Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
145s -
platform
android_x64 -
resource
android-x64-arm64-20240624-en -
resource tags
-
submitted
16/11/2024, 22:01
General
-
Target
4a5a1a18a09f192c37e86fa3dfcc8cd19374a883eb4fe8c039c047c18b0002e3.apk
-
Size
2.7MB
-
MD5
68b0cc9ef0e7b8e3da931061913402fb
-
SHA1
7c90084540c75cfec0bdc68ee05391b55c91e8ed
-
SHA256
4a5a1a18a09f192c37e86fa3dfcc8cd19374a883eb4fe8c039c047c18b0002e3
-
SHA512
5e97dd3414df498ae2e11ef59e69580bd1495ee6105af68a56b9300514ca38be0af75101f864262af0b96e0c312dc815392c7ac8351a6f94419fd46b9861e6b4
-
SSDEEP
49152:eGd6Kjcf1ObPyI4trAm8a8KLGBHzFOTkCMmn6U9BrVT9mDl8r601sS8IQsA:e4FjEI4iZaUzYH99yI6
Malware Config
Extracted
octo
https://45.88.88.100:7117/gate/
https://45.88.88.100:8080/rootmd50ma/panelcgfuzwxleg9kdxnvy3rv/gate/
https://45.88.88.100:80/builderxxxzzz/gate/
-
target_apps
at.spardat.bcrmobile
at.spardat.netbanking
com.bankaustria.android.olb
com.bmo.mobile
com.cibc.android.mobi
com.rbc.mobile.android
com.scotiabank.mobile
com.td
cz.airbank.android
eu.inmite.prj.kb.mobilbank
com.bankinter.launcher
com.kutxabank.android
com.rsi
com.tecnocom.cajalaboral
es.bancopopular.nbmpopular
es.evobanco.bancamovil
es.lacaixa.mobile.android.newwapicon
com.dbs.hk.dbsmbanking
com.FubonMobileClient
com.hangseng.rbmobile
com.MobileTreeApp
com.mtel.androidbea
com.scb.breezebanking.hk
hk.com.hsbc.hsbchkmobilebanking
com.aff.otpdirekt
com.ideomobile.hapoalim
com.infrasofttech.indianBank
com.mobikwik_new
com.oxigen.oxigenwallet
jp.co.aeonbank.android.passbook
Signatures
-
Octo
Octo is a banking malware with remote access capabilities first seen in April 2022.
-
Octo family
-
Makes use of the framework's Accessibility service 4 TTPs 2 IoCs
Retrieves information displayed on the phone screen using AccessibilityService.
-
Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
-
Queries the phone number (MSISDN for GSM devices) 1 TTPs
-
Acquires the wake lock 1 IoCs
-
Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs
Application may abuse the framework's foreground service to continue running in the foreground.
-
Performs UI accessibility actions on behalf of the user 1 TTPs 4 IoCs
Application may abuse the accessibility service to prevent their removal.
-
Queries the mobile country code (MCC) 1 TTPs 1 IoCs
-
Reads information about phone network operator. 1 TTPs
-
Requests accessing notifications (often used to intercept notifications before users become aware). 1 TTPs 1 IoCs
-
Requests disabling of battery optimizations (often used to enable hiding in the background). 1 TTPs 1 IoCs
-
Requests modifying system settings. 1 IoCs
-
Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs
Processes
-
com.nameown121⤵
- Makes use of the framework's Accessibility service
- Acquires the wake lock
- Makes use of the framework's foreground persistence service
- Performs UI accessibility actions on behalf of the user
- Queries the mobile country code (MCC)
- Requests accessing notifications (often used to intercept notifications before users become aware).
- Requests disabling of battery optimizations (often used to enable hiding in the background).
- Requests modifying system settings.
- Uses Crypto APIs (Might try to encrypt user data)
Network
MITRE ATT&CK Mobile v15
Defense Evasion
Foreground Persistence
1Hide Artifacts
1User Evasion
1Impair Defenses
1Prevent Application Removal
1Input Injection
1Credential Access
Access Notifications
1Input Capture
2GUI Input Capture
1Keylogging
1Discovery
Software Discovery
1Security Software Discovery
1System Network Configuration Discovery
3Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
48B
MD5046a414913add6f5bb60072c7db819b6
SHA1451ee4f6809260aec622d772fd329c7d0297a842
SHA256b66c1320cb063a1d391c94273572ea6edae76c8c8b0a07f8d75c88686f0df72a
SHA5124e6355f3051ed5e811ab030abde1f5be7f5e1cf33be99cd08477e9b6c015deb1d8bd75a09fb9c7176b8511c5ad0a67abc0902a3531e97564ccb6afc57496a47c
-
