Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    149s
  • max time network
    156s
  • platform
    android_x64
  • resource
    android-33-x64-arm64-20240624-en
  • resource tags

    androidarch:arm64arch:x64image:android-33-x64-arm64-20240624-enlocale:en-usos:android-13-x64system
  • submitted
    18/01/2025, 22:03

General

  • Target

    c09011b78cbe43730394d81184a1b9a12ce6b8c78f0c8b726e56d7920d7912b8.apk

  • Size

    2.4MB

  • MD5

    2cb1098e144f8f65541d9f72f22a5ebf

  • SHA1

    ed945df638f55279c4d3700fec4b6a7c7a2d8137

  • SHA256

    c09011b78cbe43730394d81184a1b9a12ce6b8c78f0c8b726e56d7920d7912b8

  • SHA512

    5c29d74229a6e2e1ae65adf109ec40025ae6c53cec1512f2529cbb85245e222f03386726ff650dc050120975b4cdb82012b8ad2d348dab103af57a930ccf4cf9

  • SSDEEP

    49152:FHtONEZ+8/s00WFXwDfNIUj2kkAoLmHCdDWjwKSLPBQfs0dgeEQr:7HBVGHj2kox6NCPBmldEQr

Malware Config

Extracted

Family

octo

C2

https://91.215.85.142/NTA4MzIxMjdkYzNj/

https://edfwn923sfdml237vm90sdl23k.com/NTA4MzIxMjdkYzNj/

https://823jkfs4829nk48kef742kj675.com/NTA4MzIxMjdkYzNj/

https://sdglk33498knsf32667sfknwfr.com/NTA4MzIxMjdkYzNj/

https://952dsjk47kf73ls23k489klfdd.com/NTA4MzIxMjdkYzNj/

https://nzxvjej7337bjsdl232nsdlsfa.com/NTA4MzIxMjdkYzNj/

https://2348sdks230df834sd03272nsd.com/NTA4MzIxMjdkYzNj/

rc4.plain

Extracted

Family

octo

C2

https://91.215.85.142/NTA4MzIxMjdkYzNj/

https://edfwn923sfdml237vm90sdl23k.com/NTA4MzIxMjdkYzNj/

https://823jkfs4829nk48kef742kj675.com/NTA4MzIxMjdkYzNj/

https://sdglk33498knsf32667sfknwfr.com/NTA4MzIxMjdkYzNj/

https://952dsjk47kf73ls23k489klfdd.com/NTA4MzIxMjdkYzNj/

https://nzxvjej7337bjsdl232nsdlsfa.com/NTA4MzIxMjdkYzNj/

https://2348sdks230df834sd03272nsd.com/NTA4MzIxMjdkYzNj/

https://hgfghjgf435gghjeerg43567nvz78845rt4.com/NTA4MzIxMjdkYzNj/

https://6tythgfghjgf435g675656nv354yrt54y545.com/NTA4MzIxMjdkYzNj/

https://65regfghjgf4rt345er35gnvt545yrt4345.com/NTA4MzIxMjdkYzNj/

https://634557hgfghjgf43ytjt3585gnvzv54rt5t345.com/NTA4MzIxMjdkYzNj/

Attributes
  • target_apps

    at.spardat.bcrmobile

    com.google.android.apps.messaging

    com.samsung.android.messaging

    at.spardat.netbanking

    com.bankaustria.android.olb

    com.bmo.mobile

    com.cibc.android.mobi

    com.rbc.mobile.android

    com.scotiabank.mobile

    com.td

    cz.airbank.android

    eu.inmite.prj.kb.mobilbank

    com.bankinter.launcher

    com.kutxabank.android

    com.rsi

    com.tecnocom.cajalaboral

    es.bancopopular.nbmpopular

    es.evobanco.bancamovil

    es.lacaixa.mobile.android.newwapicon

    com.dbs.hk.dbsmbanking

    com.FubonMobileClient

    com.hangseng.rbmobile

    com.MobileTreeApp

    com.mtel.androidbea

    com.scb.breezebanking.hk

    hk.com.hsbc.hsbchkmobilebanking

    com.aff.otpdirekt

    com.ideomobile.hapoalim

    com.infrasofttech.indianBank

    com.mobikwik_new

AES_key

Signatures

  • Octo

    Octo is a banking malware with remote access capabilities first seen in April 2022.

  • Octo family
  • Octo payload 1 IoCs
  • Loads dropped Dex/Jar 1 TTPs 1 IoCs

    Runs executable file dropped to the device during analysis.

  • Makes use of the framework's Accessibility service 4 TTPs 2 IoCs

    Retrieves information displayed on the phone screen using AccessibilityService.

  • Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
  • Queries the phone number (MSISDN for GSM devices) 1 TTPs
  • Acquires the wake lock 1 IoCs
  • Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs

    Application may abuse the framework's foreground service to continue running in the foreground.

  • Performs UI accessibility actions on behalf of the user 1 TTPs 3 IoCs

    Application may abuse the accessibility service to prevent their removal.

