Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

10

Static

static

6

8dde417520...f1.apk

android-9-x86

8dde417520...f1.apk

android-10-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    8dde4175208409616454647991f27384b94f529f6740285bbb9561c07dbd0af1.bin

  • Size

    1.6MB

  • Sample

    250110-1xljyaskdq

  • MD5

    9247b93b661123710d406698ca236f5b

  • SHA1

    e31798395d56ea9451d408001be4171dfcdf0a48

  • SHA256

    8dde4175208409616454647991f27384b94f529f6740285bbb9561c07dbd0af1

  • SHA512

    dcece60635af1bdacac3411e3f308c56d071e8cbbb25358f3a6bf6b6c6fa22dfe8c1efc9890c6819e4a4a24421ad3047fbbb631727b7dfa8afe7ae62b82507ff

  • SSDEEP

    49152:cD+nnWUIxonZzsnK1jYHtKnDzPAGsYGABIs/G+TB6BrRA441tGX3CJX91L10:cIWF2zsnK1utKDps3ABIL+16tRJ414Xt

Score
10/10
octoandroidbankerdiscoveryevasioninfostealerrattrojan

Malware Config

Extracted

Family

octo

C2

https://otorisotobuyukisyan.xyz/MzhiMTg0NTAwOTY5/

https://otorisotomakineler.xyz/MzhiMTg0NTAwOTY5/

https://otorisotoyukselishik.xyz/MzhiMTg0NTAwOTY5/

https://otorisotokontrol.xyz/MzhiMTg0NTAwOTY5/

https://otorisotomucadele.xyz/MzhiMTg0NTAwOTY5/

https://otorisotodunyasiyasi.xyz/MzhiMTg0NTAwOTY5/

https://otorisotogelecek.xyz/MzhiMTg0NTAwOTY5/

https://otorisotoveintikam.xyz/MzhiMTg0NTAwOTY5/

https://otorisotouyanisi.xyz/MzhiMTg0NTAwOTY5/

https://otorisotomakineleri.xyz/MzhiMTg0NTAwOTY5/

https://otorisototarihiyolu.xyz/MzhiMTg0NTAwOTY5/

https://otorisotoinsani.xyz/MzhiMTg0NTAwOTY5/

https://otorisotogucoyunu.xyz/MzhiMTg0NTAwOTY5/

https://otorisotopaylasim.xyz/MzhiMTg0NTAwOTY5/

https://otorisototeknoloji.xyz/MzhiMTg0NTAwOTY5/

https://otorisotomakinasanati.xyz/MzhiMTg0NTAwOTY5/

https://otorisotoplatform.xyz/MzhiMTg0NTAwOTY5/

https://otorisotomucadelesan.xyz/MzhiMTg0NTAwOTY5/

https://otorisotoarastirmasi.xyz/MzhiMTg0NTAwOTY5/

https://otorisotounutulmaz.xyz/MzhiMTg0NTAwOTY5/
rc4.plain

Targets

    • Target

      8dde4175208409616454647991f27384b94f529f6740285bbb9561c07dbd0af1.bin

    • Size

      1.6MB

    • MD5

      9247b93b661123710d406698ca236f5b

    • SHA1

      e31798395d56ea9451d408001be4171dfcdf0a48

    • SHA256

      8dde4175208409616454647991f27384b94f529f6740285bbb9561c07dbd0af1

    • SHA512

      dcece60635af1bdacac3411e3f308c56d071e8cbbb25358f3a6bf6b6c6fa22dfe8c1efc9890c6819e4a4a24421ad3047fbbb631727b7dfa8afe7ae62b82507ff

    • SSDEEP

      49152:cD+nnWUIxonZzsnK1jYHtKnDzPAGsYGABIs/G+TB6BrRA441tGX3CJX91L10:cIWF2zsnK1utKDps3ABIL+16tRJ414Xt

    Score
    10/10
    octobankerdiscoveryevasioninfostealerrattrojan

    • Octo

      Octo is a banking malware with remote access capabilities first seen in April 2022.

      bankertrojaninfostealerratocto

    • Octo family

      octo

    • Octo payload

    • Loads dropped Dex/Jar

      Runs executable file dropped to the device during analysis.

      evasion

    • Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps)

      bankerdiscovery
    behavioral1behavioral2

MITRE ATT&CK Mobile v15

Tasks