Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    148s
  • max time network
    152s
  • platform
    android-13_x64
  • resource
    android-33-x64-arm64-20240910-en
  • resource tags

    arch:arm64arch:x64arch:x86image:android-33-x64-arm64-20240910-enlocale:en-usos:android-13-x64system
  • submitted
    11/11/2024, 22:03

General

  • Target

    dbbd502dee5866b1cb0ddd2ae7ec9f67a2ef9b4faa3e63c8afe6a0a23e80978e.apk

  • Size

    1.8MB

  • MD5

    0140846494e0d3d4d0ce6ec40decee8f

  • SHA1

    9c09d7186e799da6a87aa1114467c1b4eb41d1b6

  • SHA256

    dbbd502dee5866b1cb0ddd2ae7ec9f67a2ef9b4faa3e63c8afe6a0a23e80978e

  • SHA512

    7ea18be49918eb80af02c5e80914d4ed9567b58cf9f56518b65d5d9161e6f97e6e29ffce40164a3bf6fa3d211ff0d602f17dacde3e3573d1c49713adc5d51e93

  • SSDEEP

    49152:RX2cRQ6b1ZbxsfIOWXVCSGn8Lwy7KtRfkRhiCHcVpI5F40XdiG/MI:RX2rQ1ZbyIOmVFLtwyTKIL4mV/p

