Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    149s
  • max time network
    158s
  • platform
    android_x64
  • resource
    android-x64-arm64-20240624-en
  • resource tags

    androidarch:armarch:arm64arch:x64arch:x86image:android-x64-arm64-20240624-enlocale:en-usos:android-11-x64system
  • submitted
    09/11/2024, 22:03

General

  • Target

    babf62153de34767e43eb56676a46f07c71f0bc0025de48762d3f443f6b1c02d.apk

  • Size

    3.2MB

  • MD5

    f0e84429ebd26a8aaeae85c1be529cab

  • SHA1

    63a9965bd4c70b1322b9058b8ba9f8ed8a91f48f

  • SHA256

    babf62153de34767e43eb56676a46f07c71f0bc0025de48762d3f443f6b1c02d

  • SHA512

    5651e119e8139b761129e3eb820224f9fbad65375657846b0383881ff33c268b23b4feddae0466ab7bc5e45bb2a6e7cf70b767e8bdbc43a2ff05420459558ece

  • SSDEEP

    98304:ZrvJp3OSejUYfbovEJYZfM7r0dLrrgwdjAc3n8bcrP:tvJJfeQifkdLXTl84P

Malware Config

Extracted

Family

octo

C2

https://87.120.115.219:7117/gate/

https://87.120.115.219:8080/gate/

Attributes
  • target_apps

    com.google.android.apps.messaging

    at.spardat.bcrmobile

    at.spardat.netbanking

    com.bankaustria.android.olb

    com.android.messaging

    com.bmo.mobile(英文)

    com.cibc.android.mobi

    com.rbc.mobile.android的

    com.scotiabank.mobile(丰业银行手机)

    com.td

    cz.airbank.android

    eu.inmite.prj.kb.mobilbank

    com.bankinter.launcher (英语)

    com.kutxabank.android

    com.rsi

    com.bbva.bbvacontigo

    com.android.chrome的

    com.akbank.android.apps.akbank_direkt

    com.denizbank.mobildeniz

    com.finansbank.mobile.cepsube

    com.garanti.cepsubesi

    com.ingbanktr.ingmobil

    com.kuveytturk.mobil

    com.paribu.app

    com.pozitron.iscep

    com.teb(英语:com.teb)

    com.tmobtech.halkbank(英语:com.tmobtech.halkbank)

    com.vakifbank.mobile(移动版)

    com.ykb.android

    com.ziraat.ziraatmobil

AES_key

Signatures

  • Octo

    Octo is a banking malware with remote access capabilities first seen in April 2022.

  • Octo family
  • Makes use of the framework's Accessibility service 4 TTPs 2 IoCs

    Retrieves information displayed on the phone screen using AccessibilityService.

  • Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
  • Queries the phone number (MSISDN for GSM devices) 1 TTPs
  • Acquires the wake lock 1 IoCs
  • Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs

    Application may abuse the framework's foreground service to continue running in the foreground.

  • Performs UI accessibility actions on behalf of the user 1 TTPs 4 IoCs

    Application may abuse the accessibility service to prevent their removal.

  • Queries the mobile country code (MCC) 1 TTPs 1 IoCs
  • Reads information about phone network operator. 1 TTPs
  • Requests accessing notifications (often used to intercept notifications before users become aware). 1 TTPs 1 IoCs
  • Requests disabling of battery optimizations (often used to enable hiding in the background). 1 TTPs 1 IoCs
  • Requests modifying system settings. 1 IoCs
  • Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs

Processes

  • com.nameown12
    1⤵
    • Makes use of the framework's Accessibility service
    • Acquires the wake lock
    • Makes use of the framework's foreground persistence service
    • Performs UI accessibility actions on behalf of the user
    • Queries the mobile country code (MCC)
    • Requests accessing notifications (often used to intercept notifications before users become aware).
    • Requests disabling of battery optimizations (often used to enable hiding in the background).
    • Requests modifying system settings.
    • Uses Crypto APIs (Might try to encrypt user data)
    PID:4481

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • /data/user/0/com.nameown12/.qcom.nameown12

