Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

10

Static

static

10

70318728b9...bc.apk

android-9-x86

10

70318728b9...bc.apk

android-10-x64

10

Analysis

  • max time kernel
    148s
  • max time network
    152s
  • platform
    android-10_x64
  • resource
    android-x64-20240910-en
  • resource tags

    arch:x64arch:x86image:android-x64-20240910-enlocale:en-usos:android-10-x64system
  • submitted
    21/12/2024, 22:08 UTC

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    70318728b910d01dfe262b06cb47098c3e8172c7716fee73d9442d66f615a5bc.apk

  • Size

    2.7MB

  • MD5

    55c5691e8c1fa44813eccf69febe0741

  • SHA1

    e34d014190a56d394338e19e9606b7061579c890

  • SHA256

    70318728b910d01dfe262b06cb47098c3e8172c7716fee73d9442d66f615a5bc

  • SHA512

    497889c14f2df31e9089c82255efae275b247e4adad5953c66e3e710a9247811344bcc40c37d33fa701643176ff494c6b1867ed5c593bf3c17f81649826378eb

  • SSDEEP

    49152:ZYoQrw6Kjcf1ObPyI4trAm8a8KLGBHzFOTkCMmn6U9BrVT9mDl8r601sS8IQe:6oQrwFjEI4iZaUzYH99yIJ

Score
10/10
octobankercollectioncredential_accessdiscoveryevasionimpactinfostealerpersistencerattrojan

Malware Config

Extracted

Family

octo

C2

https://93.123.109.166:7117/gate/

https://93.123.109.166:8080/rootmd50ma/panelcgfuzwxleg9kdxnvy3rv/gate/

https://93.123.109.166:80/builderxxxzzz/gate/
Attributes
  • target_apps

    at.spardat.bcrmobile

    at.spardat.netbanking

    com.bankaustria.android.olb

    com.bmo.mobile

    com.cibc.android.mobi

    com.rbc.mobile.android

    com.scotiabank.mobile

    com.td

    cz.airbank.android

    eu.inmite.prj.kb.mobilbank

    com.bankinter.launcher

    com.kutxabank.android

    com.rsi

    com.tecnocom.cajalaboral

    es.bancopopular.nbmpopular

    es.evobanco.bancamovil

    es.lacaixa.mobile.android.newwapicon

    com.dbs.hk.dbsmbanking

    com.FubonMobileClient

    com.hangseng.rbmobile

    com.MobileTreeApp

    com.mtel.androidbea

    com.scb.breezebanking.hk

    hk.com.hsbc.hsbchkmobilebanking

    com.aff.otpdirekt

    com.ideomobile.hapoalim

    com.infrasofttech.indianBank

    com.mobikwik_new

    com.oxigen.oxigenwallet

    jp.co.aeonbank.android.passbook

AES_key
1
3534353639643261616165373137363333356136376266373265383637333666

Signatures

  • Octo

    Octo is a banking malware with remote access capabilities first seen in April 2022.

    bankertrojaninfostealerratocto
  • Octo family
    octo
  • Makes use of the framework's Accessibility service 4 TTPs 2 IoCs

    Retrieves information displayed on the phone screen using AccessibilityService.

    collectionevasioncredential_access
  • Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
    bankerdiscovery
  • Queries the phone number (MSISDN for GSM devices) 1 TTPs
    discovery
  • Acquires the wake lock 1 IoCs
  • Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs

    Application may abuse the framework's foreground service to continue running in the foreground.

    evasionpersistence
  • Performs UI accessibility actions on behalf of the user 1 TTPs 4 IoCs

    Application may abuse the accessibility service to prevent their removal.

    evasion
  • Queries the mobile country code (MCC) 1 TTPs 1 IoCs
    discovery
  • Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs
    persistence
  • Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs
    impact

Processes

  • com.nameown12
    1⤵
    • Makes use of the framework's Accessibility service
    • Acquires the wake lock
    • Makes use of the framework's foreground persistence service
    • Performs UI accessibility actions on behalf of the user
    • Queries the mobile country code (MCC)
    • Registers a broadcast receiver at runtime (usually for listening for system events)
    • Uses Crypto APIs (Might try to encrypt user data)
    PID:5095

