Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    148s
  • max time network
    146s
  • platform
    android_x64
  • resource
    android-x64-20240624-en
  • resource tags

    androidarch:x64arch:x86image:android-x64-20240624-enlocale:en-usos:android-10-x64system
  • submitted
    17/11/2024, 22:00

General

  • Target

    dc72c6a6f656133f7464341466cbd66965e46ea545d6644d87df90ee34e67255.apk

  • Size

    2.3MB

  • MD5

    ccb4262679755cb606af2750984be35c

  • SHA1

    a32419c824a6c60f78ca941c36ed86ee823785a2

  • SHA256

    dc72c6a6f656133f7464341466cbd66965e46ea545d6644d87df90ee34e67255

  • SHA512

    cd7f7059325d213bb4f1639f200b822e718f53e7dc95754590015a14b5662feb9faf316cd31a4e49a523d0d5205ed4258725faba7c417a8ae4f552da0cc90905

  • SSDEEP

    49152:s8QQQQ+8QQQQNvC08QQQQ38QQQQl6u/RQFFhh6vn/m/LHwJQb8Z3Kfu9YSvhPcke:im7pQzhY/uLQJQoZ3izSJ3J8

Malware Config

Extracted

Family

octo

C2

https://populeryabancianimaserver.xyz/MDQ2MTZjMDhlZDQy/

https://eglencelikahramanlaranimas.xyz/MDQ2MTZjMDhlZDQy/

https://cizgifilmtutkunlarianim.xyz/MDQ2MTZjMDhlZDQy/

https://renklidunyavekarakterler.xyz/MDQ2MTZjMDhlZDQy/

https://animasyonvekulturhikayeleri.xyz/MDQ2MTZjMDhlZDQy/

https://yabancisanatcizgiustalari.xyz/MDQ2MTZjMDhlZDQy/

https://cocukvesinemaoyuncular.xyz/MDQ2MTZjMDhlZDQy/

https://cizgidunyasindakiyabanci.xyz/MDQ2MTZjMDhlZDQy/

https://animasyontavsiyeveyorumlar.xyz/MDQ2MTZjMDhlZDQy/

https://sevimlicanlilarhikarakat.xyz/MDQ2MTZjMDhlZDQy/

https://yabancianimasinemaustalari.xyz/MDQ2MTZjMDhlZDQy/

https://cizgianimasanatyaraticilik.xyz/MDQ2MTZjMDhlZDQy/

https://populeranimaserverkaliteleri.xyz/MDQ2MTZjMDhlZDQy/

https://kulturelanimasyonvesanat.xyz/MDQ2MTZjMDhlZDQy/

https://yabancicizgianimasanatyolu.xyz/MDQ2MTZjMDhlZDQy/

https://eglencevesanatcizgihikaye.xyz/MDQ2MTZjMDhlZDQy/

https://yabanciveklasikanimasyon.xyz/MDQ2MTZjMDhlZDQy/

https://populeranimaserverdunyasi.xyz/MDQ2MTZjMDhlZDQy/

https://cizgianimasanatkonusmasi.xyz/MDQ2MTZjMDhlZDQy/

rc4.plain

Extracted

Family

octo

C2

https://populeryabancianimaserver.xyz/MDQ2MTZjMDhlZDQy/

https://eglencelikahramanlaranimas.xyz/MDQ2MTZjMDhlZDQy/

https://cizgifilmtutkunlarianim.xyz/MDQ2MTZjMDhlZDQy/

https://renklidunyavekarakterler.xyz/MDQ2MTZjMDhlZDQy/

https://animasyonvekulturhikayeleri.xyz/MDQ2MTZjMDhlZDQy/

https://yabancisanatcizgiustalari.xyz/MDQ2MTZjMDhlZDQy/

https://cocukvesinemaoyuncular.xyz/MDQ2MTZjMDhlZDQy/

https://cizgidunyasindakiyabanci.xyz/MDQ2MTZjMDhlZDQy/

https://animasyontavsiyeveyorumlar.xyz/MDQ2MTZjMDhlZDQy/

https://sevimlicanlilarhikarakat.xyz/MDQ2MTZjMDhlZDQy/

https://yabancianimasinemaustalari.xyz/MDQ2MTZjMDhlZDQy/

https://cizgianimasanatyaraticilik.xyz/MDQ2MTZjMDhlZDQy/

https://populeranimaserverkaliteleri.xyz/MDQ2MTZjMDhlZDQy/

https://kulturelanimasyonvesanat.xyz/MDQ2MTZjMDhlZDQy/

https://yabancicizgianimasanatyolu.xyz/MDQ2MTZjMDhlZDQy/

https://eglencevesanatcizgihikaye.xyz/MDQ2MTZjMDhlZDQy/

https://yabanciveklasikanimasyon.xyz/MDQ2MTZjMDhlZDQy/

https://populeranimaserverdunyasi.xyz/MDQ2MTZjMDhlZDQy/

https://cizgianimasanatkonusmasi.xyz/MDQ2MTZjMDhlZDQy/

Attributes
  • target_apps

    at.spardat.bcrmobile

    at.spardat.netbanking

    com.bankaustria.android.olb

