Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
142s -
platform
android_x64 -
resource
android-33-x64-arm64-20240624-en -
resource tags
-
submitted
20/01/2025, 22:00
General
-
Target
ec671e13e47c6212495f517dade9355b6b1890c82a0cfebdcfc2f98743e9cdfa.apk
-
Size
2.7MB
-
MD5
8965e859df1620892646aa3a7b1bb92b
-
SHA1
631cfdbb25335ef4cd9444d26d441a8304acb71a
-
SHA256
ec671e13e47c6212495f517dade9355b6b1890c82a0cfebdcfc2f98743e9cdfa
-
SHA512
62109ba049dfbcdaf8e2e4fdfd41cee999ee335408dc3f572d6c96eb163196960af8f98f83d05021f722e6ff3262ade660b7c1c9f88214d7de6834d2571de29d
-
SSDEEP
49152:aj16Kjcf1ObPyI4trAm8a8KLGBHzFOTkCMmn6U9BrVT9mDl8r601sS8IQ9M:yFjEI4iZaUzYH99yIx
Malware Config
Extracted
octo
https://85.31.47.134:7117/gate/
https://85.31.47.134:8080/rootmd50ma/panelcgfuzwxleg9kdxnvy3rv/gate/
https://85.31.47.134:80/builderxxxzzz/gate/
-
target_apps
at.spardat.bcrmobile
at.spardat.netbanking
com.bankaustria.android.olb
com.bmo.mobile
com.cibc.android.mobi
com.rbc.mobile.android
com.scotiabank.mobile
com.td
cz.airbank.android
eu.inmite.prj.kb.mobilbank
com.bankinter.launcher
com.kutxabank.android
com.rsi
com.tecnocom.cajalaboral
es.bancopopular.nbmpopular
es.evobanco.bancamovil
es.lacaixa.mobile.android.newwapicon
com.dbs.hk.dbsmbanking
com.FubonMobileClient
com.hangseng.rbmobile
com.MobileTreeApp
com.mtel.androidbea
com.scb.breezebanking.hk
hk.com.hsbc.hsbchkmobilebanking
com.aff.otpdirekt
com.ideomobile.hapoalim
com.infrasofttech.indianBank
com.mobikwik_new
com.oxigen.oxigenwallet
jp.co.aeonbank.android.passbook
Signatures
-
Octo
Octo is a banking malware with remote access capabilities first seen in April 2022.
-
Octo family
-
Makes use of the framework's Accessibility service 4 TTPs 2 IoCs
Retrieves information displayed on the phone screen using AccessibilityService.
-
Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
-
Queries the phone number (MSISDN for GSM devices) 1 TTPs
-
Acquires the wake lock 1 IoCs
-
Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs
Application may abuse the framework's foreground service to continue running in the foreground.
-
Performs UI accessibility actions on behalf of the user 1 TTPs 4 IoCs
Application may abuse the accessibility service to prevent their removal.
-
Queries the mobile country code (MCC) 1 TTPs 1 IoCs
-
Reads information about phone network operator. 1 TTPs
-
Requests accessing notifications (often used to intercept notifications before users become aware). 1 TTPs 1 IoCs
-
Requests disabling of battery optimizations (often used to enable hiding in the background). 1 TTPs 1 IoCs
-
Requests modifying system settings. 1 IoCs
-
Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs
Processes
-
com.nameown121⤵
- Makes use of the framework's Accessibility service
- Acquires the wake lock
- Makes use of the framework's foreground persistence service
- Performs UI accessibility actions on behalf of the user
- Queries the mobile country code (MCC)
- Requests accessing notifications (often used to intercept notifications before users become aware).
- Requests disabling of battery optimizations (often used to enable hiding in the background).
- Requests modifying system settings.
