Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    149s
  • max time network
    150s
  • platform
    android-11_x64
  • resource
    android-x64-arm64-20240910-en
  • resource tags

    arch:armarch:arm64arch:x64arch:x86image:android-x64-arm64-20240910-enlocale:en-usos:android-11-x64system
  • submitted
    27/10/2024, 22:00

General

  • Target

    4923c03fcf31c83273bb76817ff9a61f3ba25c579543235b79544e80351584b8.apk

  • Size

    561KB

  • MD5

    f4d926722e236626641a514310e09490

  • SHA1

    2cfe12611661877963abefd105db18fbd5fda1c2

  • SHA256

    4923c03fcf31c83273bb76817ff9a61f3ba25c579543235b79544e80351584b8

  • SHA512

    e0c2dff2ad7f463084618dcb5fb9c181ea5b2bea8bb5cab5918f1d08a0fc241e6f50c8753aa54ab71474d24d4f42a498f9d0b1f13f829603c24a4231edc1362b

  • SSDEEP

    12288:jAaGJ2ukTtgXGAbtv0xjejpj9kcltX60UsKxltxpnX:jAaGJ2ukaXbtvnppkcltX9jCrjnX

Malware Config

Extracted

Family

octo

C2

https://hepsinezipala4esdim52.com/YzM1YThkNDFkNmQ0/

https://hersenbo67saaaeldai548.com/YzM1YThkNDFkNmQ0/

https://alayinag45idaesaesr5454.com/YzM1YThkNDFkNmQ0/

https://neadamsin45mdeaayaq.com/YzM1YThkNDFkNmQ0/

https://hepsi010malltim21.com/YzM1YThkNDFkNmQ0/

rc4.plain

Extracted

Family

octo

C2

https://hepsinezipala4esdim52.com/YzM1YThkNDFkNmQ0/

https://hersenbo67saaaeldai548.com/YzM1YThkNDFkNmQ0/

https://alayinag45idaesaesr5454.com/YzM1YThkNDFkNmQ0/

https://neadamsin45mdeaayaq.com/YzM1YThkNDFkNmQ0/

https://hepsi010malltim21.com/YzM1YThkNDFkNmQ0/

Attributes
  • target_apps

    at.spardat.bcrmobile

    at.spardat.netbanking

    com.bankaustria.android.olb

    com.bmo.mobile

    com.cibc.android.mobi

    com.rbc.mobile.android

    com.scotiabank.mobile

    com.td

    cz.airbank.android

    eu.inmite.prj.kb.mobilbank

    com.bankinter.launcher

    com.kutxabank.android

    com.rsi

    com.tecnocom.cajalaboral

    es.bancopopular.nbmpopular

    es.evobanco.bancamovil

    es.lacaixa.mobile.android.newwapicon

    com.dbs.hk.dbsmbanking

    com.FubonMobileClient

    com.hangseng.rbmobile

    com.MobileTreeApp

    com.mtel.androidbea

    com.scb.breezebanking.hk

    hk.com.hsbc.hsbchkmobilebanking

    com.aff.otpdirekt

    com.ideomobile.hapoalim

    com.infrasofttech.indianBank

    com.mobikwik_new

    com.oxigen.oxigenwallet

    jp.co.aeonbank.android.passbook

AES_key

Signatures

  • Octo

    Octo is a banking malware with remote access capabilities first seen in April 2022.

  • Octo family
  • Octo payload 1 IoCs
  • Loads dropped Dex/Jar 1 TTPs 2 IoCs

    Runs executable file dropped to the device during analysis.

  • Makes use of the framework's Accessibility service 4 TTPs 2 IoCs

    Retrieves information displayed on the phone screen using AccessibilityService.

  • Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
  • Queries the phone number (MSISDN for GSM devices) 1 TTPs
  • Acquires the wake lock 1 IoCs
  • Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs

    Application may abuse the framework's foreground service to continue running in the foreground.

  • Performs UI accessibility actions on behalf of the user 1 TTPs 2 IoCs

    Application may abuse the accessibility service to prevent their removal.

  • Queries the mobile country code (MCC) 1 TTPs 1 IoCs
  • Reads information about phone network operator. 1 TTPs
  • Requests accessing notifications (often used to intercept notifications before users become aware). 1 TTPs 1 IoCs
  • Requests disabling of battery optimizations (often used to enable hiding in the background). 1 TTPs 1 IoCs
  • Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs

Processes

  • com.letterleft38
    1⤵
    • Loads dropped Dex/Jar
    • Makes use of the framework's Accessibility service
    • Acquires the wake lock
    • Makes use of the framework's foreground persistence service
    • Performs UI accessibility actions on behalf of the user
    • Queries the mobile country code (MCC)
    • Requests accessing notifications (often used to intercept notifications before users become aware).
    • Requests disabling of battery optimizations (often used to enable hiding in the background).
    • Uses Crypto APIs (Might try to encrypt user data)
    PID:4812

