Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    149s
  • max time network
    152s
  • platform
    android-9_x86
  • resource
    android-x86-arm-20240910-en
  • resource tags

    arch:armarch:x86image:android-x86-arm-20240910-enlocale:en-usos:android-9-x86system
  • submitted
    15/11/2024, 22:01

General

  • Target

    7895cd4c1991cfc093be9764f037194111403ccefa9449dcbd3311d0af69223a.apk

  • Size

    2.3MB

  • MD5

    090503d59c0988bee95477110434ace2

  • SHA1

    dc74df1043bf13a95db90d9d062457e48221f2a4

  • SHA256

    7895cd4c1991cfc093be9764f037194111403ccefa9449dcbd3311d0af69223a

  • SHA512

    d9a4c5f340ddeaf1bdedf5976eaf53941c279955dfcdd985e5d7257fe887a77031b4ab9c366051c383897a429d00f0a75b2429950cfe4c8bcdb760f44e395b0d

  • SSDEEP

    49152:mjsLSx3rOwGPeIw6bqX2wtCQBReHEij4ms9R+GSHyNWVfj2/M7Bwz:WhqwGPeZQqG0CQ74z8Z+GSSNWVfi/MWz

Malware Config

Extracted

Family

octo

C2

https://populeryabancianimaserver.xyz/MDQ2MTZjMDhlZDQy/

https://eglencelikahramanlaranimas.xyz/MDQ2MTZjMDhlZDQy/

https://cizgifilmtutkunlarianim.xyz/MDQ2MTZjMDhlZDQy/

https://renklidunyavekarakterler.xyz/MDQ2MTZjMDhlZDQy/

https://animasyonvekulturhikayeleri.xyz/MDQ2MTZjMDhlZDQy/

https://yabancisanatcizgiustalari.xyz/MDQ2MTZjMDhlZDQy/

https://cocukvesinemaoyuncular.xyz/MDQ2MTZjMDhlZDQy/

https://cizgidunyasindakiyabanci.xyz/MDQ2MTZjMDhlZDQy/

https://animasyontavsiyeveyorumlar.xyz/MDQ2MTZjMDhlZDQy/

https://sevimlicanlilarhikarakat.xyz/MDQ2MTZjMDhlZDQy/

https://yabancianimasinemaustalari.xyz/MDQ2MTZjMDhlZDQy/

https://cizgianimasanatyaraticilik.xyz/MDQ2MTZjMDhlZDQy/

https://populeranimaserverkaliteleri.xyz/MDQ2MTZjMDhlZDQy/

https://kulturelanimasyonvesanat.xyz/MDQ2MTZjMDhlZDQy/

https://yabancicizgianimasanatyolu.xyz/MDQ2MTZjMDhlZDQy/

https://eglencevesanatcizgihikaye.xyz/MDQ2MTZjMDhlZDQy/

https://yabanciveklasikanimasyon.xyz/MDQ2MTZjMDhlZDQy/

https://populeranimaserverdunyasi.xyz/MDQ2MTZjMDhlZDQy/

https://cizgianimasanatkonusmasi.xyz/MDQ2MTZjMDhlZDQy/

rc4.plain

Extracted

Family

octo

C2

https://populeryabancianimaserver.xyz/MDQ2MTZjMDhlZDQy/

https://eglencelikahramanlaranimas.xyz/MDQ2MTZjMDhlZDQy/

https://cizgifilmtutkunlarianim.xyz/MDQ2MTZjMDhlZDQy/

https://renklidunyavekarakterler.xyz/MDQ2MTZjMDhlZDQy/

https://animasyonvekulturhikayeleri.xyz/MDQ2MTZjMDhlZDQy/

https://yabancisanatcizgiustalari.xyz/MDQ2MTZjMDhlZDQy/

https://cocukvesinemaoyuncular.xyz/MDQ2MTZjMDhlZDQy/

https://cizgidunyasindakiyabanci.xyz/MDQ2MTZjMDhlZDQy/

https://animasyontavsiyeveyorumlar.xyz/MDQ2MTZjMDhlZDQy/

https://sevimlicanlilarhikarakat.xyz/MDQ2MTZjMDhlZDQy/

https://yabancianimasinemaustalari.xyz/MDQ2MTZjMDhlZDQy/

https://cizgianimasanatyaraticilik.xyz/MDQ2MTZjMDhlZDQy/

https://populeranimaserverkaliteleri.xyz/MDQ2MTZjMDhlZDQy/

https://kulturelanimasyonvesanat.xyz/MDQ2MTZjMDhlZDQy/

https://yabancicizgianimasanatyolu.xyz/MDQ2MTZjMDhlZDQy/

https://eglencevesanatcizgihikaye.xyz/MDQ2MTZjMDhlZDQy/

https://yabanciveklasikanimasyon.xyz/MDQ2MTZjMDhlZDQy/

https://populeranimaserverdunyasi.xyz/MDQ2MTZjMDhlZDQy/

https://cizgianimasanatkonusmasi.xyz/MDQ2MTZjMDhlZDQy/

Attributes
  • target_apps

    at.spardat.bcrmobile

    at.spardat.netbanking

    com.bankaustria.android.olb

    com.bmo.mobile

    com.cibc.android.mobi

    com.denizbank.mobildeniz

    com.rbc.mobile.android

    com.scotiabank.mobile

    com.td

    cz.airbank.android

    eu.inmite.prj.kb.mobilbank

    com.bankinter.launcher

    com.kutxabank.android

    com.rsi

    com.tecnocom.cajalaboral

    es.bancopopular.nbmpopular

    es.evobanco.bancamovil

    es.lacaixa.mobile.android.newwapicon

    com.dbs.hk.dbsmbanking

    com.FubonMobileClient

    com.hangseng.rbmobile

