Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    149s
  • max time network
    151s
  • platform
    android-10_x64
  • resource
    android-x64-20240910-en
  • resource tags

    arch:x64arch:x86image:android-x64-20240910-enlocale:en-usos:android-10-x64system
  • submitted
    06/12/2024, 22:02

General

  • Target

    3bc86b6a99d7fbfb975cccfb3fc7074e81f5bd53db646219eda2ce6a4adcf79d.apk

  • Size

    2.4MB

  • MD5

    c40387afd5102d46301a6550cfed5d1f

  • SHA1

    47f7039d472605312d8cea4557701f95e30395c3

  • SHA256

    3bc86b6a99d7fbfb975cccfb3fc7074e81f5bd53db646219eda2ce6a4adcf79d

  • SHA512

    6d7f26e5cdfdc4fe89b3defdd45a2ed71777d2501d3054fe31399120f5f8467da82068e0c27376ad7e1ccc5935d1063dd9bf0d4fc57fce2a8d2e97acf88444d1

  • SSDEEP

    49152:VVpZjxFISjhJaJJYLWoQafZsunGgL7VmT0rTMjMexitX3xHUuy:VxjIJgWo3fZs6G87CmT1eGxHby

Malware Config

Extracted

Family

octo

C2

https://567237453981d0595033c23.com/MjNkNTlkYzBhZjNk/

https://4453981d0595033c23.com/MjNkNTlkYzBhZjNk/

https://554237453981d0595033c23.com/MjNkNTlkYzBhZjNk/

https://77233467453981d0595033c23.com/MjNkNTlkYzBhZjNk/

https://5672346981d0595033c23.com/MjNkNTlkYzBhZjNk/

https://56723747455033c23.com/MjNkNTlkYzBhZjNk/

https://7237453981d0595033c23.com/MjNkNTlkYzBhZjNk/

https://9237453981d0595033c23.com/MjNkNTlkYzBhZjNk/

https://8237453981d0595033c23.com/MjNkNTlkYzBhZjNk/

rc4.plain

Extracted

Family

octo

C2

https://567237453981d0595033c23.com/MjNkNTlkYzBhZjNk/

https://4453981d0595033c23.com/MjNkNTlkYzBhZjNk/

https://554237453981d0595033c23.com/MjNkNTlkYzBhZjNk/

https://77233467453981d0595033c23.com/MjNkNTlkYzBhZjNk/

https://5672346981d0595033c23.com/MjNkNTlkYzBhZjNk/

https://56723747455033c23.com/MjNkNTlkYzBhZjNk/

https://7237453981d0595033c23.com/MjNkNTlkYzBhZjNk/

https://9237453981d0595033c23.com/MjNkNTlkYzBhZjNk/

https://8237453981d0595033c23.com/MjNkNTlkYzBhZjNk/

Attributes
  • target_apps

    at.spardat.bcrmobile

    com.google.android.apps.messaging

    com.samsung.android.messaging

    at.spardat.netbanking

    com.bankaustria.android.olb

    com.bmo.mobile

    com.cibc.android.mobi

    com.rbc.mobile.android

    com.scotiabank.mobile

    com.td

    cz.airbank.android

    eu.inmite.prj.kb.mobilbank

    com.bankinter.launcher

    com.kutxabank.android

    com.rsi

    com.tecnocom.cajalaboral

    es.bancopopular.nbmpopular

    es.evobanco.bancamovil

    es.lacaixa.mobile.android.newwapicon

    com.dbs.hk.dbsmbanking

    com.FubonMobileClient

    com.hangseng.rbmobile

    com.MobileTreeApp

    com.mtel.androidbea

    com.scb.breezebanking.hk

    hk.com.hsbc.hsbchkmobilebanking

    com.aff.otpdirekt

    com.ideomobile.hapoalim

    com.infrasofttech.indianBank

    com.mobikwik_new

AES_key

Signatures

  • Octo

    Octo is a banking malware with remote access capabilities first seen in April 2022.

  • Octo family
  • Octo payload 1 IoCs
  • Loads dropped Dex/Jar 1 TTPs 2 IoCs

    Runs executable file dropped to the device during analysis.

  • Makes use of the framework's Accessibility service 4 TTPs 2 IoCs

    Retrieves information displayed on the phone screen using AccessibilityService.

  • Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
  • Queries the phone number (MSISDN for GSM devices) 1 TTPs
  • Acquires the wake lock 1 IoCs
  • Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs

    Application may abuse the framework's foreground service to continue running in the foreground.

  • Performs UI accessibility actions on behalf of the user 1 TTPs 4 IoCs

    Application may abuse the accessibility service to prevent their removal.