    com.bmo.mobile

    com.cibc.android.mobi

    com.denizbank.mobildeniz

    com.rbc.mobile.android

    com.scotiabank.mobile

    com.td

    cz.airbank.android

    eu.inmite.prj.kb.mobilbank

    com.bankinter.launcher

    com.kutxabank.android

    com.rsi

    com.tecnocom.cajalaboral

    es.bancopopular.nbmpopular

    es.evobanco.bancamovil

    es.lacaixa.mobile.android.newwapicon

    com.dbs.hk.dbsmbanking

    com.FubonMobileClient

    com.hangseng.rbmobile

    com.MobileTreeApp

    com.mtel.androidbea

    com.scb.breezebanking.hk

    hk.com.hsbc.hsbchkmobilebanking

    com.aff.otpdirekt

    com.ideomobile.hapoalim

    com.infrasofttech.indianBank

    com.mobikwik_new

    com.oxigen.oxigenwallet

AES_key

Signatures

  • Octo

    Octo is a banking malware with remote access capabilities first seen in April 2022.

  • Octo family
  • Octo payload 1 IoCs
  • Loads dropped Dex/Jar 1 TTPs 1 IoCs

    Runs executable file dropped to the device during analysis.

  • Makes use of the framework's Accessibility service 4 TTPs 2 IoCs

    Retrieves information displayed on the phone screen using AccessibilityService.

  • Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
  • Queries the phone number (MSISDN for GSM devices) 1 TTPs
  • Acquires the wake lock 1 IoCs
  • Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs

    Application may abuse the framework's foreground service to continue running in the foreground.

  • Performs UI accessibility actions on behalf of the user 1 TTPs 4 IoCs

    Application may abuse the accessibility service to prevent their removal.

  • Queries the mobile country code (MCC) 1 TTPs 1 IoCs
  • Reads information about phone network operator. 1 TTPs
  • Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs
  • Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs

Processes

  • com.exotic.depart
    1⤵
    • Loads dropped Dex/Jar
    • Makes use of the framework's Accessibility service
    • Acquires the wake lock
    • Makes use of the framework's foreground persistence service
    • Performs UI accessibility actions on behalf of the user
    • Queries the mobile country code (MCC)
    • Registers a broadcast receiver at runtime (usually for listening for system events)
    • Uses Crypto APIs (Might try to encrypt user data)
    PID:5051

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • /data/data/com.exotic.depart/.qcom.exotic.depart

    Filesize

    48B

    MD5

    046a414913add6f5bb60072c7db819b6

    SHA1

    451ee4f6809260aec622d772fd329c7d0297a842

    SHA256

    b66c1320cb063a1d391c94273572ea6edae76c8c8b0a07f8d75c88686f0df72a

    SHA512

    4e6355f3051ed5e811ab030abde1f5be7f5e1cf33be99cd08477e9b6c015deb1d8bd75a09fb9c7176b8511c5ad0a67abc0902a3531e97564ccb6afc57496a47c

  • /data/data/com.exotic.depart/app_energy/WoAD.json

    Filesize

    153KB

    MD5

    e58cba8793e97d1bcf516e4aa85a5d76

    SHA1

    14b9df7759ffa3a068c787cd1b1cb77115b4e267

    SHA256

    b62af204fea6b67405dfac9187ddab686d55408e39199fbd2538401b4cc86fab

    SHA512

    063e2e16f809f555210fbeb2fde47654c343eca474a1153fab22c77d31036da0af1db2cb5d3245d1bfbbd5f1b0e6d0061f6c413936be70c22b189b8a4ccf52dd

