Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
178s -
max time network
187s -
platform
android_x64 -
resource
android-x64-20240624-en -
resource tags
-
submitted
30/06/2024, 22:12
General
-
Target
b9bbc7219caa86952062dbf717ba5640fb8a2a6c73765c8a5cc0df8bf9088474.apk
-
Size
509KB
-
MD5
423897405093b562c0d54df05b64d2d3
-
SHA1
e557405b3b12d24ffdb2a84bf1375db301cb9de5
-
SHA256
b9bbc7219caa86952062dbf717ba5640fb8a2a6c73765c8a5cc0df8bf9088474
-
SHA512
45639211ac23fca6c88bca3a8fbcdf67cc083a1e2873924bb26435ada8c684b5c768969908e96d674eb908f4fb6ab84f5639ddae64a291079169acd58dec398e
-
SSDEEP
12288:lxrkYJ0QP+rSnVHTOJnLdKe/Xo28NBBOGYuj7T/+fzEKYFTbUA:lfHCJnB/ohNBBO2j3/7tYA
Malware Config
Extracted
octo
https://basgaancosturuyor.com/YzBlNzk4NmVlZDA0/
https://biribasganidurdursunn.com/YzBlNzk4NmVlZDA0/
https://bassganndomaingitti.com/YzBlNzk4NmVlZDA0/
https://usomapompaliyorum.com/YzBlNzk4NmVlZDA0/
https://usomukarimyaptimbasgaaan.com/YzBlNzk4NmVlZDA0/
https://basgaaanpompaaa.com/YzBlNzk4NmVlZDA0/
Signatures
-
Octo
Octo is a banking malware with remote access capabilities first seen in April 2022.
-
Octo payload 1 IoCs
-
Loads dropped Dex/Jar 1 TTPs 2 IoCs
Runs executable file dropped to the device during analysis.
-
Makes use of the framework's Accessibility service 4 TTPs 2 IoCs
Retrieves information displayed on the phone screen using AccessibilityService.
-
Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
-
Queries the phone number (MSISDN for GSM devices) 1 TTPs
-
Acquires the wake lock 1 IoCs
-
Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs
Application may abuse the framework's foreground service to continue running in the foreground.
-
Performs UI accessibility actions on behalf of the user 1 TTPs 4 IoCs
Application may abuse the accessibility service to prevent their removal.
-
Queries the mobile country code (MCC) 1 TTPs 1 IoCs
-
Reads information about phone network operator. 1 TTPs
-
Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs
-
Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs
Processes
-
com.likepower51⤵
- Loads dropped Dex/Jar
- Makes use of the framework's Accessibility service
- Acquires the wake lock
- Makes use of the framework's foreground persistence service
- Performs UI accessibility actions on behalf of the user
- Queries the mobile country code (MCC)
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Uses Crypto APIs (Might try to encrypt user data)
Network
MITRE ATT&CK Mobile v15
Persistence
Event Triggered Execution
1Broadcast Receivers
1Foreground Persistence
1Defense Evasion
Download New Code at Runtime
1Foreground Persistence
1Impair Defenses
1Prevent Application Removal
1Input Injection
1Discovery
Software Discovery
1Security Software Discovery
1System Network Configuration Discovery
3Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
462B
MD5608c4a5b203b466ca2c15f5d38106ef5
SHA1a709f46fc1856206e607b62d144c5ca256fe45de
SHA256c168624a92f97a5e7b6eb3812ae9a0604367da9aa794199493201057bdc6d850
SHA5124d4687e76031f4e7a61d2448d858385befd5b47f21f5aab9b8576b448db79780393addc1c2946d8d3bbb583de7ac2cf9cec935d0a6a71d274cba77145c7b0a7e
-
Filesize
448KB
MD5f622adf41258559be800657401679fb4
SHA14a6f62b4e4a962293f6c7d89e7d53f714efc673f
SHA2565ef51cfa64a0ed13c6965721837eb455ddd9d3d9172e059a8955457141778daa
SHA512355f3283a47d9112b0500de70baa08e7a4de75407e4497d5bfaadc5f5b86d155aa8e4bb26a7c9915c95daaa9a548aa83ae489808c340a43e33be3dd3becc1c58