Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    43s
  • max time network
    130s
  • platform
    android_x86
  • resource
    android-x86-arm-20240624-en
  • resource tags

    androidarch:armarch:x86image:android-x86-arm-20240624-enlocale:en-usos:android-9-x86system
  • submitted
    17/11/2024, 22:02

General

  • Target

    4e8da6bab2b06c0394cb0e3ce6082d43b10d40a601fa11455ced6045c7916604.apk

  • Size

    2.4MB

  • MD5

    f21675d780257fe04690660551c7cfbb

  • SHA1

    55fab5f882c431e2b4bc0bb650afc00a2325d1bc

  • SHA256

    4e8da6bab2b06c0394cb0e3ce6082d43b10d40a601fa11455ced6045c7916604

  • SHA512

    49882c824bb882fd0d0acdf49f8bd40685b1a04626d267e6bb3a836cfa19e77259f8a3f76fd6cb9910aedf1be19b59fd34bb0dcc50e04ceb060e18d540705ecc

  • SSDEEP

    49152:C9ydLD6xrmfVYZ61pCcCrBVDF5yQcOdyNJG+LGCBDz8o3PcWcPnBXfy:zkxqr0cCrTWxjKk5dzTcWcPnBa

Malware Config

Extracted

Family

octo

C2

https://malkafaniskm.com/NzY2NDZkZmViYjZj/

https://fukiyibartiyom2.com/NzY2NDZkZmViYjZj/

https://malkafali222.com/NzY2NDZkZmViYjZj/

https://oyunbaimlisi35.com/NzY2NDZkZmViYjZj/

https://mal1fukizmirli.com/NzY2NDZkZmViYjZj/

rc4.plain

Extracted

Family

octo

C2

https://malkafaniskm.com/NzY2NDZkZmViYjZj/

https://fukiyibartiyom2.com/NzY2NDZkZmViYjZj/

https://malkafali222.com/NzY2NDZkZmViYjZj/

https://oyunbaimlisi35.com/NzY2NDZkZmViYjZj/

https://mal1fukizmirli.com/NzY2NDZkZmViYjZj/

AES_key

Signatures

  • Octo

    Octo is a banking malware with remote access capabilities first seen in April 2022.

  • Octo family
  • Octo payload 1 IoCs
  • Removes its main activity from the application launcher 1 TTPs 1 IoCs
  • Loads dropped Dex/Jar 1 TTPs 2 IoCs

    Runs executable file dropped to the device during analysis.

  • Makes use of the framework's Accessibility service 4 TTPs 2 IoCs

    Retrieves information displayed on the phone screen using AccessibilityService.

  • Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
  • Queries the phone number (MSISDN for GSM devices) 1 TTPs
  • Acquires the wake lock 1 IoCs
  • Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs

    Application may abuse the framework's foreground service to continue running in the foreground.

  • Performs UI accessibility actions on behalf of the user 1 TTPs 4 IoCs

    Application may abuse the accessibility service to prevent their removal.

  • Queries the mobile country code (MCC) 1 TTPs 1 IoCs
  • Queries the unique device ID (IMEI, MEID, IMSI) 1 TTPs
  • Reads information about phone network operator. 1 TTPs
  • Requests accessing notifications (often used to intercept notifications before users become aware). 1 TTPs 1 IoCs
  • Requests disabling of battery optimizations (often used to enable hiding in the background). 1 TTPs 1 IoCs
  • Requests modifying system settings. 1 IoCs
  • Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs
  • Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs

Processes

  • com.decidesmall4
    1⤵
    • Removes its main activity from the application launcher
    • Loads dropped Dex/Jar
    • Makes use of the framework's Accessibility service
    • Acquires the wake lock
    • Makes use of the framework's foreground persistence service
    • Performs UI accessibility actions on behalf of the user
    • Queries the mobile country code (MCC)
    • Requests accessing notifications (often used to intercept notifications before users become aware).
    • Requests disabling of battery optimizations (often used to enable hiding in the background).
    • Requests modifying system settings.
    • Registers a broadcast receiver at runtime (usually for listening for system events)
    • Uses Crypto APIs (Might try to encrypt user data)
    PID:4215

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • /data/data/com.decidesmall4/cache/oat/ytooyiwkr.cur.prof

    Filesize

    546B

    MD5

    0a3da922a0a7d54a3e860f5fe5c46a20

    SHA1

    c8b226b29e647950096a62ce5459663545e1839e

    SHA256

    01dca6e38c31cbbc0b5634c9c8fdd1bfdaad7b6c9f4564db59dc44a574077c88

    SHA512

    089d0ebe3e5f4a1e1f5511df2a49caf72dad6f01c5bc23eb32fed252c1531e2ee97f9c5173486ec6846f371f5bf11e6e3d1f56af14b68b1bcb4dd7475baa449a

  • /data/data/com.decidesmall4/cache/ytooyiwkr

    Filesize

    2.3MB

    MD5

    54cf7b17aab3cd8a3a4d14975fae07ad

    SHA1

    24667586e78cb919fe0e1bf1ba818e0f857eb791

    SHA256

    585653b3bc676b696c28c4937a1678b5a84d0bae649f3110abd8b7853425f0ed

    SHA512

    9224a37044f3bb07c0e89317b8bd12222d807e6c968a9bff2658be8a20cdcbac911ba9453a409367fab48c4430d8f5469627488ced1f8837c4e0179a3b19ced5