Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    148s
  • max time network
    150s
  • platform
    android-9_x86
  • resource
    android-x86-arm-20240910-en
  • resource tags

    arch:armarch:x86image:android-x86-arm-20240910-enlocale:en-usos:android-9-x86system
  • submitted
    16/10/2024, 22:47

General

  • Target

    152709b8ed7fd9bae41a80312ed1a6e145065a775f65ce32c89d6da5b63f7fa5.apk

  • Size

    509KB

  • MD5

    ac5aa1f8abc7423ce6c957c401020cdb

  • SHA1

    03d963639b14aed4bcbc3310bfb59203b6c20917

  • SHA256

    152709b8ed7fd9bae41a80312ed1a6e145065a775f65ce32c89d6da5b63f7fa5

  • SHA512

    a157616ed1cd9e05c9d4644e231ff27a69ff46a72de683f4a8763b7fbe58b280a508040128b7d3f7b2a2d1bd3424aee7f974cb18a4afdcb513275b925cd90389

  • SSDEEP

    12288:XFFD8OSMU1onhGeAqBuBj+UxKrCX4PKBc6QeAarN//XdUpTfXHGtoin8:n8c8G/AqYATPgVzAarB/Xduf+5n8

Malware Config

Extracted

Family

octo

C2

https://hepsinidoe01malltim21.com/YzM1YThkNDFkNmQ0/

https://hepsinezipla4dime522.com/YzM1YThkNDFkNmQ0/

https://hersenbo67saaldia548.com/YzM1YThkNDFkNmQ0/

https://alayinag45idserr5454.com/YzM1YThkNDFkNmQ0/

https://neadamsin45mda1yq.com/YzM1YThkNDFkNmQ0/

rc4.plain

Extracted

Family

octo

C2

https://hepsinidoe01malltim21.com/YzM1YThkNDFkNmQ0/

https://hepsinezipla4dime522.com/YzM1YThkNDFkNmQ0/

https://hersenbo67saaldia548.com/YzM1YThkNDFkNmQ0/

https://alayinag45idserr5454.com/YzM1YThkNDFkNmQ0/

https://neadamsin45mda1yq.com/YzM1YThkNDFkNmQ0/

Attributes
  • target_apps

    at.spardat.bcrmobile

    at.spardat.netbanking

    com.bankaustria.android.olb

    com.bmo.mobile

    com.cibc.android.mobi

    com.rbc.mobile.android

    com.scotiabank.mobile

    com.td

    cz.airbank.android

    eu.inmite.prj.kb.mobilbank

    com.bankinter.launcher

    com.kutxabank.android

    com.rsi

    com.tecnocom.cajalaboral

    es.bancopopular.nbmpopular

    es.evobanco.bancamovil

    es.lacaixa.mobile.android.newwapicon

    com.dbs.hk.dbsmbanking

    com.FubonMobileClient

    com.hangseng.rbmobile

    com.MobileTreeApp

    com.mtel.androidbea

    com.scb.breezebanking.hk

    hk.com.hsbc.hsbchkmobilebanking

    com.aff.otpdirekt

    com.ideomobile.hapoalim

    com.infrasofttech.indianBank

    com.mobikwik_new

    com.oxigen.oxigenwallet

    jp.co.aeonbank.android.passbook

AES_key

Signatures

Processes

  • com.tryonlyuaoj
    1⤵
    • Removes its main activity from the application launcher
    • Loads dropped Dex/Jar
    • Makes use of the framework's Accessibility service
    • Acquires the wake lock
    • Makes use of the framework's foreground persistence service
    • Performs UI accessibility actions on behalf of the user
    • Queries the mobile country code (MCC)
    • Requests accessing notifications (often used to intercept notifications before users become aware).
    • Requests disabling of battery optimizations (often used to enable hiding in the background).
    • Registers a broadcast receiver at runtime (usually for listening for system events)
    • Uses Crypto APIs (Might try to encrypt user data)
    PID:4366

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • /data/data/com.tryonlyuaoj/.qcom.tryonlyuaoj

    Filesize

    48B

    MD5

    046a414913add6f5bb60072c7db819b6

    SHA1

    451ee4f6809260aec622d772fd329c7d0297a842

    SHA256

    b66c1320cb063a1d391c94273572ea6edae76c8c8b0a07f8d75c88686f0df72a

    SHA512

    4e6355f3051ed5e811ab030abde1f5be7f5e1cf33be99cd08477e9b6c015deb1d8bd75a09fb9c7176b8511c5ad0a67abc0902a3531e97564ccb6afc57496a47c

