Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    148s
  • max time network
    145s
  • platform
    android_x64
  • resource
    android-x64-arm64-20240624-en
  • resource tags

    androidarch:armarch:arm64arch:x64arch:x86image:android-x64-arm64-20240624-enlocale:en-usos:android-11-x64system
  • submitted
    15/12/2024, 22:00

General

  • Target

    50ddded58b127c98ff3e88d4716aaba57c6df340c5c8393534025f59e11ea1cf.apk

  • Size

    2.7MB

  • MD5

    8c1ae57f860d282c4085a46aaab03de5

  • SHA1

    e05e373bf6fe47d166318ec6690f70df4daf35ee

  • SHA256

    50ddded58b127c98ff3e88d4716aaba57c6df340c5c8393534025f59e11ea1cf

  • SHA512

    476618ebd9eb236dda53568700b80cfa79792f6feb4ea4c2afe70166c1cd3af31b039503958fafa2b733026afaaf760e5f05ea8f3d84e7a5dcaf5c9f60360eb7

  • SSDEEP

    49152:ZYoQrw6Kjcf1ObPyI4trAm8a8KLGBHzFOTkCMmn6U9BrVT9mDl8r601sS8IQ4:6oQrwFjEI4iZaUzYH99yIT

Malware Config

Extracted

Family

octo

C2

https://93.123.109.166:7117/gate/

https://93.123.109.166:8080/rootmd50ma/panelcgfuzwxleg9kdxnvy3rv/gate/

https://93.123.109.166:80/builderxxxzzz/gate/

Attributes
  • target_apps

    at.spardat.bcrmobile

    at.spardat.netbanking

    com.bankaustria.android.olb

    com.bmo.mobile

    com.cibc.android.mobi

    com.rbc.mobile.android

    com.scotiabank.mobile

    com.td

    cz.airbank.android

    eu.inmite.prj.kb.mobilbank

    com.bankinter.launcher

    com.kutxabank.android

    com.rsi

    com.tecnocom.cajalaboral

    es.bancopopular.nbmpopular

    es.evobanco.bancamovil

    es.lacaixa.mobile.android.newwapicon

    com.dbs.hk.dbsmbanking

    com.FubonMobileClient

    com.hangseng.rbmobile

    com.MobileTreeApp

    com.mtel.androidbea

    com.scb.breezebanking.hk

    hk.com.hsbc.hsbchkmobilebanking

    com.aff.otpdirekt

    com.ideomobile.hapoalim

    com.infrasofttech.indianBank

    com.mobikwik_new

    com.oxigen.oxigenwallet

    jp.co.aeonbank.android.passbook

AES_key

Signatures

  • Octo

    Octo is a banking malware with remote access capabilities first seen in April 2022.

  • Octo family
  • Makes use of the framework's Accessibility service 4 TTPs 2 IoCs

    Retrieves information displayed on the phone screen using AccessibilityService.

  • Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
  • Queries the phone number (MSISDN for GSM devices) 1 TTPs
  • Acquires the wake lock 1 IoCs
  • Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs

    Application may abuse the framework's foreground service to continue running in the foreground.

  • Performs UI accessibility actions on behalf of the user 1 TTPs 4 IoCs

    Application may abuse the accessibility service to prevent their removal.

  • Queries the mobile country code (MCC) 1 TTPs 1 IoCs
  • Reads information about phone network operator. 1 TTPs
  • Requests accessing notifications (often used to intercept notifications before users become aware). 1 TTPs 1 IoCs
  • Requests disabling of battery optimizations (often used to enable hiding in the background). 1 TTPs 1 IoCs
  • Requests modifying system settings. 1 IoCs
  • Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs

Processes

  • com.nameown12
    1⤵
    • Makes use of the framework's Accessibility service
    • Acquires the wake lock
    • Makes use of the framework's foreground persistence service
    • Performs UI accessibility actions on behalf of the user
    • Queries the mobile country code (MCC)
    • Requests accessing notifications (often used to intercept notifications before users become aware).
    • Requests disabling of battery optimizations (often used to enable hiding in the background).
    • Requests modifying system settings.
    • Uses Crypto APIs (Might try to encrypt user data)
    PID:4642

