Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    148s
  • max time network
    150s
  • platform
    android-10_x64
  • resource
    android-x64-20240910-en
  • resource tags

    arch:x64arch:x86image:android-x64-20240910-enlocale:en-usos:android-10-x64system
  • submitted
    19/10/2024, 22:14

General

  • Target

    17e77a713a8bade156cf07561156c5515e7027c07ae902feaffcba0a1d23abaf.apk

  • Size

    1.9MB

  • MD5

    cd8a7c85e961c40d942582e0219d71dc

  • SHA1

    1af2395f00b7c4a638d25527f84e180846df5499

  • SHA256

    17e77a713a8bade156cf07561156c5515e7027c07ae902feaffcba0a1d23abaf

  • SHA512

    f1ff54fe99ce3a7a73fe081f20a6ea238865784afc7ed8b6b35639de7efc26f38e625ea2545f6f35e8659dfc3742128b91fd63e17e939f5d6572525e13cfe9b0

  • SSDEEP

    49152:EFsieKTDR1rL8npKrP4XcxkS03IQREe8nULSKuniC4bVcB2PEnIqiYfKvtSxc:WeKHR1rLcKDIcxkXrun0VcB2WIqiztS+

Malware Config

Extracted

Family

octo

C2

https://yapayzekaveteknologigirisimi.xyz/YjdkMWRjNTllNzZi/

https://dijitaldonanimveyazilimharikasi.xyz/YjdkMWRjNTllNzZi/

https://bulutbilisimveyapayzekatavsiyesi.xyz/YjdkMWRjNTllNzZi/

https://blockchainvekriptofinansuzmani.xyz/YjdkMWRjNTllNzZi/

https://yapayzekavegelecekteknolojisi.xyz/YjdkMWRjNTllNzZi/

https://robotikteknolojilerevesimulasyon.xyz/YjdkMWRjNTllNzZi/

https://sibertezvebilisimdunyasiprojeleri.xyz/YjdkMWRjNTllNzZi/

https://dijitaldunyavebilisimyenilikleri.xyz/YjdkMWRjNTllNzZi/

https://uzayteknolojisiveyapayzekakesfi.xyz/YjdkMWRjNTllNzZi/

https://akillirobotiksistemlerveotomat.xyz/YjdkMWRjNTllNzZi/

https://dijitaldunyabilgimimariprogrami.xyz/YjdkMWRjNTllNzZi/

https://kriptoekonomivetrendbilisim.xyz/YjdkMWRjNTllNzZi/

https://dijitaldonanimvebilisimproje.xyz/YjdkMWRjNTllNzZi/

https://kapsamdijitalanalizveveriharitasi.xyz/YjdkMWRjNTllNzZi/

https://akilliveriyonetimiplatformuve.xyz/YjdkMWRjNTllNzZi/

https://yapayzekaileakillialtyapi.xyz/YjdkMWRjNTllNzZi/

https://uzakgelecekbilisimplatformuve.xyz/YjdkMWRjNTllNzZi/

https://kriptoalgoritmaozeldanisman.xyz/YjdkMWRjNTllNzZi/

https://endustri4veakillifabrikalar.xyz/YjdkMWRjNTllNzZi/

https://bulutbilisimkapsamdijitaldonanim.xyz/YjdkMWRjNTllNzZi/

rc4.plain

Extracted

Family

octo

C2

https://yapayzekaveteknologigirisimi.xyz/YjdkMWRjNTllNzZi/

https://dijitaldonanimveyazilimharikasi.xyz/YjdkMWRjNTllNzZi/

https://bulutbilisimveyapayzekatavsiyesi.xyz/YjdkMWRjNTllNzZi/

https://blockchainvekriptofinansuzmani.xyz/YjdkMWRjNTllNzZi/

https://yapayzekavegelecekteknolojisi.xyz/YjdkMWRjNTllNzZi/

https://robotikteknolojilerevesimulasyon.xyz/YjdkMWRjNTllNzZi/

https://sibertezvebilisimdunyasiprojeleri.xyz/YjdkMWRjNTllNzZi/

https://dijitaldunyavebilisimyenilikleri.xyz/YjdkMWRjNTllNzZi/

https://uzayteknolojisiveyapayzekakesfi.xyz/YjdkMWRjNTllNzZi/

https://akillirobotiksistemlerveotomat.xyz/YjdkMWRjNTllNzZi/

https://dijitaldunyabilgimimariprogrami.xyz/YjdkMWRjNTllNzZi/

https://kriptoekonomivetrendbilisim.xyz/YjdkMWRjNTllNzZi/

https://dijitaldonanimvebilisimproje.xyz/YjdkMWRjNTllNzZi/

https://kapsamdijitalanalizveveriharitasi.xyz/YjdkMWRjNTllNzZi/

https://akilliveriyonetimiplatformuve.xyz/YjdkMWRjNTllNzZi/

https://yapayzekaileakillialtyapi.xyz/YjdkMWRjNTllNzZi/

https://uzakgelecekbilisimplatformuve.xyz/YjdkMWRjNTllNzZi/

https://kriptoalgoritmaozeldanisman.xyz/YjdkMWRjNTllNzZi/

https://endustri4veakillifabrikalar.xyz/YjdkMWRjNTllNzZi/

