Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    149s
  • max time network
    151s
  • platform
    android_x86
  • resource
    android-x86-arm-20240624-en
  • resource tags

    androidarch:armarch:x86image:android-x86-arm-20240624-enlocale:en-usos:android-9-x86system
  • submitted
    09/11/2024, 23:10

General

  • Target

    afc0cdd2e7e8494039e108e9d7d5af51856413ecb6ca3b4db9878821fd3b2f82.apk

  • Size

    316KB

  • MD5

    accdaba362b3dad23371c4a6cb4962fd

  • SHA1

    59423dbfc7871198d5252ada5ba3036c5deab1f3

  • SHA256

    afc0cdd2e7e8494039e108e9d7d5af51856413ecb6ca3b4db9878821fd3b2f82

  • SHA512

    808f8d04428162a735fc3d2c64869bd3f6f49b2af4f9717af9a90bf61d5f9700e7e943059124aa3f08a3fc91a560e1dcf88fd79ed645b631996163045c9258a6

  • SSDEEP

    6144:u/e4U5TSJ6Fn6BdDlfdaIlIHLJCnqagubDYOz34W/au7G:hSJzDlfdaICHLIqLyDYOT4apa

Malware Config

Extracted

Family

octo

C2

https://brunchxy.top/YTZhZjliODdlYTI4/

https://sporkly.top/YTZhZjliODdlYTI4/

https://glampingaz.top/YTZhZjliODdlYTI4/

https://frenemyq.top/YTZhZjliODdlYTI4/

https://chillaxio.top/YTZhZjliODdlYTI4/

https://ginormusj.top/YTZhZjliODdlYTI4/

https://workaholkc.top/YTZhZjliODdlYTI4/

https://hangryv.top/YTZhZjliODdlYTI4/

https://spanglix.top/YTZhZjliODdlYTI4/

https://blogosphze.top/YTZhZjliODdlYTI4/

https://smoggyu.top/YTZhZjliODdlYTI4/

https://edutainmt.top/YTZhZjliODdlYTI4/

https://mockumnt.top/YTZhZjliODdlYTI4/

https://fleekyp.top/YTZhZjliODdlYTI4/

https://infoglo.top/YTZhZjliODdlYTI4/

https://staycatzu.top/YTZhZjliODdlYTI4/

https://mansplainu.top/YTZhZjliODdlYTI4/

https://spaghettom.top/YTZhZjliODdlYTI4/

https://gluttonyd.top/YTZhZjliODdlYTI4/

https://electrohu.top/YTZhZjliODdlYTI4/

rc4.plain

Extracted

Family

octo

C2

https://brunchxy.top/YTZhZjliODdlYTI4/

https://sporkly.top/YTZhZjliODdlYTI4/

https://glampingaz.top/YTZhZjliODdlYTI4/

https://frenemyq.top/YTZhZjliODdlYTI4/

https://chillaxio.top/YTZhZjliODdlYTI4/

https://ginormusj.top/YTZhZjliODdlYTI4/

https://workaholkc.top/YTZhZjliODdlYTI4/

https://hangryv.top/YTZhZjliODdlYTI4/

https://spanglix.top/YTZhZjliODdlYTI4/

https://blogosphze.top/YTZhZjliODdlYTI4/

https://smoggyu.top/YTZhZjliODdlYTI4/

https://edutainmt.top/YTZhZjliODdlYTI4/

https://mockumnt.top/YTZhZjliODdlYTI4/

https://fleekyp.top/YTZhZjliODdlYTI4/

https://infoglo.top/YTZhZjliODdlYTI4/

https://staycatzu.top/YTZhZjliODdlYTI4/

https://mansplainu.top/YTZhZjliODdlYTI4/

https://spaghettom.top/YTZhZjliODdlYTI4/

https://gluttonyd.top/YTZhZjliODdlYTI4/

https://electrohu.top/YTZhZjliODdlYTI4/

Attributes
  • target_apps

    at.spardat.bcrmobile

    at.spardat.netbanking

    com.bankaustria.android.olb

    com.bmo.mobile

    com.cibc.android.mobi

    com.rbc.mobile.android

    com.scotiabank.mobile

    com.td

    cz.airbank.android

    eu.inmite.prj.kb.mobilbank

    com.bankinter.launcher

    com.kutxabank.android

    com.rsi

    com.tecnocom.cajalaboral

    es.bancopopular.nbmpopular

    es.evobanco.bancamovil

    es.lacaixa.mobile.android.newwapicon

    com.dbs.hk.dbsmbanking

    com.FubonMobileClient

    com.hangseng.rbmobile

    com.MobileTreeApp

    com.mtel.androidbea

    com.scb.breezebanking.hk

    hk.com.hsbc.hsbchkmobilebanking

