Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
148s -
max time network
151s -
platform
android-11_x64 -
resource
android-x64-arm64-20240910-en -
resource tags
-
submitted
05/12/2024, 22:10
General
-
Target
e2fb77cf96f882a1ceaeb23275419a583fe9fdb575dc18ddad872061e4f1c774.apk
-
Size
2.7MB
-
MD5
d093780e730cad5ac45290ed1c237583
-
SHA1
11d5b928b99e5063f6e1d6fc6f7814be6e41edf2
-
SHA256
e2fb77cf96f882a1ceaeb23275419a583fe9fdb575dc18ddad872061e4f1c774
-
SHA512
85bf79eb582f64927a8a22f31f00b4751f5941010fba0e9e0345345a2a9fca9c99e0065f42d1331def1d9beb6e399b3a2f8e79f0e773094f87bc479ed902512e
-
SSDEEP
49152:ZYoQrw6Kjcf1ObPyI4trAm8a8KLGBHzFOTkCMmn6U9BrVT9mDl8r601sS8IQNt:6oQrwFjEI4iZaUzYH99yIk
Malware Config
Extracted
octo
https://93.123.109.166:7117/gate/
https://93.123.109.166:8080/rootmd50ma/panelcgfuzwxleg9kdxnvy3rv/gate/
https://93.123.109.166:80/builderxxxzzz/gate/
https://alicetvyineyayinde.xyz/gate/
-
target_apps
at.spardat.bcrmobile
at.spardat.netbanking
com.bankaustria.android.olb
com.bmo.mobile
com.cibc.android.mobi
com.rbc.mobile.android
com.scotiabank.mobile
com.td
cz.airbank.android
eu.inmite.prj.kb.mobilbank
com.bankinter.launcher
com.kutxabank.android
com.rsi
com.tecnocom.cajalaboral
es.bancopopular.nbmpopular
es.evobanco.bancamovil
es.lacaixa.mobile.android.newwapicon
com.dbs.hk.dbsmbanking
com.FubonMobileClient
com.hangseng.rbmobile
com.MobileTreeApp
com.mtel.androidbea
com.scb.breezebanking.hk
hk.com.hsbc.hsbchkmobilebanking
com.aff.otpdirekt
com.ideomobile.hapoalim
com.infrasofttech.indianBank
com.mobikwik_new
com.oxigen.oxigenwallet
jp.co.aeonbank.android.passbook
Signatures
-
Octo
Octo is a banking malware with remote access capabilities first seen in April 2022.
-
Octo family
-
Makes use of the framework's Accessibility service 4 TTPs 2 IoCs
Retrieves information displayed on the phone screen using AccessibilityService.
-
Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
-
Queries the phone number (MSISDN for GSM devices) 1 TTPs
-
Acquires the wake lock 1 IoCs
-
Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs
Application may abuse the framework's foreground service to continue running in the foreground.
-
Performs UI accessibility actions on behalf of the user 1 TTPs 5 IoCs
Application may abuse the accessibility service to prevent their removal.
-
Queries the mobile country code (MCC) 1 TTPs 1 IoCs
-
Reads information about phone network operator. 1 TTPs
-
Requests accessing notifications (often used to intercept notifications before users become aware). 1 TTPs 1 IoCs
-
Requests disabling of battery optimizations (often used to enable hiding in the background). 1 TTPs 1 IoCs
-
Requests modifying system settings. 1 IoCs
-
Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs
Processes
-
com.nameown121⤵
- Makes use of the framework's Accessibility service
- Acquires the wake lock
- Makes use of the framework's foreground persistence service
- Performs UI accessibility actions on behalf of the user
- Queries the mobile country code (MCC)
- Requests accessing notifications (often used to intercept notifications before users become aware).
- Requests disabling of battery optimizations (often used to enable hiding in the background).
- Requests modifying system settings.
