Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

10

Static

static

6

028436b9c1...13.apk

android-9-x86

10

028436b9c1...13.apk

android-10-x64

10

028436b9c1...13.apk

android-11-x64

10

Analysis

  • max time kernel
    149s
  • max time network
    146s
  • platform
    android_x64
  • resource
    android-x64-20240624-en
  • resource tags

    androidarch:x64arch:x86image:android-x64-20240624-enlocale:en-usos:android-10-x64system
  • submitted
    17/11/2024, 22:08

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    028436b9c18135ed661d90cc817f821c4d8ad6d43f85ece17de6ac03dae07113.apk

  • Size

    605KB

  • MD5

    844e1a7088f531d429f244032cca79eb

  • SHA1

    435c71c133b5e161c701c874a7fe981fef0b753f

  • SHA256

    028436b9c18135ed661d90cc817f821c4d8ad6d43f85ece17de6ac03dae07113

  • SHA512

    590fcce88c91cda765b80b29264de7c760a7b24f15f9b4037616c3f6753b716c60e3a5a0ffc86eff972068171e60b741ad6d49c293eeeb39f9063bd797fd82d4

  • SSDEEP

    12288:mlA+SE2uziR2FPwmfr7my8fvRcLqqejcakBbnpn6bCIvXhbqKMUs4hDLrMhdxty:mlA+SEtziR2FTfHmy8fe+qejBk5p6bCo

Score
10/10
octobankercollectioncredential_accessdiscoveryevasionexecutionimpactinfostealerpersistencerattrojan

Malware Config

Extracted

Family

octo

C2

https://34b6413595033c23.biz/YmZiMzU0OTU5NGIz/

https://34b6413595033c23.xyz/YmZiMzU0OTU5NGIz/

https://64b6413903074567453981d0595033c23.biz/YmZiMzU0OTU5NGIz/

https://64b6413903074567453981d0595033c23.xyz/YmZiMzU0OTU5NGIz/

https://34b6413903074567453981d0595033c23.com/YmZiMzU0OTU5NGIz/

https://64b6413903074567453981d0595033c23.com/YmZiMzU0OTU5NGIz/

https://74b6413903074567453981d0595033c23.com/YmZiMzU0OTU5NGIz/

https://894b6413903074567453981d0595033c23.com/YmZiMzU0OTU5NGIz/

https://94b64139030754567453981d0595033c23.com/YmZiMzU0OTU5NGIz/

https://94b64139033074567453981d0595033c23.com/YmZiMzU0OTU5NGIz/

https://94b641553903074567453981d0595033c23.com/YmZiMzU0OTU5NGIz/

https://at.spardat.bcrmobile/YmZiMzU0OTU5NGIz/

https://com.google.android.apps.messaging/YmZiMzU0OTU5NGIz/

https://com.samsung.android.messaging/YmZiMzU0OTU5NGIz/

https://at.spardat.netbanking/YmZiMzU0OTU5NGIz/

https://com.bankaustria.android.olb/YmZiMzU0OTU5NGIz/

https://com.bmo.mobile/YmZiMzU0OTU5NGIz/

https://com.cibc.android.mobi/YmZiMzU0OTU5NGIz/

https://com.rbc.mobile.android/YmZiMzU0OTU5NGIz/

https://com.scotiabank.mobile/YmZiMzU0OTU5NGIz/
Attributes
  • target_apps

    at.spardat.bcrmobile

    com.google.android.apps.messaging

    com.samsung.android.messaging

    at.spardat.netbanking

    com.bankaustria.android.olb

    com.bmo.mobile

    com.cibc.android.mobi

    com.rbc.mobile.android

    com.scotiabank.mobile

    com.td

    cz.airbank.android

    eu.inmite.prj.kb.mobilbank

    com.bankinter.launcher

    com.kutxabank.android

    com.rsi

    com.tecnocom.cajalaboral

    es.bancopopular.nbmpopular

    es.evobanco.bancamovil

    es.lacaixa.mobile.android.newwapicon

    com.dbs.hk.dbsmbanking

    com.FubonMobileClient

    com.hangseng.rbmobile

    com.MobileTreeApp

    com.mtel.androidbea

    com.scb.breezebanking.hk

    hk.com.hsbc.hsbchkmobilebanking

    com.aff.otpdirekt

    com.ideomobile.hapoalim

    com.infrasofttech.indianBank

    com.mobikwik_new

DES_key
AES_key

Signatures

  • Octo

    Octo is a banking malware with remote access capabilities first seen in April 2022.

