Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

General

  • Target

    c602b505ac9a4f3620b9a27a7c7c9a9f.bin

  • Size

    2.7MB

  • Sample

    250107-b6tt8sxrgx

  • MD5

    e3ec6b0e2524a96ccb11d9e08eeafeff

  • SHA1

    f59f70fbec37ccdd1fc819ce8539468fcd1c0c2b

  • SHA256

    1b6189bb2700454c7f42d86079b46daecf738fecca4aab8999bf77bc240ca13a

  • SHA512

    b5ed94a8bbe2ed1380f0d7620f12d607d8baf2b7f14992cdde2e53ee6b69938ff789ab3bd0d7a94e98abcb0459d7dfc4ee3c09dd0e6b524dfa9d1c7f7fba9317

  • SSDEEP

    49152:+RwGvPjb6Thm/g+I/Mo+6qmG2nJnv4fdTI6/NR0SjXccNJc8F:BSa786U2nJv4f5I6/NRHjZbc8F

Malware Config

Extracted

Family

octo

C2

https://212a947ce8a77f478fc25a920d4cf6e0.com

Attributes
  • target_apps

    at.spardat.bcrmobile

    at.spardat.netbanking

    com.bankaustria.android.olb

    com.bmo.mobile

    com.cibc.android.mobi

    com.rbc.mobile.android

    com.scotiabank.mobile

    com.td

    cz.airbank.android

    eu.inmite.prj.kb.mobilbank

    com.bankinter.launcher

    com.kutxabank.android

    com.rsi

    com.tecnocom.cajalaboral

    es.bancopopular.nbmpopular

    es.evobanco.bancamovil

    es.lacaixa.mobile.android.newwapicon

    com.dbs.hk.dbsmbanking

    com.FubonMobileClient

    com.hangseng.rbmobile

    com.MobileTreeApp

    com.mtel.androidbea

    com.scb.breezebanking.hk

    hk.com.hsbc.hsbchkmobilebanking

    com.aff.otpdirekt

    com.ideomobile.hapoalim

    com.infrasofttech.indianBank

    com.mobikwik_new

    com.oxigen.oxigenwallet

    jp.co.aeonbank.android.passbook

AES_key
1
65353137663730336236313531383765
AES_key
1
783178337835783778392d6263646566
AES_key
1
64666137636663303932653334396534
AES_key
1
34613566363239616131353337616537
AES_key
1
31663339303936356363653935373565
AES_key
1
66363132336331346636343337646561
AES_key
1
62393363303766326134636261626262
AES_key
1
32666535363331633163613863386161
AES_key
1
31613938393536326530666537313633
AES_key
1
34666135313664336263386138336532
AES_key
1
64393164396361666138373961643966
AES_key
1
65653636333062613131363134366235
AES_key
1
32373166343264666464653331316531
AES_key
1
62383135353764383131613534643837

Targets

    • Target

      16219c346d9b3535633f07ad18741be4ad7ec7bca4f454838aa17b2658259cf0.apk

    • Size

      4.8MB

    • MD5

      c602b505ac9a4f3620b9a27a7c7c9a9f

    • SHA1

      94f9cfc4629544d9def7553c6085e298197b19ca

    • SHA256

      16219c346d9b3535633f07ad18741be4ad7ec7bca4f454838aa17b2658259cf0

    • SHA512

      5802d2a8a29533da0b816238c494bfbfe3f18d84e1bdcc760c40e85bbbab3cefb2a168c8ee49d93f2bf9d3c5fc45ac52b4b72efad455ae5e182ec4b9c8653532

    • SSDEEP

      49152:ARsEXk0ksvKAcj7k45iS7xrGXrAi/l5jVKScDZn2ua0i4FENwiIhXGI:ARsnHsvBcj7N5iSRGNBVKn9iMEJm/

    • Octo

      Octo is a banking malware with remote access capabilities first seen in April 2022.

    • Octo family

    • Octo payload

    • Removes its main activity from the application launcher

    • Loads dropped Dex/Jar

      Runs executable file dropped to the device during analysis.

    • Makes use of the framework's Accessibility service

      Retrieves information displayed on the phone screen using AccessibilityService.

    • Obtains sensitive information copied to the device clipboard

      Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.

    • Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps)

    • Queries the phone number (MSISDN for GSM devices)

    • Acquires the wake lock

    • Makes use of the framework's foreground persistence service

      Application may abuse the framework's foreground service to continue running in the foreground.

    • Queries the mobile country code (MCC)

    • Queries the unique device ID (IMEI, MEID, IMSI)

    • Reads information about phone network operator.

    • Requests disabling of battery optimizations (often used to enable hiding in the background).

    • Tries to add a device administrator.

MITRE ATT&CK Mobile v15

Tasks

We care about your privacy.

This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.