- Uses Crypto APIs (Might try to encrypt user data)
Network
MITRE ATT&CK Mobile v15
Defense Evasion
Foreground Persistence
1Hide Artifacts
1User Evasion
1Impair Defenses
1Prevent Application Removal
1Input Injection
1Credential Access
Access Notifications
1Input Capture
2GUI Input Capture
1Keylogging
1Discovery
Software Discovery
1Security Software Discovery
1System Network Configuration Discovery
3Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
48B
MD5046a414913add6f5bb60072c7db819b6
SHA1451ee4f6809260aec622d772fd329c7d0297a842
SHA256b66c1320cb063a1d391c94273572ea6edae76c8c8b0a07f8d75c88686f0df72a
SHA5124e6355f3051ed5e811ab030abde1f5be7f5e1cf33be99cd08477e9b6c015deb1d8bd75a09fb9c7176b8511c5ad0a67abc0902a3531e97564ccb6afc57496a47c
-
Filesize
84B
MD57ddff8f42477fc7cf0b9eb5af3199f04
SHA1ca2f9d4072581aa936f0f1376dff09e453fe7c5f
SHA2562b85f2edb933f3f2aa8135ca96cbb50303a3ca4df9519edf4bb9d694eb564551
SHA512b798ea09a33e765a1af7019fa6170e6d72797998c813cafc6a0e83427f6001f820f2010bcd9d64373d0bf2f32b03f0287f42a75eccd826bbb6624ab650a3af2a
-
Filesize
68B
MD5f042971ebb63dcb5b7b40cd348a25018
SHA1eff730bc23066ed7f571a194efc36811b095d5f3
SHA2569ae9b2176c11311957c29a06daf01bf97fca4701493fa0bbd2c6d37d094a6775
SHA512adbe6ef9ab6a67d6231f9e3aeb2ac7de3a018faa9dfcf100cc18e4c1db0e9b8660210cbce2cc7f6282dcfe1a8cb2db6a3d417799587145789afad041ebec3c16
-
Filesize
230B
MD5abc91561979117cb080fe78d3e08f5a1
SHA194e24776ce28c37d1a4a2268ce8de383409d9aba
SHA2569b4f71186ca23a2a5ccf5179822591f6fb3dc564712288160429643ad30085d6
SHA5121cc82f85c590e9217e12ece229c04e715022d094a71913c80dbb75d3bb41693c784d1e98dcec825a0bc595edce5579484c81b20f013e22f36ed0acc1de022d52
-
Filesize
54B
MD536ae1b60bc82d935597c787e460fac2b
SHA11368dae75bef2c30b0c9a1f23d5f99d929a0f62f
SHA256b0287c3a1c40cd7242a0cd6a677a06abf285a65a6c427bfd41e665bd5a3d19e1
SHA51260b35f2b324c0034f00763d2f69c4f2c68f8563cff0993b33ca0bb82de6eca83a8885aa5efca63c4c4cc83fa0062e0d24f7c04dc814ca7bba699b38b46e9e124
-
Filesize
63B
MD5bfb39b6d6646eb273cc3e60f885fc454
SHA101cef8ba8e37a573b8105acee0ab71e4afde0dea
SHA256063bd613016984dfeeeca84b2854bdf6509b1f6da70fc65960f87354a6164caa
SHA5121a137cb391cdfef3fe7bec5c4a281e8c42388ee242d80bc93a71a2361876e6374b7ae1d05c5ae01816fbff1f82ed0665bae3f9081d2f838ce4ff228f0d4e0907
-
Filesize
45B
MD59fcb726b3ed95b9ef496b11db8b5b7e6
SHA1c74a9606804c476dea978b9316d31a41a9dc8395
SHA2567bc620983fa1fdd3666a3378fa63e47c49d37dc6158127b91f434eff77feda6a
SHA512b47950daa720d5c0708c43cdf0443a4891c6a7f3dd9b9ed42d4051d5267d1ff9514d5a9e7ba89b906ba5afa05eeb89e184c5c6aa2a222cc2d43ea7b5878964ef
-
Filesize
466B
MD5314378ab1ffbba8cd8210fc50bdfa8c2
SHA18e3c0f4c5c224dacaa204228d14f7b8661d91a0b
SHA256d7e5f7bee780e33d02ff5dcccbfa5d36690490245864184f9caf189f11c09556
SHA512f4bf4c2592f2c584cc5c22945fbcaa2f067ce9dff3fbdbd85a33ec1e0c98c1adfba0f73ddc8e849ca37135ec2d1178edb4618f78ffbb34879c2f52d13c850cf7
-
Filesize
45B
MD5e00cf3b95e5d4f017b958566d189306d
SHA1f51eb91e3991e3d142b98b4f54cde665eda4dc66
SHA25645e0bce8e23615d38ab91056e82b92e431b528788a6442eeec4303aa6d4b97d3
SHA512d77d87577e37412ac865dec459f8c978a59476fdd4170d1b18441a844beba30f44b65a83644a459670c130a007952aec1e9a023adac976d63cb877840453e131
-
Filesize
66B
MD5a0adcbceabe7e2673e77c5ef0f3bb372
SHA148f444a13d1d599006d17c569123e668c58a6071
SHA256c5e5d92ac563a86a16354c1a6b7bb4c76762abbd53832b9f55cd6e098002f7a4
SHA51252ab104c0c81c6ff691e57c83a3c1eebbc94f0f6cfd2a007a2ee09688ae46cc26d5d099e37ddc0d73476b57006bae331db48140ce966d1eb59eeb09d01f87d85
-
Filesize
45B
MD5879b44500d3402c27c29c5f57cc4f40d
SHA113155478ca015edb9cdb1357b87893d8b8ed31f9
SHA256fd2c9f63b87c16873a674f2a069177df93f9a7290f1f71af96c9e589aeb582b4
SHA5125515e1acbee2d3fbe28201b8c591314f0ec0bdbf3dffdd927e63d28572c5a2f9e87fdcc3de6ef7ef32657b59ce552ee8c757f33311efe7c66615c980a11b866b