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • /data/user/0/com.nameown12/.qcom.nameown12

    Filesize

    48B

    MD5

    046a414913add6f5bb60072c7db819b6

    SHA1

    451ee4f6809260aec622d772fd329c7d0297a842

    SHA256

    b66c1320cb063a1d391c94273572ea6edae76c8c8b0a07f8d75c88686f0df72a

    SHA512

    4e6355f3051ed5e811ab030abde1f5be7f5e1cf33be99cd08477e9b6c015deb1d8bd75a09fb9c7176b8511c5ad0a67abc0902a3531e97564ccb6afc57496a47c

  • /data/user/0/com.nameown12/kl.txt

    Filesize

    45B

    MD5

    f8ca764c0eb61f388ed5edc48751da1d

    SHA1

    f3001baf9f62a0690586841c49e3573698aeaeda

    SHA256

    185074d2fac7933be0862338991c205fbbb14d8eb715c80a883759b5dfe46ab6

    SHA512

    dc6972694dc9a957b9654ce9d14c30e870cc03c7a5e5b473e114f9df90977dbff537561d8cea7475a1f189dc41d62dd5719a87c6f51a3081752ada3c31d5fd72

  • /data/user/0/com.nameown12/kl.txt

    Filesize

    66B

    MD5

    0f41adba2762bf15db0b556b21e9a73d

    SHA1

    6a2f7afcd707c2b84321e23350e56fbdcf5ad17c

    SHA256

    d537c8039565de3c973c5e26c764fa5e9e0af9b7f210441238d19c31a15fa36a

    SHA512

    e0dc10f7606a2a7fd0f02509dd67b43828ee49d05a122b31ec1f321f5ac2d61597205222f5cdd5db90a7130495ae5714caabead991a336c1ee48283df4bd8e7f

  • /data/user/0/com.nameown12/kl.txt

    Filesize

    84B

    MD5

    6702ae2524b1777a5512487315826403

    SHA1

    68adbd61588a7ea947e1cde0da45cdc397f8f2f7

    SHA256

    a02cdf84c8e941ed6469ae72d3a8eb452b9194f29511d490586c8f9b9551a728

    SHA512

    24d0d8b24ca5dad283c953527d0c497496e2fc46f90449976dbb5c112e201a206c7586b58d9046a0c965883665b45bc00a9db7d535fd95f59e0683f87f2916b4

  • /data/user/0/com.nameown12/kl.txt

    Filesize

    63B

    MD5

    d2137f417c5c59db9dd0bdbf42d8425c

    SHA1

    4cc45e1cfc5d89f33897759f17ace9bd95a3f40a

    SHA256

    288496d50139c41eeea587f3a835f34dbe42a2f092cd23c7ce75f4c441877e34

    SHA512

    f00aac1bcabb4804134bcf679a0a034a43bcfdd803bc58c846f0badae28bfff5a10cdd4321fdfcfb73fbf47570228e5415eeb150f380a298eb71a0e61ea015b8

  • /data/user/0/com.nameown12/kl.txt

    Filesize

    58B

    MD5

    633ad71786a2c8da4a3319b5e5b6c4a0

    SHA1

    070512296adbe8fd0fd9b0276ca9b95004e56c5d

    SHA256

    6092cce2267e0daee7b4d7879795cf2c316b2a599152054d7266c4d87e77f905

    SHA512

    d6d27bfbac7ce9d426e16d99ef4bb984d85a3e6bb57fd71f95fd8d4f2d60816bdb0c43871c6553758b54e78ba4846043e46682c5e98ba6b93c8c96537e1fc70a

  • /data/user/0/com.nameown12/kl.txt

    Filesize

    63B

    MD5

    f0832c68aad5f4c07f56bc620a6eef90

    SHA1

    345bd1fb1eb284e7583a1d91daa54756b1d06190

    SHA256

    66d32fa49c70e11b44989f44f0f7a2665935ced7b3fbff2a569cfee182c71ede

    SHA512

    0a8b6abdc708bdd5dae4fa679a89ea72a9c60128b1e1b148ee2b4db457f4be98bb5b783786c6da976c06c28b3204686e8800c59bd785375c95d8d07cd9628845