    bankertrojaninfostealerratocto
  • Octo family
    octo
  • Octo payload 1 IoCs
  • Loads dropped Dex/Jar 1 TTPs 2 IoCs

    Runs executable file dropped to the device during analysis.

    evasion
  • Makes use of the framework's Accessibility service 4 TTPs 2 IoCs

    Retrieves information displayed on the phone screen using AccessibilityService.

    collectionevasioncredential_access
  • Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
    bankerdiscovery
  • Queries the phone number (MSISDN for GSM devices) 1 TTPs
    discovery
  • Acquires the wake lock 1 IoCs
  • Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs

    Application may abuse the framework's foreground service to continue running in the foreground.

    evasionpersistence
  • Performs UI accessibility actions on behalf of the user 1 TTPs 4 IoCs

    Application may abuse the accessibility service to prevent their removal.

    evasion
  • Queries the mobile country code (MCC) 1 TTPs 1 IoCs
    discovery
  • Reads information about phone network operator. 1 TTPs
    discovery
  • Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs
    persistence
  • Schedules tasks to execute at a specified time 1 TTPs 1 IoCs

    Application may abuse the framework's APIs to perform task scheduling for initial or recurring execution of malicious code.

    executionpersistence
  • Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs
    impact

Processes

  • com.enoughnumbergbrr
    1⤵
    • Loads dropped Dex/Jar
    • Makes use of the framework's Accessibility service
    • Acquires the wake lock
    • Makes use of the framework's foreground persistence service
    • Performs UI accessibility actions on behalf of the user
    • Queries the mobile country code (MCC)
    • Registers a broadcast receiver at runtime (usually for listening for system events)
    • Schedules tasks to execute at a specified time
    • Uses Crypto APIs (Might try to encrypt user data)
    PID:4947

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Scheduled Task/Job

1
T1603

Persistence

Event Triggered Execution

1
T1624

Broadcast Receivers

1
T1624.001

Foreground Persistence

1
T1541

Scheduled Task/Job

1
T1603

Privilege Escalation

Defense Evasion

Download New Code at Runtime

1
T1407

Foreground Persistence

1
T1541

Impair Defenses

1
T1629

Prevent Application Removal

1
T1629.001

Input Injection

1
T1516

Credential Access

Input Capture

2
T1417

GUI Input Capture

1
T1417.002

Keylogging

1
T1417.001

Discovery

Software Discovery

1
T1418

Security Software Discovery

1
T1418.001

System Network Configuration Discovery

3
T1422

Lateral Movement

Collection

Input Capture

2
T1417

GUI Input Capture

1
T1417.002

Keylogging

1
T1417.001

Screen Capture

1
T1513

Command and Control

Exfiltration

Impact

Data Encrypted for Impact

1
T1471

Input Injection

1
T1516

Replay Monitor

Loading Replay Monitor...

Downloads

  • /data/data/com.enoughnumbergbrr/.qcom.enoughnumbergbrr
    Filesize

    48B

    MD5

    046a414913add6f5bb60072c7db819b6

    SHA1

    451ee4f6809260aec622d772fd329c7d0297a842

    SHA256

    b66c1320cb063a1d391c94273572ea6edae76c8c8b0a07f8d75c88686f0df72a

    SHA512

    4e6355f3051ed5e811ab030abde1f5be7f5e1cf33be99cd08477e9b6c015deb1d8bd75a09fb9c7176b8511c5ad0a67abc0902a3531e97564ccb6afc57496a47c

