Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    149s
  • max time network
    130s
  • platform
    android-10_x64
  • resource
    android-x64-20240910-en
  • resource tags

    arch:x64arch:x86image:android-x64-20240910-enlocale:en-usos:android-10-x64system
  • submitted
    27/10/2024, 22:01

General

  • Target

    914c3c4b09043d9850dda2c00ea9b731f2d1464b32d54d3f70af1b4ea89f0b48.apk

  • Size

    561KB

  • MD5

    e5e0f6cb7e54686baa5bb8f11ab88103

  • SHA1

    17f8dae6ed958699909bc08c106584ff5323ffac

  • SHA256

    914c3c4b09043d9850dda2c00ea9b731f2d1464b32d54d3f70af1b4ea89f0b48

  • SHA512

    fe4ae2bee1cc9ea7f045550dc7dccbfdfcfb7745596062ebd4570578cd9cdf36a72625319dca276f6d3e0c4acfafb8fd5b658e9b5e69b6411b72e75677371013

  • SSDEEP

    12288:4lChJ84IBCdt8715z7brkqksOmB96tla+hulM/UK4XPylHaxMn3:4lChJ8jCv8JBvrkqks16tRYMcKcPcHSK

Malware Config

Extracted

Family

octo

C2

https://hepsinezipala4esdim52.com/YzM1YThkNDFkNmQ0/

https://hersenbo67saaaeldai548.com/YzM1YThkNDFkNmQ0/

https://alayinag45idaesaesr5454.com/YzM1YThkNDFkNmQ0/

https://neadamsin45mdeaayaq.com/YzM1YThkNDFkNmQ0/

https://hepsi010malltim21.com/YzM1YThkNDFkNmQ0/

rc4.plain

Extracted

Family

octo

C2

https://hepsinezipala4esdim52.com/YzM1YThkNDFkNmQ0/

https://hersenbo67saaaeldai548.com/YzM1YThkNDFkNmQ0/

https://alayinag45idaesaesr5454.com/YzM1YThkNDFkNmQ0/

https://neadamsin45mdeaayaq.com/YzM1YThkNDFkNmQ0/

https://hepsi010malltim21.com/YzM1YThkNDFkNmQ0/

Attributes
  • target_apps

    at.spardat.bcrmobile

    at.spardat.netbanking

    com.bankaustria.android.olb

    com.bmo.mobile

    com.cibc.android.mobi

    com.rbc.mobile.android

    com.scotiabank.mobile

    com.td

    cz.airbank.android

    eu.inmite.prj.kb.mobilbank

    com.bankinter.launcher

    com.kutxabank.android

    com.rsi

    com.tecnocom.cajalaboral

    es.bancopopular.nbmpopular

    es.evobanco.bancamovil

    es.lacaixa.mobile.android.newwapicon

    com.dbs.hk.dbsmbanking

    com.FubonMobileClient

    com.hangseng.rbmobile

    com.MobileTreeApp

    com.mtel.androidbea

    com.scb.breezebanking.hk

    hk.com.hsbc.hsbchkmobilebanking

    com.aff.otpdirekt

    com.ideomobile.hapoalim

    com.infrasofttech.indianBank

    com.mobikwik_new

    com.oxigen.oxigenwallet

    jp.co.aeonbank.android.passbook

AES_key

Signatures

  • Octo

    Octo is a banking malware with remote access capabilities first seen in April 2022.

  • Octo family
  • Octo payload 1 IoCs
  • Loads dropped Dex/Jar 1 TTPs 2 IoCs

    Runs executable file dropped to the device during analysis.

  • Makes use of the framework's Accessibility service 4 TTPs 2 IoCs

    Retrieves information displayed on the phone screen using AccessibilityService.

  • Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
  • Queries the phone number (MSISDN for GSM devices) 1 TTPs
  • Acquires the wake lock 1 IoCs
  • Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs

    Application may abuse the framework's foreground service to continue running in the foreground.

  • Performs UI accessibility actions on behalf of the user 1 TTPs 2 IoCs

    Application may abuse the accessibility service to prevent their removal.

