Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    149s
  • max time network
    150s
  • platform
    android-10_x64
  • resource
    android-x64-20240910-en
  • resource tags

    arch:x64arch:x86image:android-x64-20240910-enlocale:en-usos:android-10-x64system
  • submitted
    09/11/2024, 22:02

General

  • Target

    c57713a444ff45e8ef8f0bab4a9d4511c04bf26a617f0ac2119e8d40ce8c9af6.apk

  • Size

    2.4MB

  • MD5

    95f469f981616f2860839d2255f8ad5e

  • SHA1

    a618850f35316f73af2fe3ccad712f43332ba7ec

  • SHA256

    c57713a444ff45e8ef8f0bab4a9d4511c04bf26a617f0ac2119e8d40ce8c9af6

  • SHA512

    f34e133c86578fd540d2c0e3f7f601fc0ff577372523fc33edb6126af1107683556d35cc32fa8f0db53998fbeb0256fab9990251ef44e5a0fb31233eb0a363e4

  • SSDEEP

    49152:20r3tYzRhP59FLcvAgbAfgD/h5R4T4zuNMe9o7K+bpEh0W7rWOXpkJ3aMAJ8:fgRhPzFL6A/YD//R3uNMcifbpEhhyOXI

Malware Config

Extracted

Family

octo

C2

https://malkafaniskm.com/NzY2NDZkZmViYjZj/

https://fukiyibartiyom2.com/NzY2NDZkZmViYjZj/

https://malkafali222.com/NzY2NDZkZmViYjZj/

https://oyunbaimlisi35.com/NzY2NDZkZmViYjZj/

https://mal1fukizmirli.com/NzY2NDZkZmViYjZj/

rc4.plain

Extracted

Family

octo

C2

https://malkafaniskm.com/NzY2NDZkZmViYjZj/

https://fukiyibartiyom2.com/NzY2NDZkZmViYjZj/

https://malkafali222.com/NzY2NDZkZmViYjZj/

https://oyunbaimlisi35.com/NzY2NDZkZmViYjZj/

https://mal1fukizmirli.com/NzY2NDZkZmViYjZj/

Attributes
  • target_apps

    at.spardat.bcrmobile

    at.spardat.netbanking

    com.bankaustria.android.olb

    com.bmo.mobile

    com.cibc.android.mobi

    com.rbc.mobile.android

    com.scotiabank.mobile

    com.td

    cz.airbank.android

    eu.inmite.prj.kb.mobilbank

    com.bankinter.launcher

    com.kutxabank.android

    com.rsi

    com.tecnocom.cajalaboral

    es.bancopopular.nbmpopular

    es.evobanco.bancamovil

    es.lacaixa.mobile.android.newwapicon

    com.dbs.hk.dbsmbanking

    com.FubonMobileClient

    com.hangseng.rbmobile

    com.MobileTreeApp

    com.mtel.androidbea

    com.scb.breezebanking.hk

    hk.com.hsbc.hsbchkmobilebanking

    com.aff.otpdirekt

    com.ideomobile.hapoalim

    com.infrasofttech.indianBank

    com.mobikwik_new

    com.oxigen.oxigenwallet

    jp.co.aeonbank.android.passbook

AES_key

Signatures

  • Octo

    Octo is a banking malware with remote access capabilities first seen in April 2022.

  • Octo family
  • Octo payload 1 IoCs
  • Loads dropped Dex/Jar 1 TTPs 2 IoCs

    Runs executable file dropped to the device during analysis.

  • Makes use of the framework's Accessibility service 4 TTPs 2 IoCs

    Retrieves information displayed on the phone screen using AccessibilityService.

  • Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
  • Queries the phone number (MSISDN for GSM devices) 1 TTPs
  • Acquires the wake lock 1 IoCs
  • Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs

    Application may abuse the framework's foreground service to continue running in the foreground.

  • Performs UI accessibility actions on behalf of the user 1 TTPs 4 IoCs

    Application may abuse the accessibility service to prevent their removal.

  • Queries the mobile country code (MCC) 1 TTPs 1 IoCs
  • Reads information about phone network operator. 1 TTPs
  • Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs
  • Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs

Processes

  • com.beenday7
    1⤵
    • Loads dropped Dex/Jar
    • Makes use of the framework's Accessibility service
    • Acquires the wake lock
    • Makes use of the framework's foreground persistence service
    • Performs UI accessibility actions on behalf of the user
    • Queries the mobile country code (MCC)
    • Registers a broadcast receiver at runtime (usually for listening for system events)
    • Uses Crypto APIs (Might try to encrypt user data)
    PID:5058

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • /data/data/com.beenday7/.qcom.beenday7

