Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

10

Static

static

6

001c43293f...09.apk

android-9-x86

10

001c43293f...09.apk

android-11-x64

10

Analysis

  • max time kernel
    149s
  • max time network
    152s
  • platform
    android-9_x86
  • resource
    android-x86-arm-20240910-en
  • resource tags

    arch:armarch:x86image:android-x86-arm-20240910-enlocale:en-usos:android-9-x86system
  • submitted
    18/11/2024, 22:02

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    001c43293f68ebc6a914518f5ef2fce3ec8eccef274f42662a783f0b340a1509.apk

  • Size

    2.3MB

  • MD5

    03fe02d1c77afc416ea7b2cde11d0730

  • SHA1

    43e48ed5f674dcf241ba8b9456162b97f671f7fc

  • SHA256

    001c43293f68ebc6a914518f5ef2fce3ec8eccef274f42662a783f0b340a1509

  • SHA512

    ff6ad234ecd2f9399c647d23a67be8b325e2ba73eb6ee7e533593c6cb33039c7e5a5fcbe717d1a3e0f97ab1d6a5f1459b6f15894f0a837a44360d8a31f0734e5

  • SSDEEP

    49152:Vc1Jy5LpRQk7pb3HQFBUX+uwsN0H6jECVDPVpN94y+wy:vBpqkBwFBUX+lw0svhY

Score
10/10
octobankercollectioncredential_accessdiscoveryevasionimpactinfostealerpersistenceratstealthtrojan