- Uses Crypto APIs (Might try to encrypt user data)
Network
MITRE ATT&CK Mobile v15
Defense Evasion
Foreground Persistence
1Hide Artifacts
1User Evasion
1Impair Defenses
1Prevent Application Removal
1Input Injection
1Credential Access
Access Notifications
1Input Capture
2GUI Input Capture
1Keylogging
1Discovery
Software Discovery
1Security Software Discovery
1System Network Configuration Discovery
3Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
48B
MD5046a414913add6f5bb60072c7db819b6
SHA1451ee4f6809260aec622d772fd329c7d0297a842
SHA256b66c1320cb063a1d391c94273572ea6edae76c8c8b0a07f8d75c88686f0df72a
SHA5124e6355f3051ed5e811ab030abde1f5be7f5e1cf33be99cd08477e9b6c015deb1d8bd75a09fb9c7176b8511c5ad0a67abc0902a3531e97564ccb6afc57496a47c
-
Filesize
214B
MD54625743837d65af62fa8b81f64f292d6
SHA1c634ad020a7b786d4efc80c88ecaa9b6018d5500
SHA256a4d68316f986b63f8334a913e5c6d9b41f109e6169205a490ddf58adf9105626
SHA512fc3d0195bab8b1cb4e4c766b0effb04e446ac23f64fcec42691d70c4add8f612df95c595cb3b791923751e08e36643d999d6d9b46177851215885cf0d72b690b
-
Filesize
54B
MD54d2b22b3ef95d965ec001a1057ce796d
SHA13a051ae091f728bf39bccc7669ddf3286dbf7f7f
SHA25680c059d7c3679ef5a71f643acd2b8e37378c2533c74760cb0f95387e685b2097
SHA512267b0775a63017775ff6c2c819e50d03756df196ff77b9ab3b1bb72f713954af5ad7d0e4e578ec7a400fbbcfc656efb8c76e33218676d398596a718171320b44
-
Filesize
68B
MD5bf1b383be6e0973d8ad850a48f8ff4a1
SHA1e023fb187c4f38f61b19972dca4bba56757f79e0
SHA256437c49f6bc086bca6f40e500e22f6bddba26b25e6afebc72e719e3dfbf088660
SHA512bfa991f3aa2e1580ffc463d7755c4eac40af18e54507c1321c9e812752b47349a0ca1c22d4f680e38d982a36ae2cec599b70bd773fba1bbff04abc93b6cb6f47
-
Filesize
214B
MD5eab13117474a1af3f80d211338d8a69e
SHA1c0c4d74cf3bfd8ba0474f30cdc43a7b8b87590b7
SHA2568ef2e81baaaba6e14b4d2de511d1abbcfc56c86a823f13ab001533e341bf53da
SHA51251bef1bcf5cf843e0cf016901584582acdc7b2f7e4f83839afc0ee6ab40378346c14400265d266e0868d474bebbef24392f6b3affb502426837c093e5b66e500
-
Filesize
52B
MD5ff7722e17c816b311f13d72347074e42
SHA1fe319cc9c2830585676b835d46b42ef80fb4a000
SHA25690b1704648235e8d4408d267429299eb26fd3b540c10cd4bdc95b0d46bab8ee0
SHA5128b1374d166332cc6084aca43d42f210b99b18db5819c04cfb3c25c593f424506cf522025562818fc546e6b4986766beab51ffb7dbb8accb0b8d36c1cb6440b4c
-
Filesize
70B
MD564f219a127647873aeedb83f99e51cc5
SHA1990f7327a22daed12ca2008d765480587e2ba94d
SHA256e524152641b1829ca3f1541ee230b2074c03566ab3fd2abb908e47355e3ecec2
SHA5121a250fc3227e072c0656397560ae49d6b6b0a0a3d1b4c5abc1df1911ee59b5d4a7579b335c60b2354f108748f749679f8ee40f60c22fa1cc03f7664e1c787f39
-
Filesize
55B
MD57a6780e8e03300ceaca3bc3ad0ebd3b0
SHA161f81f785c8da4836783b1372e9dd233dde5b376
SHA2564be776484eaa07563510041c94c2d1ab091918592fdd65899981e9c9cf762f2a
SHA5121eeea44a72a54e5c4abf80e2917c436781bfecb6f0a1035c90c1977b9389d6db083464893dfeb8d38cbd8c43461d7862fc23cdf30c4845b717e6b31dcad2468b
-
Filesize
70B
MD566e4329d336b25e63d17b4d71592df9e
SHA1f29c2cc8e04e86d6b29039bb5c38f5a9fd8348e0
SHA2565ea80390e0330109b4717adf7eea74467bc08f6ad560452e776eab2104121a29
SHA512d98dd2d4424208fe895150bf5a51bbc8afe2caddd7ebc6814c0676ba4852a4c1f1c3ed8ce99d47bcbe530dd37646a4f13ec5c7e7baf8cacf978c35c8706905e6
-
Filesize
79B
MD5f8885e891d624b5b5978651609747cb9
SHA198a75e1801792a0f3cf2deeb45d6f147b76f4fc7
SHA2562c99dd561fb4c655c4e18917e4fb951da3f3f1c551ab3f2937fcd4568ec0785b
SHA512380fc472e640c81f7af2a183bc4075e80dc201da8b8ed35b32f9dd35dec177fb9436237e1a2c517549f4e4b2edf1abb201420a69b997321deb5aea459506b855
-
Filesize
490B
MD5a81bf0354488896850bcbd8dd2fd33a4
SHA175e614fed7670f17ec0aa7a202a43a68c6e5badc
SHA256191b774b60a5bb77aae2d4ba39c8fbbcb763bc4c3a581345a16889d99f51f816
SHA5123a36a38cf79fba37be9533b9c6e1c54a09e02243e523080ce4af7896545764595b851c2c506bc58b11981561350cc12ef6adf5d3d7ebd7fa4ba8bd9e47170839
-
Filesize
214B
MD5f639894769a3a530f0986852d3310d37
SHA147dc01574df0ce51ab4963c00eb737367c3db0fe
SHA256b32f0f8ce7aef6c380bd3a360bf058a5016e2f0231293aedb63cb8880cd9fa12
SHA512f4613087bbc7c413ddb9918d7e524bf999103ef0d66154a9881f3df0f9ff2eefba077db09764d604fd2ee1c2afff2dbdfe3c7dab43a832a7d5c23fd5640fb2a0