Network

  • flag-us
    DNS
    android.apis.google.com
    Remote address:
    1.1.1.1:53
    Request
    android.apis.google.com
    IN A
    Response
    android.apis.google.com
    IN CNAME
    clients.l.google.com
    clients.l.google.com
    IN A
    216.58.204.78
  • flag-bg
    POST
    https://93.123.109.166:7117/gate/
    Remote address:
    93.123.109.166:7117
    Request
    POST /gate/ HTTP/1.1
    Packets-sent: 60170
    Content-Encoding: gzip
    Content-Length: 6159
    Host: 93.123.109.166:7117
    Connection: Keep-Alive
    Response
    HTTP/1.1 200 OK
    Date: Sat, 21 Dec 2024 22:08:07 GMT
    Server: Apache/2.4.62 (Debian)
    Vary: Accept-Encoding
    Connection: close
    Transfer-Encoding: chunked
    Content-Type: text/html; charset=UTF-8
  • flag-us
    DNS
    www.ip-api.com
    Remote address:
    1.1.1.1:53
    Request
    www.ip-api.com
    IN A
    Response
    www.ip-api.com
    IN A
    208.95.112.1
  • flag-bg
    POST
    https://93.123.109.166:7117/gate/
    Remote address:
    93.123.109.166:7117
    Request
    POST /gate/ HTTP/1.1
    Packets-sent: 60170
    Content-Encoding: gzip
    Content-Length: 292
    Host: 93.123.109.166:7117
    Connection: Keep-Alive
    Response
    HTTP/1.1 200 OK
    Date: Sat, 21 Dec 2024 22:08:07 GMT
    Server: Apache/2.4.62 (Debian)
    Vary: Accept-Encoding
    Connection: close
    Transfer-Encoding: chunked
    Content-Type: text/html; charset=UTF-8
  • flag-us
    GET
    http://www.ip-api.com/json
    Remote address:
    208.95.112.1:80
    Request
    GET /json HTTP/1.1
    Host: www.ip-api.com
    Connection: Keep-Alive
    Response
    HTTP/1.1 200 OK
    Date: Sat, 21 Dec 2024 22:08:07 GMT
    Content-Type: application/json; charset=utf-8
    Content-Length: 291
    Access-Control-Allow-Origin: *
    X-Ttl: 60
    X-Rl: 44
  • flag-us
    DNS
    ssl.google-analytics.com
    Remote address:
    1.1.1.1:53
    Request
    ssl.google-analytics.com
    IN A
    Response
    ssl.google-analytics.com
    IN A
    142.250.187.200
  • flag-bg
    POST
    https://93.123.109.166:7117/gate/
    Remote address:
    93.123.109.166:7117
    Request
    POST /gate/ HTTP/1.1
    Packets-sent: 60170
    Content-Encoding: gzip
    Content-Length: 1798
    Host: 93.123.109.166:7117
    Connection: Keep-Alive
    Response
    HTTP/1.1 200 OK
    Date: Sat, 21 Dec 2024 22:08:31 GMT
    Server: Apache/2.4.62 (Debian)
    Vary: Accept-Encoding
    Content-Length: 364
    Connection: close
    Content-Type: text/html; charset=UTF-8
  • flag-bg
    POST
    https://93.123.109.166:7117/gate/
    Remote address:
    93.123.109.166:7117
    Request
    POST /gate/ HTTP/1.1
    Packets-sent: 60170
    Content-Encoding: gzip
    Content-Length: 754
    Host: 93.123.109.166:7117
    Connection: Keep-Alive
    Response
    HTTP/1.1 200 OK
    Date: Sat, 21 Dec 2024 22:08:43 GMT
    Server: Apache/2.4.62 (Debian)
    Vary: Accept-Encoding
    Content-Length: 364
    Connection: close
    Content-Type: text/html; charset=UTF-8
  • flag-bg
    POST
    https://93.123.109.166:7117/gate/
    Remote address:
    93.123.109.166:7117
    Request
    POST /gate/ HTTP/1.1
    Packets-sent: 60170
    Content-Encoding: gzip
    Content-Length: 427
    Host: 93.123.109.166:7117
    Connection: Keep-Alive
    Response
    HTTP/1.1 200 OK
    Date: Sat, 21 Dec 2024 22:09:09 GMT
    Server: Apache/2.4.62 (Debian)
    Vary: Accept-Encoding
    Content-Length: 364
    Connection: close
    Content-Type: text/html; charset=UTF-8
  • flag-bg
    POST
    https://93.123.109.166:7117/gate/
    Remote address:
    93.123.109.166:7117
    Request
    POST /gate/ HTTP/1.1
    Packets-sent: 60170
    Content-Encoding: gzip
    Content-Length: 424
    Host: 93.123.109.166:7117
    Connection: Keep-Alive
    Response
    HTTP/1.1 200 OK
    Date: Sat, 21 Dec 2024 22:10:09 GMT
    Server: Apache/2.4.62 (Debian)
    Vary: Accept-Encoding
    Content-Length: 364
    Connection: close
    Content-Type: text/html; charset=UTF-8
  • 142.250.200.10:443
    tls, https
    1.2kB
     40 B
     1
    1
  • 216.58.212.238:443
    tls, https
    914 B
     40 B
     1
    1
  • 142.250.180.14:443
    tls, https
    914 B
     40 B
     1
    1
  • 216.58.212.206:443
    tls, https
    914 B
     40 B
     1
    1
  • 216.58.204.78:443
    android.apis.google.com
    tls
    4.9kB
     8.7kB
     22
    22
  • 172.217.169.74:443
    tls, https
    2.3kB
     40 B
     1
    1
  • 93.123.109.166:7117
    https://93.123.109.166:7117/gate/
    tls, http
    7.7kB
     26.0kB
     19
    23