Malware Config

Extracted

Family

octo

C2

https://populeryabancianimaserver.xyz/MDQ2MTZjMDhlZDQy/

https://eglencelikahramanlaranimas.xyz/MDQ2MTZjMDhlZDQy/

https://cizgifilmtutkunlarianim.xyz/MDQ2MTZjMDhlZDQy/

https://renklidunyavekarakterler.xyz/MDQ2MTZjMDhlZDQy/

https://animasyonvekulturhikayeleri.xyz/MDQ2MTZjMDhlZDQy/

https://yabancisanatcizgiustalari.xyz/MDQ2MTZjMDhlZDQy/

https://cocukvesinemaoyuncular.xyz/MDQ2MTZjMDhlZDQy/

https://cizgidunyasindakiyabanci.xyz/MDQ2MTZjMDhlZDQy/

https://animasyontavsiyeveyorumlar.xyz/MDQ2MTZjMDhlZDQy/

https://sevimlicanlilarhikarakat.xyz/MDQ2MTZjMDhlZDQy/

https://yabancianimasinemaustalari.xyz/MDQ2MTZjMDhlZDQy/

https://cizgianimasanatyaraticilik.xyz/MDQ2MTZjMDhlZDQy/

https://populeranimaserverkaliteleri.xyz/MDQ2MTZjMDhlZDQy/

https://kulturelanimasyonvesanat.xyz/MDQ2MTZjMDhlZDQy/

https://yabancicizgianimasanatyolu.xyz/MDQ2MTZjMDhlZDQy/

https://eglencevesanatcizgihikaye.xyz/MDQ2MTZjMDhlZDQy/

https://yabanciveklasikanimasyon.xyz/MDQ2MTZjMDhlZDQy/

https://populeranimaserverdunyasi.xyz/MDQ2MTZjMDhlZDQy/

https://cizgianimasanatkonusmasi.xyz/MDQ2MTZjMDhlZDQy/
rc4.plain

Extracted

Family

octo

C2

https://populeryabancianimaserver.xyz/MDQ2MTZjMDhlZDQy/

https://eglencelikahramanlaranimas.xyz/MDQ2MTZjMDhlZDQy/

https://cizgifilmtutkunlarianim.xyz/MDQ2MTZjMDhlZDQy/

https://renklidunyavekarakterler.xyz/MDQ2MTZjMDhlZDQy/

https://animasyonvekulturhikayeleri.xyz/MDQ2MTZjMDhlZDQy/

https://yabancisanatcizgiustalari.xyz/MDQ2MTZjMDhlZDQy/

https://cocukvesinemaoyuncular.xyz/MDQ2MTZjMDhlZDQy/

https://cizgidunyasindakiyabanci.xyz/MDQ2MTZjMDhlZDQy/

https://animasyontavsiyeveyorumlar.xyz/MDQ2MTZjMDhlZDQy/

https://sevimlicanlilarhikarakat.xyz/MDQ2MTZjMDhlZDQy/

https://yabancianimasinemaustalari.xyz/MDQ2MTZjMDhlZDQy/

https://cizgianimasanatyaraticilik.xyz/MDQ2MTZjMDhlZDQy/

https://populeranimaserverkaliteleri.xyz/MDQ2MTZjMDhlZDQy/

https://kulturelanimasyonvesanat.xyz/MDQ2MTZjMDhlZDQy/

https://yabancicizgianimasanatyolu.xyz/MDQ2MTZjMDhlZDQy/

https://eglencevesanatcizgihikaye.xyz/MDQ2MTZjMDhlZDQy/

https://yabanciveklasikanimasyon.xyz/MDQ2MTZjMDhlZDQy/

https://populeranimaserverdunyasi.xyz/MDQ2MTZjMDhlZDQy/

https://cizgianimasanatkonusmasi.xyz/MDQ2MTZjMDhlZDQy/
Attributes
  • target_apps

    at.spardat.bcrmobile

    at.spardat.netbanking

    com.bankaustria.android.olb

    com.bmo.mobile

    com.cibc.android.mobi

    com.denizbank.mobildeniz

    com.rbc.mobile.android

    com.scotiabank.mobile

    com.td

    cz.airbank.android

    eu.inmite.prj.kb.mobilbank

    com.bankinter.launcher

    com.kutxabank.android

    com.rsi

    com.tecnocom.cajalaboral

    es.bancopopular.nbmpopular

    es.evobanco.bancamovil

    es.lacaixa.mobile.android.newwapicon

    com.dbs.hk.dbsmbanking

    com.FubonMobileClient

    com.hangseng.rbmobile

    com.MobileTreeApp

    com.mtel.androidbea

    com.scb.breezebanking.hk

    hk.com.hsbc.hsbchkmobilebanking

    com.aff.otpdirekt

    com.ideomobile.hapoalim

    com.infrasofttech.indianBank

    com.mobikwik_new

    com.oxigen.oxigenwallet

AES_key

Signatures

  • Octo

    Octo is a banking malware with remote access capabilities first seen in April 2022.

    bankertrojaninfostealerratocto
  • Octo family
    octo
  • Octo payload 2 IoCs
  • Removes its main activity from the application launcher 1 TTPs 1 IoCs
    stealthtrojanevasion
  • Loads dropped Dex/Jar 1 TTPs 2 IoCs

    Runs executable file dropped to the device during analysis.

    evasion
  • Makes use of the framework's Accessibility service 4 TTPs 2 IoCs

    Retrieves information displayed on the phone screen using AccessibilityService.

    collectionevasioncredential_access
  • Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
    bankerdiscovery
  • Queries the phone number (MSISDN for GSM devices) 1 TTPs
    discovery
  • Acquires the wake lock 1 IoCs
  • Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs

    Application may abuse the framework's foreground service to continue running in the foreground.

    evasionpersistence
  • Performs UI accessibility actions on behalf of the user 1 TTPs 4 IoCs

    Application may abuse the accessibility service to prevent their removal.

    evasion
  • Queries the mobile country code (MCC) 1 TTPs 1 IoCs
    discovery
  • Queries the unique device ID (IMEI, MEID, IMSI) 1 TTPs
    discovery
  • Reads information about phone network operator. 1 TTPs
    discovery
  • Requests accessing notifications (often used to intercept notifications before users become aware). 1 TTPs 1 IoCs
    collectioncredential_access
  • Requests disabling of battery optimizations (often used to enable hiding in the background). 1 TTPs 1 IoCs
    evasion
  • Requests modifying system settings. 1 IoCs
    evasion
  • Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs
    persistence
  • Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs
    impact

