Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    148s
  • max time network
    141s
  • platform
    android_x86
  • resource
    android-x86-arm-20240624-en
  • resource tags

    androidarch:armarch:x86image:android-x86-arm-20240624-enlocale:en-usos:android-9-x86system
  • submitted
    17/10/2024, 22:00

General

  • Target

    ebf56e62fae239c37b350d4ab369ca82d5c8d68b7c47346e8cda799761ffd643.apk

  • Size

    513KB

  • MD5

    2f6a9babfd2d8578212bfd5329841e86

  • SHA1

    83ab1ab309a193746a50bb128652e243be7d8cb9

  • SHA256

    ebf56e62fae239c37b350d4ab369ca82d5c8d68b7c47346e8cda799761ffd643

  • SHA512

    ab939e0c92d844df7f77698c9891b86914ec4708d437c0b4f83bac3f81e4fa2d1a91afca4281e91dabcf81f400aa0a74d2c8e3cd305ff8e19a78b1f9554089be

  • SSDEEP

    12288:txh4PNMxgNxKVir8P83xtDRUBJGBrlPYFufCOUn1:LGP2xgNMVHetqBJ05P8u6OUn1

Malware Config

Extracted

Family

octo

C2

https://hepsinidoe01malltim21.com/YzM1YThkNDFkNmQ0/

https://hepsinezipla4dime522.com/YzM1YThkNDFkNmQ0/

https://hersenbo67saaldia548.com/YzM1YThkNDFkNmQ0/

https://alayinag45idserr5454.com/YzM1YThkNDFkNmQ0/

https://neadamsin45mda1yq.com/YzM1YThkNDFkNmQ0/

rc4.plain

Extracted

Family

octo

C2

https://hepsinidoe01malltim21.com/YzM1YThkNDFkNmQ0/

https://hepsinezipla4dime522.com/YzM1YThkNDFkNmQ0/

https://hersenbo67saaldia548.com/YzM1YThkNDFkNmQ0/

https://alayinag45idserr5454.com/YzM1YThkNDFkNmQ0/

https://neadamsin45mda1yq.com/YzM1YThkNDFkNmQ0/

Attributes
  • target_apps

    at.spardat.bcrmobile

    at.spardat.netbanking

    com.bankaustria.android.olb

    com.bmo.mobile

    com.cibc.android.mobi

    com.rbc.mobile.android

    com.scotiabank.mobile

    com.td

    cz.airbank.android

    eu.inmite.prj.kb.mobilbank

    com.bankinter.launcher

    com.kutxabank.android

    com.rsi

    com.tecnocom.cajalaboral

    es.bancopopular.nbmpopular

    es.evobanco.bancamovil

    es.lacaixa.mobile.android.newwapicon

    com.dbs.hk.dbsmbanking

    com.FubonMobileClient

    com.hangseng.rbmobile

    com.MobileTreeApp

    com.mtel.androidbea

    com.scb.breezebanking.hk

    hk.com.hsbc.hsbchkmobilebanking

    com.aff.otpdirekt

    com.ideomobile.hapoalim

    com.infrasofttech.indianBank

    com.mobikwik_new

    com.oxigen.oxigenwallet

    jp.co.aeonbank.android.passbook

AES_key

Signatures

Processes

  • com.fishpass5
    1⤵
    • Removes its main activity from the application launcher
    • Loads dropped Dex/Jar
    • Makes use of the framework's Accessibility service
    • Acquires the wake lock
    • Makes use of the framework's foreground persistence service
    • Performs UI accessibility actions on behalf of the user
    • Queries the mobile country code (MCC)
    • Requests accessing notifications (often used to intercept notifications before users become aware).
    • Requests disabling of battery optimizations (often used to enable hiding in the background).
    • Registers a broadcast receiver at runtime (usually for listening for system events)
    • Uses Crypto APIs (Might try to encrypt user data)
    PID:4264

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • /data/data/com.fishpass5/.qcom.fishpass5

    Filesize

    48B

    MD5

    046a414913add6f5bb60072c7db819b6

    SHA1

    451ee4f6809260aec622d772fd329c7d0297a842

    SHA256

    b66c1320cb063a1d391c94273572ea6edae76c8c8b0a07f8d75c88686f0df72a

    SHA512

    4e6355f3051ed5e811ab030abde1f5be7f5e1cf33be99cd08477e9b6c015deb1d8bd75a09fb9c7176b8511c5ad0a67abc0902a3531e97564ccb6afc57496a47c

