Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    178s
  • max time network
    160s
  • platform
    android_x64
  • resource
    android-x64-20240624-en
  • resource tags

    androidarch:x64arch:x86image:android-x64-20240624-enlocale:en-usos:android-10-x64system
  • submitted
    24/06/2024, 18:03

General

  • Target

    2eda5dcdb7da2eff9afb11dc79782771ed56005dbd8a6b3b118505712865ea96.apk

  • Size

    509KB

  • MD5

    a6aff54c116b2be693e67f25b41b7ff2

  • SHA1

    959c5e07e03950703cfdf554f30643f40e81f95d

  • SHA256

    2eda5dcdb7da2eff9afb11dc79782771ed56005dbd8a6b3b118505712865ea96

  • SHA512

    759980e15472fc7e09b37ca38af9bdcd9bf02cb791f865d8bf79b489bba37e9f712085ca325b870d2ed9b7a5bf5cc70129340e1f4ed20985518c720218f254ad

  • SSDEEP

    12288:dsLknOEEY7FL4/2jY17lmzpJ3+jMd3ysAaJSz0HbkEDQGKXDnu:Uk5Et/00lmzpEzW+qqTnu

Malware Config

Extracted

Family

octo

C2

https://sinirlicivciv.com/YjNlM2ZhMjlhNjNi/

https://aglayancivciv3.com/YjNlM2ZhMjlhNjNi/

https://benhamburgersöyledimihtiyar3.com/YjNlM2ZhMjlhNjNi/

https://benyemekyememihtiyar2.com/YjNlM2ZhMjlhNjNi/

https://benkolaicmemihtiyar51.com/YjNlM2ZhMjlhNjNi/

https://mutlucivciv25.com/YjNlM2ZhMjlhNjNi/

Attributes
  • target_apps

    at.spardat.bcrmobile

    at.spardat.netbanking

    com.bankaustria.android.olb

    com.bmo.mobile

    com.cibc.android.mobi

    com.rbc.mobile.android

    com.scotiabank.mobile

    com.td

    cz.airbank.android

    eu.inmite.prj.kb.mobilbank

    com.bankinter.launcher

    com.kutxabank.android

    com.rsi

    com.tecnocom.cajalaboral

    es.bancopopular.nbmpopular

    es.evobanco.bancamovil

    es.lacaixa.mobile.android.newwapicon

    com.dbs.hk.dbsmbanking

    com.FubonMobileClient

    com.hangseng.rbmobile

    com.MobileTreeApp

    com.mtel.androidbea

    com.scb.breezebanking.hk

    hk.com.hsbc.hsbchkmobilebanking

    com.aff.otpdirekt

    com.ideomobile.hapoalim

    com.infrasofttech.indianBank

    com.mobikwik_new

    com.oxigen.oxigenwallet

    jp.co.aeonbank.android.passbook

AES_key

Signatures

Processes

  • com.roadcoursec
    1⤵
    • Loads dropped Dex/Jar
    • Makes use of the framework's Accessibility service
    • Obtains sensitive information copied to the device clipboard
    • Acquires the wake lock
    • Makes use of the framework's foreground persistence service
    • Performs UI accessibility actions on behalf of the user
    • Queries the mobile country code (MCC)
    • Registers a broadcast receiver at runtime (usually for listening for system events)
    • Uses Crypto APIs (Might try to encrypt user data)
    • Checks CPU information
    • Checks memory information
    PID:4920

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • /data/data/com.roadcoursec/.qcom.roadcoursec

    Filesize

    48B

    MD5

    046a414913add6f5bb60072c7db819b6

    SHA1

    451ee4f6809260aec622d772fd329c7d0297a842

    SHA256

    b66c1320cb063a1d391c94273572ea6edae76c8c8b0a07f8d75c88686f0df72a

    SHA512

    4e6355f3051ed5e811ab030abde1f5be7f5e1cf33be99cd08477e9b6c015deb1d8bd75a09fb9c7176b8511c5ad0a67abc0902a3531e97564ccb6afc57496a47c

