Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    148s
  • max time network
    150s
  • platform
    android-9_x86
  • resource
    android-x86-arm-20240910-en
  • resource tags

    arch:armarch:x86image:android-x86-arm-20240910-enlocale:en-usos:android-9-x86system
  • submitted
    12/11/2024, 22:20

General

  • Target

    c0baab05ff68de146e81401d508173bbf0c7ba3c86144c14afbfa2bc75a4d1af.apk

  • Size

    2.7MB

  • MD5

    0259183ec9a91d2549c0f04765b742fb

  • SHA1

    22253e4b5ec9b2deff494d6504e460391cec860c

  • SHA256

    c0baab05ff68de146e81401d508173bbf0c7ba3c86144c14afbfa2bc75a4d1af

  • SHA512

    134858a4922fee75c43c777cd444cdb486737f085ffb83bd13dcaeb831971f96e417e262f0af7e2dcf4e9f503b4ea16dd28caa5a07149595759be99826d6f538

  • SSDEEP

    49152:B86Kjcf1ObPyI4trAm8a8KLGBHzFOTkCMmn6U9BrVT9mDl8r601sS8IQT:yFjEI4iZaUzYH99yI8

Malware Config

Extracted

Family

octo

C2

https://178.215.224.87:7117/gate/

https://178.215.224.87:8080/rootmd50ma/panelcgfuzwxleg9kdxnvy3rv/gate/

https://178.215.224.87:80/builderxxxzzz/gate/

Attributes
  • target_apps

    at.spardat.bcrmobile

    at.spardat.netbanking

    com.bankaustria.android.olb

    com.bmo.mobile

    com.cibc.android.mobi

    com.rbc.mobile.android

    com.scotiabank.mobile

    com.td

    cz.airbank.android

    eu.inmite.prj.kb.mobilbank

    com.bankinter.launcher

    com.kutxabank.android

    com.rsi

    com.tecnocom.cajalaboral

    es.bancopopular.nbmpopular

    es.evobanco.bancamovil

    es.lacaixa.mobile.android.newwapicon

    com.dbs.hk.dbsmbanking

    com.FubonMobileClient

    com.hangseng.rbmobile

    com.MobileTreeApp

    com.mtel.androidbea

    com.scb.breezebanking.hk

    hk.com.hsbc.hsbchkmobilebanking

    com.aff.otpdirekt

    com.ideomobile.hapoalim

    com.infrasofttech.indianBank

    com.mobikwik_new

    com.oxigen.oxigenwallet

    jp.co.aeonbank.android.passbook

AES_key

Signatures

Processes

  • com.nameown12
    1⤵
    • Removes its main activity from the application launcher
    • Makes use of the framework's Accessibility service
    • Acquires the wake lock
    • Makes use of the framework's foreground persistence service
    • Performs UI accessibility actions on behalf of the user
    • Queries the mobile country code (MCC)
    • Requests accessing notifications (often used to intercept notifications before users become aware).
    • Requests disabling of battery optimizations (often used to enable hiding in the background).
    • Requests modifying system settings.
    • Registers a broadcast receiver at runtime (usually for listening for system events)
    • Uses Crypto APIs (Might try to encrypt user data)
    PID:4270

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • /data/data/com.nameown12/.qcom.nameown12

    Filesize

    48B

    MD5

    046a414913add6f5bb60072c7db819b6

    SHA1

    451ee4f6809260aec622d772fd329c7d0297a842

    SHA256

    b66c1320cb063a1d391c94273572ea6edae76c8c8b0a07f8d75c88686f0df72a

    SHA512

    4e6355f3051ed5e811ab030abde1f5be7f5e1cf33be99cd08477e9b6c015deb1d8bd75a09fb9c7176b8511c5ad0a67abc0902a3531e97564ccb6afc57496a47c

  • /data/data/com.nameown12/kl.txt

    Filesize

    230B

    MD5

    d199e3ef4226f5c597a40a99955a6272

    SHA1

    930ebbdaca7a4e227769e6a6dfcf1f8c3fd43b8a

    SHA256

    4dfc84b1907305dc902565396723273c10cf7c0e2fee691356db4258d240cb36

    SHA512

    418293e8fbbc59b212b36026fb01a22333446cdfd92d9b7f7cb3c53f5e79f00901b397202ceec96bc9e57d01694b5a3925dd0ef95fa7dd576f8cdb1b97da074a

  • /data/data/com.nameown12/kl.txt

    Filesize

    54B

    MD5

    d63f14b79508d761e9504c98516e30f8

    SHA1

    7c13f83dfe4d2f5c7d3bd0569b6f41eff3c07dce

    SHA256

    4ae64a2de7f3afed89eed5530f130cbedf9a3e1a215262a50f4bcf423b2f75da

    SHA512

    d2d0927c487cd5c209177f791f7f41af5c9e40a57c4c572cebfa78e1995a566fd683131f8aca7822bc769c430b9b3da1c386775f1861df563ec918788f3f0a60

  • /data/data/com.nameown12/kl.txt

    Filesize

    63B

    MD5

    855ddd9b8b446d69d4f11abf3e328880

    SHA1

    38c3f35408da94239c69c8892f188d693176fa75

    SHA256

    cc112bf97d38e0833d8fdeac09247ab82bbd76ed771f3bbab79cf46dd8209ec9

    SHA512

    e0dc618d54e59b09a788f64a9125cc9efbfa1b22e3248ce9b07ff1bb0a1c3e9a8ddaf6adc3f51fc6a0ba12a23eea55a2fccf5260dcd94fb0de4c47d9a66d01bd

  • /data/data/com.nameown12/kl.txt

    Filesize

    45B

    MD5

    fa9f0bec4b0efec0fd88f0a4e26c47e1

    SHA1

    acab3e8f1c06c64636fc3957278d3271bb963399

    SHA256

    c237d7a43038d8601142d58bacbb2174e123d175515207876b71099b8572fb13

    SHA512

    1d1300c0a651d8bb0de4b5309eb27aa7789611c8301adc343451203de3cb9caf142d6bd7d89a65e52ecfc11ec74287b2e12d3a383b9f424351a2524130f1f01e

  • /data/data/com.nameown12/kl.txt

    Filesize

    423B

    MD5

    e625695705c4798ccce1f422762729bd

    SHA1

    937c2184594e333c9d3fc4d4c860b900084e13e2

    SHA256

    43076aa75225085c6c69212538fd356e3a91ea4e71c0aaee9dfc88e2bedd5d71

    SHA512

    b16db033fa7dc475c4dc773ca6ae4cc6b033dc416fd2b04aa0cb0e7e9b97821155a6c82d5e5ffcb50224636e8d2f19bb31e1ff397f98d8e86dbc8bc2322a63c1