d437e9130668e53

    SHA512

    de4f293577961a89c2b314a423332cb05e7f07d2fe41c2253473446ca01de0911534f9c3c183df3ec99386bd164281ce0df9c8578047b14ec0ed199794d1e7aa

    Download Submit

  • /data/user/0/com.doorusualam/cache/vzitddbzie
    Filesize

    449KB

    MD5

    6b3c3eeb943b95c6e24f22e23beee4a9

    SHA1

    2df84282daddf37bf3d8816b906bd32a973b6d10

    SHA256

    d03e8c7d59c14791b27f8221670a9ab511e711d5c0a2d57ea2fc522bca8ffd8b

    SHA512

    10f1750d4174624529416e82a025a7ade37275bcf005e89b0590fff97b4372b6e613da92b75d08314a4a80540248ec838afcbb82547c86697f85f78c9c07b56c

    Download Submit

  • /data/user/0/com.doorusualam/cache/vzitddbzie
    Filesize

    449KB

    MD5

    6b3c3eeb943b95c6e24f22e23beee4a9

    SHA1

    2df84282daddf37bf3d8816b906bd32a973b6d10

    SHA256

    d03e8c7d59c14791b27f8221670a9ab511e711d5c0a2d57ea2fc522bca8ffd8b

    SHA512

    10f1750d4174624529416e82a025a7ade37275bcf005e89b0590fff97b4372b6e613da92b75d08314a4a80540248ec838afcbb82547c86697f85f78c9c07b56c

    Download Submit

  • /data/user/0/com.doorusualam/cache/vzitddbzie
    Filesize

    449KB

    MD5

    6b3c3eeb943b95c6e24f22e23beee4a9

    SHA1

    2df84282daddf37bf3d8816b906bd32a973b6d10

    SHA256

    d03e8c7d59c14791b27f8221670a9ab511e711d5c0a2d57ea2fc522bca8ffd8b

    SHA512

    10f1750d4174624529416e82a025a7ade37275bcf005e89b0590fff97b4372b6e613da92b75d08314a4a80540248ec838afcbb82547c86697f85f78c9c07b56c

    Download Submit

  • /data/user/0/com.doorusualam/kl.txt
    Filesize

    79B

    MD5

    0290015f25306e66cc850729a7d69849

    SHA1

    e0edbf2d9211e3d456f87cb3867e05f2335e3fb7

    SHA256

    d5b05209c07a88023da6a9ba84828b0c126cbb7a3927cd18aa0f743409499f87

    SHA512

    e5fc9fa49f3b47112dd3a725cab92da20d482941a4847ef566f3a15635d9af9dc5b65880455237526c224fdcdafb98ec03f9e666202fad22b9e29f3588516bb9

    Download Submit

  • /data/user/0/com.doorusualam/kl.txt
    Filesize

    28B

    MD5

    6311c3fd15588bb5c126e6c28ff5fffe

    SHA1

    ce81d136fce31779f4dd62e20bdaf99c91e2fc57

    SHA256

    8b82f6032e29a2b5c96031a3630fb6173d12ff0295bc20bb21b877d08f0812d8

    SHA512

    2975fe2e94b6a8adc9cfc1a865ad113772b54572883a537b02a16dd2d029c0f7d9cca3b154fd849bdfe978e18b396bcf9fa6e67e7c61f92bdc089a29a9c355c6

    Download Submit

  • /data/user/0/com.doorusualam/kl.txt
    Filesize

    237B

    MD5

    a1ad7810025a5e758730abc6a2620a05

    SHA1

    aa91db4c306113b32abfcc2058d3ea47f23eace4

    SHA256

    8ed7e6fae592c2ecf7b4f77145ef4aff68b9d314ebfe2e668a3b191057d4e237

    SHA512

    033fb2d952cd47dacba9b4da59ea83350ee532822d97c21cd8c292f3388dcb044bdb2f667ace53678fc1bebb68812d55ae3473e04ee5a80194fe9b54b6b3a2f6

    Download Submit

  • /data/user/0/com.doorusualam/kl.txt
    Filesize

    63B

    MD5

    a94ecb76cf469b20f2e83b8969dea00e

    SHA1

    041d9db558acec9c8279dd03936bd6f9c626db7a

    SHA256

    75517ce54d29421e6b5de47c8e3f8c33d96215d361b1a5a4fd0d2aa8e809e08a

    SHA512

    d471bc81a83e0e7cf03a82d04544e5f10dce11aaf6c099cd766e7177251ea2ff2ba0a5ddcb58844eb3ee095f8a64253d960323dc2cbdd33b9e83f2b6f6cd38ae

    Download Submit

  • /data/user/0/com.doorusualam/kl.txt
    Filesize

    45B

    MD5

    3b4dc99a46105c1fefb8b606c8577759

    SHA1

    2938d54282f2a416695ef6eda5b41388d91af1bf

    SHA256

    42e2c2b9d7c0be969874a2e3ff9f759bd43d3ecb014beeda5f5130a2c3b3450d

    SHA512

    8c911aa81b028defdcf714066b42897cd640d780d52ee415eb1523ecde2cd83e237ba9d9e298988c420663d085aae9ed6bcbb6a12d81a1bd7123f9b8c4792a6d

    Download Submit