Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Resubmissions
03/05/2024, 05:43
240503-genrssae99 1003/05/2024, 05:43
240503-gel8zage5v 1003/05/2024, 05:42
240503-gejg3sae96 1026/04/2024, 11:24
240426-nhtwjsfc6y 1026/04/2024, 09:55
240426-lx8bdadh3w 1026/04/2024, 09:35
240426-lkpy9sdf5s 10Analysis
-
max time kernel
301s -
max time network
307s -
platform
android_x64 -
resource
android-x64-20240221-en -
resource tags
-
submitted
26/04/2024, 09:55
General
-
Target
1dda2398fb3c4c2aee9b2a18f0975b921cbd2809625618d7a91d174806c677b7.apk
-
Size
509KB
-
MD5
398d22e2d522ad3b4dec483d095ab0a0
-
SHA1
57864eac5ff484b9943bb30657a5b8b521a04068
-
SHA256
1dda2398fb3c4c2aee9b2a18f0975b921cbd2809625618d7a91d174806c677b7
-
SHA512
7d4c8aad0e3ea2fda730554f4fa8220567b94cf0e6a7c3d93112ea1b0b11cc972b00b3d00346976e664cdf82d672f94185f5868df9c6b9b81b2bee9748649b7b
-
SSDEEP
12288:+f22AykQKMrEjYTYVk5B+vdosmXw91+9VYATRWcOqZUeJnPG:+55QjYTPMvdjmXw9M31W5MJnPG
Malware Config
Extracted
octo
https://tecbabbshop24578.shop/ZDQyN2NmOGEZOTIK/
https://karamdsadvs2.shop/ZDQyN2NmOGEZOTIK/
https://karakalandankasd5.com/ZDQyN2NmOGEZOTIK/
https://tecklardankalan.shop/ZDQyN2NmOGEZOTIK/
-
target_apps
at.spardat.bcrmobile
at.spardat.netbanking
com.bankaustria.android.olb
com.bmo.mobile
com.cibc.android.mobi
com.rbc.mobile.android
com.scotiabank.mobile
com.td
cz.airbank.android
eu.inmite.prj.kb.mobilbank
com.bankinter.launcher
com.kutxabank.android
com.rsi
com.tecnocom.cajalaboral
es.bancopopular.nbmpopular
es.evobanco.bancamovil
es.lacaixa.mobile.android.newwapicon
com.dbs.hk.dbsmbanking
com.FubonMobileClient
com.hangseng.rbmobile
com.MobileTreeApp
com.mtel.androidbea
com.scb.breezebanking.hk
hk.com.hsbc.hsbchkmobilebanking
com.aff.otpdirekt
com.ideomobile.hapoalim
com.infrasofttech.indianBank
com.mobikwik_new
com.oxigen.oxigenwallet
jp.co.aeonbank.android.passbook
Signatures
-
Octo
Octo is a banking malware with remote access capabilities first seen in April 2022.
-
Octo payload 1 IoCs
-
Makes use of the framework's Accessibility service 4 TTPs 3 IoCs
Retrieves information displayed on the phone screen using AccessibilityService.
-
Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
-
Checks CPU information 2 TTPs 1 IoCs
Checks CPU information which indicate if the system is an emulator.
-
Checks memory information 2 TTPs 1 IoCs
Checks memory information which indicate if the system is an emulator.
-
Loads dropped Dex/Jar 1 TTPs 2 IoCs
Runs executable file dropped to the device during analysis.
-
Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs
Application may abuse the framework's foreground service to continue running in the foreground.
-
Obtains sensitive information copied to the device clipboard 2 TTPs 1 IoCs
Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.
