Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    149s
  • max time network
    162s
  • platform
    android-13_x64
  • resource
    android-33-x64-arm64-20240910-en
  • resource tags

    arch:arm64arch:x64arch:x86image:android-33-x64-arm64-20240910-enlocale:en-usos:android-13-x64system
  • submitted
    13/12/2024, 22:00

General

  • Target

    b4231a8d019d27e3bfe4ac19561bc364b945fcef67646996cab6f8d02cf4bc1b.apk

  • Size

    1.5MB

  • MD5

    4abb55e75213562b89740a83613b8a86

  • SHA1

    41508a08882aef68cad9971a702280eef2a82a9f

  • SHA256

    b4231a8d019d27e3bfe4ac19561bc364b945fcef67646996cab6f8d02cf4bc1b

  • SHA512

    4d1174d2e717e0f7a140718fce9a2579cf3615c7a2774470d2fa628b5ada99aee9121d73427b572721b00f31e481c70d755fecda4e30d92e6b1bda6176dae262

  • SSDEEP

    49152:mieyXMqj+H7HPsSH9jCB3lulrWzyB+i3nOkGtoOiM:GyXl+H7ESH9WBskzyBP+k9OJ

Malware Config

Extracted

Family

octo

C2

https://hayatvesanatguzellikduygusu.xyz/YmJlYTFiODdkMjcz/

https://mutlulukvesessizlikyolculugu.xyz/YmJlYTFiODdkMjcz/

https://yasamvesahtekarguzellik.xyz/YmJlYTFiODdkMjcz/

https://sevincligunlertatminkar.xyz/YmJlYTFiODdkMjcz/

https://dogaltatvesanatyaklasimi.xyz/YmJlYTFiODdkMjcz/

https://hayatlarinhuzurvesessiz.xyz/YmJlYTFiODdkMjcz/

https://keyifligunlerinfirsatlari.xyz/YmJlYTFiODdkMjcz/

https://sevgiiledoluyasamyolu.xyz/YmJlYTFiODdkMjcz/

https://sakinlikvehayatderinligi.xyz/YmJlYTFiODdkMjcz/

https://sanatvesanatcihayatlari.xyz/YmJlYTFiODdkMjcz/

https://ilhamdolubirhayat.xyz/YmJlYTFiODdkMjcz/

https://zenginlikvebasarihikayesi.xyz/YmJlYTFiODdkMjcz/

https://kalpvesanatdostlukhikaye.xyz/YmJlYTFiODdkMjcz/

https://mutlugunlerinyasamayolu.xyz/YmJlYTFiODdkMjcz/

https://yasananhayatinduygular.xyz/YmJlYTFiODdkMjcz/

https://dogaylaisbirligiyolu.xyz/YmJlYTFiODdkMjcz/

https://hosgoruhayatvekultur.xyz/YmJlYTFiODdkMjcz/

https://hayalguclesanatbaglantisi.xyz/YmJlYTFiODdkMjcz/

https://sadelikvehayatfelsefesi.xyz/YmJlYTFiODdkMjcz/

https://dogaldostlukvesanat.xyz/YmJlYTFiODdkMjcz/

rc4.plain

Extracted

Family

octo

C2

https://hayatvesanatguzellikduygusu.xyz/YmJlYTFiODdkMjcz/

https://mutlulukvesessizlikyolculugu.xyz/YmJlYTFiODdkMjcz/

https://yasamvesahtekarguzellik.xyz/YmJlYTFiODdkMjcz/

https://sevincligunlertatminkar.xyz/YmJlYTFiODdkMjcz/

https://dogaltatvesanatyaklasimi.xyz/YmJlYTFiODdkMjcz/

https://hayatlarinhuzurvesessiz.xyz/YmJlYTFiODdkMjcz/

https://keyifligunlerinfirsatlari.xyz/YmJlYTFiODdkMjcz/

https://sevgiiledoluyasamyolu.xyz/YmJlYTFiODdkMjcz/

https://sakinlikvehayatderinligi.xyz/YmJlYTFiODdkMjcz/

https://sanatvesanatcihayatlari.xyz/YmJlYTFiODdkMjcz/

https://ilhamdolubirhayat.xyz/YmJlYTFiODdkMjcz/

https://zenginlikvebasarihikayesi.xyz/YmJlYTFiODdkMjcz/

https://kalpvesanatdostlukhikaye.xyz/YmJlYTFiODdkMjcz/

https://mutlugunlerinyasamayolu.xyz/YmJlYTFiODdkMjcz/

https://yasananhayatinduygular.xyz/YmJlYTFiODdkMjcz/

https://dogaylaisbirligiyolu.xyz/YmJlYTFiODdkMjcz/

https://hosgoruhayatvekultur.xyz/YmJlYTFiODdkMjcz/

https://hayalguclesanatbaglantisi.xyz/YmJlYTFiODdkMjcz/

https://sadelikvehayatfelsefesi.xyz/YmJlYTFiODdkMjcz/

https://dogaldostlukvesanat.xyz/YmJlYTFiODdkMjcz/

Attributes
  • target_apps

    at.spardat.bcrmobile

    at.spardat.netbanking

    com.bankaustria.android.olb

    com.bmo.mobile

    com.cibc.android.mobi

    com.rbc.mobile.android

    com.scotiabank.mobile

    com.td

    cz.airbank.android

    eu.inmite.prj.kb.mobilbank

    com.bankinter.launcher

    com.kutxabank.android

    com.rsi

    com.tecnocom.cajalaboral

    es.bancopopular.nbmpopular

    es.evobanco.bancamovil

    es.lacaixa.mobile.android.newwapicon

    com.dbs.hk.dbsmbanking

    com.FubonMobileClient

    com.hangseng.rbmobile

    com.MobileTreeApp

    com.mtel.androidbea

    com.scb.breezebanking.hk

    hk.com.hsbc.hsbchkmobilebanking