Malware Config

Extracted

Family

octo

C2

https://dijitaldonanimvegirisimdunyasi.xyz/YjdkMWRjNTllNzZi/

https://yapayzekaveakilliteknolojisirlari.xyz/YjdkMWRjNTllNzZi/

https://kriptoparayatirimvesanalpazar.xyz/YjdkMWRjNTllNzZi/

https://fotografvedijitaltasarimodulu.xyz/YjdkMWRjNTllNzZi/

https://gelecekteknolojivemodatrendleri.xyz/YjdkMWRjNTllNzZi/

https://robotikteknolojivesanalgerceklik.xyz/YjdkMWRjNTllNzZi/

https://bilisimvedijitalveriprogrami.xyz/YjdkMWRjNTllNzZi/

https://blockchainvekriptoparayonetimi.xyz/YjdkMWRjNTllNzZi/

https://sibertehditveakilliguvenlik.xyz/YjdkMWRjNTllNzZi/

https://gelecekinovasyonvegirisimrehberi.xyz/YjdkMWRjNTllNzZi/

https://teknolojideakilliverionerileri.xyz/YjdkMWRjNTllNzZi/

https://verianaliziveteknolojigezileri.xyz/YjdkMWRjNTllNzZi/

https://dijitalekonomivedonusumprojesi.xyz/YjdkMWRjNTllNzZi/

https://akillifabrikalarvemakineler.xyz/YjdkMWRjNTllNzZi/

https://bulutbilisimvegirisimfikirleri.xyz/YjdkMWRjNTllNzZi/

https://dijitalodaklivirusaonlem.xyz/YjdkMWRjNTllNzZi/

https://veridunyasindastratejionerileri.xyz/YjdkMWRjNTllNzZi/

https://akilliekonomiveblockchaindunyasi.xyz/YjdkMWRjNTllNzZi/

https://bilisimdonanimveoyunteknolojisi.xyz/YjdkMWRjNTllNzZi/

https://fotografvevideoeditorununyolu.xyz/YjdkMWRjNTllNzZi/

rc4.plain

Extracted

Family

octo

C2

https://dijitaldonanimvegirisimdunyasi.xyz/YjdkMWRjNTllNzZi/

https://yapayzekaveakilliteknolojisirlari.xyz/YjdkMWRjNTllNzZi/

https://kriptoparayatirimvesanalpazar.xyz/YjdkMWRjNTllNzZi/

https://fotografvedijitaltasarimodulu.xyz/YjdkMWRjNTllNzZi/

https://gelecekteknolojivemodatrendleri.xyz/YjdkMWRjNTllNzZi/

https://robotikteknolojivesanalgerceklik.xyz/YjdkMWRjNTllNzZi/

https://bilisimvedijitalveriprogrami.xyz/YjdkMWRjNTllNzZi/

https://blockchainvekriptoparayonetimi.xyz/YjdkMWRjNTllNzZi/

https://sibertehditveakilliguvenlik.xyz/YjdkMWRjNTllNzZi/

https://gelecekinovasyonvegirisimrehberi.xyz/YjdkMWRjNTllNzZi/

https://teknolojideakilliverionerileri.xyz/YjdkMWRjNTllNzZi/

https://verianaliziveteknolojigezileri.xyz/YjdkMWRjNTllNzZi/

https://dijitalekonomivedonusumprojesi.xyz/YjdkMWRjNTllNzZi/

https://akillifabrikalarvemakineler.xyz/YjdkMWRjNTllNzZi/

https://bulutbilisimvegirisimfikirleri.xyz/YjdkMWRjNTllNzZi/

https://dijitalodaklivirusaonlem.xyz/YjdkMWRjNTllNzZi/

https://veridunyasindastratejionerileri.xyz/YjdkMWRjNTllNzZi/

https://akilliekonomiveblockchaindunyasi.xyz/YjdkMWRjNTllNzZi/

https://bilisimdonanimveoyunteknolojisi.xyz/YjdkMWRjNTllNzZi/

https://fotografvevideoeditorununyolu.xyz/YjdkMWRjNTllNzZi/

AES_key

Signatures

  • Octo

    Octo is a banking malware with remote access capabilities first seen in April 2022.

  • Octo family
  • Octo payload 1 IoCs
  • Loads dropped Dex/Jar 1 TTPs 1 IoCs

    Runs executable file dropped to the device during analysis.

  • Makes use of the framework's Accessibility service 4 TTPs 2 IoCs

    Retrieves information displayed on the phone screen using AccessibilityService.

  • Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
  • Queries the phone number (MSISDN for GSM devices) 1 TTPs
  • Acquires the wake lock 1 IoCs
  • Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs

    Application may abuse the framework's foreground service to continue running in the foreground.

  • Performs UI accessibility actions on behalf of the user 1 TTPs 6 IoCs

    Application may abuse the accessibility service to prevent their removal.

  • Queries the mobile country code (MCC) 1 TTPs 1 IoCs
  • Reads information about phone network operator. 1 TTPs
  • Requests accessing notifications (often used to intercept notifications before users become aware). 1 TTPs 1 IoCs
  • Requests disabling of battery optimizations (often used to enable hiding in the background). 1 TTPs 1 IoCs
  • Requests modifying system settings. 1 IoCs
  • Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs

Processes

  • com.six.hazard
    1⤵
    • Loads dropped Dex/Jar
    • Makes use of the framework's Accessibility service
    • Acquires the wake lock
    • Makes use of the framework's foreground persistence service
    • Performs UI accessibility actions on behalf of the user
    • Queries the mobile country code (MCC)
    • Requests accessing notifications (often used to intercept notifications before users become aware).
    • Requests disabling of battery optimizations (often used to enable hiding in the background).
    • Requests modifying system settings.
    • Uses Crypto APIs (Might try to encrypt user data)
    PID:4515

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • /data/data/com.six.hazard/app_index/ZAerF.json

    Filesize

    153KB

    MD5

    a3118c0e47e4ca12df9338b0fb6f407f

    SHA1

    6bfa74982b3003f49d1b0a46235ad68992c7a760

    SHA256

    9a4a3fa6d990d28244b5ad63845102e1e8dc3dd6c2fc40e531be068e6df294fb

    SHA512

    0b872899dc4d6ddc57ef4ec5370f73bcf10587ab383919c44d6ef85cbb298e70331e7c9f8cfed9ece01f8b859a6680ee8cee4eae284e0aebc4b137c8ca4c4736

  • /data/data/com.six.hazard/app_index/ZAerF.json

    Filesize

    153KB

    MD5

    876f0eea4bc1d4ef2f610829b9256dc5

    SHA1

    381b163c011313d15d4506937b7b952833c26d97

    SHA256

    1e43faeb1a946420ad1472caeee644da283a658705f30502b9ad5b45fcb2d38e

    SHA512

    1f4dd32cafd480ce180b12af3faf9822012df798615d3cf92496af401e9b52742ac200bc99714b863345388c37261bb7542812513461acbffe594760d64c2041

  • /data/user/0/com.six.hazard/app_index/ZAerF.json

    Filesize

    451KB

    MD5

    93231adebaf7e9aa81d9d9faa1db18be

    SHA1

    16552526731fb218af1b4e34d4823b0a3eefabc2

    SHA256

    69af883474ec050272b5babe5f5258e112a6fcecba6124a0914154a0ea00492d

    SHA512

    d15eb1ae6aa59530eaf5c1412b220cf277af67e86768dcacc366185ba94785bf21ff4a76048487725bd99cfd7422f7eb67520a0338f61b18a768a96845224900