Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

10

Static

static

6

1d2376d7bd...9d.apk

android-9-x86

10

1d2376d7bd...9d.apk

android-13-x64

10

Analysis

  • max time kernel
    145s
  • max time network
    157s
  • platform
    android-13_x64
  • resource
    android-33-x64-arm64-20240910-en
  • resource tags

    arch:arm64arch:x64arch:x86image:android-33-x64-arm64-20240910-enlocale:en-usos:android-13-x64system
  • submitted
    17/11/2024, 22:10

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    1d2376d7bd4afd60ad565b43ff6148c071c9469e09cc79e88c5d3293e0e63f9d.apk

  • Size

    1.2MB

  • MD5

    1c7286487d8b0703694ce16a5ce05bb1

  • SHA1

    616c4ad548e04baba19d12f04a427019c2a7c78a

  • SHA256

    1d2376d7bd4afd60ad565b43ff6148c071c9469e09cc79e88c5d3293e0e63f9d

  • SHA512

    43783cd66577ce5968dc6ab999d0cb897e864bd3f7a2286905a4168f0674be5ebf0fcb05e61f71416e71cef751609c4b01e258b33b5357e1927a3d4340c4b7f3

  • SSDEEP

    24576:iWx4ZNK4xu9HeSiZML8QXu1RIW3j4GdVHyiMMKEZwo28:iSONK4xu9+HZ5QXOjHBjvwoV

Score
10/10
octobankercollectioncredential_accessdiscoveryevasionimpactinfostealerpersistencerattrojan

Malware Config

Extracted

Family

octo

C2

https://34b6413903074567453981d0595033c23.com/YmZiMzU0OTU5NGIz/

https://64b6413903074567453981d0595033c23.com/YmZiMzU0OTU5NGIz/

https://74b6413903074567453981d0595033c23.com/YmZiMzU0OTU5NGIz/

https://894b6413903074567453981d0595033c23.com/YmZiMzU0OTU5NGIz/

https://94b64139030754567453981d0595033c23.com/YmZiMzU0OTU5NGIz/

https://94b64139033074567453981d0595033c23.com/YmZiMzU0OTU5NGIz/

https://94b641553903074567453981d0595033c23.com/YmZiMzU0OTU5NGIz/

https://at.spardat.bcrmobile/YmZiMzU0OTU5NGIz/

https://com.google.android.apps.messaging/YmZiMzU0OTU5NGIz/

https://com.samsung.android.messaging/YmZiMzU0OTU5NGIz/

https://at.spardat.netbanking/YmZiMzU0OTU5NGIz/

https://com.bankaustria.android.olb/YmZiMzU0OTU5NGIz/

https://com.bmo.mobile/YmZiMzU0OTU5NGIz/

https://com.cibc.android.mobi/YmZiMzU0OTU5NGIz/

https://com.rbc.mobile.android/YmZiMzU0OTU5NGIz/

https://com.scotiabank.mobile/YmZiMzU0OTU5NGIz/

https://com.td/YmZiMzU0OTU5NGIz/

https://cz.airbank.android/YmZiMzU0OTU5NGIz/

https://eu.inmite.prj.kb.mobilbank/YmZiMzU0OTU5NGIz/

https://com.bankinter.launcher/YmZiMzU0OTU5NGIz/
Attributes
  • target_apps

    at.spardat.bcrmobile

    com.google.android.apps.messaging

    com.samsung.android.messaging

    at.spardat.netbanking

    com.bankaustria.android.olb

    com.bmo.mobile

    com.cibc.android.mobi

    com.rbc.mobile.android

    com.scotiabank.mobile

    com.td

    cz.airbank.android

    eu.inmite.prj.kb.mobilbank

    com.bankinter.launcher

    com.kutxabank.android

    com.rsi

    com.tecnocom.cajalaboral

    es.bancopopular.nbmpopular

    es.evobanco.bancamovil

    es.lacaixa.mobile.android.newwapicon

    com.dbs.hk.dbsmbanking

    com.FubonMobileClient

    com.hangseng.rbmobile

    com.MobileTreeApp

    com.mtel.androidbea

    com.scb.breezebanking.hk

    hk.com.hsbc.hsbchkmobilebanking

    com.aff.otpdirekt

    com.ideomobile.hapoalim

    com.infrasofttech.indianBank

    com.mobikwik_new

AES_key

Signatures

  • Octo

    Octo is a banking malware with remote access capabilities first seen in April 2022.

    bankertrojaninfostealerratocto
  • Octo family
    octo
  • Octo payload 1 IoCs
  • Loads dropped Dex/Jar 1 TTPs 1 IoCs

    Runs executable file dropped to the device during analysis.

    evasion
  • Makes use of the framework's Accessibility service 4 TTPs 2 IoCs

    Retrieves information displayed on the phone screen using AccessibilityService.

    collectionevasioncredential_access
  • Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
    bankerdiscovery
  • Queries the phone number (MSISDN for GSM devices) 1 TTPs
    discovery
  • Acquires the wake lock 1 IoCs
  • Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs

    Application may abuse the framework's foreground service to continue running in the foreground.

    evasionpersistence
  • Performs UI accessibility actions on behalf of the user 1 TTPs 2 IoCs

    Application may abuse the accessibility service to prevent their removal.

    evasion
  • Queries the mobile country code (MCC) 1 TTPs 1 IoCs
    discovery
  • Reads information about phone network operator. 1 TTPs
    discovery
  • Requests accessing notifications (often used to intercept notifications before users become aware). 1 TTPs 1 IoCs
    collectioncredential_access
  • Requests disabling of battery optimizations (often used to enable hiding in the background). 1 TTPs 1 IoCs
    evasion
  • Requests modifying system settings. 1 IoCs
    evasion
  • Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs
    impact

