Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
142s -
max time network
134s -
platform
android_x64 -
resource
android-33-x64-arm64-20240624-en -
resource tags
-
submitted
17/12/2024, 22:13
General
-
Target
d6bb85aca7bd7540f32d0a4a41692dea3947a41a4e7dbf7f438882cdaafe888a.apk
-
Size
4.8MB
-
MD5
6fe5d5e9e03738fc3191167ba5d07c76
-
SHA1
24208d31ec6ca363f934fc23fb30f91636a63e22
-
SHA256
d6bb85aca7bd7540f32d0a4a41692dea3947a41a4e7dbf7f438882cdaafe888a
-
SHA512
53e5e6607b093d9c5de6228026b20307787bc7d009113fbeae26370dd398ea14749e798607cbde0b6860034617922d4e495eb73cf72e3126fa4c8ca2b57703f7
-
SSDEEP
49152:jRsEX9p6LvKphj7v45iS7xrGzrUugTBjVKScYZcDqaIOI2X3dpj3asx2P:jRsIavshj7Q5iSRGcZVKPAOI2HdxlkP
Malware Config
Extracted
octo
Signatures
-
Octo
Octo is a banking malware with remote access capabilities first seen in April 2022.
-
Octo family
-
Octo payload 1 IoCs
-
Loads dropped Dex/Jar 1 TTPs 1 IoCs
Runs executable file dropped to the device during analysis.
-
Makes use of the framework's Accessibility service 4 TTPs 1 IoCs
Retrieves information displayed on the phone screen using AccessibilityService.
-
Obtains sensitive information copied to the device clipboard 2 TTPs 1 IoCs
Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.
-
Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
-
Queries the phone number (MSISDN for GSM devices) 1 TTPs
-
Acquires the wake lock 1 IoCs
-
Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs
Application may abuse the framework's foreground service to continue running in the foreground.
-
Queries the mobile country code (MCC) 1 TTPs 1 IoCs
-
Reads information about phone network operator. 1 TTPs
-
Requests disabling of battery optimizations (often used to enable hiding in the background). 1 TTPs 1 IoCs
-
Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs
-
Checks CPU information 2 TTPs 1 IoCs
-
Checks memory information 2 TTPs 1 IoCs
Processes
-
com.routinesapi_health631⤵
- Loads dropped Dex/Jar
- Makes use of the framework's Accessibility service
- Obtains sensitive information copied to the device clipboard
- Acquires the wake lock
- Makes use of the framework's foreground persistence service
- Queries the mobile country code (MCC)
- Requests disabling of battery optimizations (often used to enable hiding in the background).
- Uses Crypto APIs (Might try to encrypt user data)
- Checks CPU information
- Checks memory information
Network
MITRE ATT&CK Mobile v15
Defense Evasion
Download New Code at Runtime
1Foreground Persistence
1Hide Artifacts
1User Evasion
1Input Injection
1Virtualization/Sandbox Evasion
2System Checks
2Credential Access
Clipboard Data
1Input Capture
2GUI Input Capture
1Keylogging
1Discovery
Software Discovery
1Security Software Discovery
1System Information Discovery
2System Network Configuration Discovery
3Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
48B
MD5046a414913add6f5bb60072c7db819b6
SHA1451ee4f6809260aec622d772fd329c7d0297a842
SHA256b66c1320cb063a1d391c94273572ea6edae76c8c8b0a07f8d75c88686f0df72a
SHA5124e6355f3051ed5e811ab030abde1f5be7f5e1cf33be99cd08477e9b6c015deb1d8bd75a09fb9c7176b8511c5ad0a67abc0902a3531e97564ccb6afc57496a47c
-
Filesize
322KB
MD577dc50489b9323274732d27dc8a4e803
SHA10e02a3595b62489d0739d771881da8604d117c65
SHA256c5684e792d1ebefea6aac09fed45911703fd58c899f8a08133d49dd91429a820
SHA5120684a92f3e9c525384cfa53f531afba61e5930e1c27032a7e27e3315f72761b62e122dc34768d8162ba08f9bed53d148aa8dc034b46456bdd211f230637eba58
-
Filesize
13KB
MD50506c0578182405f13a68bee593a3d0c
SHA1882f3205ed988bb9494e6699443d960b53635b7c
SHA256220928f3077ddfc97f5a167f13c9446a8a41953d3b85e379d2fc93f5caa541e7
SHA5126881a8fb7da5180edb7dce2b7368585d90ee75d21957f43f64288081cd304108b8806c295e096388800a59f2ad318828e73abb6f0b93bd946ea5304b0873a47e
-
Filesize
526KB
MD5836cb211c8e03b0fe0619e794507ff1f
SHA19291a7244233531c15dad63857ec2a76b918c6a7
SHA256557b5c9d6367ecf8062722722c76bc9fb86a92ba98008d655ea3a710134112a7
SHA512ea1bf384343c9ad0ff85db317fa096dfabfebfc8f8e64521ec262944016e9f12b78dab42b2713879896e23a9626c4732102baf9bce39b452e913964655a0ccda