Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    148s
  • max time network
    155s
  • platform
    android-10_x64
  • resource
    android-x64-20240910-en
  • resource tags

    arch:x64arch:x86image:android-x64-20240910-enlocale:en-usos:android-10-x64system
  • submitted
    15/11/2024, 22:01

General

  • Target

    7895cd4c1991cfc093be9764f037194111403ccefa9449dcbd3311d0af69223a.apk

  • Size

    2.3MB

  • MD5

    090503d59c0988bee95477110434ace2

  • SHA1

    dc74df1043bf13a95db90d9d062457e48221f2a4

  • SHA256

    7895cd4c1991cfc093be9764f037194111403ccefa9449dcbd3311d0af69223a

  • SHA512

    d9a4c5f340ddeaf1bdedf5976eaf53941c279955dfcdd985e5d7257fe887a77031b4ab9c366051c383897a429d00f0a75b2429950cfe4c8bcdb760f44e395b0d

  • SSDEEP

    49152:mjsLSx3rOwGPeIw6bqX2wtCQBReHEij4ms9R+GSHyNWVfj2/M7Bwz:WhqwGPeZQqG0CQ74z8Z+GSSNWVfi/MWz

Malware Config

Extracted

Family

octo

C2

https://populeryabancianimaserver.xyz/MDQ2MTZjMDhlZDQy/

https://eglencelikahramanlaranimas.xyz/MDQ2MTZjMDhlZDQy/

https://cizgifilmtutkunlarianim.xyz/MDQ2MTZjMDhlZDQy/

https://renklidunyavekarakterler.xyz/MDQ2MTZjMDhlZDQy/

https://animasyonvekulturhikayeleri.xyz/MDQ2MTZjMDhlZDQy/

https://yabancisanatcizgiustalari.xyz/MDQ2MTZjMDhlZDQy/

https://cocukvesinemaoyuncular.xyz/MDQ2MTZjMDhlZDQy/

https://cizgidunyasindakiyabanci.xyz/MDQ2MTZjMDhlZDQy/

https://animasyontavsiyeveyorumlar.xyz/MDQ2MTZjMDhlZDQy/

https://sevimlicanlilarhikarakat.xyz/MDQ2MTZjMDhlZDQy/

https://yabancianimasinemaustalari.xyz/MDQ2MTZjMDhlZDQy/

https://cizgianimasanatyaraticilik.xyz/MDQ2MTZjMDhlZDQy/

https://populeranimaserverkaliteleri.xyz/MDQ2MTZjMDhlZDQy/

https://kulturelanimasyonvesanat.xyz/MDQ2MTZjMDhlZDQy/

https://yabancicizgianimasanatyolu.xyz/MDQ2MTZjMDhlZDQy/

https://eglencevesanatcizgihikaye.xyz/MDQ2MTZjMDhlZDQy/

https://yabanciveklasikanimasyon.xyz/MDQ2MTZjMDhlZDQy/

https://populeranimaserverdunyasi.xyz/MDQ2MTZjMDhlZDQy/

https://cizgianimasanatkonusmasi.xyz/MDQ2MTZjMDhlZDQy/

rc4.plain

Extracted

Family

octo

C2

https://populeryabancianimaserver.xyz/MDQ2MTZjMDhlZDQy/

https://eglencelikahramanlaranimas.xyz/MDQ2MTZjMDhlZDQy/

https://cizgifilmtutkunlarianim.xyz/MDQ2MTZjMDhlZDQy/

https://renklidunyavekarakterler.xyz/MDQ2MTZjMDhlZDQy/

https://animasyonvekulturhikayeleri.xyz/MDQ2MTZjMDhlZDQy/

https://yabancisanatcizgiustalari.xyz/MDQ2MTZjMDhlZDQy/

https://cocukvesinemaoyuncular.xyz/MDQ2MTZjMDhlZDQy/

https://cizgidunyasindakiyabanci.xyz/MDQ2MTZjMDhlZDQy/

https://animasyontavsiyeveyorumlar.xyz/MDQ2MTZjMDhlZDQy/

https://sevimlicanlilarhikarakat.xyz/MDQ2MTZjMDhlZDQy/

https://yabancianimasinemaustalari.xyz/MDQ2MTZjMDhlZDQy/

https://cizgianimasanatyaraticilik.xyz/MDQ2MTZjMDhlZDQy/

https://populeranimaserverkaliteleri.xyz/MDQ2MTZjMDhlZDQy/

https://kulturelanimasyonvesanat.xyz/MDQ2MTZjMDhlZDQy/

https://yabancicizgianimasanatyolu.xyz/MDQ2MTZjMDhlZDQy/

https://eglencevesanatcizgihikaye.xyz/MDQ2MTZjMDhlZDQy/

https://yabanciveklasikanimasyon.xyz/MDQ2MTZjMDhlZDQy/

https://populeranimaserverdunyasi.xyz/MDQ2MTZjMDhlZDQy/

https://cizgianimasanatkonusmasi.xyz/MDQ2MTZjMDhlZDQy/

Attributes
  • target_apps

    at.spardat.bcrmobile

    at.spardat.netbanking

    com.bankaustria.android.olb

