Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
148s -
max time network
149s -
platform
android_x64 -
resource
android-x64-arm64-20240624-en -
resource tags
-
submitted
17/11/2024, 22:06
General
-
Target
3d525dda3db10bac8ed5ffbda3ecb617a19c656e6b4c8ce92737f948d884f23f.apk
-
Size
2.7MB
-
MD5
89cfc1591d94eefd0bf3b3d2a310c3a8
-
SHA1
6d26709ee0f7def881bb8bbde726d43e0e3437f2
-
SHA256
3d525dda3db10bac8ed5ffbda3ecb617a19c656e6b4c8ce92737f948d884f23f
-
SHA512
76ab659ba564a8134dfcc9a4cfcf407041ead318c1cb578b4914091cda3d5c22cc514da2f54f96f71bd7cc5af1e8db0e16a2e27635cb1145a8c73ed04fb43483
-
SSDEEP
49152:eGd6Kjcf1ObPyI4trAm8a8KLGBHzFOTkCMmn6U9BrVT9mDl8r601sS8IQG:e4FjEI4iZaUzYH99yIN
Malware Config
Extracted
octo
https://45.88.88.100:7117/gate/
https://45.88.88.100:8080/rootmd50ma/panelcgfuzwxleg9kdxnvy3rv/gate/
https://45.88.88.100:80/builderxxxzzz/gate/
-
target_apps
at.spardat.bcrmobile
at.spardat.netbanking
com.bankaustria.android.olb
com.bmo.mobile
com.cibc.android.mobi
com.rbc.mobile.android
com.scotiabank.mobile
com.td
cz.airbank.android
eu.inmite.prj.kb.mobilbank
com.bankinter.launcher
com.kutxabank.android
com.rsi
com.tecnocom.cajalaboral
es.bancopopular.nbmpopular
es.evobanco.bancamovil
es.lacaixa.mobile.android.newwapicon
com.dbs.hk.dbsmbanking
com.FubonMobileClient
com.hangseng.rbmobile
com.MobileTreeApp
com.mtel.androidbea
com.scb.breezebanking.hk
hk.com.hsbc.hsbchkmobilebanking
com.aff.otpdirekt
com.ideomobile.hapoalim
com.infrasofttech.indianBank
com.mobikwik_new
com.oxigen.oxigenwallet
jp.co.aeonbank.android.passbook
Signatures
-
Octo
Octo is a banking malware with remote access capabilities first seen in April 2022.
-
Octo family
-
Makes use of the framework's Accessibility service 4 TTPs 2 IoCs
Retrieves information displayed on the phone screen using AccessibilityService.
-
Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
-
Queries the phone number (MSISDN for GSM devices) 1 TTPs
-
Acquires the wake lock 1 IoCs
-
Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs
Application may abuse the framework's foreground service to continue running in the foreground.
-
Performs UI accessibility actions on behalf of the user 1 TTPs 4 IoCs
Application may abuse the accessibility service to prevent their removal.
-
Queries the mobile country code (MCC) 1 TTPs 1 IoCs
-
Reads information about phone network operator. 1 TTPs
-
Requests accessing notifications (often used to intercept notifications before users become aware). 1 TTPs 1 IoCs
-
Requests disabling of battery optimizations (often used to enable hiding in the background). 1 TTPs 1 IoCs
-
Requests modifying system settings. 1 IoCs
-
Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs
Processes
-
com.nameown121⤵
- Makes use of the framework's Accessibility service
- Acquires the wake lock
- Makes use of the framework's foreground persistence service
- Performs UI accessibility actions on behalf of the user
- Queries the mobile country code (MCC)
- Requests accessing notifications (often used to intercept notifications before users become aware).
- Requests disabling of battery optimizations (often used to enable hiding in the background).
- Requests modifying system settings.
- Uses Crypto APIs (Might try to encrypt user data)
Network
MITRE ATT&CK Mobile v15
Defense Evasion
Foreground Persistence
1Hide Artifacts
1User Evasion
1Impair Defenses
1Prevent Application Removal
1Input Injection
1Credential Access
Access Notifications
1Input Capture
2GUI Input Capture
1Keylogging
1Discovery
Software Discovery
1Security Software Discovery
1System Network Configuration Discovery
3Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
48B
MD5046a414913add6f5bb60072c7db819b6
SHA1451ee4f6809260aec622d772fd329c7d0297a842
SHA256b66c1320cb063a1d391c94273572ea6edae76c8c8b0a07f8d75c88686f0df72a
SHA5124e6355f3051ed5e811ab030abde1f5be7f5e1cf33be99cd08477e9b6c015deb1d8bd75a09fb9c7176b8511c5ad0a67abc0902a3531e97564ccb6afc57496a47c