    com.aff.otpdirekt

    com.ideomobile.hapoalim

    com.infrasofttech.indianBank

    com.mobikwik_new

    com.oxigen.oxigenwallet

    jp.co.aeonbank.android.passbook

AES_key

Signatures

  • Octo

    Octo is a banking malware with remote access capabilities first seen in April 2022.

  • Octo family
  • Octo payload 1 IoCs
  • Loads dropped Dex/Jar 1 TTPs 1 IoCs

    Runs executable file dropped to the device during analysis.

  • Makes use of the framework's Accessibility service 4 TTPs 2 IoCs

    Retrieves information displayed on the phone screen using AccessibilityService.

  • Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
  • Queries the phone number (MSISDN for GSM devices) 1 TTPs
  • Acquires the wake lock 1 IoCs
  • Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs

    Application may abuse the framework's foreground service to continue running in the foreground.

  • Performs UI accessibility actions on behalf of the user 1 TTPs 3 IoCs

    Application may abuse the accessibility service to prevent their removal.

  • Queries the mobile country code (MCC) 1 TTPs 1 IoCs
  • Reads information about phone network operator. 1 TTPs
  • Requests accessing notifications (often used to intercept notifications before users become aware). 1 TTPs 1 IoCs
  • Requests disabling of battery optimizations (often used to enable hiding in the background). 1 TTPs 1 IoCs
  • Requests modifying system settings. 1 IoCs
  • Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs

Processes

  • com.kiwi.style
    1⤵
    • Loads dropped Dex/Jar
    • Makes use of the framework's Accessibility service
    • Acquires the wake lock
    • Makes use of the framework's foreground persistence service
    • Performs UI accessibility actions on behalf of the user
    • Queries the mobile country code (MCC)
    • Requests accessing notifications (often used to intercept notifications before users become aware).
    • Requests disabling of battery optimizations (often used to enable hiding in the background).
    • Requests modifying system settings.
    • Uses Crypto APIs (Might try to encrypt user data)
    PID:4517

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • /data/data/com.kiwi.style/.qcom.kiwi.style

    Filesize

    48B

    MD5

    046a414913add6f5bb60072c7db819b6

    SHA1

    451ee4f6809260aec622d772fd329c7d0297a842

    SHA256

    b66c1320cb063a1d391c94273572ea6edae76c8c8b0a07f8d75c88686f0df72a

    SHA512

    4e6355f3051ed5e811ab030abde1f5be7f5e1cf33be99cd08477e9b6c015deb1d8bd75a09fb9c7176b8511c5ad0a67abc0902a3531e97564ccb6afc57496a47c

  • /data/data/com.kiwi.style/.qcom.kiwi.style

    Filesize

    89B

    MD5

    b07eda510bba984ca734e36008229f3a

    SHA1

    5c15d801b2d17463a0a8f227caebbde2c32a631f

    SHA256

    a5632f182d59a6fc6f3a2b17679e672d033fcb65bcb5716aaeea9556a9bb58b0

    SHA512

    4a857b3a37f1adbd80ff41a378d92680b8920919c77053b6f0be5c758f0a703abbb7fac2554c5fad41deaa222a59f8a4d1284f8482a6c73733179d29891c3864

  • /data/data/com.kiwi.style/.qcom.kiwi.style

    Filesize

    130B

    MD5

    12846f0d22f7bfd709ba6649e498cd0f

    SHA1

    5a59a06e7edb0c57b66231b89339bbdbf862812c

    SHA256

    480e22abeeb4e2c3fb5ac94bcd4af9223d46eaf9d6d7622542b692c743210d02

    SHA512

    5171671e4339a11a798d9cec3dff3e2957985116febc46126d9134862a22fa089089e6e533db53f67ee69e8ef74a587cd0469e36c21ce0f0da2297f149579c32

  • /data/data/com.kiwi.style/.qcom.kiwi.style

    Filesize

    171B

    MD5

    37aa21ce04d03a4ba72027a0ddd5fbbc

    SHA1

    1e3f9cdccf94951843951f2cda222c6170cbea51

    SHA256

    b0250ae8c4d06580ddefa6d374ae2457e9a9eca9642a0e1bbd48a2d9c5a459c0

    SHA512

    cc8883ed57f16e4d1e77cf74cbaf7dd14fa05034b0f0f49e4c1f341de6aea88415bca8cc798a417d7ad69a009c2769e7209e6738d411e4c77420f5a6e2fe89c6