Processes

  • com.satoshi.foam
    1⤵
    • Removes its main activity from the application launcher
    • Loads dropped Dex/Jar
    • Makes use of the framework's Accessibility service
    • Acquires the wake lock
    • Makes use of the framework's foreground persistence service
    • Performs UI accessibility actions on behalf of the user
    • Queries the mobile country code (MCC)
    • Requests accessing notifications (often used to intercept notifications before users become aware).
    • Requests disabling of battery optimizations (often used to enable hiding in the background).
    • Requests modifying system settings.
    • Registers a broadcast receiver at runtime (usually for listening for system events)
    • Uses Crypto APIs (Might try to encrypt user data)
    PID:4216
    • /system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.satoshi.foam/app_mass/knU.json --output-vdex-fd=41 --oat-fd=42 --oat-location=/data/user/0/com.satoshi.foam/app_mass/oat/x86/knU.odex --compiler-filter=quicken --class-loader-context=&
      2⤵
      • Loads dropped Dex/Jar
      PID:4241

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Event Triggered Execution

1
T1624

Broadcast Receivers

1
T1624.001

Foreground Persistence

1
T1541

Privilege Escalation

Defense Evasion

Download New Code at Runtime

1
T1407

Foreground Persistence

1
T1541

Hide Artifacts

2
T1628

Suppress Application Icon

1
T1628.001

User Evasion

1
T1628.002

Impair Defenses

1
T1629

Prevent Application Removal

1
T1629.001

Input Injection

1
T1516

Credential Access

Access Notifications

1
T1517

Input Capture

2
T1417

GUI Input Capture

1
T1417.002

Keylogging

1
T1417.001

Discovery

Software Discovery

1
T1418

Security Software Discovery

1
T1418.001

System Network Configuration Discovery

4
T1422

Lateral Movement

Collection

Access Notifications

1
T1517

Input Capture

2
T1417

GUI Input Capture

1
T1417.002

Keylogging

1
T1417.001

Screen Capture

1
T1513

Command and Control

Exfiltration

Impact

Data Encrypted for Impact

1
T1471

Input Injection

1
T1516

Replay Monitor

Loading Replay Monitor...

Downloads

  • /data/data/com.satoshi.foam/.qcom.satoshi.foam
    Filesize

    48B

    MD5

    046a414913add6f5bb60072c7db819b6

    SHA1

    451ee4f6809260aec622d772fd329c7d0297a842

    SHA256

    b66c1320cb063a1d391c94273572ea6edae76c8c8b0a07f8d75c88686f0df72a

    SHA512

    4e6355f3051ed5e811ab030abde1f5be7f5e1cf33be99cd08477e9b6c015deb1d8bd75a09fb9c7176b8511c5ad0a67abc0902a3531e97564ccb6afc57496a47c

    Download Submit

  • /data/data/com.satoshi.foam/app_mass/knU.json
    Filesize

    153KB

    MD5

    53b72875d8f78e93bb46fb9f7779ed4b

    SHA1

    8b31704dba39af8f941a4c6c7dfceabd946ba45f

    SHA256

    c9db43266d862fafbb48d41f141e73195428c065c482c77f5fbdec6ceebdda81

    SHA512

    8caf154f5e99d556a64823c9d60692a65b75a24fd375a739d7fec9c859cb9c1747debe35a82ce95810c49b25be5dfe96c94ab4f413a4cda1598a01b942060b13

    Download Submit

  • /data/data/com.satoshi.foam/app_mass/knU.json
    Filesize

    153KB

    MD5

    cc113036f66a1718c439c37129e1a5ea

    SHA1

    df0e0f78fc533ea35e42c9ec3ce892a08f8ce158

    SHA256

    3dccb2261a6d723574234c3e9c8108b489759bec88495df4d6dac7ea1cfa0ddd

    SHA512

    364e81b4530822c7bb59499957afd807e0ced93e4f1e20847b393ad4456ac36d8cb106171b5fb9d2496b7d8743dcf33765013aef28b442a62749d32758a4bda7