    com.aff.otpdirekt

    com.ideomobile.hapoalim

    com.infrasofttech.indianBank

    com.mobikwik_new

    com.oxigen.oxigenwallet

    jp.co.aeonbank.android.passbook

AES_key

Signatures

  • Octo

    Octo is a banking malware with remote access capabilities first seen in April 2022.

  • Octo family
  • Octo payload 2 IoCs
  • Removes its main activity from the application launcher 1 TTPs 1 IoCs
  • Loads dropped Dex/Jar 1 TTPs 3 IoCs

    Runs executable file dropped to the device during analysis.

  • Makes use of the framework's Accessibility service 4 TTPs 2 IoCs

    Retrieves information displayed on the phone screen using AccessibilityService.

  • Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
  • Queries the phone number (MSISDN for GSM devices) 1 TTPs
  • Acquires the wake lock 1 IoCs
  • Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs

    Application may abuse the framework's foreground service to continue running in the foreground.

  • Performs UI accessibility actions on behalf of the user 1 TTPs 4 IoCs

    Application may abuse the accessibility service to prevent their removal.

  • Queries the mobile country code (MCC) 1 TTPs 1 IoCs
  • Queries the unique device ID (IMEI, MEID, IMSI) 1 TTPs
  • Requests accessing notifications (often used to intercept notifications before users become aware). 1 TTPs 1 IoCs
  • Requests disabling of battery optimizations (often used to enable hiding in the background). 1 TTPs 1 IoCs
  • Requests modifying system settings. 1 IoCs
  • Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs
  • Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs

Processes

  • com.sgakagak.agakagabs
    1⤵
    • Removes its main activity from the application launcher
    • Loads dropped Dex/Jar
    • Makes use of the framework's Accessibility service
    • Acquires the wake lock
    • Makes use of the framework's foreground persistence service
    • Performs UI accessibility actions on behalf of the user
    • Queries the mobile country code (MCC)
    • Requests accessing notifications (often used to intercept notifications before users become aware).
    • Requests disabling of battery optimizations (often used to enable hiding in the background).
    • Requests modifying system settings.
    • Registers a broadcast receiver at runtime (usually for listening for system events)
    • Uses Crypto APIs (Might try to encrypt user data)
    PID:4251
    • /system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.sgakagak.agakagabs/app_apkprotector_dex/classes-v1.bin --output-vdex-fd=41 --oat-fd=42 --oat-location=/data/user/0/com.sgakagak.agakagabs/app_apkprotector_dex/oat/x86/classes-v1.odex --compiler-filter=quicken --class-loader-context=&
      2⤵
      • Loads dropped Dex/Jar
      PID:4276

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • /data/data/com.sgakagak.agakagabs/.qcom.sgakagak.agakagabs

    Filesize

    48B

    MD5

    046a414913add6f5bb60072c7db819b6

    SHA1

    451ee4f6809260aec622d772fd329c7d0297a842

    SHA256

    b66c1320cb063a1d391c94273572ea6edae76c8c8b0a07f8d75c88686f0df72a

    SHA512

    4e6355f3051ed5e811ab030abde1f5be7f5e1cf33be99cd08477e9b6c015deb1d8bd75a09fb9c7176b8511c5ad0a67abc0902a3531e97564ccb6afc57496a47c

