Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

General

  • Target

    2d00a7f3761666fbd7dae3a7066124990b39040b467c328685dad619b42fcf34.bin

  • Size

    4.8MB

  • Sample

    241012-1xdjbsxgql

  • MD5

    c5da4ee4cc024c1147bad389d6647f5e

  • SHA1

    b2aa3e21dc32655486e336fd46273097f917bb26

  • SHA256

    2d00a7f3761666fbd7dae3a7066124990b39040b467c328685dad619b42fcf34

  • SHA512

    e66af0216f1f9732487b18adfba4091f607833e5ab6cf116c270e8d173be1513d738a5eeb6c4a85cd46afb08689e68bb074038b6b4d680f35842b32d7345ccf0

  • SSDEEP

    49152:uRsEXpBwNqKGQ3XqS45iS7xrGUvEc26qjVKSc9uDDxvuNOMDWzzI9Kj:uRsYiqPQ3X+5iSRGIUVKOhuNOMDWw9s

Malware Config

Extracted

Family

octo

C2

https://6f3aedf597b5b5b20718ecaef86e38f8.com

https://e6d3c4622b5e1bd14da3e5aebd478810.org

Attributes
  • target_apps

    at.spardat.bcrmobile

    at.spardat.netbanking

    com.bankaustria.android.olb

    com.bmo.mobile

    com.garanti.cepsubesi

    com.cibc.android.mobi

    com.rbc.mobile.android

    com.scotiabank.mobile

    com.td

    cz.airbank.android

    eu.inmite.prj.kb.mobilbank

    com.bankinter.launcher

    com.kutxabank.android

    com.rsi

    com.tecnocom.cajalaboral

    es.bancopopular.nbmpopular

    es.evobanco.bancamovil

    es.lacaixa.mobile.android.newwapicon

    com.dbs.hk.dbsmbanking

    com.FubonMobileClient

    com.hangseng.rbmobile

    com.MobileTreeApp

    com.mtel.androidbea

    com.scb.breezebanking.hk

    hk.com.hsbc.hsbchkmobilebanking

    com.aff.otpdirekt

    com.ideomobile.hapoalim

    com.infrasofttech.indianBank

    com.mobikwik_new

    com.oxigen.oxigenwallet

AES_key
1
61623863646139323832373130626338
AES_key
1
783178337835783778392d6263646566
AES_key
1
62626461396266363433663165373739
AES_key
1
64383135333930353666353062383437
AES_key
1
63643161353037343437333565616334
AES_key
1
39613563343662363033663438633234
AES_key
1
37626532313531383033623963633163
AES_key
1
30343363343037653261323032633337
AES_key
1
63306661643262623561653261363638
AES_key
1
30663134613935666335383539326536
AES_key
1
31626436313334313037393664643130
AES_key
1
65343866323535316432616263653531
AES_key
1
62323935353666666665366464356263
AES_key
1
30386566393639346536353532383463
AES_key
1
61636437613361626634666661306661
AES_key
1
64646430306237356633346136353066
AES_key
1
64303165323134653436373332313732
AES_key
1
38346231353930623933333833363461
AES_key
1
36366430636631653831346236303238
AES_key
1
33393430613563393163393161613763
AES_key
1
33316435626663633234353865613262
AES_key
1
37646264626430393334383436393234
AES_key
1
33393837656533643337333262623430
AES_key
1
39393962333437636134326139336566
AES_key
1
65333765313638643934326436386534
AES_key
1
63633261323938663662666631623234

Targets

    • Target

      2d00a7f3761666fbd7dae3a7066124990b39040b467c328685dad619b42fcf34.bin

    • Size

      4.8MB

    • MD5

      c5da4ee4cc024c1147bad389d6647f5e

    • SHA1

      b2aa3e21dc32655486e336fd46273097f917bb26

    • SHA256

      2d00a7f3761666fbd7dae3a7066124990b39040b467c328685dad619b42fcf34

    • SHA512

      e66af0216f1f9732487b18adfba4091f607833e5ab6cf116c270e8d173be1513d738a5eeb6c4a85cd46afb08689e68bb074038b6b4d680f35842b32d7345ccf0

    • SSDEEP

      49152:uRsEXpBwNqKGQ3XqS45iS7xrGUvEc26qjVKSc9uDDxvuNOMDWzzI9Kj:uRsYiqPQ3X+5iSRGIUVKOhuNOMDWw9s

    • Octo

      Octo is a banking malware with remote access capabilities first seen in April 2022.

    • Octo payload

    • Loads dropped Dex/Jar

      Runs executable file dropped to the device during analysis.

    • Makes use of the framework's Accessibility service

      Retrieves information displayed on the phone screen using AccessibilityService.

    • Obtains sensitive information copied to the device clipboard

      Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.

    • Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps)

    • Queries the phone number (MSISDN for GSM devices)

    • Acquires the wake lock

    • Makes use of the framework's foreground persistence service

      Application may abuse the framework's foreground service to continue running in the foreground.

    • Queries the mobile country code (MCC)

    • Queries the unique device ID (IMEI, MEID, IMSI)

    • Reads information about phone network operator.

    • Requests disabling of battery optimizations (often used to enable hiding in the background).

MITRE ATT&CK Mobile v15

Tasks

We care about your privacy.

This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.