Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    149s
  • max time network
    157s
  • platform
    android-11_x64
  • resource
    android-x64-arm64-20240910-en
  • resource tags

    arch:armarch:arm64arch:x64arch:x86image:android-x64-arm64-20240910-enlocale:en-usos:android-11-x64system
  • submitted
    16/11/2024, 22:02

General

  • Target

    2d940a54b2dae557560129a98e7e17f221fad5bf1000eacbf9f15212cd1d6fd3.apk

  • Size

    605KB

  • MD5

    39e58f7eb8fff109c37a2a3159eb16a5

  • SHA1

    8eb22ff428f0c1ec1060c6d03f62312f70b9df99

  • SHA256

    2d940a54b2dae557560129a98e7e17f221fad5bf1000eacbf9f15212cd1d6fd3

  • SHA512

    8ed6b2aa9c4ec9ce1876809b4f4f2e580eee6ec4ad88c9e3b2b578f6b0489cc085b1b3b4269bd572bd83d9f53955a2b2fa3d11ed9f892288c4d60682b18e4bb3

  • SSDEEP

    12288:6xcTSduysIZWgd8ZymOtxwXmtV0L5Lw46xWra4EGg4xhqMOSk1D5s4hDLrMhdHN:6xcEhsI0gd8Ym6zS8xxWm4JgiwSUD5sz

Malware Config

Extracted

Family

octo

C2

https://34b6413595033c23.biz/YmZiMzU0OTU5NGIz/

https://34b6413595033c23.xyz/YmZiMzU0OTU5NGIz/

https://34b6413903074567453981d0595033c23.com/YmZiMzU0OTU5NGIz/

https://64b6413903074567453981d0595033c23.com/YmZiMzU0OTU5NGIz/

https://74b6413903074567453981d0595033c23.com/YmZiMzU0OTU5NGIz/

https://894b6413903074567453981d0595033c23.com/YmZiMzU0OTU5NGIz/

https://94b64139030754567453981d0595033c23.com/YmZiMzU0OTU5NGIz/

https://94b64139033074567453981d0595033c23.com/YmZiMzU0OTU5NGIz/

https://94b641553903074567453981d0595033c23.com/YmZiMzU0OTU5NGIz/

DES_key
AES_key

Signatures

  • Octo

    Octo is a banking malware with remote access capabilities first seen in April 2022.

  • Octo family
  • Octo payload 1 IoCs
  • Loads dropped Dex/Jar 1 TTPs 2 IoCs

    Runs executable file dropped to the device during analysis.

  • Makes use of the framework's Accessibility service 4 TTPs 2 IoCs

    Retrieves information displayed on the phone screen using AccessibilityService.

  • Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
  • Queries the phone number (MSISDN for GSM devices) 1 TTPs
  • Acquires the wake lock 1 IoCs
  • Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs

    Application may abuse the framework's foreground service to continue running in the foreground.

  • Performs UI accessibility actions on behalf of the user 1 TTPs 5 IoCs

    Application may abuse the accessibility service to prevent their removal.

  • Queries the mobile country code (MCC) 1 TTPs 1 IoCs
  • Reads information about phone network operator. 1 TTPs
  • Requests accessing notifications (often used to intercept notifications before users become aware). 1 TTPs 1 IoCs
  • Requests disabling of battery optimizations (often used to enable hiding in the background). 1 TTPs 1 IoCs
  • Requests modifying system settings. 1 IoCs
  • Schedules tasks to execute at a specified time 1 TTPs 1 IoCs

    Application may abuse the framework's APIs to perform task scheduling for initial or recurring execution of malicious code.

  • Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs

Processes

  • com.shouldfivejf
    1⤵
    • Loads dropped Dex/Jar
    • Makes use of the framework's Accessibility service
    • Acquires the wake lock
    • Makes use of the framework's foreground persistence service
    • Performs UI accessibility actions on behalf of the user
    • Queries the mobile country code (MCC)
    • Requests accessing notifications (often used to intercept notifications before users become aware).
    • Requests disabling of battery optimizations (often used to enable hiding in the background).
    • Requests modifying system settings.
    • Schedules tasks to execute at a specified time
    • Uses Crypto APIs (Might try to encrypt user data)
    PID:4821

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • /data/data/com.shouldfivejf/cache/classes.dex

    Filesize

    447KB

    MD5

    be59c2b34d906da0cea68197e682e383

    SHA1

    dff831bdd0a10c94958d898b8ab60bf0288bad8e

    SHA256

    8876b62f7429a43b0608248ec58025fb3024ca5cc4f777002e9a1f1b9d5a442b

    SHA512

    1ab97f380b4ec6b243a7fbad55ded0e01e8fa075096ffd691acd20c072fe8a2db20215617d22f390cd2bbbcc5b4ea8b9573f92afa2ef10f993fdb3359fdda7ed

  • /data/data/com.shouldfivejf/code_cache/secondary-dexes/1731794541870_classes.dex

    Filesize

    1.1MB

    MD5

    3076ef16ae272e6bb2cbd7e0a340f409

    SHA1

    0f729f031ac9d388a950b8394a98792e287d7cb7

    SHA256

    9301b29b21a2da963c40ed5a4e215f4645808ec5b834347ed26e1090e415afc8

    SHA512

    56757f31045c71743e6011728ec212e3e798c1cda5200448ae2b7fee84694285ec71bc192d434c132ec979be516b26c386b48ee70afc6f93ec015199341b4994