  • /data/data/com.sgakagak.agakagabs/app_apkprotector_dex/classes-v1.bin

    Filesize

    450KB

    MD5

    9237f9a5f6b5b07cd668293cb5f612d1

    SHA1

    b673f5950c1f5c5cfa3bfe46484098610cb57b14

    SHA256

    bc91a52eb6367777b53562dec2eb1a8d46d275ffd29573b3e7d6d1305353f16c

    SHA512

    ed6c9b10dc26b75c0337068131c2a5c674ed389a3e3be194951de566cb3953026e4e6456d6e0e185e2c1d823448c97e4d32add6ce8b31b64e9057d3894c1cf1c

  • /data/data/com.sgakagak.agakagabs/kl.txt

    Filesize

    423B

    MD5

    5898f3516697abc96de45c8667eee4a6

    SHA1

    497b8f0a2a5de26ef4f7e8ee4d62806c9c554ae3

    SHA256

    2cab5a93374e3cad6d526597f98a7575ec25f9d3a52fd6735ac59d9720eb0b1e

    SHA512

    9ce18b5e4816c1951f2ea95e33e5907c0e892e913c8dda88e6cc2c65bad0a79e359a604c2feae53b5087f259c5733ee31fcb3e5a8eb99b64f47dbf87c8b3b2bf

  • /data/data/com.sgakagak.agakagabs/kl.txt

    Filesize

    230B

    MD5

    84eb24d0eaeed61f87c8a7d99d436cbe

    SHA1

    6e000a97f3b0c6068f145bb7d477a4d9be7c3d1b

    SHA256

    c4e58e00945ed6b50ba8d6c59b893b988aaf977cbc481b58557495c703ef895b

    SHA512

    09e294d9ec6b07bb2802c0816a54bfde03db7538177c3065ab4486ac0f6364016f9866158365f557371be3b605e9bfcadb5fda001cac0a54a52a30e62d6e7fd7

  • /data/data/com.sgakagak.agakagabs/kl.txt

    Filesize

    54B

    MD5

    6d041a2e9188ef459ac32c968a68c624

    SHA1

    4d1b3e30273f3545ed520dabeb15ee28bfd0caee

    SHA256

    a1f2278ba2599e91e78f4cde3634cace693e7725e8184f75ed8ef27a2f4bf9f8

    SHA512

    d24e5c68a99ddbdf83d29a162f8cab84506947677afe54380c56f194dc677d0fc5dced01a9fe422b2ecf8ad3514c4315422f79b8bf15aabf252a86b5450299f6

  • /data/data/com.sgakagak.agakagabs/kl.txt

    Filesize

    68B

    MD5

    437eb061c7cf02ba4f8a9b0b9b645c1b

    SHA1

    d7d3880256e87002f992cab98570dfe0b46804ce

    SHA256

    50d27ef51d903c839f401f34d37498bfd38529ff1b0e84010fd884684571ed7c

    SHA512

    396d42b7426d4862fc540717284504f1fb4670bd4136d2a8d17887325571a0aea7bdcede8e9dab0db75fdb5b2d8bfda15935fe628490b164c236b29f02ac7ac3

  • /data/data/com.sgakagak.agakagabs/kl.txt

    Filesize

    63B

    MD5

    78cc676996dde5a5a8999a16f7b4c356

    SHA1

    c66808f3eecbba7d8275ce1515959630fcbe8af0

    SHA256

    8b547f59728855ec4a8b1b7c58cad50b214b640b33d49be51caabf6cbb36a108

    SHA512

    2cc423730b7d56145ce38679fa60cf9bcb3e850de30e627f87754c3f97f9e5670ec657365906f6080784d6e84fb82aeb2206ddb20a8a40c90249e2e7812f4640

  • /data/user/0/com.sgakagak.agakagabs/app_apkprotector_dex/classes-v1.bin

    Filesize

    450KB

    MD5

    0f63fa66f97ddfab75a6fb22a0c849dc

    SHA1

    fd9d18cbbfe2a1be656291181ced1058e41bedc6

    SHA256

    7bf6dbad4597ea5dba33fe3f280329b8e258fa9e26caaf5258cd97da4ea4b5f6

    SHA512

    7953227b453283b8148923f136180b97db73a2ac5122534bbdae833be0acc8d5f0e9f0a0518a9aaf2625a0120aeb6bb1048856fab841846f6a418ae68ad96b06