  • /data/data/com.fishpass5/cache/jsxnjkazpxawnfi

    Filesize

    450KB

    MD5

    75b6909991f9d20c1f5225563f72ba07

    SHA1

    5c5487f9f7d5f7773ed2f44a1245d71e92ab85d7

    SHA256

    bc6470fdfdae6bc175fb7e9786441a26a560eba93ed7e26341d24e4253e3baeb

    SHA512

    4626e7efae1af17db64d539de796b539de9b99578e1b94019dc99b3277c0f494867d0dca90364494475fe526e017af0b4a9c53ad4a59d527f6ab601d65ed94c4

  • /data/data/com.fishpass5/cache/oat/jsxnjkazpxawnfi.cur.prof

    Filesize

    460B

    MD5

    4481f92321dd7d0bac2fbe9e9ec10c80

    SHA1

    54e1495fa363ca13f3fe79f31e4faafc346904ae

    SHA256

    05bd8fce5ff9ab1868e897437d6993a409ec859b95fd38a86200490fcf93de73

    SHA512

    a87e00469184d5a137198afc070dcbe04c9b748b437f01b5590b86bd7766ea4d9db666268db886eb7d3f02bc8c69c292e4f9fab406c393625988c9d5a66464d9

  • /data/data/com.fishpass5/kl.txt

    Filesize

    237B

    MD5

    56cd74b4c835395f3983627b15b7f329

    SHA1

    1a9d7944e393508d22d7965a461f65cbb0d35e16

    SHA256

    015792e7dd611c88efe6841589d96cc74dcd5345cdf5594df1064b1d78a23959

    SHA512

    6ec308b8d401d7ae0fe2b53a32316cb2a73f7975b1b2cdaab36c3a965c66deca120e876ea124c9ca06f4cc2dc97432b71e16617098a358972f3458b9264c62b5

  • /data/data/com.fishpass5/kl.txt

    Filesize

    79B

    MD5

    8b3b0c91b569f99d3e7063df814fc4b7

    SHA1

    02e20706b0b9fe7d08c4de8e412ee179eed52002

    SHA256

    9bab6abec302476322b9d9a34c3e10bfc730217a7825f32e1dc18b868ef2bb1f

    SHA512

    7426ab96fd17e0e2ee747cdfb885230c0e28230777f18e06003188db2505b808353851a39f671032e0804fcefb9a849017d741bc59de9435eadc5b65f7243473

  • /data/data/com.fishpass5/kl.txt

    Filesize

    63B

    MD5

    f7f1edb0b47fdf1ce5907f3d307bca5b

    SHA1

    39a22604484987c174dd307af518507c9142e30e

    SHA256

    97f3e2283d32798d225cdfd6a72f3f69c0e6aaa0ad737070206d15093bde5fca

    SHA512

    99ff8845033516c9dcd03af1f50c94b951e6923daa563caf6f4b7a673b4dc857eec69605e1c39398a4eeb6408688b803d7428115af7db966a2d0980756948b97

  • /data/data/com.fishpass5/kl.txt

    Filesize

    45B

    MD5

    a15138fa555645c6e9bd2ff487a38196

    SHA1

    63bfed4c92c48cea9e8d6589afcfb42ce63e363a

    SHA256

    30ac419a7349d58af705cc4b9a692926735e15ab559637125e3ac988c144dd62

    SHA512

    174a86c3c96f0ec9356649aeff7185ab531bfe0260db26b09680372a69767df5f0d89f00a6eed8b3ff24f7e61a6b7c36ca087594f1d3afa558c2dfb117c169b6

  • /data/data/com.fishpass5/kl.txt

    Filesize

    437B

    MD5

    a70fd05c3fa3f70c12be916b98056387

    SHA1

    da0e4bd8b33d8ce1188fb7f2e13a1dd87339c7e0

    SHA256

    fc3cd3e887753e73b10adeddb9c4cc3393d409818c66e75cbefe55fcb2c7f019

    SHA512

    9182d90073d64e6494771a5482ae2bdc59718f2f75c3468060e90b827e48b99f723214784f1c0dfaacc9721bfb2315330a398487a57f02beeab5fa02a920ed5b