Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    148s
  • max time network
    160s
  • platform
    android-10_x64
  • resource
    android-x64-20240910-en
  • resource tags

    arch:x64arch:x86image:android-x64-20240910-enlocale:en-usos:android-10-x64system
  • submitted
    09/01/2025, 22:00

General

  • Target

    77524fb0a064d6ea5d8092a841d9a2a436790836777941abcf0efddb2eec53be.apk

  • Size

    2.3MB

  • MD5

    c8003e7b185f1ad67eb21b954b1cb45e

  • SHA1

    f3683357280412be0928a47d14d4ca30671a0d7b

  • SHA256

    77524fb0a064d6ea5d8092a841d9a2a436790836777941abcf0efddb2eec53be

  • SHA512

    f1d5b892f7f0ee4be413e96b8b9ff2e392c104e4fbcbf2f1d601f08c64740904d76f1929566ada84854502210f47d5f1767f9cd4e1d30df9781726e9b2281455

  • SSDEEP

    49152:um/JZsn/A0Q2PFzl+Q0wlVFHMhbf+kyOd0FbmqBtyBES8NhtL3Bex+ig2szF:RZsnS2NzOwdQbf+kyOd0FZoBr8Nv3BeS

Malware Config

Extracted

Family

octo

C2

https://ruceayipma.xyz/YjVmNGU0NmNhODlm/

https://yapayzekaisyanlari.xyz/YjVmNGU0NmNhODlm/

https://makineordulariyukseliyor.xyz/YjVmNGU0NmNhODlm/

https://teknolojinisyanhikayesi.xyz/YjVmNGU0NmNhODlm/

https://robotkorsanlargeliyor.xyz/YjVmNGU0NmNhODlm/

https://dunyayirobotlarkapliyor.xyz/YjVmNGU0NmNhODlm/

https://mekanikordularinintikam.xyz/YjVmNGU0NmNhODlm/

https://otomasyonkalesindemucadele.xyz/YjVmNGU0NmNhODlm/

https://robotlarvemakineisyanlari.xyz/YjVmNGU0NmNhODlm/

https://teknolojikseferberlik.xyz/YjVmNGU0NmNhODlm/

https://yapayordularinhikayesi.xyz/YjVmNGU0NmNhODlm/

https://makinevekodisyancilari.xyz/YjVmNGU0NmNhODlm/

https://mekanikorduyolculugu.xyz/YjVmNGU0NmNhODlm/

https://robotikturunculer.xyz/YjVmNGU0NmNhODlm/

https://mekanikisyanveteknoloji.xyz/YjVmNGU0NmNhODlm/

https://makineuyanikaynaklari.xyz/YjVmNGU0NmNhODlm/

https://mekanikseferisyani.xyz/YjVmNGU0NmNhODlm/

https://yapayzekauyanislari.xyz/YjVmNGU0NmNhODlm/

https://robotinsanvedunyavasfi.xyz/YjVmNGU0NmNhODlm/

https://dunyayisaranmekanik.xyz/YjVmNGU0NmNhODlm/

rc4.plain

Extracted

Family

octo

C2

https://ruceayipma.xyz/YjVmNGU0NmNhODlm/

https://yapayzekaisyanlari.xyz/YjVmNGU0NmNhODlm/

https://makineordulariyukseliyor.xyz/YjVmNGU0NmNhODlm/

https://teknolojinisyanhikayesi.xyz/YjVmNGU0NmNhODlm/

https://robotkorsanlargeliyor.xyz/YjVmNGU0NmNhODlm/

https://dunyayirobotlarkapliyor.xyz/YjVmNGU0NmNhODlm/

https://mekanikordularinintikam.xyz/YjVmNGU0NmNhODlm/

https://otomasyonkalesindemucadele.xyz/YjVmNGU0NmNhODlm/

https://robotlarvemakineisyanlari.xyz/YjVmNGU0NmNhODlm/

https://teknolojikseferberlik.xyz/YjVmNGU0NmNhODlm/

https://yapayordularinhikayesi.xyz/YjVmNGU0NmNhODlm/

https://makinevekodisyancilari.xyz/YjVmNGU0NmNhODlm/

https://mekanikorduyolculugu.xyz/YjVmNGU0NmNhODlm/

https://robotikturunculer.xyz/YjVmNGU0NmNhODlm/

https://mekanikisyanveteknoloji.xyz/YjVmNGU0NmNhODlm/

https://makineuyanikaynaklari.xyz/YjVmNGU0NmNhODlm/

https://mekanikseferisyani.xyz/YjVmNGU0NmNhODlm/

https://yapayzekauyanislari.xyz/YjVmNGU0NmNhODlm/