    Download Submit

  • /data/data/com.satoshi.foam/kl.txt
    Filesize

    45B

    MD5

    9a0454df9031bc0795c33ad73deb6501

    SHA1

    35794a37ac76ece0a6d76b928994dfb7ee723e2f

    SHA256

    68dc88465f86666703c10222d53f1e3fe147dad77a87d17c84615c05e4e997a3

    SHA512

    ab5d965d73909f8abf4ab756b02f5c41c1c2bf7a0212471f9126f800d18dda9839f57cfff0ce90343b2c270589b66c45906413c512c08a29dd60250ec1ac0961

    Download Submit

  • /data/data/com.satoshi.foam/kl.txt
    Filesize

    423B

    MD5

    a4ac0bad5893002d292851d361ab385a

    SHA1

    9d4a49da4d654b5f15fe77f98822a01dbd11997d

    SHA256

    ec3b4d779f76a5b1e0db7ba170480e7474a708e7d08e1ce5bbd8fa0772f867db

    SHA512

    312c2f6df5b518e49a0bab74e13a6ddbcfef447996fba1bf3a396eb71713469d015682ef016a8eb71f038aa269d6fb6787b6840ce2273505995911e6dc4295b5

    Download Submit

  • /data/data/com.satoshi.foam/kl.txt
    Filesize

    230B

    MD5

    77dda3d7930cdc2c81a68e8307557dd1

    SHA1

    229ecf85ca6eb3a01ca7b823a0096a073fb6b691

    SHA256

    584e9cae98db7732b8ac29a23746ba95be6f91340ab379d3beaa1bd0e3e1e61e

    SHA512

    64a3399b544cf99fcca9415573a7af6bea6c8e3c41b0397a4e03e732d23ab65549fb7984ddd11e858e0badb0b6952c6aca71a08aeb359db1b270ffad48d48968

    Download Submit

  • /data/data/com.satoshi.foam/kl.txt
    Filesize

    54B

    MD5

    ec994e6ed2695a5ec630ed21cf78e3ab

    SHA1

    06688092f28bd6f400b69d518595d4b62ac2c930

    SHA256

    03539c2d4c9b870e93124e594d71e50df402acf26fbeaf710a6144ac540a1e76

    SHA512

    a2f9264f925e01b91607070096f93d7fd3aec670d0ed0ca4222306d4c38ede5a178d5386aede026cb20d679b60de737b8c7a7780eae26e21eaa42797ddd6f925

    Download Submit

  • /data/data/com.satoshi.foam/kl.txt
    Filesize

    63B

    MD5

    d2a9fb0f084ba9a44f2c9e20c5ad4ec2

    SHA1

    bf072d8eecadf668147afd13749ec02858e5a5bc

    SHA256

    e9fe273332991511bcdc4746b789324bd8e3ff046447c546caf1cdf535f2f3c6

    SHA512

    4269a0334d83d0c703f456bc83c93167cc85863a9ec940bbc6f3bb749c00a6c5d2d7ec5b642fa3ef3bf2d00ed25321ea1c9654a4d29f041e0bfa39b4018d1b29

    Download Submit

  • /data/user/0/com.satoshi.foam/app_mass/knU.json
    Filesize

    451KB

    MD5

    c4c69b7409d9a625a1e50e69bc5733a5

    SHA1

    a2f89253b85035e87d6103de3c4ef26416a8c870

    SHA256

    9b60456e88938110e93b0092585f07acb29c0d4d6c0f1758c74d00d69233bb7c

    SHA512

    2275b0e2eddae3a69f7c6e80bf213631ac0c29b2e818353932ab4a3c510974326d2c6131bfdc645870b716ca0fc5737267732371d8537ecaf7795e8a42746dba

    Download Submit

  • /data/user/0/com.satoshi.foam/app_mass/knU.json
    Filesize

    451KB

    MD5

    87abaa3b780e74a0a40f3b89ca1e3fa7

    SHA1

    36c2b2a365847284845d3c2740da64f9bc8879f3

    SHA256

    6b29057033fea1f90cb1124b97bbcb1614d45985b27239251855787cc89120a2

    SHA512

    e0e3dd027bae4893f32220ee69c14d209b335e5fb537820678aa450112b3e7d52ee776f799a854dd6a7f58e9ac5cd2bd0fcc23b0824510095f4984a01f98d6a7

    Download Submit