Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
150s -
platform
android-13_x64 -
resource
android-33-x64-arm64-20240910-en -
resource tags
-
submitted
03/12/2024, 22:15
General
-
Target
57cc90364a7dd3082868555e57e85dfe348d5ade80bc9cfffd7a126175cb4d90.apk
-
Size
2.7MB
-
MD5
39a40f0a46a53a2b7cd8aba7812adaae
-
SHA1
b2931410cc59d303850b31878e02cc95ede26e65
-
SHA256
57cc90364a7dd3082868555e57e85dfe348d5ade80bc9cfffd7a126175cb4d90
-
SHA512
d2afe22afcb87a908009f5bac7eb98bf4fda37d2af734012c447018df61b01879deed7f7e5fb26d6771373e701cb9f18f2062f2c1b29b00194b2a6c84d125d63
-
SSDEEP
49152:eGd6Kjcf1ObPyI4trAm8a8KLGBHzFOTkCMmn6U9BrVT9mDl8r601sS8IQb:e4FjEI4iZaUzYH99yII
Malware Config
Extracted
octo
https://45.88.88.100:7117/gate/
https://45.88.88.100:8080/rootmd50ma/panelcgfuzwxleg9kdxnvy3rv/gate/
https://45.88.88.100:80/builderxxxzzz/gate/
-
target_apps
at.spardat.bcrmobile
at.spardat.netbanking
com.bankaustria.android.olb
com.bmo.mobile
com.cibc.android.mobi
com.rbc.mobile.android
com.scotiabank.mobile
com.td
cz.airbank.android
eu.inmite.prj.kb.mobilbank
com.bankinter.launcher
com.kutxabank.android
com.rsi
com.tecnocom.cajalaboral
es.bancopopular.nbmpopular
es.evobanco.bancamovil
es.lacaixa.mobile.android.newwapicon
com.dbs.hk.dbsmbanking
com.FubonMobileClient
com.hangseng.rbmobile
com.MobileTreeApp
com.mtel.androidbea
com.scb.breezebanking.hk
hk.com.hsbc.hsbchkmobilebanking
com.aff.otpdirekt
com.ideomobile.hapoalim
com.infrasofttech.indianBank
com.mobikwik_new
com.oxigen.oxigenwallet
jp.co.aeonbank.android.passbook
Signatures
-
Octo
Octo is a banking malware with remote access capabilities first seen in April 2022.
-
Octo family
-
Makes use of the framework's Accessibility service 4 TTPs 2 IoCs
Retrieves information displayed on the phone screen using AccessibilityService.
-
Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
-
Queries the phone number (MSISDN for GSM devices) 1 TTPs
-
Acquires the wake lock 1 IoCs
-
Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs
Application may abuse the framework's foreground service to continue running in the foreground.
-
Performs UI accessibility actions on behalf of the user 1 TTPs 6 IoCs
Application may abuse the accessibility service to prevent their removal.
-
Queries the mobile country code (MCC) 1 TTPs 1 IoCs
-
Reads information about phone network operator. 1 TTPs
-
Requests accessing notifications (often used to intercept notifications before users become aware). 1 TTPs 1 IoCs
-
Requests disabling of battery optimizations (often used to enable hiding in the background). 1 TTPs 1 IoCs
-
Requests modifying system settings. 1 IoCs
-
Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs
Processes
-
com.nameown121⤵
- Makes use of the framework's Accessibility service
- Acquires the wake lock
- Makes use of the framework's foreground persistence service
- Performs UI accessibility actions on behalf of the user
- Queries the mobile country code (MCC)
- Requests accessing notifications (often used to intercept notifications before users become aware).
- Requests disabling of battery optimizations (often used to enable hiding in the background).
- Requests modifying system settings.
