Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    148s
  • max time network
    137s
  • platform
    android_x64
  • resource
    android-33-x64-arm64-20240624-en
  • resource tags

    androidarch:arm64arch:x64image:android-33-x64-arm64-20240624-enlocale:en-usos:android-13-x64system
  • submitted
    17/12/2024, 22:03

General

  • Target

    a8b594c1616f75157c1f55564c063621f4441d3b62efdc5c1790e3e34a7a28b2.apk

  • Size

    2.7MB

  • MD5

    4579079b4b1ec9c10022b376fc27d930

  • SHA1

    c051e3154ee4e42c0d515d3cfa3b7d89191d6bea

  • SHA256

    a8b594c1616f75157c1f55564c063621f4441d3b62efdc5c1790e3e34a7a28b2

  • SHA512

    ddd2543cc78fb722d4feff52f000746a5315bf630c4522544b3f9872dc2b4b3f171549906503deb4ae53c299a2ee37b2318197c053252b2a1ecfa9293b326383

  • SSDEEP

    49152:ZYoQrw6Kjcf1ObPyI4trAm8a8KLGBHzFOTkCMmn6U9BrVT9mDl8r601sS8IQl:6oQrwFjEI4iZaUzYH99yI+

Malware Config

Extracted

Family

octo

C2

https://93.123.109.166:7117/gate/

https://93.123.109.166:8080/rootmd50ma/panelcgfuzwxleg9kdxnvy3rv/gate/

https://93.123.109.166:80/builderxxxzzz/gate/

Attributes
  • target_apps

    at.spardat.bcrmobile

    at.spardat.netbanking

    com.bankaustria.android.olb

    com.bmo.mobile

    com.cibc.android.mobi

    com.rbc.mobile.android

    com.scotiabank.mobile

    com.td

    cz.airbank.android

    eu.inmite.prj.kb.mobilbank

    com.bankinter.launcher

    com.kutxabank.android

    com.rsi

    com.tecnocom.cajalaboral

    es.bancopopular.nbmpopular

    es.evobanco.bancamovil

    es.lacaixa.mobile.android.newwapicon

    com.dbs.hk.dbsmbanking

    com.FubonMobileClient

    com.hangseng.rbmobile

    com.MobileTreeApp

    com.mtel.androidbea

    com.scb.breezebanking.hk

    hk.com.hsbc.hsbchkmobilebanking

    com.aff.otpdirekt

    com.ideomobile.hapoalim

    com.infrasofttech.indianBank

    com.mobikwik_new

    com.oxigen.oxigenwallet

    jp.co.aeonbank.android.passbook

AES_key

Signatures

  • Octo

    Octo is a banking malware with remote access capabilities first seen in April 2022.

  • Octo family
  • Makes use of the framework's Accessibility service 4 TTPs 2 IoCs

    Retrieves information displayed on the phone screen using AccessibilityService.

  • Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
  • Queries the phone number (MSISDN for GSM devices) 1 TTPs
  • Acquires the wake lock 1 IoCs
  • Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs

    Application may abuse the framework's foreground service to continue running in the foreground.

  • Performs UI accessibility actions on behalf of the user 1 TTPs 4 IoCs

    Application may abuse the accessibility service to prevent their removal.

  • Queries the mobile country code (MCC) 1 TTPs 1 IoCs
  • Requests accessing notifications (often used to intercept notifications before users become aware). 1 TTPs 1 IoCs
  • Requests disabling of battery optimizations (often used to enable hiding in the background). 1 TTPs 1 IoCs
  • Requests modifying system settings. 1 IoCs
  • Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs

Processes

  • com.nameown12
    1⤵
    • Makes use of the framework's Accessibility service
    • Acquires the wake lock
    • Makes use of the framework's foreground persistence service
    • Performs UI accessibility actions on behalf of the user
    • Queries the mobile country code (MCC)
    • Requests accessing notifications (often used to intercept notifications before users become aware).
    • Requests disabling of battery optimizations (often used to enable hiding in the background).
    • Requests modifying system settings.
    • Uses Crypto APIs (Might try to encrypt user data)
    PID:4331

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • /data/user/0/com.nameown12/.qcom.nameown12

    Filesize

    48B

    MD5

    046a414913add6f5bb60072c7db819b6

    SHA1

    451ee4f6809260aec622d772fd329c7d0297a842

    SHA256

    b66c1320cb063a1d391c94273572ea6edae76c8c8b0a07f8d75c88686f0df72a

    SHA512

    4e6355f3051ed5e811ab030abde1f5be7f5e1cf33be99cd08477e9b6c015deb1d8bd75a09fb9c7176b8511c5ad0a67abc0902a3531e97564ccb6afc57496a47c