  • /data/data/com.tryonlyuaoj/cache/idgkgyxkx

    Filesize

    449KB

    MD5

    42fe5d75f0d11595ac658ea69222e743

    SHA1

    ca04e5b403261697c2488c25f6979b3292bb9f47

    SHA256

    90fa69dece9e3d6fe1d52dfa8b00c721dbbe070bcd3f08aa3862c471bd7ba91e

    SHA512

    ffb452f692dc099e5028b5d9f6eefc5e53630c9e95ace2263ecd3b09c117759f6f213ecf484535e79f7a970e068e169a46f071386800429ef3e10bb03008f183

  • /data/data/com.tryonlyuaoj/cache/oat/idgkgyxkx.cur.prof

    Filesize

    487B

    MD5

    456d400d875d49ac97893efa21dd65f8

    SHA1

    54c5a599cfe4c669a72f6842b9cc942482a00feb

    SHA256

    af4bbf7d2c7d2334e148e77072eb6f1cf7d14ab17bcf34a0832c802ba23ae903

    SHA512

    94c6ae7d5797d34d8707ab2ce281dfca32cc29a7785c7d24dcb85964245df55fac8f997a3805b722b5391c9a29974a596ed955bad524dac48df58340a9c35fa7

  • /data/data/com.tryonlyuaoj/kl.txt

    Filesize

    237B

    MD5

    6b6efc652089ab36187fc018837790c1

    SHA1

    79a959684c2cee339cd92f204b0b862affdcf156

    SHA256

    36ab404e9a0ab7fe663667e67668d49e6a4cce1b07ec0996010f60b3533c3090

    SHA512

    4cfe737714e66eb56892a735d5ffda4e720e1c56b584eb14e63a6ff809123d88f9ab538dadc9a770e61c284f4a1cf5a29b61d39b166bb0445cc5127e1bf996fc

  • /data/data/com.tryonlyuaoj/kl.txt

    Filesize

    54B

    MD5

    6d752d2ddff5fb923e0e805b8f32cdc5

    SHA1

    3b41a015279abe8873f2ac8bfa8debf462d35816

    SHA256

    d1a793fb1e578341b982667529d8399863a3386afe9a7f30c2f50d2a9341b640

    SHA512

    07f492c3171400c96ace408444bdce920d99e08793eb161e1147418c6c7ee4cdaaf984fe29821799d6eda9e66043852020731b2cef85a58b798f22ee6e4e4829

  • /data/data/com.tryonlyuaoj/kl.txt

    Filesize

    63B

    MD5

    2199da36ff99c8876ed32c05acbec13f

    SHA1

    fd523933ca1613a40142c8ac428dabf3c94a57dd

    SHA256

    70c1c7e20c78dc7c86d8179a136a13c8c866a85756389d92a8fb3dcaa8279e7e

    SHA512

    5d6449592e619192b1d41401f8e24912c29d4ae3d4cb5340b230a3f2d040ef3a5e3f5c0de5bf039e3a8a2c84b4d6e2bd41f810957257f8215f0a121f968df769

  • /data/data/com.tryonlyuaoj/kl.txt

    Filesize

    45B

    MD5

    db0e8a3c703e7b2b369ef6ebac940647

    SHA1

    66b01e0a24c5b49b045babaf1f5e945ca1e6cf63

    SHA256

    ae3591988fdfa8141f1f2a44cf76dd234443b9a6f9d2de84224d307f79a72564

    SHA512

    956fcd5de833d6f238192febdc18e54b7e55a4f40e440daff1fc6fa578644bcd1950172f85b12efab60f8bf4468e8c4ff2b029f3890784877206241bea45c551

  • /data/data/com.tryonlyuaoj/kl.txt

    Filesize

    437B

    MD5

    fcdd2c639d84e2e983b1e2dd71c7f5ae

    SHA1

    d23003f2391697afad98bc086073c5d501196fe7

    SHA256

    249f0ea9c2458157721c53afc921c535932cd011141b2685927d7ba135db848d

    SHA512

    c70def7a4b8ed4e7f27025fbb651006261254b9d3d4f20875b7a01d3374d09f2c8038732d6975cbf4494740bb4da7603abe1b0daf606efc9f26c3c6d185c9607