https://bulutbilisimkapsamdijitaldonanim.xyz/YjdkMWRjNTllNzZi/

Attributes
  • target_apps

    at.spardat.bcrmobile

    at.spardat.netbanking

    com.bankaustria.android.olb

    com.bmo.mobile

    com.cibc.android.mobi

    com.rbc.mobile.android

    com.scotiabank.mobile

    com.td

    cz.airbank.android

    eu.inmite.prj.kb.mobilbank

    com.bankinter.launcher

    com.kutxabank.android

    com.rsi

    com.tecnocom.cajalaboral

    es.bancopopular.nbmpopular

    es.evobanco.bancamovil

    es.lacaixa.mobile.android.newwapicon

    com.dbs.hk.dbsmbanking

    com.FubonMobileClient

    com.hangseng.rbmobile

    com.MobileTreeApp

    com.mtel.androidbea

    com.scb.breezebanking.hk

    hk.com.hsbc.hsbchkmobilebanking

    com.aff.otpdirekt

    com.ideomobile.hapoalim

    com.infrasofttech.indianBank

    com.mobikwik_new

    com.oxigen.oxigenwallet

    jp.co.aeonbank.android.passbook

AES_key

Signatures

  • Octo

    Octo is a banking malware with remote access capabilities first seen in April 2022.

  • Octo payload 1 IoCs
  • Loads dropped Dex/Jar 1 TTPs 1 IoCs

    Runs executable file dropped to the device during analysis.

  • Makes use of the framework's Accessibility service 4 TTPs 2 IoCs

    Retrieves information displayed on the phone screen using AccessibilityService.

  • Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
  • Queries the phone number (MSISDN for GSM devices) 1 TTPs
  • Acquires the wake lock 1 IoCs
  • Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs

    Application may abuse the framework's foreground service to continue running in the foreground.

  • Performs UI accessibility actions on behalf of the user 1 TTPs 4 IoCs

    Application may abuse the accessibility service to prevent their removal.

  • Queries the mobile country code (MCC) 1 TTPs 1 IoCs
  • Reads information about phone network operator. 1 TTPs
  • Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs
  • Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs

Processes

  • com.infant.mesh
    1⤵
    • Loads dropped Dex/Jar
    • Makes use of the framework's Accessibility service
    • Acquires the wake lock
    • Makes use of the framework's foreground persistence service
    • Performs UI accessibility actions on behalf of the user
    • Queries the mobile country code (MCC)
    • Registers a broadcast receiver at runtime (usually for listening for system events)
    • Uses Crypto APIs (Might try to encrypt user data)
    PID:5063

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • /data/data/com.infant.mesh/.qcom.infant.mesh

    Filesize

    48B

    MD5

    046a414913add6f5bb60072c7db819b6

    SHA1

    451ee4f6809260aec622d772fd329c7d0297a842

    SHA256

    b66c1320cb063a1d391c94273572ea6edae76c8c8b0a07f8d75c88686f0df72a

    SHA512

    4e6355f3051ed5e811ab030abde1f5be7f5e1cf33be99cd08477e9b6c015deb1d8bd75a09fb9c7176b8511c5ad0a67abc0902a3531e97564ccb6afc57496a47c

  • /data/data/com.infant.mesh/app_negative/YEELSG.json

    Filesize

    153KB

    MD5

    d14ea5573736adddb96a83f3b90bfc67

    SHA1

    05c91a77b40caa837ca1849c19b6e71c3ea2f987

    SHA256

    286aead38991d32065ff9e528486b8c309d0f4338743ece2e1d234fe3e55909e

    SHA512

    180d6400ed5670747f58ff4ff6887504c6edfcbdbce9b7005211f2f1eac17b8ffa33b90e8e65b4320a1076061e012422146d23a1210e85daf8abf19799d890d1