Processes

  • com.needhourrd
    1⤵
    • Loads dropped Dex/Jar
    • Makes use of the framework's Accessibility service
    • Acquires the wake lock
    • Makes use of the framework's foreground persistence service
    • Performs UI accessibility actions on behalf of the user
    • Queries the mobile country code (MCC)
    • Requests accessing notifications (often used to intercept notifications before users become aware).
    • Requests disabling of battery optimizations (often used to enable hiding in the background).
    • Requests modifying system settings.
    • Uses Crypto APIs (Might try to encrypt user data)
    PID:4523

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • /data/data/com.needhourrd/.qcom.needhourrd
    Filesize

    48B

    MD5

    046a414913add6f5bb60072c7db819b6

    SHA1

    451ee4f6809260aec622d772fd329c7d0297a842

    SHA256

    b66c1320cb063a1d391c94273572ea6edae76c8c8b0a07f8d75c88686f0df72a

    SHA512

    4e6355f3051ed5e811ab030abde1f5be7f5e1cf33be99cd08477e9b6c015deb1d8bd75a09fb9c7176b8511c5ad0a67abc0902a3531e97564ccb6afc57496a47c

    Download Submit

  • /data/data/com.needhourrd/cache/oat/owfivveb.cur.prof
    Filesize

    1KB

    MD5

    5c33c6437b5c4b8b8f33153f3711de84

    SHA1

    811d0eec7debbf8353f6c0670a15a1eaa9d69dd0

    SHA256

    8e9166d53a23a452f6b99fcd25efe66998e1419b7efc5300ce1da0cf015f2436

    SHA512

    906a3a8de14cc530447eb867e529613d05ea4c2c792b0d5dfb902309d8c6266e5a60742088a9152aaf38ec704fa39001f006c43565f3141d3ed8ed5b7ab4e261

    Download Submit

  • /data/data/com.needhourrd/cache/owfivveb
    Filesize

    1.1MB

    MD5

    1cc91a5edf34b6d16e7897e5a241a534

    SHA1

    1139fc623b762382411ea8d43db00dc305553039

    SHA256

    9bb76d08c32fb31a48e2d8167bc23466a74c0f5385063424aac1f23956c3384a

    SHA512

    de244ca8ee900525f3156eb7b93c7ad1b3a97695634223419fca97899ce7e64447ba6d8d64f86769898bd0057fbbf48469c1d806ead816850a8c9e82b8302b67

    Download Submit

  • /data/data/com.needhourrd/kl.txt
    Filesize

    69B

    MD5

    b58c0b3094a7feccc0bf5319bf0537a9

    SHA1

    48cd156adbd4c539a45d775debc9577fdd252b3e

    SHA256

    305aaa4e9cd27d3d871ef20c96242f5e53dc22f44a0d93064154f9cea9f8434a

    SHA512

    6f42bcfd743bb3187b32c69c9593f6bf0645c51cd5403afb92bd82b024e1cbaec417ad982a1be6111d209b49b3a3ff4babee9df59491984d0f9becd353361bea

    Download Submit

  • /data/data/com.needhourrd/kl.txt
    Filesize

    45B

    MD5

    14b641fe8ee2c2d1e12a0df913897446

    SHA1

    125f92b20416a90d8f347aa8c910ee08f45e42cb

    SHA256

    fdd8983bbca75cec2c7b17f77eeea12154fa06a3197daee4935eca0ab8474225

    SHA512

    cedc545a7923ffa80677aac6134e898ff15f5b54b0dd05564697eeaf914fd0d4cb0b93cee04597ae82e8fc067c5b2f946cd41e9e415dfc2884bedf5cc7622df6

    Download Submit

  • /data/data/com.needhourrd/kl.txt
    Filesize

    70B

    MD5

    30832e05810c1a32d5b9dd21cf59d393

    SHA1

    c14bff45c0525d6c0bf64d001c7a4c1b6816d932

    SHA256

    97c429d4ea88dd372a5a606d983f458e1e56e3f357642c81d2a3280efc03d661

    SHA512

    4d4333eb64a79362b87b7fbe66ad404d9e19decf513abb065261856760b57e73b8115c8edc69669613c3e41f83170fdf7c8ba0213eb5c8beafd7b9c3b813c2f5

    Download Submit

  • /data/data/com.needhourrd/kl.txt
    Filesize

    45B

    MD5

    2a24e36389ce08ed33e3f7336f73bf0b

    SHA1

    d98122cb6094443a0852fee09109a99574c1e913

    SHA256

    31fb74ca459975e74d0243bc1eabc22f1b19632c7343abc1461e6999b5f935ec

    SHA512

    28e443996990908d5d747077e266f8879c74134a6331d5377f0e50d3553b6677cd39816180f877727afa516a2bbf934e155dd80f644a68a7671b265a4a1a2f61

    Download Submit

  • /data/data/com.needhourrd/kl.txt
    Filesize

    219B

    MD5

    e4348ecb81eea17f4d91cfce3e4c1f69

    SHA1

    69b1a5bd2ee2fe7d1450fbb9a5c1f0e14333b542

    SHA256

    aba532a96ab3397c7622b40c41465c1c7371e27aaea8d01be5a0a91640c2154d

    SHA512

    2f8268f0ebc4ababe0325f1606d23cc23356d31638beec5bcf355b2a9f85eaf1013d6b9a07008c0e6dc175b9cc28b953827d9b774bfd0e785ea846a1e8cdfbf2

    Download Submit