Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    149s
  • max time network
    157s
  • platform
    android_x86
  • resource
    android-x86-arm-20240624-en
  • resource tags

    androidarch:armarch:x86image:android-x86-arm-20240624-enlocale:en-usos:android-9-x86system
  • submitted
    09/11/2024, 22:03

General

  • Target

    babf62153de34767e43eb56676a46f07c71f0bc0025de48762d3f443f6b1c02d.apk

  • Size

    3.2MB

  • MD5

    f0e84429ebd26a8aaeae85c1be529cab

  • SHA1

    63a9965bd4c70b1322b9058b8ba9f8ed8a91f48f

  • SHA256

    babf62153de34767e43eb56676a46f07c71f0bc0025de48762d3f443f6b1c02d

  • SHA512

    5651e119e8139b761129e3eb820224f9fbad65375657846b0383881ff33c268b23b4feddae0466ab7bc5e45bb2a6e7cf70b767e8bdbc43a2ff05420459558ece

  • SSDEEP

    98304:ZrvJp3OSejUYfbovEJYZfM7r0dLrrgwdjAc3n8bcrP:tvJJfeQifkdLXTl84P

Malware Config

Extracted

Family

octo

C2

https://87.120.115.219:7117/gate/

https://87.120.115.219:8080/gate/

Attributes
  • target_apps

    com.google.android.apps.messaging

    at.spardat.bcrmobile

    at.spardat.netbanking

    com.bankaustria.android.olb

    com.android.messaging

    com.bmo.mobile(英文)

    com.cibc.android.mobi

    com.rbc.mobile.android的

    com.scotiabank.mobile(丰业银行手机)

    com.td

    cz.airbank.android

    eu.inmite.prj.kb.mobilbank

    com.bankinter.launcher (英语)

    com.kutxabank.android

    com.rsi

    com.bbva.bbvacontigo

    com.android.chrome的

    com.akbank.android.apps.akbank_direkt

    com.denizbank.mobildeniz

    com.finansbank.mobile.cepsube

    com.garanti.cepsubesi

    com.ingbanktr.ingmobil

    com.kuveytturk.mobil

    com.paribu.app

    com.pozitron.iscep

    com.teb(英语:com.teb)

    com.tmobtech.halkbank(英语:com.tmobtech.halkbank)

    com.vakifbank.mobile(移动版)

    com.ykb.android

    com.ziraat.ziraatmobil

AES_key

Signatures

  • Octo

    Octo is a banking malware with remote access capabilities first seen in April 2022.

  • Octo family
  • Removes its main activity from the application launcher 1 TTPs 1 IoCs
  • Makes use of the framework's Accessibility service 4 TTPs 2 IoCs

    Retrieves information displayed on the phone screen using AccessibilityService.

  • Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
  • Queries the phone number (MSISDN for GSM devices) 1 TTPs
  • Acquires the wake lock 1 IoCs
  • Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs

    Application may abuse the framework's foreground service to continue running in the foreground.

  • Performs UI accessibility actions on behalf of the user 1 TTPs 4 IoCs

    Application may abuse the accessibility service to prevent their removal.

  • Queries the mobile country code (MCC) 1 TTPs 1 IoCs
  • Queries the unique device ID (IMEI, MEID, IMSI) 1 TTPs
  • Requests accessing notifications (often used to intercept notifications before users become aware). 1 TTPs 1 IoCs
  • Requests disabling of battery optimizations (often used to enable hiding in the background). 1 TTPs 1 IoCs
  • Requests modifying system settings. 1 IoCs
  • Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs
  • Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs

Processes

  • com.nameown12
    1⤵
    • Removes its main activity from the application launcher
    • Makes use of the framework's Accessibility service
    • Acquires the wake lock
    • Makes use of the framework's foreground persistence service
    • Performs UI accessibility actions on behalf of the user
    • Queries the mobile country code (MCC)
    • Requests accessing notifications (often used to intercept notifications before users become aware).
    • Requests disabling of battery optimizations (often used to enable hiding in the background).
    • Requests modifying system settings.
    • Registers a broadcast receiver at runtime (usually for listening for system events)
    • Uses Crypto APIs (Might try to encrypt user data)
    PID:4273

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • /data/data/com.nameown12/.qcom.nameown12

    Filesize

    48B

    MD5

    046a414913add6f5bb60072c7db819b6

    SHA1

    451ee4f6809260aec622d772fd329c7d0297a842

    SHA256

    b66c1320cb063a1d391c94273572ea6edae76c8c8b0a07f8d75c88686f0df72a

    SHA512

    4e6355f3051ed5e811ab030abde1f5be7f5e1cf33be99cd08477e9b6c015deb1d8bd75a09fb9c7176b8511c5ad0a67abc0902a3531e97564ccb6afc57496a47c

  • /data/data/com.nameown12/kl.txt

    Filesize

    238B

    MD5

    bfa4842ee6c4a6fc68aa9c3f591d708d

    SHA1

    2a00d1c3e18fbe8f57643de07b17ab2256befa13

    SHA256

    4966db4cce25a539da1aada19d8e3d50b68d897d4416c93797a351f3f6c90c82

    SHA512

    0267d575a9c7b802a846847e7b0ead4643100756c0cb667a52d434b8c398592d10ee082df3e210975f42f587d317848ba0cfbbe26a5295ed8d4cec7083be38b3

  • /data/data/com.nameown12/kl.txt

    Filesize

    54B

    MD5

    aa52eeedae7791fcab8f2d256755a005

    SHA1

    90e5787599cb5a823ec9520f160732b4ce50b538

    SHA256

    93bcc6d34dc9f1566f9ae474d49c1018bb70c3654120562333e0430c61c2a054

    SHA512

    cb5c6e2c972c458ad235d82287e31c9d6692f857058b36f4a2201071179f940977dcf2066776906680269b9b1d2e790417515efef568b814b6b44793b6e107c0

  • /data/data/com.nameown12/kl.txt

    Filesize

    68B

    MD5

    885e48f2795d59285438f584504f4f8c

    SHA1

    fd60e3dd9f84d7dba7de1330a48071114684e41c

    SHA256

    901dc169073241bac255486273ce3a474922d9ad3b19cbd3d361f3993ba366af

    SHA512

    187329bb52579c6e232c691ba5465e6539dbe8183985e17a771bdb562a906734f6c122eba8593317aec58c3f8eb0d53e90fe217e86aa30f51a03598a5e483ed6

  • /data/data/com.nameown12/kl.txt

    Filesize

    63B

    MD5

    16cb0a84e93b89ad649a9d92b87d463c

    SHA1

    71e07dc5580485982d40886674ee25c7dede4622

    SHA256

    4fe70f1e6b76de88299bb6c7f4017a9e0e834d3889bdd5a833f2dab6a13f497c

    SHA512

    1ec3aced83804fe71fc6e400edea011e99a7fb77db09808f448d2d4dc0490dffc335b6d8a40fafc59636b451e5332fe8dce3604c2279bc0e086fd5744c5054eb

  • /data/data/com.nameown12/kl.txt

    Filesize

    439B

    MD5

    c75fc2b0ca790cca0fc44a7fb82ce70c

    SHA1

    c31fcf3c9ced6017fa7244e65dba253aba5f3817

    SHA256

    e9ee6228e4da6ac4e7815f324df6ac770ab31e10851067fef9c485c8ffa63c44

    SHA512

    db7ac251ae3482590aaa8dcc13b90c38fae5c1e3016e8cc096abd9ca17bc0fee0b04c299723aa5c6240d52442ba09831a47c0eb3316772b4a6309cd8e333e024