  • Queries the mobile country code (MCC) 1 TTPs 1 IoCs
  • Reads information about phone network operator. 1 TTPs
  • Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs
  • Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs

Processes

  • com.neverturnqpgq
    1⤵
    • Loads dropped Dex/Jar
    • Makes use of the framework's Accessibility service
    • Acquires the wake lock
    • Makes use of the framework's foreground persistence service
    • Performs UI accessibility actions on behalf of the user
    • Queries the mobile country code (MCC)
    • Registers a broadcast receiver at runtime (usually for listening for system events)
    • Uses Crypto APIs (Might try to encrypt user data)
    PID:5160

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • /data/data/com.neverturnqpgq/.qcom.neverturnqpgq

    Filesize

    48B

    MD5

    046a414913add6f5bb60072c7db819b6

    SHA1

    451ee4f6809260aec622d772fd329c7d0297a842

    SHA256

    b66c1320cb063a1d391c94273572ea6edae76c8c8b0a07f8d75c88686f0df72a

    SHA512

    4e6355f3051ed5e811ab030abde1f5be7f5e1cf33be99cd08477e9b6c015deb1d8bd75a09fb9c7176b8511c5ad0a67abc0902a3531e97564ccb6afc57496a47c

  • /data/data/com.neverturnqpgq/cache/byslrjptjenu

    Filesize

    2.3MB

    MD5

    17820987d007505452364ab8cbf722ad

    SHA1

    3cab5b92f4a5f5f2b4f72a28ca9187c4893d9cfe

    SHA256

    d70f13661cbaa7c8324d16509aa2a27629ac556dd67a3e6c83af86feee651296

    SHA512

    10d4009f0945c037014295c1d1e05278903caa09e5cd934229e3ff53df467bd95c79e10a7f7047ae7f7395d4151ebf7582327ebd253bc0ae7e0c5f2affd8888d

  • /data/data/com.neverturnqpgq/cache/oat/byslrjptjenu.cur.prof

    Filesize

    509B

    MD5

    13bcc8d89eedbf8c77a27dec34e197d7

    SHA1

    2816cd1a3549605acc63d66b785317262dfc553f

    SHA256

    4cd4069775da7a1f3a809ca27428a719eed558dbe02089e76105814f27ddec54

    SHA512

    ac019a408b47381e2e3e0c9c61c54695c5562b7e874e60c9b2664c6e79c5118c29ed0767065b858e30f37726a626a98e82b7a633a781ec97aaf71580099a3308

  • /data/data/com.neverturnqpgq/kl.txt

    Filesize

    237B

    MD5

    430b11fba314be7c9b985e91689bc3ab

    SHA1

    16982514a0da594c0b7328cd9ba534e70cea5396

    SHA256

    35af0c50d6d1fcc4fc5586610bf9bfb13316f9a34ab939d186127e9480faeacd

    SHA512

    5752f4af993b80af316351104f126feab3e15f22fa30c215def50f38bd569bbd1706bd3cf4e10a8ebaa3419acb70cc94b9edb4e26047bfd8919456154956b9a9

  • /data/data/com.neverturnqpgq/kl.txt

    Filesize

    54B

    MD5

    c2f23126604cf86f3fd5659ace2dff68

    SHA1

    347894a5e78bda51b8ee3cbd89f261a523315c30

    SHA256

    b2c990160f6106eb65493e52da91b1ac2b98c52eee29ea2b8a8738eb72061742

    SHA512

    e61890ed4a45f2234560818665947421efc95e0369aaad91229147fe22f07e47d47748e74c6450ffb167facb0770c4afc4d81fd9383dbd47790f36210facff1f

  • /data/data/com.neverturnqpgq/kl.txt

    Filesize

    63B

    MD5

    5bca2ac2435710fa40a7b3c378da0dd9

    SHA1

    4048cfbebcae22b7be85c04fc415fc63ba213c23

    SHA256

    0dc7c4f0353f890e956116f5684d3c2260822643ea1572e1efdfe6eef045c664

    SHA512

    284c63e83e6a4d06071a9e5825a0c9d132ac0cc34530ded34d3b26c6fc9deaee66804127c33d30f3515632fd2f8c46548e3d738718b2617e380ce98f108e25fd

  • /data/data/com.neverturnqpgq/kl.txt

    Filesize

    45B

    MD5

    8fc5bb59f8f8127ac9adc9aa496866ba

    SHA1

    ef0f1ee91af288b12bbc885d3243222af7cfa249

    SHA256

    af6e5e4269a3c122bd8e526b6e4cd755e1f647988d4a71dc3554e10d9a4f9e51

    SHA512

    09b8a564d34f4c3a0a79e06924c4cde6e0455807bca4ebdba514c9ca0ae12eceb5b885ce93114266a9b61d9b0e25c473eca8b0d2dd79e539c88b821bd29df7f5

  • /data/data/com.neverturnqpgq/kl.txt

    Filesize

    437B

    MD5

    4b16452ce35547bc6084ae0b2a0dc6bb

    SHA1

    09f1792ff95d0d0fd50a511e396c45aff01e5945

    SHA256

    64a1000fa661f5c5783929b9181c1e28294c7560f843968e8494431fb4f19986

    SHA512

    7f06800d01c1d3387d3fd92149571406f93513d4569eb043b8cd256c64eb18b16ba6ae953c16d1bfde021324890051a26c6eb4e35d2f4724065ca551bdfe0c84