  • /data/data/com.roadcoursec/cache/oat/zuqtbfhml.cur.prof

    Filesize

    438B

    MD5

    c1de0642dd59a5629a14c05ddedbfc74

    SHA1

    793b5b6fc5703c6af19b90e8490d041f73c4c411

    SHA256

    bf0706228877705cdd18614066c976a28f3fa38e6a9654648ce873879a33c0c2

    SHA512

    ba2a242b1f5d4e9e3d35c7a67a95fc66ccb0219dde4c8e088529020d2f3f5e2f57b0f7805e6ad0a27ab9b7eb0230d288c78e685e724c17c62d4a73a1b7efb27d

  • /data/data/com.roadcoursec/cache/zuqtbfhml

    Filesize

    449KB

    MD5

    2f7bcdc07d2fd614a245122ab6a4e905

    SHA1

    af65910ff3a1f7bae639d032e500e7fefc7b3847

    SHA256

    6e89766ddea90e16b8cca8bf9f81a9ed70b2d5b8bb3560b9bdb708662b121474

    SHA512

    927cc014ef2346033cae6acd90897e9b2cc54e640b2ab3fa9847f7e413d3aca91976ac9a70a30fdadbdc845e79faac9b98b3019b46daad5913f4657ab846d05f

  • /data/data/com.roadcoursec/kl.txt

    Filesize

    28B

    MD5

    6311c3fd15588bb5c126e6c28ff5fffe

    SHA1

    ce81d136fce31779f4dd62e20bdaf99c91e2fc57

    SHA256

    8b82f6032e29a2b5c96031a3630fb6173d12ff0295bc20bb21b877d08f0812d8

    SHA512

    2975fe2e94b6a8adc9cfc1a865ad113772b54572883a537b02a16dd2d029c0f7d9cca3b154fd849bdfe978e18b396bcf9fa6e67e7c61f92bdc089a29a9c355c6

  • /data/data/com.roadcoursec/kl.txt

    Filesize

    63B

    MD5

    b838930ca497cfd1d9d7452af7ce5f7f

    SHA1

    60ff5554a2df4c9d51ce9d133e24ea8812f0d3bf

    SHA256

    ba3277441b8706afeea3f95d8f08d9fae45332829a02dca36d51e9d23a85bb26

    SHA512

    37d054f00fa74c23b82fe33d48e97ad44809ad697ade4e7f59a5cb4649eb4d54a289e83e8fc3f2061347df53d776773270dcbb8923460dad74b8305c4433c5dc

  • /data/data/com.roadcoursec/kl.txt

    Filesize

    66B

    MD5

    b8fbe89763a3bb4f9c15da4b76df38bd

    SHA1

    5d2edbb5bc785fcbe6c06807a46e57b9fefd60a6

    SHA256

    fd38aed348f6d96a566add072cbc6121ee1d5419395222fd21a11f26aba8affb

    SHA512

    f5ea8b90da97569e3f337ff5a76cbf845ba662fe6f25d17060265e1b0a7e59702c819aefa9a292e27b2f29585053030dca8af193b8548b877d6be372b10fbd90

  • /data/data/com.roadcoursec/kl.txt

    Filesize

    45B

    MD5

    3d3da3df8334844621699e216cc444d6

    SHA1

    d2507e0790543c4b715085ab8c7e2ea13f3f8a9f

    SHA256

    3ea8eb648df0400b5b20c303e6f2b4f131818326d6459d11e19d51fc964ed061

    SHA512

    015aab90dc169410eaba5ca4f81928f9d4cb0277fdffb708ab782d593154b0b52fc65379e2efa0dd69cf5d624ddfe959cc476cff9052747e3970f599c2c5c5a0

  • /data/data/com.roadcoursec/kl.txt

    Filesize

    84B

    MD5

    e0fc9487d9223aae21ef6cbc76f80cfe

    SHA1

    1399122ae195e73025cd90856fbd814abe9108ba

    SHA256

    f901e941edacd532862bc4e3bbe77226e4040e770bc46996f15fcf5c4ca551b2

    SHA512

    2753726ffcbf7ccd873b4493fd63e706e68f8e6ab9891053f48950da457ad9f92ffb65775bada9795a569cdbe0eb2303db33b9e446fee0194f0543b4b34c38dd