    HTTP Request

    POST https://93.123.109.166:7117/gate/

    HTTP Response

    200
  • 93.123.109.166:7117
    https://93.123.109.166:7117/gate/
    tls, http
    3.1kB
     97.1kB
     43
    66

    HTTP Request

    POST https://93.123.109.166:7117/gate/

    HTTP Response

    200
  • 208.95.112.1:80
    http://www.ip-api.com/json
    http
    328 B
     600 B
     6
    3

    HTTP Request

    GET http://www.ip-api.com/json

    HTTP Response

    200
  • 142.250.187.200:443
    ssl.google-analytics.com
    tls
    1.4kB
     6.3kB
     10
    9
  • 93.123.109.166:7117
    https://93.123.109.166:7117/gate/
    tls, http
    2.8kB
     2.3kB
     9
    7

    HTTP Request

    POST https://93.123.109.166:7117/gate/

    HTTP Response

    200
  • 93.123.109.166:7117
    https://93.123.109.166:7117/gate/
    tls, http
    1.8kB
     2.4kB
     9
    8

    HTTP Request

    POST https://93.123.109.166:7117/gate/

    HTTP Response

    200
  • 93.123.109.166:7117
    https://93.123.109.166:7117/gate/
    tls, http
    1.5kB
     2.3kB
     9
    7

    HTTP Request

    POST https://93.123.109.166:7117/gate/

    HTTP Response

    200
  • 93.123.109.166:7117
    https://93.123.109.166:7117/gate/
    tls, http
    1.5kB
     2.4kB
     9
    8

    HTTP Request

    POST https://93.123.109.166:7117/gate/

    HTTP Response

    200
  • 224.0.0.251:5353
    3.9kB
     13
  • 1.1.1.1:53
    android.apis.google.com
    dns
    69 B
     109 B
     1
    1