    Download Submit

  • /data/data/com.enoughnumbergbrr/cache/classes.dex
    Filesize

    447KB

    MD5

    6cd0261692704e68c5d1e9f3399afcdd

    SHA1

    e56a48a839cc9a1828667b237e2183a8053ec99f

    SHA256

    6c6c6a5e1a6c028e64ca4d5b15fbd33cce490cebe4bd0a1cf70f7978c7d85c11

    SHA512

    d6cdc1a317138df030f91103614fbdda73edf8804cfdf46896a82ef23679e7ffd222156941b6c3c6c5b96349783e69e4312416ed1545866291368ce205443159

    Download Submit

  • /data/data/com.enoughnumbergbrr/code_cache/secondary-dexes/1731881390855_classes.dex
    Filesize

    1.1MB

    MD5

    4c78a54b925d3eb24deb8221dad06426

    SHA1

    dc2c3283777c64828406ba02c23a28964a5e2985

    SHA256

    37c01970ed67e71d4271c408e2c3081f59c95de9c19cde1174f382c7ca1b112e

    SHA512

    8ce31c6acaf40cfc77e02a8bc399ddc542d25d2be17f6cc8dd3ade92399db8d543cfc412b2efaa09ab421e78a2d5c726aba5d7e086cedcfcf58a2df66408a13a

    Download Submit

  • /data/data/com.enoughnumbergbrr/files/profileInstalled
    Filesize

    24B

    MD5

    2919a8c9d5c9114bf8422c7f64ea6fde

    SHA1

    43c46388d5cac7fde236b7105bf4ee227fab4eb1

    SHA256

    bde4133c3a072762e576d04f8ba2b07121d6d6bff949511ae84c0ffea20dd58e

    SHA512

    fa0cf6b92d078dff0a90ca9c1c3bdfb6cad76898e4d2f46a49d68de01cf21c2fbc4e0b25f11823fa781d41a5a338b91eb3e14fea261e99fe0c4b176ae559c534

    Download Submit

  • /data/data/com.enoughnumbergbrr/files/profileinstaller_profileWrittenFor_lastUpdateTime.dat
    Filesize

    8B

    MD5

    04db00243365555eea914e3fd7c89cc7

    SHA1

    35705abcb757b8013d98652f5f603a609abf6529

    SHA256

    33691c8c624555ba75f28ba9680b3dcd963ed902d5b2f4789f3cd0f9b3543445

    SHA512

    0c675145ce275085a9bc22c723f4398f60e9925a5fda2f195d958c75fd4278d1eaf3d464875a8b4124efa00a20e5d9ca66b6def9a307b6debab5c14a77f4bbb8

    Download Submit

  • /data/data/com.enoughnumbergbrr/no_backup/androidx.work.workdb
    Filesize

    4KB

    MD5

    f2b4b0190b9f384ca885f0c8c9b14700

    SHA1

    934ff2646757b5b6e7f20f6a0aa76c7f995d9361

    SHA256

    0a8ffb6b327963558716e87db8946016d143e39f895fa1b43e95ba7032ce2514

    SHA512

    ec12685fc0d60526eed4d38820aad95611f3e93ae372be5a57142d8e8a1ba17e6e5dfe381a4e1365dddc0b363c9c40daaffdc1245bd515fddac69bf1abacd7f1

    Download Submit

  • /data/data/com.enoughnumbergbrr/no_backup/androidx.work.workdb-journal
    Filesize

    512B

    MD5

    7b9f8a65aac6832c412c9382e69800bb

    SHA1

    2a750ff6bf68e3a32a1a315b71881d4cef05f4d9

    SHA256

    ee3602b72c903cd79fc53bbc73d2d27531b0c0d2bcd85683cb296aff298e1c21

    SHA512

    eb10db07ab46832b8469da5d4de20fc86d1d7e7a62e7c2b02686d60d28aee02bad0536e636369edfd3be9393bebf045997da47a4e597a3c11636ddb75b716cbe

    Download Submit

  • /data/data/com.enoughnumbergbrr/no_backup/androidx.work.workdb-shm
    Filesize