    com.bmo.mobile

    com.cibc.android.mobi

    com.denizbank.mobildeniz

    com.rbc.mobile.android

    com.scotiabank.mobile

    com.td

    cz.airbank.android

    eu.inmite.prj.kb.mobilbank

    com.bankinter.launcher

    com.kutxabank.android

    com.rsi

    com.tecnocom.cajalaboral

    es.bancopopular.nbmpopular

    es.evobanco.bancamovil

    es.lacaixa.mobile.android.newwapicon

    com.dbs.hk.dbsmbanking

    com.FubonMobileClient

    com.hangseng.rbmobile

    com.MobileTreeApp

    com.mtel.androidbea

    com.scb.breezebanking.hk

    hk.com.hsbc.hsbchkmobilebanking

    com.aff.otpdirekt

    com.ideomobile.hapoalim

    com.infrasofttech.indianBank

    com.mobikwik_new

    com.oxigen.oxigenwallet

AES_key

Signatures

  • Octo

    Octo is a banking malware with remote access capabilities first seen in April 2022.

  • Octo family
  • Octo payload 1 IoCs
  • Loads dropped Dex/Jar 1 TTPs 1 IoCs

    Runs executable file dropped to the device during analysis.

  • Makes use of the framework's Accessibility service 4 TTPs 2 IoCs

    Retrieves information displayed on the phone screen using AccessibilityService.

  • Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
  • Queries the phone number (MSISDN for GSM devices) 1 TTPs
  • Acquires the wake lock 1 IoCs
  • Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs

    Application may abuse the framework's foreground service to continue running in the foreground.

  • Performs UI accessibility actions on behalf of the user 1 TTPs 4 IoCs

    Application may abuse the accessibility service to prevent their removal.

  • Queries the mobile country code (MCC) 1 TTPs 1 IoCs
  • Reads information about phone network operator. 1 TTPs
  • Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs
  • Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs

Processes

  • com.opinion.blush
    1⤵
    • Loads dropped Dex/Jar
    • Makes use of the framework's Accessibility service
    • Acquires the wake lock
    • Makes use of the framework's foreground persistence service
    • Performs UI accessibility actions on behalf of the user
    • Queries the mobile country code (MCC)
    • Registers a broadcast receiver at runtime (usually for listening for system events)
    • Uses Crypto APIs (Might try to encrypt user data)
    PID:5242

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • /data/data/com.opinion.blush/.qcom.opinion.blush

    Filesize

    48B

    MD5

    046a414913add6f5bb60072c7db819b6

    SHA1

    451ee4f6809260aec622d772fd329c7d0297a842

    SHA256

    b66c1320cb063a1d391c94273572ea6edae76c8c8b0a07f8d75c88686f0df72a

    SHA512

    4e6355f3051ed5e811ab030abde1f5be7f5e1cf33be99cd08477e9b6c015deb1d8bd75a09fb9c7176b8511c5ad0a67abc0902a3531e97564ccb6afc57496a47c

  • /data/data/com.opinion.blush/app_toward/DaFk.json

    Filesize

    153KB

    MD5

    02f455b585a6032381ffa45571632789

    SHA1

    29add7366a643bce651b67c6275968892d06667d

    SHA256

    5b80ae118f7d2b3bddd34e62b256f8e2a829ea093a63941b8cfd227e43a9f515

    SHA512

    8dd96ba12dd3986e3be792dabb17d92a2ecada231ea4cdb40fcddb6e6411492d905b0294008cfcc1273442eac1e31e0795d6ec5993507839ac64034c60a011dd