    com.MobileTreeApp

    com.mtel.androidbea

    com.scb.breezebanking.hk

    hk.com.hsbc.hsbchkmobilebanking

    com.aff.otpdirekt

    com.ideomobile.hapoalim

    com.infrasofttech.indianBank

    com.mobikwik_new

    com.oxigen.oxigenwallet

AES_key

Signatures

  • Octo

    Octo is a banking malware with remote access capabilities first seen in April 2022.

  • Octo family
  • Octo payload 2 IoCs
  • Removes its main activity from the application launcher 1 TTPs 1 IoCs
  • Loads dropped Dex/Jar 1 TTPs 2 IoCs

    Runs executable file dropped to the device during analysis.

  • Makes use of the framework's Accessibility service 4 TTPs 2 IoCs

    Retrieves information displayed on the phone screen using AccessibilityService.

  • Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
  • Queries the phone number (MSISDN for GSM devices) 1 TTPs
  • Acquires the wake lock 1 IoCs
  • Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs

    Application may abuse the framework's foreground service to continue running in the foreground.

  • Performs UI accessibility actions on behalf of the user 1 TTPs 4 IoCs

    Application may abuse the accessibility service to prevent their removal.

  • Queries the mobile country code (MCC) 1 TTPs 1 IoCs
  • Queries the unique device ID (IMEI, MEID, IMSI) 1 TTPs
  • Requests accessing notifications (often used to intercept notifications before users become aware). 1 TTPs 1 IoCs
  • Requests disabling of battery optimizations (often used to enable hiding in the background). 1 TTPs 1 IoCs
  • Requests modifying system settings. 1 IoCs
  • Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs
  • Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs

Processes

  • com.opinion.blush
    1⤵
    • Removes its main activity from the application launcher
    • Loads dropped Dex/Jar
    • Makes use of the framework's Accessibility service
    • Acquires the wake lock
    • Makes use of the framework's foreground persistence service
    • Performs UI accessibility actions on behalf of the user
    • Queries the mobile country code (MCC)
    • Requests accessing notifications (often used to intercept notifications before users become aware).
    • Requests disabling of battery optimizations (often used to enable hiding in the background).
    • Requests modifying system settings.
    • Registers a broadcast receiver at runtime (usually for listening for system events)
    • Uses Crypto APIs (Might try to encrypt user data)
    PID:4323
    • /system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.opinion.blush/app_toward/DaFk.json --output-vdex-fd=41 --oat-fd=42 --oat-location=/data/user/0/com.opinion.blush/app_toward/oat/x86/DaFk.odex --compiler-filter=quicken --class-loader-context=&
      2⤵
      • Loads dropped Dex/Jar
      PID:4349

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • /data/data/com.opinion.blush/.qcom.opinion.blush

    Filesize

    48B

    MD5

    046a414913add6f5bb60072c7db819b6

    SHA1

    451ee4f6809260aec622d772fd329c7d0297a842

    SHA256

    b66c1320cb063a1d391c94273572ea6edae76c8c8b0a07f8d75c88686f0df72a

    SHA512

    4e6355f3051ed5e811ab030abde1f5be7f5e1cf33be99cd08477e9b6c015deb1d8bd75a09fb9c7176b8511c5ad0a67abc0902a3531e97564ccb6afc57496a47c

  • /data/data/com.opinion.blush/app_toward/DaFk.json

    Filesize

    153KB

    MD5

    02f455b585a6032381ffa45571632789

    SHA1

    29add7366a643bce651b67c6275968892d06667d

    SHA256

    5b80ae118f7d2b3bddd34e62b256f8e2a829ea093a63941b8cfd227e43a9f515

    SHA512

    8dd96ba12dd3986e3be792dabb17d92a2ecada231ea4cdb40fcddb6e6411492d905b0294008cfcc1273442eac1e31e0795d6ec5993507839ac64034c60a011dd