  • /data/data/com.kiwi.style/app_embody/Ejqkl.json

    Filesize

    153KB

    MD5

    294436af0b71173f530d8cb8b34961aa

    SHA1

    5fb1d1404efbfd6dd7ed1ff83cfbfe69ab73df1a

    SHA256

    024fe4978f709eb225e3bfe5e799c52c4e04fa7ddbae2c95713978353d11e87a

    SHA512

    2201f19835473d710c7c71f474531301257eefc5b152a0772089e3cad6ea9803d3506dace850b68866804cf009ea710b049785e428516d39ebf8166544c2f57f

  • /data/data/com.kiwi.style/app_embody/Ejqkl.json

    Filesize

    153KB

    MD5

    3f6638abca8b4ed573217f7b4c248b88

    SHA1

    32b3aa65b4679142a32da9779f2b39b66a459ba2

    SHA256

    7c91b9781ed920ad0eec2dfb9ce655011561a28b147631812124f31e773ba68b

    SHA512

    c36b985c86ff4c19a1766654417973655e21bbd89f536a940490f49317579ccf0944a205dcf40b952a55d9fc372fb9eccdfbd13217bc64172f0099e293219434

  • /data/data/com.kiwi.style/kl.txt

    Filesize

    70B

    MD5

    05e2b120c9ef8ee11cc92efcd2dfdca0

    SHA1

    2baa25a034ec6e87c9f89834dba93d6c31d1658b

    SHA256

    5719bad2eeeea7fcdf9006a93929b71644418411b7008b80ad5289078f652c57

    SHA512

    da9fac05a47f44a391267b320c7ab3be86115167cab9f79975f8f3af84d5c60172710e32b6c63ed3c5c156f6c52b97136cce13a93c44de2a5ca9b28fb8589ce3

  • /data/data/com.kiwi.style/kl.txt

    Filesize

    55B

    MD5

    7f3ebd50e3d47aafe191d86f4f7b8d79

    SHA1

    8c7143049e4fb709bfdfd45d4a97a8b1a4c71e3a

    SHA256

    90d926a9ce010235d1451cab151b52752c8ec9b18a75996ca60eb447cf8e9243

    SHA512

    eee07da7380191a6d85eb5939d04358b8acf7f4e3bab591853788ad05bde453e9004caad1d1a59328a67b613c26cbde14b0da98302fe3a70d534dac60a9a13aa

  • /data/data/com.kiwi.style/kl.txt

    Filesize

    490B

    MD5

    f049738c5a555e24797df4971aacb6ea

    SHA1

    f056f28dec5efebcf772b99b4330240e28b48038

    SHA256

    5064b6fcad440e84370b9740541d274199fb919cbf2ff8490ec1a29e34427a9e

    SHA512

    c6994accadce088f6492c09e9e5417c2a4c19cdba0cc667a69e251bdb538570d32ec3495539e8338a5d4792a360f08aca4c354e4c92438b0068a5eba34af0dfa

  • /data/data/com.kiwi.style/kl.txt

    Filesize

    214B

    MD5

    6df7a2bbaa4b2adda63d28da38d2d9f5

    SHA1

    7c948cc5697c35c9ad88537ae9f1529f41962288

    SHA256

    21cce683a5c07fb60a22da67af78e1c2a3a26ff07170ed8a33bb478b9cae6ec7

    SHA512

    c98ca50ee5da38091aaae48e67c8ef62d95fc2ac7d6eed1204b197ba604ba67b088808942673ec95ffc220c9834744c5b4f0c28702d6324901f7e7db6d8e04f8

  • /data/data/com.kiwi.style/kl.txt

    Filesize

    52B

    MD5

    cdd212780279ed79adb707516affd5cf

    SHA1

    b30482dc13f4e40d53c385d0263a7f03e2ae18c3

    SHA256

    f06d8ccaf342892a25137f819ab4000a5dcd767357a6a1f35baaed71c0800838

    SHA512

    b79ff87a7a4006e661be677f6857842f74483642d6e56935a5a81c4b2ccaecb5eeec14f911c66cf104935db68d2344243fd63142fd5e7b94bcaa8b871b2aada0

  • /data/user/0/com.kiwi.style/app_embody/Ejqkl.json

    Filesize

    450KB

    MD5

    35bfdd8b5b2c828a289f02b79362b784

    SHA1

    a84e529d5af4dc30486a1f4f0acbee881ad2bf17

    SHA256

    8fe9db1a220592745f39a84fe3981847e938e03bd95ee330123ca3af433f5881

    SHA512

    573fbee7b38a92b56003862b9341b5268ee768d2fc7675f53974b77ed4b3f5a6676e77b4049e9b1e2f12163b09abe3a672f9638dc472bd28a06bbc84240f1286