Filesize
45B
MD5577e7e270f1146c6c773b81cbe4967d9
SHA12c7b393dad5f8a1d0d1d91b43f161165942ff397
SHA2564fe457fe1aea65f5903db7831abe728eec98d1d308fafe5fb18defaa6454b1a2
SHA512a1b25ac09da4c7015119631bd88754890e429c2f6e075e6f3e1a380b8000f365d65f2a40d1124c4d5530123a5dee1140e6c2c942358d5176c2cb78c61e08e86c
-
Filesize
66B
MD564caecbd102e7181b9bdda857ca99eb2
SHA1044042f5f546c46f1601fd99c27afc3bf15f3b91
SHA256e6946a2f60faa3fba67cc6ebe8a9ad18d1a0e2e600311d204f0fcbdf60bfbe00
SHA512624b1c3c7f2a3088c59819c021b021010808b87c9ae3bf0823af8d880f5a40be66dada541e3474134dfad19e940f4011c167dc4bf47d1e0f2639eababdedef8a
-
Filesize
84B
MD57e18eb9f5517af2e6dbacbc9d06b28e7
SHA1c02323fbd4de6d31871884f263bdaeb935f62c94
SHA25676cc4623c6477e9f49b2e639e44ffb0c69238c25e9bb48a70f75756d8193e54a
SHA512377d40d6ec999f498beec195cfedf59ddb2d3274b29a18982070d64fbd00cf0b1f8573b1e4f48de694ba8bc931e5d28fc221f1285bca280ee1f20da085c18649
-
Filesize
63B
MD5a23b639e3dc2667e0e8e75684edb19a5
SHA1c64ddd7ec57952d85b5b136cc16cc25c9876a376
SHA256c04dabf9bee9d5e312586397190a42642a5655388d20a1607e2fbaf653a9518f
SHA512436da658a94f7c39ff810a529ad4802689b9a83c521636930eaaa439a67c0e5f0f27543aa8885423720430769df2e8ba7672709f213ccb691e30477bf3983a9d
-
Filesize
58B
MD55b8d8760bc2d4aab3fa86ffb7c2f68b5
SHA14fd5a57cfa0c13a68efd6c5a9573a7b4bd411096
SHA256b066ed767d7ba37f6784a53c7d5d73f2aa739bde4355f2fa5da8b5f408a98d42
SHA5128ab91b7243cefb636e0bd807dc3e5c505a19c2ba28460da9bb560688dadafed5cf0d90288ef0f8ab7461bf96c3ba0ca04dc79c96faea1b60991c022bf4e25a10
-
Filesize
63B
MD5804088594a925b0cc1c21bde8ab43976
SHA1d7c9070c80e6278710575ecd073bb67f8d07a0d2
SHA2569f0fc8a1c773cb32736447fe48bbe9a6ee8191310be21b815b226d5dadc78e03
SHA512b2be450bebe973412701cdc5e6c7fdfd9bced17c2e552df82577e3e3254ff8c01e9d75fb8a6c40e3e662ca8928c8ca7b2bc6543c750417cf8a452bf3de674346
-
Filesize
230B
MD53760172d1709ecf4e96644b38f830d85
SHA1635b282908a2fbd1902a9cdbdef47454d4548b86
SHA25652d16442ad1707f6caa5b4913d3d5df67c0ce019e41bd3a6c7967950b4560fc7
SHA5121c0b3009451db54fde9040021db804dc69dea2773a001b9e244a5421b8677de2fd5a1c50e188107e5e5264a3aee9f8faef0bece32ba7947880cc134c0b7ab0bc
-
Filesize
45B
MD5eab78eb8fdfb4805a5c4ba9c875f1394
SHA10ba0af8ed12f52e5a73049acc752966ed8679647
SHA25637b63e48562291d27078be756e30cd3fa88e44d2634aa833b256e27e77552dea
SHA512e20c1e80cd0167f51fec46bfe9b764c0ba064512736abd04891b99ba6ac5449d3c3fb94e8d15b2fb0d880ea87353aa93dd497a85f4b361d98199976e9e647753
-
Filesize
63B
MD5cf1e59ab415811284986f2a7fbc92869
SHA11be4cb08660c5d9cfc70f6013a9c5a1c3a90fb6d
SHA25602e06b5d5043c45d0e6d5f610da4d24de55443c6ace9a6624324eb14f42b1ab1
SHA5121e4a40a264534cfc91738a11bdd68343e210284666b56c13d4beada167705ec2f00b76d1eeb681709bb6789e789b714409d4d42cf7c88b1fbff8b3bd23f74dce
-
Filesize
45B
MD5886d129446fe3fccf506054b71b60a28
SHA1503dabc6c8ff2494ec94a6d731b52b9fd7e3be76
SHA256d13bc80116393968a69b3c71bc23307b44c1832883bfb5ecf28f54d9e6b049bb
SHA5124cd0aa155118f19fb53b009d21562d370e9ea0ed157bb7cc3d39408bca01b129cf18cd380b7dcfa2b2e6a22de76efa6ac7bb42e8bc6d7dba1791bd1f5f8dd879
-
Filesize
466B
MD5ee3cfb06363daa950970305740c4c0af
SHA10adcf1a38e17dbf33129712fc1367f1fde6762da
SHA256ee7060bba2bdd97693530c308492b8605e34e33b6209295e13b7d73799aba89c
SHA512a0b28a6bb1c2bb2b9cb4f72c33de74b946dcae9d41d6abc5bc54aa06237f156b45212003909c575a804d13f98f11315220179a637687c0810e81a860133dba86
-
Filesize
63B
MD51bce3a317d8992ba6a4a030143d1a87d
SHA136825859f492026fe774291d2aa68407cd30aa08
SHA256a84575e62f2ff156a1338b7dccd62eba1c77a378b1d7e06ff22a4f5a13d70cf8
SHA51287224b0304a0aaa3d0a225570091d95d77a0683950f64db4e7fad1b2f83ffeaa4f776c6e6de3f801113d8057571b76b9b30839e6420247eaa869c55b0ede210e
-
Filesize
58B
MD5e8c141ba079051f60d6eb86848d63e6f
SHA1e1649d8fce3ab39dd60ce9166c3b377f2d56c369
SHA25623da561e8c1d510a20919b6da4508f9f90a765ca3263346b5f1aefd941b5d1d5
SHA512618cb6c8ae5819a3665333f0665247687ea3bb3111d763211f7d92a433dcc5f1083b310f28d4d28d309f664555a48bd750f092444f5a9a87c6ca33344aac1dc3