Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

General

  • Target

    babf62153de34767e43eb56676a46f07c71f0bc0025de48762d3f443f6b1c02d.bin

  • Size

    3.2MB

  • Sample

    241109-1yjfzatcjr

  • MD5

    f0e84429ebd26a8aaeae85c1be529cab

  • SHA1

    63a9965bd4c70b1322b9058b8ba9f8ed8a91f48f

  • SHA256

    babf62153de34767e43eb56676a46f07c71f0bc0025de48762d3f443f6b1c02d

  • SHA512

    5651e119e8139b761129e3eb820224f9fbad65375657846b0383881ff33c268b23b4feddae0466ab7bc5e45bb2a6e7cf70b767e8bdbc43a2ff05420459558ece

  • SSDEEP

    98304:ZrvJp3OSejUYfbovEJYZfM7r0dLrrgwdjAc3n8bcrP:tvJJfeQifkdLXTl84P

Malware Config

Extracted

Family

octo

C2

https://87.120.115.219:7117/gate/

rc4.plain

Extracted

Family

octo

C2

https://87.120.115.219:7117/gate/

https://87.120.115.219:8080/gate/

Attributes
  • target_apps

    com.google.android.apps.messaging

    at.spardat.bcrmobile

    at.spardat.netbanking

    com.bankaustria.android.olb

    com.android.messaging

    com.bmo.mobile(英文)

    com.cibc.android.mobi

    com.rbc.mobile.android的

    com.scotiabank.mobile(丰业银行手机)

    com.td

    cz.airbank.android

    eu.inmite.prj.kb.mobilbank

    com.bankinter.launcher (英语)

    com.kutxabank.android

    com.rsi

    com.bbva.bbvacontigo

    com.android.chrome的

    com.akbank.android.apps.akbank_direkt

    com.denizbank.mobildeniz

    com.finansbank.mobile.cepsube

    com.garanti.cepsubesi

    com.ingbanktr.ingmobil

    com.kuveytturk.mobil

    com.paribu.app

    com.pozitron.iscep

    com.teb(英语:com.teb)

    com.tmobtech.halkbank(英语:com.tmobtech.halkbank)

    com.vakifbank.mobile(移动版)

    com.ykb.android

    com.ziraat.ziraatmobil

AES_key

Targets

    • Target

      babf62153de34767e43eb56676a46f07c71f0bc0025de48762d3f443f6b1c02d.bin

    • Size

      3.2MB

    • MD5

      f0e84429ebd26a8aaeae85c1be529cab

    • SHA1

      63a9965bd4c70b1322b9058b8ba9f8ed8a91f48f

    • SHA256

      babf62153de34767e43eb56676a46f07c71f0bc0025de48762d3f443f6b1c02d

    • SHA512

      5651e119e8139b761129e3eb820224f9fbad65375657846b0383881ff33c268b23b4feddae0466ab7bc5e45bb2a6e7cf70b767e8bdbc43a2ff05420459558ece

    • SSDEEP

      98304:ZrvJp3OSejUYfbovEJYZfM7r0dLrrgwdjAc3n8bcrP:tvJJfeQifkdLXTl84P

    • Octo

      Octo is a banking malware with remote access capabilities first seen in April 2022.

    • Octo family

    • Removes its main activity from the application launcher

    • Makes use of the framework's Accessibility service

      Retrieves information displayed on the phone screen using AccessibilityService.

    • Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps)

    • Queries the phone number (MSISDN for GSM devices)

    • Acquires the wake lock

    • Makes use of the framework's foreground persistence service

      Application may abuse the framework's foreground service to continue running in the foreground.

    • Performs UI accessibility actions on behalf of the user

      Application may abuse the accessibility service to prevent their removal.

    • Queries the mobile country code (MCC)

    • Queries the unique device ID (IMEI, MEID, IMSI)

    • Reads information about phone network operator.

    • Requests accessing notifications (often used to intercept notifications before users become aware).

    • Requests disabling of battery optimizations (often used to enable hiding in the background).

    • Requests modifying system settings.

MITRE ATT&CK Mobile v15

Tasks