  • /data/data/com.exotic.depart/app_energy/WoAD.json

    Filesize

    153KB

    MD5

    8f8bebfbd6e4cd11cbbf73b8eb77c142

    SHA1

    04f4c6226bd210c350e8519824f7cd79bbf214fd

    SHA256

    6e61a1296540ee2f97d70688b4f179c3fe57d6090afaa0de4c72765593eb5e21

    SHA512

    9bcee89f8c3e317114c07614d9aea6b71b030a5507dd44adfbac14a91c82be0fa5f3ba17c27c9547990a4572a21e648da2dd4309405770d2d26abdef98a91ea0

  • /data/data/com.exotic.depart/kl.txt

    Filesize

    230B

    MD5

    7766c2143bfafcefccc7c7fafe47badd

    SHA1

    b19afe41634d1a671346023ec08c726042a6089b

    SHA256

    1d476a4df70eda6be6539d4a981cb3f02d014d8e5a5c1db038cbed50ef704926

    SHA512

    3e41624f79f34b81e14ea2271c0e49ab5e91a313544278736b5a186d20761cde011cb0abe8e0248e1c41c27168d7fc86866733d94eb986742ebc3724b9ff6347

  • /data/data/com.exotic.depart/kl.txt

    Filesize

    45B

    MD5

    031192bd4574e8b6c0c26b5fe090174e

    SHA1

    4f06afd3ad86b5dfcab3513dba7bbf3fa503e80c

    SHA256

    12d3a60d379e98131756145c13fa43a93c6463efe435c58c315e03e4f31fdc05

    SHA512

    2f5545983ac6287b71dbb10ec435d8cf3661d0e51c9a9767c47fb9700a899b286fd2cd6c378b8285b45ff68e4d2973bae39e85d2c0018fc6761c5c2a8a1abf56

  • /data/data/com.exotic.depart/kl.txt

    Filesize

    63B

    MD5

    c9db43ad1e4e690c64835aba10a0ffca

    SHA1

    984ebbd91f7a9dc61b0cf1c3b55304138faf881c

    SHA256

    5f3b6015fb8d1ba6bb45e2e92fcca62a2102b495b9dde927753c47e4c86aad22

    SHA512

    8008a6f7f010e336dc814478b93606eeb9f1c11290193e1d9d799f760a5f4d3502139b548ad12681181269d9c82fb0cacd0fb9dd686544b616d41a9261a4ecd3

  • /data/data/com.exotic.depart/kl.txt

    Filesize

    45B

    MD5

    c95fe5cd996dc9511e04e6fb576918fc

    SHA1

    b6afaec42c151d990d086b9c935e77fc89e8c240

    SHA256

    2300ad5ef875e59b044742e9fde37c1bf63f28ed54baac40ebe442db9817b601

    SHA512

    649d4e73f34629122e6cb2294028b2b498dd8c1f3e7305802bd02bc9ecccd1f66639795faa8407171d6128582496d3b07f7befd78442602cf32ef154dd2ad0f8

  • /data/data/com.exotic.depart/kl.txt

    Filesize

    423B

    MD5

    cc35373122b119d507f0d9220b61094e

    SHA1

    1d93fea80dbb2fd3cd3f18445256edf579a6c259

    SHA256

    8854cfc6ead3fc074306678dcd26d205339ffcad72cabdc9f4a1bd73403469a4

    SHA512

    7b37ff6b0ec580e98116cba55a991d1091c0845637bf5179b0d260e9fe47390c169f25e8d6656736a0018390d25c365b15c8afae7ef58cb999a0d05e02db7bdd

  • /data/user/0/com.exotic.depart/app_energy/WoAD.json

    Filesize

    450KB

    MD5

    7ab975ff95a4c9cba3ca297700b9fbbf

    SHA1

    5b10fad3f875bc322d17dbb09637479861567eff

    SHA256

    9856fa4ae1bb070c6f60c98b3f966ad14de802a2b7942d5bbd0f8a42b2e47f27

    SHA512

    9c8b9dd85bb0b1adde5276d3befe9d7e5cb4957781b3b4ede82df893e420aa58ba1a7bdd20082704ca57b8fba2c240935fd1fc02066f6982fefb3ff1f9f97b33