  • /data/user/0/com.nameown12/kl.txt

    Filesize

    45B

    MD5

    6f595710b8cae8166e3292dde27c0038

    SHA1

    0bab5cc47797ec631736891856b27f95d033c5ae

    SHA256

    ca9bc679d173e5567d917102e71aa3f6609788c09c065afd6f6fe39263c2a4b4

    SHA512

    d275475e4f5d2d3718c4489dddbaa64ace1b02128ad072fbc22d9fed81fcd8659cb1dc20c2c9184f3531bb8cf6558783c162e61c9d38b647750f8593e810ed4d

  • /data/user/0/com.nameown12/kl.txt

    Filesize

    490B

    MD5

    83c9737bc8525b41758e5f696a1b26dd

    SHA1

    45522e764eed92fc9eb8f3b91f12d0f9e4d064d4

    SHA256

    13c2ea61afd7f1c1826c215c15d8a3e1421e31b9348a540ad98590d8379a9a47

    SHA512

    e5d03b564b71067a0cc9373e99078a9d63fe1591db1f1be5db64bf9738807a117c758928bb99866977d590f64814e5177047d13a37f159e72cccade02d86511e

  • /data/user/0/com.nameown12/kl.txt

    Filesize

    70B

    MD5

    500f8787e6b950c5dc32b8fc56289165

    SHA1

    06add83cc1fca5688f4f2c322fed382f56cf23f7

    SHA256

    2716788b8d32eb1c3b626a9d413f10172d6cc5073c51ce87bfc407d703b51e93

    SHA512

    8e222c92e585e7948af1bd079f7f82fd2e09c34fce56582262a3f3fdbeffaab0c890b859936fda8db9be3e078ee80fd92b3a27c0f96db96f39a37c10e514aa2f

  • /data/user/0/com.nameown12/kl.txt

    Filesize

    68B

    MD5

    9a6896118f98cda70ab38dc4fb40581e

    SHA1

    cd6db7e11e63bf29c705a495e7ab812b5f3acf84

    SHA256

    14d0072328c92280722073129584641a19b3ea390e08c67df54ab0b5ff45cd20

    SHA512

    2e0b30ee1e4c3a9d7630bb5420348c71e18168118190c03e5da091b696e9daa59a78315d966bad6cc058072c7662b78c8bc1fe19d406527c59d6ddd0f63419d8

  • /data/user/0/com.nameown12/kl.txt

    Filesize

    60B

    MD5

    0685ad4fd6194df55b8e7ce088f30d62

    SHA1

    fbb1d80bb1eb240b3ff58d67230cbcf6d7f121e1

    SHA256

    52cca746ff7bab94a884cf3fc2f512c41c0daeea1bc5873b6851ac95ea795489

    SHA512

    01c3c7b36432e302c985850924f431814ffd6a6f332ab68e430805504d600834cfbd867c514555462a607bdfca6c00a6684043adf5ae16f482b28fe73811cb09

  • /data/user/0/com.nameown12/kl.txt

    Filesize

    52B

    MD5

    5b0b6220350cb39912815a88631d6261

    SHA1

    251612f044e77df876e2d8fc54803e1f033e0d10

    SHA256

    b853691ed19598781b51ee82d4a40cf19f1fa08733124e7b1c5a3269836f1fe1

    SHA512

    bf9d2a1c161236d3aa46d96aceb3553af89691e7e6e6c9419b960b093ad7090316f05dfe538b57244cf4b4fc8ccffc42c88c45b29a7f8d72997d6ff738c7a3e0

  • /data/user/0/com.nameown12/kl.txt

    Filesize

    84B

    MD5

    ec3336ad6b2e54e5271590d0a551bb26

    SHA1

    11216c6a55ce674719e4664e66f5f0da38c35036

    SHA256

    35f2220e723c5e21f8e7f92e305d7b4ec0d10b12667f1e4264f16cd4e573d386

    SHA512

    6070a9066f4850e7873bc20001d0a9ce9af19f4f086a28d60ee60ca147b54c0f1920b292dfff321167f50317d43a95d616014be3fb613640836f151f4836c962

