Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
154s -
platform
android-11_x64 -
resource
android-x64-arm64-20240910-en -
resource tags
arch:armarch:arm64arch:x64arch:x86image:android-x64-arm64-20240910-enlocale:en-usos:android-11-x64system -
submitted
20/10/2024, 22:04
Static task
static1
Behavioral task
behavioral1
Sample
3097245af13e654937d04f6ce539f2242c67a50f09d5e14beb774ac28a6e7ced.apk
Resource
android-x86-arm-20240910-en
Behavioral task
behavioral2
Sample
3097245af13e654937d04f6ce539f2242c67a50f09d5e14beb774ac28a6e7ced.apk
Resource
android-x64-arm64-20240910-en
General
-
Target
3097245af13e654937d04f6ce539f2242c67a50f09d5e14beb774ac28a6e7ced.apk
-
Size
557KB
-
MD5
75cbe73d1ae3357191da259e67e57bd5
-
SHA1
29829ebc4f6f74a876ccfdd8c7b85cd7af274e36
-
SHA256
3097245af13e654937d04f6ce539f2242c67a50f09d5e14beb774ac28a6e7ced
-
SHA512
a3f4c80b92375152763519caf38d75fa18eb7e9c0a5d91f6479a2d45520e5e4e71bd083130905de6409ba551aff0d6060825a01f1911ef9223e6985986b03a7f
-
SSDEEP
12288:fkKcDxXlwdjzyq6dgDpwKUWMmWQJVnJx3c4/70g1dSohbF0EutQ:fkKcFX8t+9mW0VnJxMAphF0Et
Malware Config
Extracted
octo
https://2pethsop332.com/MzQ1Yzk1ZGQ4ODY3/
https://3pethsop332.com/MzQ1Yzk1ZGQ4ODY3/
https://4pethsop332.com/MzQ1Yzk1ZGQ4ODY3/
https://5pethsop332.com/MzQ1Yzk1ZGQ4ODY3/
https://6pethsop332.com/MzQ1Yzk1ZGQ4ODY3/
https://22pethsop332.com/MzQ1Yzk1ZGQ4ODY3/
https://32pethsop332.com/MzQ1Yzk1ZGQ4ODY3/
https://52pethsop332.com/MzQ1Yzk1ZGQ4ODY3/
Extracted
octo
https://2pethsop332.com/MzQ1Yzk1ZGQ4ODY3/
https://3pethsop332.com/MzQ1Yzk1ZGQ4ODY3/
https://4pethsop332.com/MzQ1Yzk1ZGQ4ODY3/
https://5pethsop332.com/MzQ1Yzk1ZGQ4ODY3/
https://6pethsop332.com/MzQ1Yzk1ZGQ4ODY3/
https://22pethsop332.com/MzQ1Yzk1ZGQ4ODY3/
https://32pethsop332.com/MzQ1Yzk1ZGQ4ODY3/
https://52pethsop332.com/MzQ1Yzk1ZGQ4ODY3/
Signatures
-
Octo
Octo is a banking malware with remote access capabilities first seen in April 2022.
-
Octo payload 1 IoCs
resource yara_rule behavioral2/files/fstream-1.dat family_octo -
Loads dropped Dex/Jar 1 TTPs 2 IoCs
Runs executable file dropped to the device during analysis.
ioc pid Process /data/user/0/com.sureusual99/cache/pqlslbqtyoz 4847 com.sureusual99 /data/user/0/com.sureusual99/cache/pqlslbqtyoz 4847 com.sureusual99 -
Makes use of the framework's Accessibility service 4 TTPs 2 IoCs
Retrieves information displayed on the phone screen using AccessibilityService.
description ioc Process Framework service call android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByViewId com.sureusual99 Framework service call android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId com.sureusual99 -
Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
-
Queries the phone number (MSISDN for GSM devices) 1 TTPs
-
Acquires the wake lock 1 IoCs
description ioc Process Framework service call android.os.IPowerManager.acquireWakeLock com.sureusual99 -
Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs
Application may abuse the framework's foreground service to continue running in the foreground.
description ioc Process Framework service call android.app.IActivityManager.setServiceForeground com.sureusual99 -
Performs UI accessibility actions on behalf of the user 1 TTPs 5 IoCs
Application may abuse the accessibility service to prevent their removal.
ioc Process android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction com.sureusual99 android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction com.sureusual99 android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction com.sureusual99 android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction com.sureusual99 android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction com.sureusual99 -
Queries the mobile country code (MCC) 1 TTPs 1 IoCs
description ioc Process Framework service call com.android.internal.telephony.ITelephony.getNetworkCountryIsoForPhone com.sureusual99 -
Reads information about phone network operator. 1 TTPs
-
Requests accessing notifications (often used to intercept notifications before users become aware). 1 TTPs 1 IoCs
description ioc Process Intent action android.settings.ACTION_NOTIFICATION_LISTENER_SETTINGS com.sureusual99 -
Requests disabling of battery optimizations (often used to enable hiding in the background). 1 TTPs 1 IoCs
description ioc Process Intent action android.settings.REQUEST_IGNORE_BATTERY_OPTIMIZATIONS com.sureusual99 -
Requests modifying system settings. 1 IoCs
description ioc Process Intent action android.settings.action.MANAGE_WRITE_SETTINGS com.sureusual99 -
Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs
description ioc Process Framework API call javax.crypto.Cipher.doFinal com.sureusual99
Processes
-
com.sureusual991⤵
- Loads dropped Dex/Jar
- Makes use of the framework's Accessibility service
- Acquires the wake lock
- Makes use of the framework's foreground persistence service
- Performs UI accessibility actions on behalf of the user
- Queries the mobile country code (MCC)
- Requests accessing notifications (often used to intercept notifications before users become aware).
- Requests disabling of battery optimizations (often used to enable hiding in the background).
- Requests modifying system settings.
- Uses Crypto APIs (Might try to encrypt user data)
PID:4847
Network
MITRE ATT&CK Mobile v15
Defense Evasion
Download New Code at Runtime
1Foreground Persistence
1Hide Artifacts
1User Evasion
1Impair Defenses
1Prevent Application Removal
1Input Injection
1Credential Access
Access Notifications
1Input Capture
2GUI Input Capture
1Keylogging
1Discovery
Software Discovery
1Security Software Discovery
1System Network Configuration Discovery
3Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
314B
MD5cf79dab20970f08c18bc3c8e0b36cf17
SHA189bad5851453c5b52d527f46ca57ca85c36e3a5e
SHA256a7d7fea6c66316a21384003e794999832862ffef55831f7510cbaa81de4d4335
SHA512d648144d1e75d9e2d0331009b474a685316487abc4168854e9e8251983b1bda95d30d4786a489e02ab7bc94b45cb85021e9de8c9390fe657148b27b34c36dfd0
-
Filesize
449KB
MD568bf892857d47a837ce96665749ee445
SHA14fce8da81e43247e95313ba330cd421fcb7bf624
SHA256769a9648bab85c6300997d6732bd901f64fc79cc7df9f1920ec9f223bc629218
SHA5122fb66af2fe3c32c5e961c4284cae1a9e02e310653c0b138d276e9a8cd01eb11f22a3b29a32992705977347face1756730e5261ffa7c44ca5b71ab07b7bf68584