Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
132s -
platform
android_x64 -
resource
android-33-x64-arm64-20240624-en -
resource tags
-
submitted
01/12/2024, 22:00
General
-
Target
a082de209475ef2eaee9a5db5ec329dcc67880f1bf3a98a27f3fb18035855c59.apk
-
Size
2.2MB
-
MD5
fca8afc4fa61d0ab38e5545cad57f563
-
SHA1
f2e730b4bfb3a6bc0885898fa326f43750ca96f0
-
SHA256
a082de209475ef2eaee9a5db5ec329dcc67880f1bf3a98a27f3fb18035855c59
-
SHA512
5a6f38d3871288417691ca86b00ff794a2735d08fdaad2789a3a01e0fd2d75899e1306879d22f0bd8b360d8a2622713d8ee42ae122c568c8ce1194ccb5f59fda
-
SSDEEP
49152:QCLOayuJ7Uz0AT7z+p6axJY5RhSoIGPxTUFRlWRZFbUEOWsf0VNrnA:QYOadU3zn5RhSotPQ+MEOW+KrnA
Malware Config
Extracted
octo
https://20hffqm13hac.top/MTU2OWE0NzJjNGY5/
https://4lmmw85977x2.xyz/MTU2OWE0NzJjNGY5/
https://kirijdnka15ca.pro/MTU2OWE0NzJjNGY5/
Extracted
octo
https://20hffqm13hac.top/MTU2OWE0NzJjNGY5/
https://4lmmw85977x2.xyz/MTU2OWE0NzJjNGY5/
https://kirijdnka15ca.pro/MTU2OWE0NzJjNGY5/
Signatures
-
Octo
Octo is a banking malware with remote access capabilities first seen in April 2022.
-
Octo family
-
Octo payload 1 IoCs
-
Loads dropped Dex/Jar 1 TTPs 2 IoCs
Runs executable file dropped to the device during analysis.
-
Makes use of the framework's Accessibility service 4 TTPs 2 IoCs
Retrieves information displayed on the phone screen using AccessibilityService.
-
Obtains sensitive information copied to the device clipboard 2 TTPs 1 IoCs
Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.
-
Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
-
Queries the phone number (MSISDN for GSM devices) 1 TTPs
-
Acquires the wake lock 1 IoCs
-
Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs
Application may abuse the framework's foreground service to continue running in the foreground.
-
Queries the mobile country code (MCC) 1 TTPs 1 IoCs
-
Reads information about phone network operator. 1 TTPs
-
Requests accessing notifications (often used to intercept notifications before users become aware). 1 TTPs 1 IoCs
-
Requests disabling of battery optimizations (often used to enable hiding in the background). 1 TTPs 1 IoCs
-
Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs
-
Checks CPU information 2 TTPs 1 IoCs
-
Checks memory information 2 TTPs 1 IoCs
Processes
-
com.wasrule221⤵
- Loads dropped Dex/Jar
- Makes use of the framework's Accessibility service
- Obtains sensitive information copied to the device clipboard
- Acquires the wake lock
- Makes use of the framework's foreground persistence service
- Queries the mobile country code (MCC)
- Requests accessing notifications (often used to intercept notifications before users become aware).
- Requests disabling of battery optimizations (often used to enable hiding in the background).