- Uses Crypto APIs (Might try to encrypt user data)
Network
MITRE ATT&CK Mobile v15
Defense Evasion
Foreground Persistence
1Hide Artifacts
1User Evasion
1Impair Defenses
1Prevent Application Removal
1Input Injection
1Credential Access
Access Notifications
1Input Capture
2GUI Input Capture
1Keylogging
1Discovery
Software Discovery
1Security Software Discovery
1System Network Configuration Discovery
3Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
48B
MD5046a414913add6f5bb60072c7db819b6
SHA1451ee4f6809260aec622d772fd329c7d0297a842
SHA256b66c1320cb063a1d391c94273572ea6edae76c8c8b0a07f8d75c88686f0df72a
SHA5124e6355f3051ed5e811ab030abde1f5be7f5e1cf33be99cd08477e9b6c015deb1d8bd75a09fb9c7176b8511c5ad0a67abc0902a3531e97564ccb6afc57496a47c
-
Filesize
84B
MD53a37d3154c9915d7be44c52efde82e7f
SHA1fbf49e2fb39b21dd3a311a952a855b4cc3de1c95
SHA2565877bae1f652a2e765430bc5729b7c956ea0eacbc97df58655466beafaaecf54
SHA512d13b8e9b1d6065fa6e5842b5ae9338e8a0109edda50513eafcb52b8d71002e6cef0637da357deb06a6fb56a7d6b6ed7499fa7f5ab42726517c58f4c98f82ee76
-
Filesize
68B
MD581283972235180a34f03cbd9c183e9dd
SHA1c29d1953f3faed99f35ab98b286f33409b28306b
SHA2569aa5302cd912e1935d4ad09ccfef936fb1defefb9dd98682916bdba2231d8903
SHA51280f72ed9350942f7a8c152f419b4496571a98abe6fe0946fc7a7a17c6bb285d0c48fe5ae9bf62e64caa6f8ea85bd092370cb3c6ae0079f58d2547ab6c47c8bab
-
Filesize
214B
MD57a8c23758a4e2aed6f90cb0938770950
SHA176725a4a9a6d03ed1dbaa73a002459fada14fd43
SHA25679db9be6da4b94c074b47cf3b7ca9f1aeb3ca0ff5ae25f112486fdeba9ddb675
SHA5129797d506e97321a240ab08a7e7c6f983b495c4e670a3c1e77f5d991a3cb1cd758cf15e8dd4fc74b0ffe5a3fe2eae81c0db43d479a08e39a34609235b19a5e963
-
Filesize
54B
MD595214970feca6ce4e9d533d493d40f62
SHA12eecbb40c0147358a8a823d1f793789ff8e766dc
SHA2564408848b0b32f228498f35632071422228218e1823b8d608c429f4c30bcf1425
SHA512e482d68986f588da48238001fcb9ae40c45b1fcd20a2d966754115c2975322d1bcd1a117fcab8decbc8af630857841950f4fefd14429737814c1966a61804c53
-
Filesize
68B
MD536fd9e47bf219fb767b0978225df8369
SHA17f774ff8eb981581367e0610a0776721d9b79f29
SHA25614cf111bb0730a49929239a615e188bf5a87c4e9ab1ae1e9e468da29823c7e88
SHA51248904dbd4b332060e788258d7043cfdd81ef9a0a313fcaa78265d226be0908cca556f81a6623245a39b0ab6f937ab959faf69daccd15ddb7e2b5b48ff55f0109
-
Filesize
60B
MD524639a39865b23e5e26e690f044d323f
SHA16e7c35344cd5e2dd3fdb47a06be9e7ba844f7e89
SHA2566d047abac392754b97dc646299b2d026f18ff666f894caf9304742937a8093e6
SHA51221e3791ac5fda1493d4708c9fc033c3a32c566f2578b4f71a45f745a0864417984935be5a86be7c32afc39e67e213a3af080dbe43376b980240bbf37ecdbc430
-
Filesize
490B
MD5b2d95cc7ea5d1de99d26c3eb82cccf6f
SHA187840a992df2333bdf0491a66b5149b748990841
SHA256390599c9a7ea2dd7add574f560280f6a7ec1bfa8ab3e8329b8f7e5e8838fd3d4
SHA512e8ebe9dd94a356b1ca3b7a38614d2ecc0af41402095b3d08cfe17f7c05109bfdd4deba58c9b4114c2f2ef906091d144c4eb399f17011ffcb9d19f4e30568ed4c
-
Filesize
60B
MD5005a1444fbc0231b7d3088a14f3aceaf
SHA12859723fea9518123f0b7be0467d31fabe342a62
SHA2566f73dd7f5dcfc15260e2487857f80cc39b25a352c9bca6dde5a8b5f858960476
SHA512d65f0f64376f5348792ce3d6d4d91d33c293114d22425d51bdbee71bdcabb75281d1f5ec1378283f11813b8b75651f7f626d5879fea6799792d7416640ed8dc4
-
Filesize
52B
MD53abb44168e33f1e79eee42bedcc6acd7
SHA1cec038065517cf43332e37c62b5125b692a47c1e
SHA2562045d83bd4324988a262c9eb5769bfbcc54a0faa8529938c9ae128162e7d1bf1
SHA51287d287d53c362430227906afe360718a5fd1bed3a4202df0b33edf75965aa273dac1baaafff8edc09a2f94ac13dc1b4394e8b51977a29a50b603d9d69cee2f44
-
Filesize
66B
MD5f863d28ad20fb77aae5d01babeadc77e
SHA1c10b4bcfddec47962117f100e32fb873e0b3471f
SHA256a9f9c45a0ec28a8dbd54cf7b7695384a71abb700536c7d5e055216e4ad02f67c
SHA512a953f222d844e5f9674f646d67b1769f73a1b4176e3ca242f41721efb3a4d4f4cfbb373071e798bccd023b1615408d1de783f1dd6c9210c018e57e8c3b3c1c06