    Filesize

    48B

    MD5

    046a414913add6f5bb60072c7db819b6

    SHA1

    451ee4f6809260aec622d772fd329c7d0297a842

    SHA256

    b66c1320cb063a1d391c94273572ea6edae76c8c8b0a07f8d75c88686f0df72a

    SHA512

    4e6355f3051ed5e811ab030abde1f5be7f5e1cf33be99cd08477e9b6c015deb1d8bd75a09fb9c7176b8511c5ad0a67abc0902a3531e97564ccb6afc57496a47c

  • /data/user/0/com.nameown12/kl.txt

    Filesize

    45B

    MD5

    372465cf1db6c0c1a753d646341822cc

    SHA1

    c26b5125567a135687ee297f4b921c6948be0a68

    SHA256

    b58cfec47a61f25de2c1c5eade558bbcfe305313e563bfe8a41df147d2b8f621

    SHA512

    ee9d37ff2b880186985bb040306912e410daf49eb011e08fc587d7dff0adb1f4c508b12d87343ed53898053906cd1e334b40fbe8639378850f4fb9bb3784c527

  • /data/user/0/com.nameown12/kl.txt

    Filesize

    66B

    MD5

    b7813aac5f27e3985f7ad2f71a195c8e

    SHA1

    e5a26dec7670138f9ab66f8c64169b0f5df8e95a

    SHA256

    1362a7a5fad968e2b4476ebcb9d77ba415c516f9f3006472b6fb452346a7f0c3

    SHA512

    93051199836552397a87472705b4b541565f328ea25508cc647b7688db177061f5f2c184389e5d4554378006661ee906a336e03237d6d0be5e2f3d2f9b445e1f

  • /data/user/0/com.nameown12/kl.txt

    Filesize

    84B

    MD5

    64fe5443af4d666bb8708eb4ec5f1b94

    SHA1

    14ab3941e89c0f8750ff80a09a7972ac10a56f43

    SHA256

    92c1dc63789b82d5ddfffa9dc469e1a2c5700fcdd4d90461555124e226907be7

    SHA512

    60721e6ad9f6ba249ff2a892ce1a0df86cea15206e5e8681b3bf94a23de3bd06d234b03f1229ec9e8a23baf2372803e4c67b93f562ef70d99402e6ec571adb3b

  • /data/user/0/com.nameown12/kl.txt

    Filesize

    63B

    MD5

    548b3ca7fd5055cb102c957c3c303b50

    SHA1

    70ef5e4871a77df48059b5a672a6287ea1d07224

    SHA256

    2203cd282ec0ffd2f68ea96d34c63d860c1d6c92d3a0a1d0dc65b72414c7d257

    SHA512

    6bdfb1e7fcd1c62af18dadf0cd3c305fa32d8467116e6649861fbf691bcd1cc0eb02b0faffddadfa76971ffd952c0de27a770dd35d3e3228927066d79d1b45b5

  • /data/user/0/com.nameown12/kl.txt

    Filesize

    58B

    MD5

    03e455e7026c238a3a78c05afdd912bc

    SHA1

    1e951100c84b89f69b9d33ce5b92db6f223585bd

    SHA256

    b41ce80f015e578409c2161daf818d84389e992675afe28e5c2326322911903a

    SHA512

    1511a17cb5fc44692bfc845052a3a5a681f9f29e284e3b87beb942503f481020d3ee835e5b90205d2d72f261f4f049f9d6645929c5528a9e57f2208c00236a87

  • /data/user/0/com.nameown12/kl.txt

    Filesize

    63B

    MD5

    e7d0e028cf63ca34a2baea4307360252

    SHA1

    eb883a0dbe5b25e3e9d02603d4197ef4c1909f40

    SHA256

    68791b505118d18cb64e539d9fd0c0e5c0677ff37497ab7686e0b993cf1669ba

    SHA512

    e3f2f3f65da623bc7c36f923e61d0630018f229aac066697bfda685a7cef25ca1063e860b3ec0f0365fd775c814307d4f2916fea262e80e109df3784877bcb29