  • /data/data/com.opinion.blush/app_toward/DaFk.json

    Filesize

    153KB

    MD5

    1a9cd3c2fd0f9af9874151eb866be729

    SHA1

    e80bceb44b0c57bc76663b35612d462e7fb70c36

    SHA256

    d413e3b12f9a32b2edfcb32bb3dfb2cef577b08bfffe8b55cc16976f2af18b72

    SHA512

    67910e8caa141d702592638c398c68e11c1b7f53178dc8c6aab79472cf51d0860e57ef81867221ca309febe46a77c8b2f4bfc7cc5b8010593433b2b3a2bdf584

  • /data/data/com.opinion.blush/kl.txt

    Filesize

    230B

    MD5

    a67151f81f85d071a1a52314c88faf10

    SHA1

    db2ff0af8b77b52cdb565ba2c792863ed01dd00c

    SHA256

    0e4f14157925269e7611f430e11db8dd672189c083ece23e5c4e2b37a5272d64

    SHA512

    d43e4bb020ce7322b48fa08c02f7f7bf944ee66b69e2332ab9a2a9ab09dc03358bd5f944beba725f8bfe002853899174fa262c43036a95d2acdae096c6e9053b

  • /data/data/com.opinion.blush/kl.txt

    Filesize

    54B

    MD5

    0b924a607f0cfecaadaa4da2c074f285

    SHA1

    9c924f24c226e6b29f26ed58395aabccc5614661

    SHA256

    975c3f3141c6cda45fb89027d879dd2358cb3ec86b80d56cf53a41f1fc79bf2c

    SHA512

    36381a90c4ee8ccafd03f2b26af3805ed410d313ae079cac1c6f5b6cd10081f8c439c1c93eed26fb89c757501463e83fb5fb403020a6d50d706a0e6c3c521152

  • /data/data/com.opinion.blush/kl.txt

    Filesize

    63B

    MD5

    a943e4884cba40c1b2def2fc5caa9059

    SHA1

    138b7f3f95291eb776c22115823d9f3ab5fe122d

    SHA256

    218553d05db8f8444caf00c4217b5b2ed1d71db4fbe75f20f39ed4a2be99af18

    SHA512

    b1052f5a7250e1bfa0a00d1e31e03194af835bfa8712ec07992b789c149a1173ae7cdbb9232aac3352e9088dc38e343bb4135813f85eefc2519ddf913caa877d

  • /data/data/com.opinion.blush/kl.txt

    Filesize

    45B

    MD5

    1417ebd71e2d8b5017afe6ca93299948

    SHA1

    b6ce082089b92c92be60d8d1ae0cea4552fdd86d

    SHA256

    efc960c0939f19ab5a5e2176547491571cb2d6b2310cc39a7fcd87fdd79d792e

    SHA512

    21470ba05e7f9cb6a78ca933d058f63f69d077273750a0d9d35fb423514eb2fc661e86d13e4e5717a736de2a5d87e4b5ea0830c18d69bb2bd75bc114862d1782

  • /data/data/com.opinion.blush/kl.txt

    Filesize

    423B

    MD5

    735ed69899eb8eff5dab63b14c231b55

    SHA1

    011854d8c9d257b4a1eacb25848abfea9753d921

    SHA256

    c0bdee392cbd1949f03b54f41f8cf75334a987241727620d451e72803fa75402

    SHA512

    94f06c2bbfec5b26fde6a5143d6697d4b724ae16f073288c1ef8610732f3c36e9681305018dd450e4b921441e133f291da46599314cda2b858a5e66f769f43e7

  • /data/user/0/com.opinion.blush/app_toward/DaFk.json

    Filesize

    451KB

    MD5

    81f99dea0692dd6ff9ea133cc7e6aacb

    SHA1

    4c05bf02c16c85c75f1075d6de3350defdd9469e

    SHA256

    be0f6f41979ae553efee8bbf9ad91ff35c00a4bae647f195c5c1f44032af106d

    SHA512

    e0bb973c8d7193c50d16718b84b282ea78722c35863e4522d924af289610a2cb7dd210e5d284293bed64fd1fb930c6e95da40b0d68198b2fab06e9ac243a4e8d