Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

10

Static

static

6

f46acd7157...ca.apk

android-9-x86

f46acd7157...ca.apk

android-10-x64

10

Analysis

  • max time kernel
    148s
  • max time network
    150s
  • platform
    android-10_x64
  • resource
    android-x64-20240910-en
  • resource tags

    arch:x64arch:x86image:android-x64-20240910-enlocale:en-usos:android-10-x64system
  • submitted
    20/01/2025, 22:02

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    f46acd71577f07eebb00eea91bc70e06488a4c0347180f4877b28707499832ca.apk

  • Size

    2.4MB

  • MD5

    c461218898ff14e1a5cc698362331318

  • SHA1

    dcb0c5dd6521f542db274f19c0fc703d5ba49251

  • SHA256

    f46acd71577f07eebb00eea91bc70e06488a4c0347180f4877b28707499832ca

  • SHA512

    36c40d446cb1bb2571fc8fb67cc1cfb942c334cdde5c4e9e509feb00a72d079389db5331a1c0e53c10d5ca8f2c3b35820795ace39eb074a2cf23837105beef44

  • SSDEEP

    49152:CG2RouIMs0TP0VpYpvpsIJuRXw3SwzRpL+Wk/ErqWRygRtqDyaG2HS9M:a48PkSvWxRXepzbL+3/69Ry8tEyG

Score
10/10
octobankercollectioncredential_accessdefense_evasiondiscoveryevasionimpactinfostealerpersistencerattrojan

Malware Config

Extracted

Family

octo

C2

https://pildirmarkam.com/ZjQ2Njg0MWJjNGE0/

https://admarkam1.com/ZjQ2Njg0MWJjNGE0/

https://telefoncuhanem54.com/ZjQ2Njg0MWJjNGE0/

https://cantikpidebursa161.com/ZjQ2Njg0MWJjNGE0/

https://cigeryiyorum35.com/ZjQ2Njg0MWJjNGE0/
rc4.plain

Extracted

Family

octo

C2

https://pildirmarkam.com/ZjQ2Njg0MWJjNGE0/

https://admarkam1.com/ZjQ2Njg0MWJjNGE0/

https://telefoncuhanem54.com/ZjQ2Njg0MWJjNGE0/

https://cantikpidebursa161.com/ZjQ2Njg0MWJjNGE0/

https://cigeryiyorum35.com/ZjQ2Njg0MWJjNGE0/
AES_key

Signatures

  • Octo

    Octo is a banking malware with remote access capabilities first seen in April 2022.

    bankertrojaninfostealerratocto
  • Octo family
    octo
  • Octo payload 1 IoCs
  • Loads dropped Dex/Jar 1 TTPs 2 IoCs

    Runs executable file dropped to the device during analysis.

    evasion
  • Makes use of the framework's Accessibility service 4 TTPs 2 IoCs

    Retrieves information displayed on the phone screen using AccessibilityService.

    collectiondefense_evasioncredential_access
  • Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
    bankerdiscovery
  • Queries the phone number (MSISDN for GSM devices) 1 TTPs
    discovery
  • Acquires the wake lock 1 IoCs
  • Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs

    Application may abuse the framework's foreground service to continue running in the foreground.

    defense_evasionpersistence
  • Performs UI accessibility actions on behalf of the user 1 TTPs 4 IoCs

    Application may abuse the accessibility service to prevent their removal.

    evasion
  • Queries the mobile country code (MCC) 1 TTPs 1 IoCs
    discovery
  • Reads information about phone network operator. 1 TTPs
    discovery
  • Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs
    persistence
  • Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs
    impact

Processes

  • com.busybehind10
    1⤵
    • Loads dropped Dex/Jar
    • Makes use of the framework's Accessibility service
    • Acquires the wake lock
    • Makes use of the framework's foreground persistence service
    • Performs UI accessibility actions on behalf of the user
    • Queries the mobile country code (MCC)
    • Registers a broadcast receiver at runtime (usually for listening for system events)
    • Uses Crypto APIs (Might try to encrypt user data)
    PID:5071

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • /data/data/com.busybehind10/cache/oat/qzvmqqqiesssqbq.cur.prof
    Filesize

    533B

    MD5

    52222ef819f62b70f928bb1fa7ddf0a4

    SHA1

    d7f04dd309165a4335a4f8a0315db43f6b79c44c

    SHA256

    a2a85254bc92583028a766707980909b8995a48f34d3229c6361f2a84b54da9b

    SHA512

    3c979362bc3903effd6d896a86f2459e5db50c9bde41075e43764990e45d9c5b40baba9de8a8c48ed156175bfda309460fa5b1d0fb3f6038b08be0598eeac651

    Download Submit

  • /data/data/com.busybehind10/cache/qzvmqqqiesssqbq
    Filesize

    2.3MB

    MD5

    ae829ccb53ada4e0f0e85ea6649ad7e3

    SHA1

    877b65e76473684138636e967692585147fcd9d5

    SHA256

    0571ef7fb228deef3aa12cd549040f61ad961254214728d62e37fc5b78ab2916

    SHA512

    2b04c8480d7a9dfa50619a9600e675f75a8a3c4510066020194e7de68e81368410014af088f40cf935221140fd7ef8c7a5bd712396ac996482d8a850878f37b8

    Download Submit