  • Queries the mobile country code (MCC) 1 TTPs 1 IoCs
  • Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs
  • Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs

Processes

  • com.tothousand38
    1⤵
    • Loads dropped Dex/Jar
    • Makes use of the framework's Accessibility service
    • Acquires the wake lock
    • Makes use of the framework's foreground persistence service
    • Performs UI accessibility actions on behalf of the user
    • Queries the mobile country code (MCC)
    • Registers a broadcast receiver at runtime (usually for listening for system events)
    • Uses Crypto APIs (Might try to encrypt user data)
    PID:5166

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • /data/data/com.tothousand38/.qcom.tothousand38

    Filesize

    48B

    MD5

    046a414913add6f5bb60072c7db819b6

    SHA1

    451ee4f6809260aec622d772fd329c7d0297a842

    SHA256

    b66c1320cb063a1d391c94273572ea6edae76c8c8b0a07f8d75c88686f0df72a

    SHA512

    4e6355f3051ed5e811ab030abde1f5be7f5e1cf33be99cd08477e9b6c015deb1d8bd75a09fb9c7176b8511c5ad0a67abc0902a3531e97564ccb6afc57496a47c

  • /data/data/com.tothousand38/cache/oat/wamnw.cur.prof

    Filesize

    435B

    MD5

    49a1e6802d4e343fc4ddee9176af3ad1

    SHA1

    e5e157803999939785503cbf4875d3a880fa0f59

    SHA256

    57d7b50cf354e19e05d3e6f6925cc7761aba5c125a1dfa935b3c2bc09b54d8ce

    SHA512

    23bdb16fecf4596297e16a4efe714fc6b365e70ba0f94987b0cbcc903401a9fcb543afdbee699514db389d655ccf33a96e4f018e491ae7d95eb8be7acc2016be

  • /data/data/com.tothousand38/cache/wamnw

    Filesize

    449KB

    MD5

    8246941704d5f6ccf3d287b14efff025

    SHA1

    28cea1bd05a282e0cf92a04360053ec913c20779

    SHA256

    725f442ab6a47c9e551a62874e7d484163d02d6ff5e652e56ade84d8a680b02f

    SHA512

    18fe3872e22576a72675b7533341d790b3c52789643f90a8515e073d841d29ca2cd6d9895fbf70f7eed48e8b84a1bbc61cb0ada2fb2c0d0e34be63cb39ee10ca

  • /data/data/com.tothousand38/kl.txt

    Filesize

    237B

    MD5

    d236c602441a26b88746a5069da8d6bc

    SHA1

    818da35ff1b5b950009d75192ca491935c46fb93

    SHA256

    ccfc25f8c54e46a2600f616d2279e2a48aeaede8c5104eb11629fb2186b6d0e6

    SHA512

    3fb20a35f9c776d13ff083ead837fe51b020c1c8a355992ac9165a6939a0c6cf73e8061f46a442e09a8173311d40fa692fdfdbf45643a397237837a2c5a2d475

  • /data/data/com.tothousand38/kl.txt

    Filesize

    54B

    MD5

    0f0d19b2d66a4b18f849e109267f511a

    SHA1

    55d7fbe29d0b7cefd5f8327f5b541e2fe0aadcc1

    SHA256

    d4b5da83defe0426990a18469b2d08dc12cc605660c301e4f0bf7ef6946a7d8e

    SHA512

    02183f7707bf80cb4562929b04b8b8778eba019866f287e72194dda4fb9e8a791d42beb8187f5a1402fe5bb039cfd56cbde06eb1e30430ee83b1ecbedda14916

  • /data/data/com.tothousand38/kl.txt

    Filesize

    63B

    MD5

    9e7ec33b167a74c5d36deab714be2286

    SHA1

    4004e3635606d37e482785242af89b38c91daa19

    SHA256

    bc37f7877965a817aca6f58c6fbc05fbaf9470d9004823af507b385f4630dc13

    SHA512

    956bb6853e646510eda6668e092670917c9925d6370612cd046e0806dcc6151a2247a97c3955e40b427b91eb29dc06845a9125b729cc02787022732816797eeb

  • /data/data/com.tothousand38/kl.txt

    Filesize

    45B

    MD5

    3ff5be932742234bd28013af25dc677b

    SHA1

    b0231edadb7556a3c3de1e60e1cc34887d9c5f9d

    SHA256

    26905628deceee1d120dedd85c3459e86aab89a5e1cb99c598e9f5d8b34aee3c

    SHA512

    3f8e3c1517cc32dd97e76474b57ef915d1e8b5323bdc331d456cf71763ad7b2bca6a3983efbb027a099bbb785566c82b100b5a0d662459c7ea1efafc433c875d

  • /data/data/com.tothousand38/kl.txt

    Filesize

    437B

    MD5

    b8cf3f67b6a5fa290f80aa2eadcdb007

    SHA1

    249c26d7ee9cb02f16b4dd3c9cbd880020f39620

    SHA256

    6440000da33780cc0d0e37bdf6c12c1e79ea600107a00f01a243cb98768e5296

    SHA512

    c74d86b4873eb776dd5dc0f77226acaa7b0d8e4f729400c267bc79eb20b6c5b2670bd20c6f1360a4921d82794a228b4de9fc800da530e8ed56740cc1de6bd4c2