  • /data/data/com.shouldfivejf/files/profileinstaller_profileWrittenFor_lastUpdateTime.dat

    Filesize

    8B

    MD5

    cc4f7749c36d024017dbd0da4803cf32

    SHA1

    cb69d30b2f0ec38ec08ac768c79d7fdb483a7be4

    SHA256

    f9b34ae6d0fcf43222620174a64d909cfe93c301a0bc8c97fffd8adb204c8d05

    SHA512

    46a4277af5634cf8e57d32e235884aa55df8e4e2cb35b5a214bd1c547096e948f05771b4ce64ee270c4793530270c27832323579d4155d99307ae7271e8f70af

  • /data/data/com.shouldfivejf/no_backup/androidx.work.workdb

    Filesize

    4KB

    MD5

    7e858c4054eb00fcddc653a04e5cd1c6

    SHA1

    2e056bf31a8d78df136f02a62afeeca77f4faccf

    SHA256

    9010186c5c083155a45673017d1e31c2a178e63cc15a57bbffde4d1956a23dad

    SHA512

    d0c7a120940c8e637d5566ef179d01eff88a2c2650afda69ad2a46aad76533eaace192028bba3d60407b4e34a950e7560f95d9f9b8eebe361ef62897d88b30cb

  • /data/data/com.shouldfivejf/no_backup/androidx.work.workdb-journal

    Filesize

    512B

    MD5

    aca7915fe66e36cfecd88c1bce933023

    SHA1

    3a5bd9f71774c3cb4ac18ebe7c338f5328e69dd3

    SHA256

    9c215b5cd9ea8028871bf120f796550f95af2038bfc53422f97c49ed2d3f108b

    SHA512

    2c1a40fa8b9c89e0dd104e05afee66af77daf74594d82d583151976ea40f70b4e6f6942709b376920700e8eb27bddb9768840c1043c2f5fc7bbf431d8f033209

  • /data/data/com.shouldfivejf/no_backup/androidx.work.workdb-shm

    Filesize

    32KB

    MD5

    bb7df04e1b0a2570657527a7e108ae23

    SHA1

    5188431849b4613152fd7bdba6a3ff0a4fd6424b

    SHA256

    c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479

    SHA512

    768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012

  • /data/data/com.shouldfivejf/no_backup/androidx.work.workdb-wal

    Filesize

    169KB

    MD5

    df630772f339820a696bdf854f1153d1

    SHA1

    f8969c2808946127b7f64e95287afaacaa377998

    SHA256

    43e87958511069652b81d3124cab9b72f56e36800250165e9c76a7de1699fe00

    SHA512

    2d5a96cddc94e278160755376b1c7514fc8bb503e7517c6d86e702ea4e095ed20bcf69f7a9ec23986c012e89d5e257665e586cf274702994e4befb8f2df3ee2e

  • /data/data/com.shouldfivejf/no_backup/androidx.work.workdb-wal

    Filesize

    16KB

    MD5

    3ae20d0f335f205b8f51ee5915241c55

    SHA1

    c7fc5a8d1fc56b7c780b9082b7c47cb56edcff6f

    SHA256

    2e09ea7f5fb14024240750393599c551c7645a3960343ac4a5a94364212d688b

    SHA512

    22326f0bc1db186ca0f50747689a739c5f7f112978c38f921ae70fd5c0fd8cf2f2952f4347f2e769304547e186f9af1e6211604f1fab13291f2776317616e2c5

  • /data/data/com.shouldfivejf/no_backup/androidx.work.workdb-wal

    Filesize

    116KB

    MD5

    0b1af66579888c7dbee8ccabccf2cf28

    SHA1

    6f01b5854b75b6e0aee1bf730a7d9039ee068e7e

    SHA256

    e9ea1750d038e8320034c02d5aaab0fbff86e7a7cfb18861fb6da1a84b1d63a9

    SHA512

    12776dcd32702bb16783e8f8e0de9b982e6a271e59822d652202b3be79832ee4f6c83d77112b6c5499242a4b0896814a0bf2bcaf04ab6df2689981aa1636f787

  • /data/misc/profiles/cur/0/com.shouldfivejf/primary.prof

    Filesize

    113B

    MD5

    371933addf84ca8976ae2c5c9514011f

    SHA1

    590dff552e17a96420e150b3f3c0232137eb5139

    SHA256

    ffed2d6fe76139f35b3d6d95ca7cfd6de2dafb0de6a7dd0cd5b6f27da44265e9

    SHA512

    5c13da52287c419f2f0b069f41bced8fe600451c6e5de879bb7d30a5450138aaead37ce974079c72aaedcfde42e53be561e69af171d66189e3c57d31b4ea5769

  • /data/misc/profiles/cur/0/com.shouldfivejf/primary.prof

    Filesize

    25B

    MD5

    b9d9e0f8902d129e1aeebff0ae7b725b

    SHA1

    cb0d2b4c9dd60a5c1fc6261fb581bcd3416fe781

    SHA256

    25a822139d06016af8be1296c0242b60e35074f94c713e03323636be1162ce91

    SHA512

    f158a9dc753e0cb41f71a98714ff02198c576bacdd792a6153fdaf6f9a7b52d8cfb6d09099a269d0c1b0d31e2ea5a307ea1db85115bdc6797887a6de36d597f6