  • /data/user/0/com.nameown12/kl.txt

    Filesize

    214B

    MD5

    4ec71b1252a96afa5e3c2a8b0ecbd222

    SHA1

    5ed44e8ea4fae8a92d5d3b1619b5e1c4dc588e06

    SHA256

    93571b4bda7705d7bd17e20ccd0c95bb480bf6a6762287314be3c6c1a03b2c0b

    SHA512

    5aa16cf52cf4178d69eb54b6c76ea51d4443b5619b3b3f6a1145f2184a36c0b1453e9db2a1ec5ea4db150d45610b524846b2c556c360f0a65086751356b0edd7

  • /data/user/0/com.nameown12/kl.txt

    Filesize

    54B

    MD5

    ffe839e8ac0b161b82cba4a23759322b

    SHA1

    d04c82ca4c8e39a98bef674cb032b0dd00d6b582

    SHA256

    753c979faeeeee4e1698200c70791e0aa55b6721fbea222405c4b61b8dedbb35

    SHA512

    bb5ac2fe1e2498ab9a6cb7d896bf314cdedea37a5a434051fef47b1708899512f430badd6c6ad9b96ee76ee072006468836243edb0f5d2bfd3c489b750f16c22

  • /data/user/0/com.nameown12/kl.txt

    Filesize

    60B

    MD5

    198d158165cb386c3e52969a60f2d7a2

    SHA1

    ebb48791ddd76efc8a35c3c23c8063d73b99fb22

    SHA256

    0a0f3803f9036a27c216b12cc4420bee07e6c0d2b80e6eb4b701e7c035c1b882

    SHA512

    8c9105707b814f26c1df1aef8490fd3dcb2f0b6e382bf687a99de7bff942625b047651ff8466302ee43f37e0c33495498e3c2524d61d9641caccfeeeb274a07e

  • /data/user/0/com.nameown12/kl.txt

    Filesize

    52B

    MD5

    b904d08615a6eb87f5809671bcd3bf0c

    SHA1

    dea9d3bdfcdb2f0f7656fd4bc91b73c098bee1bd

    SHA256

    dbf286df7e002881a02a11a8e9e4dad700772716ac9edd3f020c81e93c60d46a

    SHA512

    2637d1cc739eb573b05f3a67f867fd938ec74674ba26a15fc566285d02fa37c594ed5662b2cf30b29fea47a9efda12188af95eb1d41fc42e2e98c3b0272b3267

  • /data/user/0/com.nameown12/kl.txt

    Filesize

    70B

    MD5

    ea4a18689d90d2337bae8661d3813a5f

    SHA1

    d1ffcda8f9f826aecadad3211b7cc54b305d83fe

    SHA256

    74d3d5a3d10c0075193f8c5332b62c57029b30d52eba2edd6521370f7efa0c0f

    SHA512

    5309af6e8c0dfe039d319193ce75d040a2413235f48cb07a624c4127af7d34aa4bdfa1e6c3e9c48a1521384bf1e2e6ec9639f0a479dfa00efbe59cc59a4866c1

  • /data/user/0/com.nameown12/kl.txt

    Filesize

    55B

    MD5

    d99bd4e373d692262a78e2068e770c0b

    SHA1

    902270e93ae1bfc2da8a533ea047e8160f7612d4

    SHA256

    b713dc96bf6a50f82b3f5ae2fb301f794b57f56e6ef59afa4746011a40491118

    SHA512

    790f84cb443b6b8fcb226ea7d2d4fbade2960c319c67a132c44eb6839afa2b1ad750896d816d345115d86996546ed48079fdb5e382471f002340b44be4eaa834

  • /data/user/0/com.nameown12/kl.txt

    Filesize

    45B

    MD5

    f84d6009f0cbad832598bad2c9426280

    SHA1

    8a9c81961d57ff9828f59273cfe9bdd5794b18e6

    SHA256

    1ded1a84b25d4ec57f88fe1222d1618b02ef3a88febc0920729123bd0354f69a

    SHA512

    b6d5629daf3be2950dd8d185ff5a1aa96fe9b531b4b2a578cfee916f2e30ef11de5462aa53bcc39e6e5253481a2141f767646bd66cabc777dfe3942e01057760

  • /data/user/0/com.nameown12/kl.txt

    Filesize

    70B

    MD5

    4956102085134760d61f6e0e3c2bbecc

    SHA1

    a9b8013445da72b5f37002ba1b5be8901c031b03

    SHA256

    21d0acd1bb230262f989f31bb58d5cde9e79347e644d7d7ad3881ec0b07071ba

    SHA512

    7a9b1b57b397c24d4a3c8f19a13cff8f0020f9defe90b491073d73f61bdfeddf1922370e9f08df4d481372f674737bcd222cb6701256aa14dee9d4da56c37583