Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    74s
  • max time network
    180s
  • platform
    android_x64
  • resource
    android-x64-20240611.1-en
  • resource tags

    androidarch:x64arch:x86image:android-x64-20240611.1-enlocale:en-usos:android-10-x64system
  • submitted
    12/06/2024, 15:31

General

  • Target

    7c97e4596816a9d5251c98f6271709867f4b50b89a8f4e9e24ac38ca7dc59cff.apk

  • Size

    517KB

  • MD5

    62584f9cc8ca888e91677b06ae0966be

  • SHA1

    48d3e0c415e8cca6396821d4921240ec738b9b2c

  • SHA256

    7c97e4596816a9d5251c98f6271709867f4b50b89a8f4e9e24ac38ca7dc59cff

  • SHA512

    8bce221887530bee24a4209c811efe3bed7a58002f435577eb0c64c2228b39b6242edd10da826eabe3c8d664ac56f8e3e28d55fb85fce8e45b79953984ae75e2

  • SSDEEP

    12288:YEnICxcCUXYOBptvrBaGdiO4hHRRYFBMpEhuer21kME/ll2VaTbf:YEnjxcCDmphGO4VRyrhXC1kME9l1vf

Malware Config

Extracted

Family

octo

C2

https://hyatyumrukgibi.top/ZjM0NjUxNDM5MmVi/

https://dnliyomsadeceuzaktan.xyz/ZjM0NjUxNDM5MmVi/

https://gecicekyramatuzatma.top/ZjM0NjUxNDM5MmVi/

https://birgunolucakelbeet.xyz/ZjM0NjUxNDM5MmVi/

https://sankioguncokuzakk.top/ZjM0NjUxNDM5MmVi/

https://snayatkatalicam.xyz/ZjM0NjUxNDM5MmVi/

https://olanlarigoruceez.xyz/ZjM0NjUxNDM5MmVi/

https://kfamhepkarambol.top/ZjM0NjUxNDM5MmVi/

https://birbirbirdenikidir.top/ZjM0NjUxNDM5MmVi/

https://fesatlarafesatkk.xyz/ZjM0NjUxNDM5MmVi/

https://bitmeztukenmezbuenerjj.xyz/ZjM0NjUxNDM5MmVi/

https://ckinsanaffettmm.top/ZjM0NjUxNDM5MmVi/

https://kirmizimavigelldii.xyz/ZjM0NjUxNDM5MmVi/

https://dememelalemnedeerr.top/ZjM0NjUxNDM5MmVi/

https://savuryadarsavuun.xyz/ZjM0NjUxNDM5MmVi/

https://taktmkafayikapattmkafayi.xyz/ZjM0NjUxNDM5MmVi/

https://taktimbirtipayivedekovayi.top/ZjM0NjUxNDM5MmVi/

https://bileneaferinbilmeyeneketamn.xyz/ZjM0NjUxNDM5MmVi/

https://gormedenglenlereslm.xyz/ZjM0NjUxNDM5MmVi/

https://saffetsafmigerckten.top/ZjM0NjUxNDM5MmVi/

Attributes
  • target_apps

    at.spardat.bcrmobile

    at.spardat.netbanking

    com.bankaustria.android.olb

    com.bmo.mobile

    com.cibc.android.mobi

    com.rbc.mobile.android

    com.scotiabank.mobile

    com.td

    cz.airbank.android

    eu.inmite.prj.kb.mobilbank

    com.bankinter.launcher

    com.kutxabank.android

    com.rsi

    com.tecnocom.cajalaboral

    es.bancopopular.nbmpopular

    es.evobanco.bancamovil

    es.lacaixa.mobile.android.newwapicon

    com.dbs.hk.dbsmbanking

    com.FubonMobileClient

    com.hangseng.rbmobile

    com.MobileTreeApp

    com.mtel.androidbea

    com.scb.breezebanking.hk

    hk.com.hsbc.hsbchkmobilebanking

    com.aff.otpdirekt

    com.ideomobile.hapoalim

    com.infrasofttech.indianBank

    com.mobikwik_new

    com.oxigen.oxigenwallet

    jp.co.aeonbank.android.passbook

AES_key

Signatures

  • Octo

    Octo is a banking malware with remote access capabilities first seen in April 2022.

  • Octo payload 1 IoCs
  • Loads dropped Dex/Jar 1 TTPs 2 IoCs

    Runs executable file dropped to the device during analysis.

  • Makes use of the framework's Accessibility service 4 TTPs 2 IoCs

    Retrieves information displayed on the phone screen using AccessibilityService.

  • Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
  • Queries the phone number (MSISDN for GSM devices) 1 TTPs
  • Acquires the wake lock 1 IoCs
  • Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs

    Application may abuse the framework's foreground service to continue running in the foreground.

  • Performs UI accessibility actions on behalf of the user 1 TTPs 2 IoCs

    Application may abuse the accessibility service to prevent their removal.