  • Queries the mobile country code (MCC) 1 TTPs 1 IoCs
  • Reads information about phone network operator. 1 TTPs
  • Requests accessing notifications (often used to intercept notifications before users become aware). 1 TTPs 1 IoCs
  • Requests disabling of battery optimizations (often used to enable hiding in the background). 1 TTPs 1 IoCs
  • Requests modifying system settings. 1 IoCs
  • Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs

Processes

  • com.standwarmv
    1⤵
    • Loads dropped Dex/Jar
    • Makes use of the framework's Accessibility service
    • Acquires the wake lock
    • Makes use of the framework's foreground persistence service
    • Performs UI accessibility actions on behalf of the user
    • Queries the mobile country code (MCC)
    • Requests accessing notifications (often used to intercept notifications before users become aware).
    • Requests disabling of battery optimizations (often used to enable hiding in the background).
    • Requests modifying system settings.
    • Uses Crypto APIs (Might try to encrypt user data)
    PID:4320

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • /data/data/com.standwarmv/.qcom.standwarmv

    Filesize

    48B

    MD5

    046a414913add6f5bb60072c7db819b6

    SHA1

    451ee4f6809260aec622d772fd329c7d0297a842

    SHA256

    b66c1320cb063a1d391c94273572ea6edae76c8c8b0a07f8d75c88686f0df72a

    SHA512

    4e6355f3051ed5e811ab030abde1f5be7f5e1cf33be99cd08477e9b6c015deb1d8bd75a09fb9c7176b8511c5ad0a67abc0902a3531e97564ccb6afc57496a47c

  • /data/data/com.standwarmv/.qcom.standwarmv

    Filesize

    88B

    MD5

    9d07d551733b15dab2dcfdd0384fcc2c

    SHA1

    5f2a304c61ecc7f29b34e7c09cfaf9f2da01ebcb

    SHA256

    d91effc3c1f75afadcf7a3ebd9d3cc3f19dd344c7183d2da97ec044b34018a47

    SHA512

    b66b1b37e2e808bec5935eb8a8bd8bacbcaa6fb4ca409b74f6eade0a6a91f68ff14df0a1cb07243beaf67ba6d766affcd1d0d2ae70e7743808684778847897b5

  • /data/data/com.standwarmv/cache/buigopghbjftb

    Filesize

    2.3MB

    MD5

    76578626b833a11e59cbeee7c67c3d0b

    SHA1

    ce084ff415f830ac44950059af1077e646242e1b

    SHA256

    0c7313488d07185a0897fea39d8b323ef2cf59c20d0ed22c173d33e4e1fd7bb3

    SHA512

    62702a97d8cd504f7e9817876152e4d52b9f9fa94725a31fcd0c7fbe5cc4027102d51a99f90292c22d1d5182fa359be2984174d7bee96830b1a7bf59dca6b7e7

  • /data/data/com.standwarmv/cache/oat/buigopghbjftb.cur.prof

    Filesize

    422B

    MD5

    0da826a85d9e26c5a635385c4e063e4b

    SHA1

    40ae42720782c2cd215cd319fd38c14a999931ce

    SHA256

    1c876a631c22322b6e60a96a7d4c75f02b4f048c03163fdaa7abfdf79de48d09

    SHA512

    da4d3593c2e8b93c8a155b4226109a8710077aeebba20f93ec44d9db2433f2dd09a7a73c8a7774c0409d4f3489e24c04414cc8f826dc21f59b4619d93955bf45

  • /data/data/com.standwarmv/kl.txt

    Filesize

    504B

    MD5

    a44fd6b03fced24c0a6b6b7cb0cb7167

    SHA1

    0f566234db75606cb3ec467c7a97bf0517978a42

    SHA256

    ca9e5638e1d35ddab3451f48c470e298b0dfbc7949257ea2f2e35be40157d016

    SHA512

    1128fa1aa41204acff0007703211a8eac17e9229b8d5e6d7f91f0711a29475016606b1fe62230b2b24b4f650a773c59d4f6b7b6aa7300987d615b8c90dc48a11

  • /data/data/com.standwarmv/kl.txt

    Filesize

    221B

    MD5

    debefba54f669abd23a584b8d30940d2

    SHA1

    fdc0717f5d45f8e1f12da73b4e61373b7ae7dfb4

    SHA256

    34083562b2e4d36988f3ebba022b9ea6786ccdd7be0d55f578bed567c83cc7fa

    SHA512

    0997df3205476d59c3f9e2e8c4440c4947c53dfed03b1fdcba310308e24b07305be889472dfb626808e4b40ef80edc167c3f818a1187cf8d4ceb5f0434269e9b

  • /data/data/com.standwarmv/kl.txt

    Filesize

    54B

    MD5

    2d81e39d2a51e482bf4fcd67264fad1c

    SHA1

    2e9fc6f39af9c5613499327188ca27f5751b470a

    SHA256

    0734bf7658f1a149cdfe0963b7710c3fce97b232429053b2c0b74ad90b67c347

    SHA512

    0d59dc7998083c3bd263eb36cad2af60a35db487eb5d0937e38d95a0fdea080b0491e5d755b74370e829811a3593f033b09425d87ff6704d2fe67391fc35999d

  • /data/data/com.standwarmv/kl.txt

    Filesize

    68B

    MD5

    1fc0535a07b6ce9f12027ab1a7dfbf73

    SHA1

    abc6524616d41581132316ef66b8a26e00e73449

    SHA256

    d5febeba812c1992c594c100f34ef69806daabd252826d462369399f549ed38f

    SHA512

    cf0454b025e869945a89ca2d10aa0ffff968ed5237122b951a0276c793f168fa811b0396c56875c4621dfd5c1d1b5d376618102b027382e3c3dfb7514b8225e2

  • /data/data/com.standwarmv/kl.txt

    Filesize

    60B

    MD5

    ffbe893b73513ee52f3b45ad4c74087e

    SHA1

    00f640aacba3a2f778deebbcc7370971265cff91

    SHA256

    7fed8adef1cfc80da4f6e2e76ac8a623abe6fca9c5ec19797a550751d9bb9396

    SHA512

    419283b18c7fa71a3b342e5dd345a8c3e665e801632bd6fb3f5da5bbb32f79e4b4f682b65ebcd9d13f217eea7d37069a4eccb2d247e9d1bb56d5b5474d991ae0