    Filesize

    48B

    MD5

    046a414913add6f5bb60072c7db819b6

    SHA1

    451ee4f6809260aec622d772fd329c7d0297a842

    SHA256

    b66c1320cb063a1d391c94273572ea6edae76c8c8b0a07f8d75c88686f0df72a

    SHA512

    4e6355f3051ed5e811ab030abde1f5be7f5e1cf33be99cd08477e9b6c015deb1d8bd75a09fb9c7176b8511c5ad0a67abc0902a3531e97564ccb6afc57496a47c

  • /data/data/com.beenday7/cache/eeuocqt

    Filesize

    2.3MB

    MD5

    5b24a3c58cdd3c3e75ce891986b05e72

    SHA1

    f7d31e75e417d613f06aba54b136c37206f12c02

    SHA256

    29f8cd86c7fb30126e99867d8f136873196bff398bc31763a5d602a340301369

    SHA512

    3acd7e7f99a8abb995e2784a9bf0803e7869b2d3d33f25988d279abef29f83a152e9315b1dafeb507f420c4241b367f789ed9438509c8f45a25d581d49559421

  • /data/data/com.beenday7/cache/oat/eeuocqt.cur.prof

    Filesize

    484B

    MD5

    559ef9c505f94f223ff1bf503a5d566a

    SHA1

    c651bb84a0c7a9ebb7e971986e7eb0c0e69b58c7

    SHA256

    a3a6034eed229787b924720eaa27ccbfffe314de59b07155d4bcb076f2237d42

    SHA512

    ef04c6ac8dd71f8e970507a346a9a108ad331eb0e3d8d909bc36b4ae4872a45d1c47d9f98566e696d1280c4ed1a3e6b67dec88bdd50bf997c5f4616a22a32450

  • /data/data/com.beenday7/kl.txt

    Filesize

    237B

    MD5

    236e0b6e0944618fbec66dcd1f49956c

    SHA1

    7876364b504dadc0308f270cf663c9a7a13a7f0c

    SHA256

    bf4e3bc8d28e824a39a1ad43f2666a1313adaca2e52afa4dba2aa215a45fa4fc

    SHA512

    bf020e90ac358611f9e449817baaaf9fbfe0253cfe248619539728a7a211dc9341bc4b98140227f1232edabd9cc073a2bcec210a17f5bdae8a608a93ec56e824

  • /data/data/com.beenday7/kl.txt

    Filesize

    54B

    MD5

    8100c36c10a80ab71b48c3dfa7b47aaa

    SHA1

    ed00732de177d472f9a9c41fc8553d44b0d26478

    SHA256

    807b63c877f51fe9df5347fc3c81bf919f34fa1651b46e7763811b352e9ccac4

    SHA512

    0202678f7d20f6583c86f4faa771f741a63861c0dc795334eb1c2a6ff35337b7c7cf9575ab2a34504a2acb533c7586b8f1cdac0317f630c315d9d3c30e22d04a

  • /data/data/com.beenday7/kl.txt

    Filesize

    63B

    MD5

    42043ce1a11ed97834ddd0f96827b0d3

    SHA1

    fa24f58bb2c4ab780e1b27f9240a95a8c0ca922b

    SHA256

    605618afdcd22c1702bd658604c795c99e23628b6fe95a51abb3f5ae9b65515c

    SHA512

    69f88e50d75889793f5670ca7371ca3638fb4f56a81c68e42b2307e026ac5c6cf2d1cec27e2dc4b8fb6e9d1d19e59464481cd5dc17cc1e1c095e59d64e72373a

  • /data/data/com.beenday7/kl.txt

    Filesize

    45B

    MD5

    ea2a311b8ba0a76916a1d27c32d490f1

    SHA1

    0f2d5f6b55035cdc5e0130263078060b3fd31586

    SHA256

    6d22102d2a6078330693fdbd8a9d1b8df842c1193fecda9566f7ab34f9a2792d

    SHA512

    f7b23a2c149d0b1a6857cd3e0b6cf247d39d2270f8e8fb3f708d3ce61eb46177c3f0acfe9d62ac69fcf0283ec1c914752bced9ba8361f9fc71ea8de7d835b643

  • /data/data/com.beenday7/kl.txt

    Filesize

    437B

    MD5

    9fbd0cdf206be5a0453b071738ba899a

    SHA1

    332cb00b86655014771e04d020ae6be5a9e03fa5

    SHA256

    55c18e786df8b1b3c6cd0afeee3f7d41f5627d407c67e8c42a1919b64d2f3935

    SHA512

    59f1fdd2b787ffd6c11292e0746e23c4e5a66130c15c899df6781b0652efe30b15ab08a2cd1408f5e8bc28e73538e439e623d877d7b2eef41e45a9e04635cc06