  • Queries the mobile country code (MCC) 1 TTPs 1 IoCs
  • Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs
  • Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs

Processes

  • com.keepnorth3
    1⤵
    • Loads dropped Dex/Jar
    • Makes use of the framework's Accessibility service
    • Acquires the wake lock
    • Makes use of the framework's foreground persistence service
    • Performs UI accessibility actions on behalf of the user
    • Queries the mobile country code (MCC)
    • Registers a broadcast receiver at runtime (usually for listening for system events)
    • Uses Crypto APIs (Might try to encrypt user data)
    PID:5009

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • /data/data/com.keepnorth3/.qcom.keepnorth3

    Filesize

    48B

    MD5

    046a414913add6f5bb60072c7db819b6

    SHA1

    451ee4f6809260aec622d772fd329c7d0297a842

    SHA256

    b66c1320cb063a1d391c94273572ea6edae76c8c8b0a07f8d75c88686f0df72a

    SHA512

    4e6355f3051ed5e811ab030abde1f5be7f5e1cf33be99cd08477e9b6c015deb1d8bd75a09fb9c7176b8511c5ad0a67abc0902a3531e97564ccb6afc57496a47c

  • /data/data/com.keepnorth3/cache/oat/tobpmklxk.cur.prof

    Filesize

    470B

    MD5

    0b1ee6391454c178898cb4673d4c584c

    SHA1

    b59510f13a2dfa67c04271d0f952019d99810011

    SHA256

    c25853847bc89fed04a4c11ca4ae14a5ca1cf51aac691ab97a04e99606bf479c

    SHA512

    bca1e126f337885bcad1f0f5163eb95331151587e4df2fb66a082d9279974397e7e07b7e9242b62f1697960dc0550967ade2e434340aedaeaaf14b58a056358f

  • /data/data/com.keepnorth3/cache/tobpmklxk

    Filesize

    451KB

    MD5

    ad99d2e463576d713843c4887b9fd92a

    SHA1

    c76a36c0af80c1705e479be87937508e7d1a64c4

    SHA256

    9c332c17cb07d2ac2bc37c15a01d78f92ab3dfd1bd39be89578125b0645ea111

    SHA512

    61a02d0e0d1ecd69134458c5086a38162056268eeaf60fc0396086f3f139c8151503ad4d02fd264a0d8885b3b45f138d821e6ac98e46e0b6e4868014f1bbda21

  • /data/data/com.keepnorth3/kl.txt

    Filesize

    237B

    MD5

    a7345e45b2a392ea34a60487582c78e9

    SHA1

    c075e7f1d281ea028ea0e6cf5e279e19390dc9e3

    SHA256

    17d397f653efd42b3c21fb7cb3a126f968df1d07876e2dc473cc82b98d33f505

    SHA512

    843b3e33c899d7378c5c5ee0c67ca652818f4191a413ea427bf8c6ee0cf83bfedf060cebeed8ece362365d52f8d4a5e3d325ab0d34e77d5db9d99f35dd77cb1c

  • /data/data/com.keepnorth3/kl.txt

    Filesize

    45B

    MD5

    ab953c795104b34aa839c16e6a522e17

    SHA1

    45f336736791a94ed188489abb849589b0d88924

    SHA256

    b5c67ab5a3b5de06561ba6235abd65d1490939e6effe9ac023153f8362f48b69

    SHA512

    773225aa7cb0a96a7bbc4c97f76ffd6e540a4aee8a5bcd5742037219f0fbdc857fae6e23498916cb3b23ef503a963f03b875bf9a7881a0d8872ec52a5c15164a

  • /data/data/com.keepnorth3/kl.txt

    Filesize

    63B

    MD5

    1bf0babe85bdb8c0c063808c3bc80f67

    SHA1

    148121d187ea698f883c5a00e35d2d45bb87b324

    SHA256

    e092135499ed3cd85e22a4800d41a1e1b6e1dfa36e4922a90d4a86f07373b64c

    SHA512

    598fac40d119bb4105ab40ab74ec39081926ef8826d870b866381f93e70ac83c3615684e5ec756e574cb6b0fc79447c7c1577fbdfa86e51450d02c6e07b92110

  • /data/data/com.keepnorth3/kl.txt

    Filesize

    45B

    MD5

    bf9fc5e8ce21a8d07efc6c3df107bcba

    SHA1

    700f3aa02c4f62326f5c90a85102c2a29740a341

    SHA256

    756ea41e11a76dfc80d7f8c5167a92c7eccfcd9b20900be0f9047dedf57766fc

    SHA512

    03ef4ee1dcd4efc31f93e3cb2fb5f9f837466b2545fcbd5181aabe4e1dba13e6e2614effa587f8d3566b022a7fe61ceca522abfcb2ae99187261f48835eeeed4

  • /data/data/com.keepnorth3/kl.txt

    Filesize

    437B

    MD5

    f56cb9d1dbd5b781ed1ac8678ca747af

    SHA1

    ba497291d93cbb7d37687b5dfbb926f4d814b664

    SHA256

    716497c557257fb1f0fcdd082d1d0f8e956ff25bb347ccb66b6fb90f55af8d2b

    SHA512

    faf57382c88e58095fa1239424b126455a453e9f125e150f29731db77051576dd22e40e179868567dc5cbd890509fe217c798bf2ff70107d69eb0ea3bbbde296