- Uses Crypto APIs (Might try to encrypt user data)
- Checks CPU information
- Checks memory information
Network
MITRE ATT&CK Mobile v15
Defense Evasion
Download New Code at Runtime
1Foreground Persistence
1Hide Artifacts
1User Evasion
1Input Injection
1Virtualization/Sandbox Evasion
2System Checks
2Credential Access
Access Notifications
1Clipboard Data
1Input Capture
2GUI Input Capture
1Keylogging
1Discovery
Software Discovery
1Security Software Discovery
1System Information Discovery
2System Network Configuration Discovery
3Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2KB
MD571a4c70d07030b607bb957c9824828dc
SHA17d63ac1f9e1fdb19db5823f7baaca634b8ec35db
SHA2564514bf15c6e733ea29fc773b2db13eb54f82338c1e121e10fac66c20a204c1bd
SHA5125a55b5a550595ffc042a2478c898b5ce53c2d589a1ec9ecd3a03bcabf9dca05a84c6d3a80de62889289f88b6325d18041770e010f6e5816a4bfd7709f0d2eef7
-
Filesize
2KB
MD50eb8a8208d3cdcdda133f9a7cc067c11
SHA183fa9eab04cb49cc097bff09ba835e826b62a993
SHA2569f0a408ae23f4d289fee6d01769e0ad129a78ae4f37c22c5000ee0b05958326d
SHA512e1e6f1dba046284a60eb35243292aeacc78c93e3176c1f34cfda4ac9b71025d54afbeef7cedfceb896910064d2a102ee944e517d114ae034fe7c93774b619632
-
Filesize
6KB
MD58b51b47080844133ced1fe1f7ba3cccf
SHA145fb88b67edf515aa9c170a0741ca62a6e514b2e
SHA256928ad0d4d81f5fcb707c0492a619062b5fc33038614b7fc23d6cfad8561685bc
SHA51260400b390df687431831b2e128c3a24713e9b9de82cf4e46546d3d7ce4334dd45bd1744cea85c0c5a0297802f7e8e7aab92303b9abd599608c2f6851d55c6e7a
-
Filesize
418B
MD55f58a1e6d628c1ef3aa41db52a337172
SHA11c50252c0e93230ff9adc24580804db0a19aca6e
SHA256f4e3536c70798a89793e749e7000ca8bec453719073acf6ac284221c5e9099ac
SHA5125a3a1db22a2a55fd713d07b6232f4a69ce7d5af8706c215e91b7727f928b1bc29b6f97fee1a551a4ff1b94e9d4bfaee8fc58a267782dbb20bf7e6906b4024898
-
Filesize
457KB
MD5b580a346c06ae2785f2a73dfdc5d6477
SHA16772605b46b9b123a423b1517ea729283744b107
SHA256ba3b4ebb8588e957b28e98bc5051e4e0a167ab23545f91ae8a88af0176a4ecd4
SHA51213d3f2290a1472d23805411da01080ff4af5dc5f94e4503efca3eb43934dbde286fcae34c3586beaaca443ceb75044fdd6bbabb0f5bbd18877d43e9b51216186
-
Filesize
28B
MD56311c3fd15588bb5c126e6c28ff5fffe
SHA1ce81d136fce31779f4dd62e20bdaf99c91e2fc57
SHA2568b82f6032e29a2b5c96031a3630fb6173d12ff0295bc20bb21b877d08f0812d8
SHA5122975fe2e94b6a8adc9cfc1a865ad113772b54572883a537b02a16dd2d029c0f7d9cca3b154fd849bdfe978e18b396bcf9fa6e67e7c61f92bdc089a29a9c355c6
-
Filesize
214B
MD5a36db14eabbb2c1d969b649ee14ea621
SHA15ea8e7f056f37b99f6ec04eabe15e90561993ac1
SHA256b85f871b007d8116d4e577de34ac3868812dde6e6976f0c50d347dd3600d917e
SHA512802741f895354884e9753dd05bd81a9ffa076bcef5d1cf3b2e85ecef253179e03770951d6e42b344774ba3f90a4fd68df316f5a4542d9125217022db4a13be73
-
Filesize
61B
MD518c3bf70c2e712101bde050935076a6c
SHA1fe116638619ecd8564f85352d9ccafb83a753ddf
SHA2561bb5d852fe93e83c6d43c50869eafe32ed1c7aacdd8ce5ccd917581e7932f610
SHA512167b76981626cd00a9fc78d6c197d272d4de499dea497911c5728297ce051262c91e64439582a8c8bd1e252b572b5a2b3f5149d34ebc04662a9930cc88882ff3