  • /data/data/com.opinion.blush/app_toward/DaFk.json

    Filesize

    153KB

    MD5

    1a9cd3c2fd0f9af9874151eb866be729

    SHA1

    e80bceb44b0c57bc76663b35612d462e7fb70c36

    SHA256

    d413e3b12f9a32b2edfcb32bb3dfb2cef577b08bfffe8b55cc16976f2af18b72

    SHA512

    67910e8caa141d702592638c398c68e11c1b7f53178dc8c6aab79472cf51d0860e57ef81867221ca309febe46a77c8b2f4bfc7cc5b8010593433b2b3a2bdf584

  • /data/data/com.opinion.blush/kl.txt

    Filesize

    45B

    MD5

    903f5ad05368ebec156541cf67ff9978

    SHA1

    3cf65f296feb9bba4443207ce81ed85bee7ab21a

    SHA256

    d782813306e36689b08e00175bf7213123959d3b7da0df70f7f42a90ef77df62

    SHA512

    2943af9969beeced7cb27ad050645570f6cd5cffb84c4dc701485f0263c919fda8255ade1460772da059e19481b0e4138a6401064c4146eaf5c34549f38fc5cb

  • /data/data/com.opinion.blush/kl.txt

    Filesize

    423B

    MD5

    cb2409a429b299c493a78e7c3e059e0e

    SHA1

    19e7701032e8bd8499b601324914e2cd28a0b957

    SHA256

    7d935bd734ab36eea905af0e9c3cc3367b8f286e41e8f83752517e7600478f60

    SHA512

    3ad41c78696f63874605b16a91af27fce88ef22eee4506551880793874b218b23e2e098b7240972f9c4b66edb8d020fa050a8df301cc5d2308384f3d87c69650

  • /data/data/com.opinion.blush/kl.txt

    Filesize

    230B

    MD5

    bb6b25ffdd153c755dc345764221988d

    SHA1

    51290f82209b2e786f6e2f22bae9a9af705852c3

    SHA256

    fe8ab848702c8fbf8724853cb33e67a2df3bf85204235f49de0096d561766aee

    SHA512

    72be5002a92a4b39865348a23166a6f2bd0f1eb61d837f271cb32d0e3eedc8448121835aa3f7f068ae5ac570acbd96f689d2bae5de13584d2ee0c2a2079ec586

  • /data/data/com.opinion.blush/kl.txt

    Filesize

    54B

    MD5

    8bd605717b23e01f69db36755bfaaf67

    SHA1

    edc2cfe9e6c252a9ba5286a225f1a4bc616919ae

    SHA256

    ee499a29ba69edbd07ca8b5deb3f671da5bb6c22f8e327dc8e43521d8b1ffbb2

    SHA512

    d027d0bc5d7662426e26b33d9cbc359fc0ee4312baf826612bf697aaa37af4bfbc5cafbfc5d1530166df2ca1681eb76ec07524ff69bd7ba2c80042a9910669dd

  • /data/data/com.opinion.blush/kl.txt

    Filesize

    63B

    MD5

    29b9cdc94fcf86a1726870b7875cb34e

    SHA1

    f5358966afb8e735dea31fdb206a3aa122c44078

    SHA256

    7f3310cccc2e119f1e1356718d474f36e3f5b4f2931bec3f929d41d7a52aafe1

    SHA512

    aedd53b4b0774091a9fd2edef17fe7b919c51d3dbaccc85d4aee3a19e388681277080c819d1d720017ea94ab6e5a709aca2cb8eb3578abc53a6ab72acdc09da1

  • /data/user/0/com.opinion.blush/app_toward/DaFk.json

    Filesize

    451KB

    MD5

    575a1bdc5bd702098e3487ef1d08f8d8

    SHA1

    1a01de1bb5364f0532c5f81d14aeca6beb76841a

    SHA256

    32e974b3c9db1a33766b074648415c5b018883787a3ce3bd3492db9738be8bd6

    SHA512

    21f65b1fdc768b83a5c8fc55d19553223c7fcf814432220afacd808e334265839d7c646649ae6b3fbe8afbd9324fc41c95522d7accbee914ef57e14ae6092a8d

  • /data/user/0/com.opinion.blush/app_toward/DaFk.json

    Filesize

    451KB

    MD5

    81f99dea0692dd6ff9ea133cc7e6aacb

    SHA1

    4c05bf02c16c85c75f1075d6de3350defdd9469e

    SHA256

    be0f6f41979ae553efee8bbf9ad91ff35c00a4bae647f195c5c1f44032af106d

    SHA512

    e0bb973c8d7193c50d16718b84b282ea78722c35863e4522d924af289610a2cb7dd210e5d284293bed64fd1fb930c6e95da40b0d68198b2fab06e9ac243a4e8d