-
Filesize
45B
MD55579a8e8b03482aaf36196f9d7097070
SHA12e4c157183bf3a0222468cd5c0cd89114e6b4970
SHA256ec93a9fac3aa1d6e9dd0e37b5f7897f2223c3f0b386fe5ea5d1c30663cac31eb
SHA51207e808d5dc0447dfb754674d41935df6b0348d7eabf14c7d6557df6c6ab081cf13a94a1b93b361747222ce73093a67411ae4f1a2a99ccc1c9d4614a24a3a1bf6
-
Filesize
66B
MD53017453be6c8b6251ac9313d0a4f01d0
SHA10a0b5d50a294d3932329025f36fa6707d626339e
SHA256738dd50a3e96a77b8468b4f40a907461aca0738266015cf48d6499c19a29e7e7
SHA512d19d3c4fd154fe496048386a88bf04a80b54558f1de5962bf87c39d0c761c2b12c4fb843162cef8156d228e56486f191c5f27a4b3ca3f2e7812e649df3c8306c
-
Filesize
84B
MD5dca395a678f7c45247491e9968cc37ff
SHA1f46eefeb9a74b9a81ad205aef2b5b74c83f32c9e
SHA25679f7a765330ff39e43634872f17133bad71899579e0207e6b246f0c88cadb1ca
SHA51204fbd09fac8c7caa6a921a63345b43ce8d3aa6d995ce564d118228ce405f2891823a375c06fdb2ed3236bebea47b6d85edb50e630b6c55992c5b7626f3355b59
-
Filesize
63B
MD5bbe10ebf1cf192dfcf54b9c1b9526b26
SHA1a1d2ceb0b2fe63ee0955b2fd5a1bcd3a087511bd
SHA2562e425131307a73fd8a98ce6506324faa7fc511be979940b5f3f14ee618d550a3
SHA512c9016fc634cf59150f7660438ebd9b68d5711468d4dceb4fafe22429231852d9d9b731116515187ccb814468432a3026d9c4d25931294f58a181f785e02d3342
-
Filesize
58B
MD56799811524e6f25c19cd39aad82886e0
SHA11130707452ba351adca8e3fbf4e7f49dc171d90e
SHA2564c14af2f083078f5aa9e9a1a3237a23843122f0e2dced26702b3a2b6f0107856
SHA5125cfae513738f455d16cabbd11f27e8aa35aee57af3b1970445cef38b2fc59d3f6123339752164e85654923f0d7f1ed770e1ad02f0c847bde76d107ed01657758
-
Filesize
63B
MD5e8d7d9d732800f254b74a60bb87e65b2
SHA1c37368504c9889e47b2a4079379fdae7cbda72f4
SHA256d46a934eaca47f61380830d02ce09bd8ef380f94e18df9828b3387508d8ea8ab
SHA51266cd8a5030836dfd8406d661f9241cb82976dc67753c7fc26600b1ad64276c26691bf8acb85783a0a69a0bc97aed9635a54878867653573f8a2af073cdd4a413
-
Filesize
230B
MD5abc8027dc59f2d121198d76df9f44b54
SHA138170705b9efc384ab3e271b888036e2d3df1499
SHA25684b1bec6e489ed91e1b41a853118bfb2cef27d6e89a72913f6be2fda37035953
SHA512d34ae553d0f82102bff706b74284b2d1384527cad67e88802a18205d4da1197deeaccf4d23b6b821a81fc62e53c4b19ffb5c5aa541b298c92c179674c7959060
-
Filesize
45B
MD5113762674c48e16305eebbe0adabd337
SHA1c42f754deda130ec106dc85eae4d03877c108ef6
SHA256005ccdcc726bd0ebf93a0a25a9dd8f74c26c1a322225b069517a34d89cb8c7a3
SHA512bbda814b5d7572fe1b8b89c36e76b5d90890bb7d19f7ef4f0da51bc2104c448670552aac74f76707241eb554a6200ab59e520d084486d95d34b2a8a3531fd3ec
-
Filesize
63B
MD5ad7c8dd4f8aaa281fa9947a081175209
SHA14d44a1aaf2187f9b4603460f6e84f48685f4b717
SHA2564075b8247f0748207ef355ba5fea49740c04035009592a09ceafcbae38a1955d
SHA5126825e8c77bb98d05248a4bab8a65df6a6a1570a3edcf39f0fd35282ebc7154ad3eeb3f234407c1a6bf6a439bea55758a1fc6297c1f8ff515947a400f95a721b4
-
Filesize
45B
MD5281af1b1cfc30f453a01fc3708130870
SHA155765f6476ca9c35f68ea04e403882e8d2224625
SHA2566af822aa05d81dc5445e41e65ceb619975e99e791304b80cc94ac0b381cb9049
SHA512248e4c1e6704efb197874871fc9ab5ae13995f9e0f299c52defe5b38e3b0d2ca980a83e915eb4d0f207e15909a036ae740fae692151c57c48f3c0bc930c0c40b
-
Filesize
466B
MD563ef0eafb208b1ae4e7d60d117f8a0b7
SHA11cc99b2e2b373d84bfb0cc58adc790631bba9995
SHA256408a0e788f4b1e8a888fb1c85bfb1a4e81edabd841f79d96579892ddaa263986
SHA512891e347f3e8b7c055d5e3b39c81714f3c93c8110a68ff1047294c4c6a063aa8535d7e8329a2b5ef5034ec9f534eec2b9beecc550ead98838f6bbb25b9ec5e634
-
Filesize
63B
MD5767a43337c1d2a94178bd3354ed18e21
SHA1694ec0e2f2de40bdfbbf2a0015a4f27600c2af62
SHA256b3a58641a5439bc927b6e334bba17b033cf03cb5ec3346e07c158ad063642124
SHA512d3eadb55d7dc962d58d7c3a48bc99f35c233ed254378eb30fbb0be888e4e5a6d80304d9a9c821cc492650c72771681ad74aabde0af14e65f13198914b60077c4
-
Filesize
58B
MD575cdd216a70fa8e0cafb579d4709d691
SHA18d41025ef97707cc814bd8fc08bd39fe01ed7a3f
SHA256efd5b219aa384e9fd2ce1cf18c6bb8d17f8b97423d86e18b5b970f8e06946e42
SHA512c0225ec5ff722bebc2779890cdf79a8b8ef29a69e8f9db84d4f1b25c90d281cc2006c3e3eda46de6380f7f102f8b90747b47fbd011baab3c017663a82ca582b5