  • /data/user/0/com.nameown12/kl.txt

    Filesize

    230B

    MD5

    027fb7ff4a89ce49bae8ec2c85524850

    SHA1

    5b1c3ae195846d7e7ec6da9bb39655f87826f572

    SHA256

    824d689ae271d29d234a9a07e7233695bde6e95557cbc8db31d402c21e00e504

    SHA512

    8d6092f93ce85ca7b67973249fc8b211e01f1cb8fcaffaa4676f70b5afdf3e913934ed4ab764446ebdfb72efd74d483ead591e9f0eb6ba6af32acc7689f612e9

  • /data/user/0/com.nameown12/kl.txt

    Filesize

    45B

    MD5

    de3b2a0b3f0020627f9049dc7b931fac

    SHA1

    4dae5e353c77fdc6175700525f8fb5673290ff05

    SHA256

    1faad0560195fff63f1d721a84116835909546766bee98c6f89e65d06b406569

    SHA512

    6ce6f59c36a7715f3a961f28798d0e845f24a7da67f2de31d63cfd322a4ac88757babade4821df6a9fdb75d22edb1479ce9b1edcf019821672787a5348f3116a

  • /data/user/0/com.nameown12/kl.txt

    Filesize

    63B

    MD5

    0167dc9b24de1ece95bfdd332a15e485

    SHA1

    eb228e367ffa8cac666dab7f76f71546b041d613

    SHA256

    3a9cf13909dff8048d09dbdec861e83aac222e12a0e5d88b588ad73cd13febb5

    SHA512

    0c062cac1de2537b99c5f5534220f8dd451a024e9d1b53990316b571d14656b5e3ff13d4782911a022319680d5bf21e2af1285d279a8f2cae2ec47035c5dbd34

  • /data/user/0/com.nameown12/kl.txt

    Filesize

    45B

    MD5

    adc44ed92fcfd6a0878d2d19011f7f68

    SHA1

    ddc5ba6efa4132e7db71c69bb85910fe58293069

    SHA256

    471133acff8f0456a8d8e835afda792c6194067ac6fa5438b4cf83e8653125ec

    SHA512

    843c80258e7a7daef45058e7774628876993073000048dde3643c1fb66e87d1d92f762107cb2659ec2dfb5c628347c5fef75ff8a3ea6a2e646b5917bb2cf6d53

  • /data/user/0/com.nameown12/kl.txt

    Filesize

    466B

    MD5

    dd8a88df07c66f24004f7719efadc6e6

    SHA1

    dd7fef584aecc3f0c87cb85d1c744d15eb5dcbec

    SHA256

    8c6bedbaf72ef108c9f640f082dd86745718139bd5fb385e52d13dd87ef6067b

    SHA512

    ad24a702af8e25f99ebcdb93f962eb2b1e27313329fea23fa3b2b1d5d5837db9793951d9684400abd40a090be2fa9b93fb8a949e07ddadc1fe841751c0e08ff0

  • /data/user/0/com.nameown12/kl.txt

    Filesize

    63B

    MD5

    46ca6f5ebd240f795d7494870e1f8592

    SHA1

    211cf2197c1f749d50b4024e940d866a61258185

    SHA256

    ac0eeb7255d11ad495de627ab0b9dd30aa33fb4ec921e35697473ec5304be9db

    SHA512

    97e7f59e406fbaa6da91c66de3dac1cd2658925ddc161db7c7919fc13d5020af2ab9a776caeefcb38e9b55d434a16d65cb99f1ebcca66707a7926a19691f2785

  • /data/user/0/com.nameown12/kl.txt

    Filesize

    58B

    MD5

    05a83dfb6942a074d368ca4c743bf2b6

    SHA1

    61adc4dd009e781fc8ca794f6a347fa966712c0c

    SHA256

    6287e3667255ed4b256f1b1095a011477af853ac5d85bf97ef25fd9313d6eb7d

    SHA512

    9e711cfd9c235574c06a1a743861ca737dd3c384c06c5a9df57cd0340c916a1c178c0513d9f98924c0a7637ef8e42b2988c4732d0a85eb57110c0999db61d40b