Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

General

  • Target

    4cdd3f83dcab4dd118ee3cf5ab4561e0bf73bc879e107fe6f70c8669322a856b.bin

  • Size

    2.7MB

  • Sample

    241222-1wyg4s1kap

  • MD5

    e28d7aa5f884284dd194bf6444d510a8

  • SHA1

    1346c2ece11e586b0046c425a98d2d787775cf71

  • SHA256

    4cdd3f83dcab4dd118ee3cf5ab4561e0bf73bc879e107fe6f70c8669322a856b

  • SHA512

    d73b1ac3cbf53aca44eb424f988a90e4707a474dcd95a29d33f4ad593ed3b4683976220a54547b9ccd42085fc39855b720cb0306e3915fa687c3bfb9dbcb919e

  • SSDEEP

    49152:ZYoQrw6Kjcf1ObPyI4trAm8a8KLGBHzFOTkCMmn6U9BrVT9mDl8r601sS8IQ6:6oQrwFjEI4iZaUzYH99yIl

Malware Config

Extracted

Family

octo

C2

https://93.123.109.166:7117/gate/

rc4.plain
1
ntIkBrPN9abLOCltkM

Extracted

Family

octo

C2

https://93.123.109.166:7117/gate/

https://93.123.109.166:8080/rootmd50ma/panelcgfuzwxleg9kdxnvy3rv/gate/

https://93.123.109.166:80/builderxxxzzz/gate/

Attributes
  • target_apps

    at.spardat.bcrmobile

    at.spardat.netbanking

    com.bankaustria.android.olb

    com.bmo.mobile

    com.cibc.android.mobi

    com.rbc.mobile.android

    com.scotiabank.mobile

    com.td

    cz.airbank.android

    eu.inmite.prj.kb.mobilbank

    com.bankinter.launcher

    com.kutxabank.android

    com.rsi

    com.tecnocom.cajalaboral

    es.bancopopular.nbmpopular

    es.evobanco.bancamovil

    es.lacaixa.mobile.android.newwapicon

    com.dbs.hk.dbsmbanking

    com.FubonMobileClient

    com.hangseng.rbmobile

    com.MobileTreeApp

    com.mtel.androidbea

    com.scb.breezebanking.hk

    hk.com.hsbc.hsbchkmobilebanking

    com.aff.otpdirekt

    com.ideomobile.hapoalim

    com.infrasofttech.indianBank

    com.mobikwik_new

    com.oxigen.oxigenwallet

    jp.co.aeonbank.android.passbook

AES_key
1
3534353639643261616165373137363333356136376266373265383637333666

Targets

    • Target

      4cdd3f83dcab4dd118ee3cf5ab4561e0bf73bc879e107fe6f70c8669322a856b.bin

    • Size

      2.7MB

    • MD5

      e28d7aa5f884284dd194bf6444d510a8

    • SHA1

      1346c2ece11e586b0046c425a98d2d787775cf71

    • SHA256

      4cdd3f83dcab4dd118ee3cf5ab4561e0bf73bc879e107fe6f70c8669322a856b

    • SHA512

      d73b1ac3cbf53aca44eb424f988a90e4707a474dcd95a29d33f4ad593ed3b4683976220a54547b9ccd42085fc39855b720cb0306e3915fa687c3bfb9dbcb919e

    • SSDEEP

      49152:ZYoQrw6Kjcf1ObPyI4trAm8a8KLGBHzFOTkCMmn6U9BrVT9mDl8r601sS8IQ6:6oQrwFjEI4iZaUzYH99yIl

    • Octo

      Octo is a banking malware with remote access capabilities first seen in April 2022.

    • Octo family

    • Removes its main activity from the application launcher

    • Makes use of the framework's Accessibility service

      Retrieves information displayed on the phone screen using AccessibilityService.

    • Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps)

    • Queries the phone number (MSISDN for GSM devices)

    • Acquires the wake lock

    • Makes use of the framework's foreground persistence service

      Application may abuse the framework's foreground service to continue running in the foreground.

    • Performs UI accessibility actions on behalf of the user

      Application may abuse the accessibility service to prevent their removal.

    • Queries the mobile country code (MCC)

    • Queries the unique device ID (IMEI, MEID, IMSI)

    • Reads information about phone network operator.

    • Requests accessing notifications (often used to intercept notifications before users become aware).

    • Requests disabling of battery optimizations (often used to enable hiding in the background).

    • Requests modifying system settings.

MITRE ATT&CK Mobile v15

Tasks

We care about your privacy.

This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.