  • /data/data/com.infant.mesh/app_negative/YEELSG.json

    Filesize

    153KB

    MD5

    fbb1dbf6ec4304f0146eb3e2e9ea1c68

    SHA1

    82429970edf8d686ac92fec5d060f4e23fe6c071

    SHA256

    ffc7dcb548445b835de9e7b6b2286c7e009322f1343b8d500ca8e7a6a8fd5b48

    SHA512

    57e8f0f6c1e0237c63fac0146ad111c8ebe8c895196f87de70713ea412c8aa79c17cca9add509731ada2c910ebca0f22eb44262e835b21c2dbcd9e0646a5ce39

  • /data/data/com.infant.mesh/kl.txt

    Filesize

    230B

    MD5

    4142d60c8c2e48f59b8b028871f92e39

    SHA1

    51d50341d7337f3bc02c6db924ff69b89e3a8788

    SHA256

    e876629630f1cd871b442c90329b41dc4decc0c487feaacc93d95acdd9073195

    SHA512

    ec0cb938cc646db9c529ff5148ca1b7cf296212ac6d8aa8be4b427a4a9ed165399fd4617403a87906a950b6c220b10a9c321653cad9ed8a7125baff2ca800d94

  • /data/data/com.infant.mesh/kl.txt

    Filesize

    54B

    MD5

    5a9451175c6fd0d01252253ec14529ae

    SHA1

    b7ce7d976499af2499f468dbd7949dfd692975ec

    SHA256

    062678ca3e9693ca9f48f11697fa67e7158b6d082349137ab76472c121e54f11

    SHA512

    4fb12abf71af192274b84282e81fda8f8f4d3667b0814554a0f966cd1d5e1c3a8366f3ca20dc5d7f4c15cf2ac6a25adbc65e354dd70e605839361c8b99800895

  • /data/data/com.infant.mesh/kl.txt

    Filesize

    63B

    MD5

    58564100464f35b2001ee124a982c14b

    SHA1

    72d423ce9c69e32a3cc373dac1a11546697659c8

    SHA256

    2a6ea5b30f5123c6653aca24ae72008137cc4cd6e94e42cbce0018731f9db393

    SHA512

    afdc390f867d528186867e2175602816c1506907bf6054852eaf606e3a311e3229e083a3043b31c9a0227cd28831cf69ff63797fa0bffe6050398c6e123e56a0

  • /data/data/com.infant.mesh/kl.txt

    Filesize

    45B

    MD5

    03c667443d5666c8ed108f2223b9745d

    SHA1

    b4028487d4f15a1e9b7608bc3d6f863c15643f75

    SHA256

    eaa8a9228d80c4347ea19c0c67164cbc11a77b5849a462ec84a6c819b5b54d08

    SHA512

    d0561f88799320bd744202ff507822df006854696120ffd75f20dac95c07f9f8ff70d46257666ee04941cd8402e0cab7daaa86f23a5829ed31eb88d524fc6fc5

  • /data/data/com.infant.mesh/kl.txt

    Filesize

    423B

    MD5

    710363bf5c150be1ab5bc8c041eb6607

    SHA1

    f51fd3c8a504e6165d3052da0d513bd4b08973e1

    SHA256

    aaa87f1ac1bf6e3e5681fc38e28413c57e62618dcec138ddd18d4f4e11727ad8

    SHA512

    7a69c99cc2192054dc8cd17cb00923aff341c8011aeaaa2199cc78fd736c4569026ef7e3306999099c5e9f20870fdd34507e95c7ecf1be6bd8ecc330424bfe78

  • /data/user/0/com.infant.mesh/app_negative/YEELSG.json

    Filesize

    451KB

    MD5

    5cf448d9d7f34fab1ca944b4237ef021

    SHA1

    87e09d84d06a3afcb3aaccdfb504ff1d0f6d36e4

    SHA256

    dda767b4579a514bc12445771366d37c7d256c6081c56782b498d99e09833d31

    SHA512

    7972bcecab9befd0bde3da6cec52dfe92b8bf2ae968116e9abfe5283e9711824788518af80986649bd824e963ce422dbfd42888e40313ad8c0fb5941f142c6ea