    32KB

    MD5

    bb7df04e1b0a2570657527a7e108ae23

    SHA1

    5188431849b4613152fd7bdba6a3ff0a4fd6424b

    SHA256

    c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479

    SHA512

    768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012

    Download Submit

  • /data/data/com.enoughnumbergbrr/no_backup/androidx.work.workdb-wal
    Filesize

    124KB

    MD5

    4b3a361757a0d32a7fb895fbfdd86864

    SHA1

    0118d273f253d19671d79d2a2ad46f9cf57401cb

    SHA256

    0558ad8f9693cad8db580ba20440c67745c236047a440c92ce7c94ade22ff598

    SHA512

    355fa7ab42ec56d043241406e6294c694fbcf71ef542bfb02f54ab6d612dad026880b80e6bad8119e05f2cf01ea8fd0972d80fe9dd20222452d0cb51124e36cb

    Download Submit

  • /data/data/com.enoughnumbergbrr/no_backup/androidx.work.workdb-wal
    Filesize

    177KB

    MD5

    e26c71ebc5d63fd219b7e845084f42fc

    SHA1

    fb49a849ca0edc95ba76463c6f3589abba341c1e

    SHA256

    10450043353d6151c44d928823899f8249f13a704a00590b39315b7f83357bbe

    SHA512

    1ea32c168b12efdf4f189fa5123b95ec3d26dbf9e94d179165c7ee88b48033ae6a9dfc1dd41ad1bd500b67480b4e5c18e7e21ebe6e1d89b27d001c8b86cc4b68

    Download Submit

  • /data/data/com.enoughnumbergbrr/no_backup/androidx.work.workdb-wal
    Filesize

    16KB

    MD5

    6615dcb20ac019c7b0c95aef87ab61a1

    SHA1

    51f3415101944ed8757a06b43aef0fad21da08c5

    SHA256

    03bbe13c873ebd4026f4df48666dd5d249c4be585a3f5e45c3d6acce712f716d

    SHA512

    15e8b6512a37907f4e983c8ac7d20a5cb9d2dcc7feefd66c46be0994ce3ea25a4cf873c337c4e9d4f6d06cd57f8cd527c4584e8dba0e8ce293e6013d3ff73aac

    Download Submit

  • /data/data/com.enoughnumbergbrr/no_backup/androidx.work.workdb-wal
    Filesize

    116KB

    MD5

    66431b0873012236a6800575e717381c

    SHA1

    1d342ec7ce24acded1961b090d84cf1027b9a2b7

    SHA256

    463914ed638a3c34c597a4482368ab9a60db5e6c076699b0d6965e2635341bee

    SHA512

    2f43daa84de275edb5388004699fb3b7cf8cbc1a594c69daeb1190059f59b5e195225222caa4f2b21d994480e038d43d348856d51414eda7ee248deb2c12a9c2

    Download Submit

  • /data/misc/profiles/cur/0/com.enoughnumbergbrr/primary.prof
    Filesize

    112B

    MD5

    13b5598a52096d695818849c5cfec363

    SHA1

    778152a877723b09293ec12e39bb637c3394f03a

    SHA256

    18137ea04b76cb8a8135ad69e5f310c1811d620c0ea2b3a6712af1f6000372e2

    SHA512

    74945f333c2ab899ec4f2c07a4f97e1c496356a2834f33a816a54cf6ab91be470e90893e4a51f54366a3bcc8dd41f61d60caf7886f8d71f36b2578ae658f986c

    Download Submit

  • /data/misc/profiles/cur/0/com.enoughnumbergbrr/primary.prof
    Filesize

    25B

    MD5

    b9d9e0f8902d129e1aeebff0ae7b725b

    SHA1

    cb0d2b4c9dd60a5c1fc6261fb581bcd3416fe781

    SHA256

    25a822139d06016af8be1296c0242b60e35074f94c713e03323636be1162ce91

    SHA512

    f158a9dc753e0cb41f71a98714ff02198c576bacdd792a6153fdaf6f9a7b52d8cfb6d09099a269d0c1b0d31e2ea5a307ea1db85115bdc6797887a6de36d597f6

    Download Submit