  • /data/user/0/com.nameown12/kl.txt

    Filesize

    238B

    MD5

    7eeadce7f53384b54b993aa9a34a6aee

    SHA1

    6e369bb125988ce6d611ac4f2360ec10d8819fae

    SHA256

    3c3453fa321d27f58b8dea15cc306015264269038c3dc6dc0bb4b77d7a23ef5a

    SHA512

    6499caab317f9762694a7ee3cc732bbc1f7f01e8ee0eec7ec5b6d67190027d39c460d16f146cf596ccc03ddbfa2afaa0cc370b98e75690e787b38b655277b990

  • /data/user/0/com.nameown12/kl.txt

    Filesize

    45B

    MD5

    514587d871fe6c91c9544a422809d845

    SHA1

    4a0f98776a72b92e12ff0c2df7d65944d6cfff4e

    SHA256

    fadc2db63af7c9d9c229be16069b7ad4f5e046f33cf3d47d194840e6d329583b

    SHA512

    f4c45626791b459e614822752ffbe3fbf9fbc377ebda4aee59b65b840f640b5afe0cb4d968ba00c97277576a7f5a71be1d245987fce8ec0831d7f5b5cf6db379

  • /data/user/0/com.nameown12/kl.txt

    Filesize

    63B

    MD5

    7699a32ccb55365eebc7b9d190e15782

    SHA1

    bd2df2bc4d8edff9beec54a160f4e2a254c14661

    SHA256

    adcdcf178eb302fc7ff1d53a7a2ba9faba93cdd97e5b6f85c6dee2a1d18afeb1

    SHA512

    9d4747b36f3794cb3516cf41c0a93829f4354c59f16ff085788d7f30f39dcfe4792054e36b14b81ce66b498a0fea06f5a505b86649deea4579f2909de16a0d6f

  • /data/user/0/com.nameown12/kl.txt

    Filesize

    45B

    MD5

    b2f7580739f84e04b3c8d07c2ceef6bb

    SHA1

    ea29b1116c21ce2ef3cbf0b68e030033a2fa8e61

    SHA256

    aae464456ae8e738840d256be449e60ce471db2368dd1106c9bfc03b5813c5b5

    SHA512

    04f36b9013fa740336bbcd1ab59bb3f4055f1538a4bf45be25f501fff5cef6de6f1e7f169b574c214c57e7f0f2f733d8f78a04d962316be38b02c062752461d5

  • /data/user/0/com.nameown12/kl.txt

    Filesize

    482B

    MD5

    779e4f5b95fadce30197587f7de481b5

    SHA1

    da4d1f68c5a5f7a017b4142558ba8d3713493df1

    SHA256

    a960b896ed5b479168e576249d3030b53d6a54f2dbb92aa5d9deea2c207e2141

    SHA512

    0f743d28ae2a2c28c7af57aae09f5c0122aa84527500c5319a45c8f6cb71e865ab42c45876839ba9fd1c28eff3462c89c84195300ce3d9f15f6a6d18e717cc60

  • /data/user/0/com.nameown12/kl.txt

    Filesize

    63B

    MD5

    6065d4fe9cf880dfe618f2bfdc309531

    SHA1

    89cac99e320c89a2f66556e915d4ec850caa9eb6

    SHA256

    88ab289bd5fe38c99f70c6dfec01beb5382f31130470214ac811c55a36939eae

    SHA512

    94608dfd17c8d9549e0ad4ba7706a240ce6dcc0c0f59855c61a52f6b9df2d91f9532b867da65f96e842cbca120a758ba57871ea71d1b41457851fde6e6eea688

  • /data/user/0/com.nameown12/kl.txt

    Filesize

    58B

    MD5

    3419b54885caab935151af829f720335

    SHA1

    9634306dbfe94e527119fcbf9f601c182d5d2244

    SHA256

    cb668dbb9a7d67cb713308162a8648a6ff77181f5de952a25d470e7ee32047ef

    SHA512

    07cf10a1487594ada8a99d7663fba2f41ce241135094a29605713587403035b9f82a55c4ccf6270422c50de327e328f446d676d05886e58263562ef1a2e73846