-
Queries the mobile country code (MCC) 1 TTPs 1 IoCs
-
Queries the phone number (MSISDN for GSM devices) 1 TTPs
-
Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs
-
Acquires the wake lock 1 IoCs
-
Reads information about phone network operator. 1 TTPs
-
Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs
Processes
-
com.beautyship51⤵
- Makes use of the framework's Accessibility service
- Checks CPU information
- Checks memory information
- Loads dropped Dex/Jar
- Makes use of the framework's foreground persistence service
- Obtains sensitive information copied to the device clipboard
- Queries the mobile country code (MCC)
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Acquires the wake lock
- Uses Crypto APIs (Might try to encrypt user data)
Network
MITRE ATT&CK Mobile v15
Persistence
Event Triggered Execution
1Broadcast Receivers
1Foreground Persistence
1Defense Evasion
Download New Code at Runtime
1Foreground Persistence
1Input Injection
1Virtualization/Sandbox Evasion
2System Checks
2Credential Access
Clipboard Data
1Input Capture
2GUI Input Capture
1Keylogging
1Discovery
Software Discovery
1Security Software Discovery
1System Information Discovery
2System Network Configuration Discovery
3Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
48B
MD5046a414913add6f5bb60072c7db819b6
SHA1451ee4f6809260aec622d772fd329c7d0297a842
SHA256b66c1320cb063a1d391c94273572ea6edae76c8c8b0a07f8d75c88686f0df72a
SHA5124e6355f3051ed5e811ab030abde1f5be7f5e1cf33be99cd08477e9b6c015deb1d8bd75a09fb9c7176b8511c5ad0a67abc0902a3531e97564ccb6afc57496a47c
-
Filesize
576B
MD597a6c69f361034cba77dac0004c03317
SHA1fcb8c44a3c0c9cf128b21278e048a9a24e4683a8
SHA256887187c7b4695533054e54058d8d27b013061efefb7105a12641e828a386fee4
SHA51257924bbad3b270bfafd703dfb2eb0346cd264f08b569636285124246e9c80a85ce184c4cc2f20f7aa6023c967ffcfd6834a37e48f8ffb313d80a08118f3ac1b7
-
Filesize
616B
MD5eb7ad8c1135edbd03b809009fddb0984
SHA1a5e2edf820c928680776f68f99e7c89a282d74ee
SHA2562859ece539f5a9ccd396cf31de00542ebba034b0b470f1950e0c6bc03cb3541e
SHA512f6be5d657403f3ca694971408b40c57867414b186edff735ac8529ad83ff6103df2a6dcb404d297fea80e3186d6bb887b9fa2b83ce2eb2beda8e566782283fa2
-
Filesize
479B
MD5d4b6670d37fff6be5f66b7e95eb985d9
SHA122a05d9d0aac569278b8b011abe51199e72872e8
SHA256ace063947bad535a8a83cc64c44e6fb0f82f28f8e9786a0844e0256a29343ce6
SHA512e1f2f3f29460c9615ded48efd09895df0fe369b3ef7b8fddaea8a5004661e7aecd058c4ebc6556e97a4e6c7185c444dc8f926279f0e7d557594e0d57b3e8d9f4
-
Filesize
449KB
MD57cfcfcdf2f1a2e962d3975435a55b97d
SHA10e3b3c6e167542c580dec3a674f2fc3b4e91628d
SHA256abe48a2b945177b37b9f59db9f4d8f92ea9dc991f0835b7df3191e937b6d8929
SHA512eafb08deef09f5b4644c42e9bccac724dd5ba0345f43ea5cbc4ca8286b6ee34e579fa6195fbff24ceeb5e25db521e44edd99cc4d9a5691405e0e1f71b805548a
-
Filesize
101B
MD503b220416af240a4e2d8c57b2d3f5552
SHA15e4c943b45abe852edf4b5ad7de4f35f37bb041e
SHA256c7d6069d26e6ff15a5e745e3fa1389083607b6ed1ac725071654ba41f576b62c
SHA512e1131ed0a438581fd966a1f175f9f3069d26a7a0e63562005696387f180cbb059e421d195d7ee120bbf4c33ec146c06538ad22fccd6f9b4f42160e4bef97bed7
-
Filesize
28B
MD56311c3fd15588bb5c126e6c28ff5fffe
SHA1ce81d136fce31779f4dd62e20bdaf99c91e2fc57
SHA2568b82f6032e29a2b5c96031a3630fb6173d12ff0295bc20bb21b877d08f0812d8
SHA5122975fe2e94b6a8adc9cfc1a865ad113772b54572883a537b02a16dd2d029c0f7d9cca3b154fd849bdfe978e18b396bcf9fa6e67e7c61f92bdc089a29a9c355c6
-
Filesize
59B
MD54e43824cc2e9e2476266e9fc1725e385
SHA1c1404e1d6aebd263783a4dd4d2bb13dac4e55adb
SHA2565f4d864dfac5ee970ba32d2a873d75ee13f923836e868d6bf23d31c6bea73cc0
SHA512b338f530d7fed16652023a20eb6251c3676ced90f605054fb25bbd32c297a7fb8ee8269dea683bfcefd21e55770a122448baea9bb1233deaf8fe697ea1fb4067
-
Filesize
63B
MD5966fb6c34de1172bc4a640476fe8a288
SHA105a32463c0c68141cf2955bb616334077f14c7b1
SHA25644331074246f2c3a8e16347c87824b6aa144a666901f16003f4f840926c28fd9
SHA5120526238492b5374121d7ef581dc2bdf9a4496dc2abdd16183ae70755d5a5d095fb236d6a7a11fc7593092297588ac8c8f79f1a7e40a379c6e2d271f1f30590e7
-
Filesize
70B
MD582e5a4be7921d1f6d64011b13a83bac2
SHA1b520d10bbb28c5145aafd840d2ed00ccb21a563d
SHA256f81ba7a66e60c85b709ba35218e1bec1c4dfbacc2911cfb4a2985f66d01074ed
SHA5125f0c72ecd1e497e057ac3718b57717d0f4129f4a8748decb17c35e4340624d765f7f0b1deba2305b01e38cb906efba7f37b8058c5f474500188582335f2e56da