https://robotinsanvedunyavasfi.xyz/YjVmNGU0NmNhODlm/

https://dunyayisaranmekanik.xyz/YjVmNGU0NmNhODlm/

AES_key

Signatures

  • Octo

    Octo is a banking malware with remote access capabilities first seen in April 2022.

  • Octo family
  • Octo payload 1 IoCs
  • Loads dropped Dex/Jar 1 TTPs 1 IoCs

    Runs executable file dropped to the device during analysis.

  • Makes use of the framework's Accessibility service 4 TTPs 2 IoCs

    Retrieves information displayed on the phone screen using AccessibilityService.

  • Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
  • Queries the phone number (MSISDN for GSM devices) 1 TTPs
  • Acquires the wake lock 1 IoCs
  • Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs

    Application may abuse the framework's foreground service to continue running in the foreground.

  • Performs UI accessibility actions on behalf of the user 1 TTPs 4 IoCs

    Application may abuse the accessibility service to prevent their removal.

  • Queries the mobile country code (MCC) 1 TTPs 1 IoCs
  • Reads information about phone network operator. 1 TTPs
  • Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs
  • Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs

Processes

  • com.ability.horror
    1⤵
    • Loads dropped Dex/Jar
    • Makes use of the framework's Accessibility service
    • Acquires the wake lock
    • Makes use of the framework's foreground persistence service
    • Performs UI accessibility actions on behalf of the user
    • Queries the mobile country code (MCC)
    • Registers a broadcast receiver at runtime (usually for listening for system events)
    • Uses Crypto APIs (Might try to encrypt user data)
    PID:5108

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • /data/data/com.ability.horror/app_logic/QbYUj.json

    Filesize

    153KB

    MD5

    69738dfa54cb9e1b651abff0c82507c7

    SHA1

    331c17eec289346566e29cb4180ba237696e4f3c

    SHA256

    a0958fdd832b390b8a09bb7db1e8524d7ee7e97b5dd8060ce2cf67806cc34635

    SHA512

    0e286fb8672e1126274ad24a16c97166630e9faa1527b115f966060d579303218c7939650a9e0407d0b7278f168f9bcce5e313a1cf72a42640bc264cfac499c6

  • /data/data/com.ability.horror/app_logic/QbYUj.json

    Filesize

    153KB

    MD5

    787b5d97e57a176efd44de2daffc4533

    SHA1

    cf009ae443778107c20c21f2a568caa2bec32a57

    SHA256

    4a80ada5fa8a2dcb0ee282a9bb90d9a1be290d41ff82b6a5d3b2ab6971b9472e

    SHA512

    8d86491f7a5e573104ac9645637c2477d98ac479deef91c872c98cfca7c4c6c256dd3a7aee598df8716e07f9abfa972d48f49cfdcc2dc33bb152dd4265b61340

  • /data/user/0/com.ability.horror/app_logic/QbYUj.json

    Filesize

    450KB

    MD5

    59d3dfdf0568716795b1910cf443dce1

    SHA1

    521a5cd5aed4f75f556b2f6dc67155e9c5d71f0f

    SHA256

    97e74db86e68a4e4cc3d70e75cdf2273a6c68f99031ce4036a2e569db3684af6

    SHA512

    fb561061e4d46df2809b2c4f07fcb7f5e7e48d7e1538f7b461eed4bf35a98e3519fc522d5a8093070f52107893fd050c805b99563b8d84c9e3c7062d4533e0de