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • /data/data/com.letterleft38/.qcom.letterleft38

    Filesize

    48B

    MD5

    046a414913add6f5bb60072c7db819b6

    SHA1

    451ee4f6809260aec622d772fd329c7d0297a842

    SHA256

    b66c1320cb063a1d391c94273572ea6edae76c8c8b0a07f8d75c88686f0df72a

    SHA512

    4e6355f3051ed5e811ab030abde1f5be7f5e1cf33be99cd08477e9b6c015deb1d8bd75a09fb9c7176b8511c5ad0a67abc0902a3531e97564ccb6afc57496a47c

  • /data/data/com.letterleft38/cache/lxxouuwmuzwn

    Filesize

    449KB

    MD5

    4c6435a5c7420cad5ad7676dda2c8daa

    SHA1

    cbdc69ce7968b6a0b14f0bde2750d8319be15f9d

    SHA256

    03fe21b744879abb9d062f7bcce08d4c4a472f85b6212e4aa8ce70effd155961

    SHA512

    31a5caa628bfd7913f70044886f8d2731f30ab9bdea21f47817bbaef863040c5b0fd101b4370ab3f5d9e56902368b05602404ae00dd0c7728c49bc1addf863d3

  • /data/data/com.letterleft38/cache/oat/lxxouuwmuzwn.cur.prof

    Filesize

    324B

    MD5

    0894486c59677bf51ea102adbb3b9b78

    SHA1

    59503d11527c0fe21702452aabd137511e63427d

    SHA256

    506a9fff930d09600770538bfb1d4da6fc9170f6a553837d4216039dbfc02c50

    SHA512

    8fb17b62b4158ae2e717093b63388b3d43ae8ef1b0c4ff105333d9a70a7554bcb0626b88f5c9a260a4fe2771048065a12beda97a2bd3e19b6b6226552b8a084d

  • /data/data/com.letterleft38/kl.txt

    Filesize

    237B

    MD5

    133e2836c169e8b677203b1879b0a247

    SHA1

    794d3b2b3346602640abb2bc7e280320709fe095

    SHA256

    aad191d3223de241e6a5db918314921e6f899f0c4f76374b37b5025aab6b07b1

    SHA512

    271ec3a993146b0262ae4f092f6ca38ea3e1f7bc0ce9f2b8c932795ca6872f66f80a3a9e18dee5b5aff2db8b18145ace2e8e0c618ccac1d5282390b8db58ded8

  • /data/data/com.letterleft38/kl.txt

    Filesize

    54B

    MD5

    f3396e864bd9f546aca974a489e6fe7f

    SHA1

    ec298f7d39ee1b8589f68c0178fe78de7f2782fe

    SHA256

    2e57e2cbebd48977971fd3a6ed2d2018944be478368aa9b85558d472cbcf7019

    SHA512

    7ed1edd9f76ec6982d3c1033974b9254c13cdd51a9821e68882c65f5b3629d9b223b60b5b89745557be8d0aee97e194598720536e223684f59c3ac820d62922e

  • /data/data/com.letterleft38/kl.txt

    Filesize

    63B

    MD5

    86b2c9b28b2f71bc45c3c48bce1f8885

    SHA1

    82d614b624a8fe6729162102f56bced612b6f0ff

    SHA256

    aa4cfafeaf87d5ffae07ea79cf9383305af7c0ae5f7a1f1f32396ec741b96d8a

    SHA512

    802fc54920e9b5a40f6b3fb0e73202cf84d08600264647084e552a31363124ec6aedb52ce0e71bdd5ccb6a9062c32e36676da092247815ee90bcdd95a7441d5f

  • /data/data/com.letterleft38/kl.txt

    Filesize

    45B

    MD5

    8b85bf357cd3d9faaa75c353853a7d28

    SHA1

    d88a47dac14078d28d293dd12ce694377a8b2b66

    SHA256

    62524078c634c88cd6b4aff46f1e483d3d000750ef43c3d941580921858d94b1

    SHA512

    eb7ed7c4dac9ce828d9faaa88df91c79c767d1f1f4867921d4802e8ec72583ba5c8769128c57bae3fc6d7208282219be29467e75339a78f2ff5db8baada00a83

  • /data/data/com.letterleft38/kl.txt

    Filesize

    480B

    MD5

    e1bb038057380154642ff8629c97c189

    SHA1

    77e7552efe62cf40563c371dbea69535cad1c5a8

    SHA256

    644260e8975de3f1ed48dd39ee256fcd0af037c0712d29d3141d9e19f2439979

    SHA512

    80b6da525bb48270c43128595bc13aae7ec3fea56643b5acaacd168deb38213c362139424fb5a1928aaae32859e5807cfc5fc4e2dc5ac93f1f924fdbe74784e3