Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

10

Static

static

6

829bae1856...65.apk

android-9-x86

10

829bae1856...65.apk

android-13-x64

10

Analysis

  • max time kernel
    149s
  • max time network
    152s
  • platform
    android-13_x64
  • resource
    android-33-x64-arm64-20240910-en
  • resource tags

    arch:arm64arch:x64arch:x86image:android-33-x64-arm64-20240910-enlocale:en-usos:android-13-x64system
  • submitted
    15/12/2024, 22:07

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    829bae1856b03eab39dc175ac48acdc8e0206275cd0e94e620624fd7da7a2665.apk

  • Size

    545KB

  • MD5

    0b0d8e65d06ccdac8527541e557ce867

  • SHA1

    d4441bdfc7f447ce04d67aa63c3974ecbe6b7607

  • SHA256

    829bae1856b03eab39dc175ac48acdc8e0206275cd0e94e620624fd7da7a2665

  • SHA512

    b490cd59cfa999a66cb1be6a29c324882c3990cf71e01d5970e8718292e0afbd79022bef88bdc2956cf8c5f2254d9d18248bd2788a132ff6e6af014bc389d98e

  • SSDEEP

    12288:jpqzW0H5JsZDrg/RsyKlcr+lwDlWo2tyraBuEILMzEkHoOn:j8zXZgDgxKVlIl84r4pzFfn

Score
10/10
octobankercollectioncredential_accessdiscoveryevasionimpactinfostealerpersistencerattrojan

Malware Config

Extracted

Family

octo

C2

https://vhrfe87jejdw7e.store/YWFiM2VkMmFmNWFh/

https://koleitgehndhe782hr.online/YWFiM2VkMmFmNWFh/

https://agenoikleiocbgr54.life/YWFiM2VkMmFmNWFh/

https://juiruhf5be6743yhyjdj.xyz/YWFiM2VkMmFmNWFh/

https://lfoi45frhre4frjhyfrh.online/YWFiM2VkMmFmNWFh/
rc4.plain

Extracted

Family

octo

C2

https://vhrfe87jejdw7e.store/YWFiM2VkMmFmNWFh/

https://koleitgehndhe782hr.online/YWFiM2VkMmFmNWFh/

https://agenoikleiocbgr54.life/YWFiM2VkMmFmNWFh/

https://juiruhf5be6743yhyjdj.xyz/YWFiM2VkMmFmNWFh/

https://lfoi45frhre4frjhyfrh.online/YWFiM2VkMmFmNWFh/
AES_key

Signatures

  • Octo

    Octo is a banking malware with remote access capabilities first seen in April 2022.

    bankertrojaninfostealerratocto
  • Octo family
    octo
  • Octo payload 1 IoCs
  • Loads dropped Dex/Jar 1 TTPs 1 IoCs

    Runs executable file dropped to the device during analysis.

    evasion
  • Makes use of the framework's Accessibility service 4 TTPs 2 IoCs

    Retrieves information displayed on the phone screen using AccessibilityService.

    collectionevasioncredential_access
  • Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
    bankerdiscovery
  • Queries the phone number (MSISDN for GSM devices) 1 TTPs
    discovery
  • Acquires the wake lock 1 IoCs
  • Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs

    Application may abuse the framework's foreground service to continue running in the foreground.

    evasionpersistence
  • Performs UI accessibility actions on behalf of the user 1 TTPs 4 IoCs

    Application may abuse the accessibility service to prevent their removal.

    evasion
  • Queries the mobile country code (MCC) 1 TTPs 1 IoCs
    discovery
  • Reads information about phone network operator. 1 TTPs
    discovery
  • Requests accessing notifications (often used to intercept notifications before users become aware). 1 TTPs 1 IoCs
    collectioncredential_access
  • Requests disabling of battery optimizations (often used to enable hiding in the background). 1 TTPs 1 IoCs
    evasion
  • Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs
    impact

Processes

  • com.whilebedg
    1⤵
    • Loads dropped Dex/Jar
    • Makes use of the framework's Accessibility service
    • Acquires the wake lock
    • Makes use of the framework's foreground persistence service
    • Performs UI accessibility actions on behalf of the user
    • Queries the mobile country code (MCC)
    • Requests accessing notifications (often used to intercept notifications before users become aware).
    • Requests disabling of battery optimizations (often used to enable hiding in the background).
    • Uses Crypto APIs (Might try to encrypt user data)
    PID:4507

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • /data/user/0/com.whilebedg/cache/aaraquclvjvr
    Filesize

    449KB

    MD5

    f1c9c5e2a8b85f795c6c459227df9d04

    SHA1

    b7fcc1566d824ab60f16581234754928f1de4af2

    SHA256

    6b161842351f03b4fe939fb8862c8e4d6fb4d233745baf063bafbd4c3d998ace

    SHA512

    a8ee2c858463eaa7759b89c9e7bd52353ae5de360b0eb160cac5b3fcfca5288391fae3ab5bdf5615aa3f333bcb5850ad48349b0342c685b9717d8335070368b1

    Download Submit

  • /data/user/0/com.whilebedg/cache/oat/aaraquclvjvr.cur.prof
    Filesize

    387B

    MD5

    247aa8adc8b8b5e63362f1292feb876f

    SHA1

    a85af021f228c8553a414d5dcca1bc6b501fa7bc

    SHA256

    1920507a51598fcfc5967d0ee4cbc04e7db102c7084d83309f04d283eae2b90d

    SHA512

    2e69600a21592519f114dbd0cff6adbc52a3aa85bd66bf3dd2f06f8adea76de0ebaecd1b446f26df94983977a2eb4451a8633bfbc635261b1b962360f75663e2

    Download Submit