    DNS Request

    android.apis.google.com

    DNS Response

    216.58.204.78

  • 1.1.1.1:53
    www.ip-api.com
    dns
    60 B
     76 B
     1
    1

    DNS Request

    www.ip-api.com

    DNS Response

    208.95.112.1

  • 1.1.1.1:53
    ssl.google-analytics.com
    dns
    70 B
     86 B
     1
    1

    DNS Request

    ssl.google-analytics.com

    DNS Response

    142.250.187.200

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • /data/data/com.nameown12/.qcom.nameown12
    Filesize

    48B

    MD5

    046a414913add6f5bb60072c7db819b6

    SHA1

    451ee4f6809260aec622d772fd329c7d0297a842

    SHA256

    b66c1320cb063a1d391c94273572ea6edae76c8c8b0a07f8d75c88686f0df72a

    SHA512

    4e6355f3051ed5e811ab030abde1f5be7f5e1cf33be99cd08477e9b6c015deb1d8bd75a09fb9c7176b8511c5ad0a67abc0902a3531e97564ccb6afc57496a47c

    Download Submit

  • /data/data/com.nameown12/kl.txt
    Filesize

    230B

    MD5

    5bf5a591ef9fe7a0bbaa9b00ad0c022d

    SHA1

    fbcb022f7d31aa0caa38462ef279761a04aa5d51

    SHA256

    df2146aad2885302de322dfb91bcef6b1e1e1c6eb534e34b37aed9826c036fd4

    SHA512

    af57e0ce4387a7d505e6df2fb61ec907fb4a713e9f71393e9810c5aa08fe1e2a6ad5284966bd36b195afa887e3a625e15c7302ae834dd7fd4021510200dd3e89

    Download Submit

  • /data/data/com.nameown12/kl.txt
    Filesize

    54B

    MD5

    913ba82c65b0794daf86328cf549c856

    SHA1

    9402bab80810dc7aab6c9945cb9901302a79d0b6

    SHA256

    b50ace00b7b95b9f8989ad8569337129acf1f7d39373fb2104323ee71ea0f7e3

    SHA512

    fa42495568d8deaf53e2b6efc5c30c3edda560a3eabd2db297bcea798219f55c425071c8072706503367b34282eb4582cb2a14edde07a07b55bc5726759e9c9a

    Download Submit

  • /data/data/com.nameown12/kl.txt
    Filesize

    63B

    MD5

    9d33202279e4a2d5a2a62cc574475b79

    SHA1

    d02aa25ae0a5021139d749fe4ddcf5c2aba8d85e

    SHA256

    6a761cb3d60f43b505b24d442e73e24298e4b1c2f5ffdbfdf92f7d181db55c1b

    SHA512

    4ad6513a58d4294e6a108e005f1a19bf77c69aa5ed3f59809aa8d1a79693af543dab5a7dfe2087f27d6b1bdaab083e698f15461083c71d9e2727a178f830e78d

    Download Submit

  • /data/data/com.nameown12/kl.txt
    Filesize

    45B

    MD5

    17107bc9c24118d6aaa2c549bfb9d75c

    SHA1

    c84e1ebf9c167e5fb42e59bddf45646a45ce3e1c

    SHA256

    22e7c7220a0ecb9b50bf3e8c9083f73f193153cf102796a88eaae7e9355cd1a6

    SHA512

    499787e8c509ee65e0f7f92bb2574037dc081ec6e789d229fb6906baeffb13a77ab4341c8347773a53c592037963c429440f42242e9f55f21691d5e80a2f4ff9

    Download Submit

  • /data/data/com.nameown12/kl.txt
    Filesize

    423B

    MD5

    619d7cde593e24f62b130e56b0d59c51

    SHA1

    c40634667b9d144eefa626cb632875b67f90fb74

    SHA256

    48859f9f56a38d272eb895c0cf39772653761f5a375148a0b4b746b9407bcf93

    SHA512

    79dbaf6350a9996e2df3bf5591319cf8c7814663974eb2ef82fb4806ee1b26ac2aca5c6f4285a444acc18a2d97daa06cce4ed4b51abb52f58d3034c93944ac14

    Download Submit

We care about your privacy.

This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.