Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    149s
  • max time network
    152s
  • platform
    android-11_x64
  • resource
    android-x64-arm64-20240910-en
  • resource tags

    arch:armarch:arm64arch:x64arch:x86image:android-x64-arm64-20240910-enlocale:en-usos:android-11-x64system
  • submitted
    21/01/2025, 22:01

General

  • Target

    0afb0bb5a75b2ecef20999cd6492b103800bb5d8b79eee32b996d261ae7d3f8e.apk

  • Size

    1.4MB

  • MD5

    3e7cb7780755538c346f77b958651843

  • SHA1

    fec0b6a38b63d2677e6c62d4b72d0f2534993f42

  • SHA256

    0afb0bb5a75b2ecef20999cd6492b103800bb5d8b79eee32b996d261ae7d3f8e

  • SHA512

    ae697478d51b163b06eb43c7f4a1911851be51ee5c80204dab3d0386a27b3e4abf10fb5928f966fc84f480aa7b4c3e3dfd6f29a996b628569cfe6f50754bbec6

  • SSDEEP

    24576:kLYhLk6keuYCHZzDJ0Ui1a/QqYXkOkAVPOJK6c+gFiPNnHfKwm:kk66EDFiUiI/YXrNu4FiFnHyZ

Malware Config

Extracted

Family

octo

C2

https://hastanebilgimtarih.xyz/MzhiMTg0NTAwOTY5/

https://yenisurencenyenifikir.xyz/MzhiMTg0NTAwOTY5/

https://yenisurencenkulturu.xyz/MzhiMTg0NTAwOTY5/

https://yenisurencenvizyon.xyz/MzhiMTg0NTAwOTY5/

https://yenisurencenplatform.xyz/MzhiMTg0NTAwOTY5/

https://yenisurencenyasam.xyz/MzhiMTg0NTAwOTY5/

https://yenisurencengundem.xyz/MzhiMTg0NTAwOTY5/

https://yenisurencentech.xyz/MzhiMTg0NTAwOTY5/

https://yenisurencensanat.xyz/MzhiMTg0NTAwOTY5/

https://yenisurencenekonomi.xyz/MzhiMTg0NTAwOTY5/

https://yenisurencenyollar.xyz/MzhiMTg0NTAwOTY5/

https://yenisurencenhaber.xyz/MzhiMTg0NTAwOTY5/

https://yenisurencenbilgi.xyz/MzhiMTg0NTAwOTY5/

https://yenisurencengelis.xyz/MzhiMTg0NTAwOTY5/

https://yenisurencenpaylas.xyz/MzhiMTg0NTAwOTY5/

https://yenisurencenkulture.xyz/MzhiMTg0NTAwOTY5/

https://yenisurencenbaris.xyz/MzhiMTg0NTAwOTY5/

https://yenisurencenkonferans.xyz/MzhiMTg0NTAwOTY5/

https://yenisurencensistem.xyz/MzhiMTg0NTAwOTY5/

https://yenisurencenprojeler.xyz/MzhiMTg0NTAwOTY5/

rc4.plain

Extracted

Family

octo

C2

https://hastanebilgimtarih.xyz/MzhiMTg0NTAwOTY5/

https://yenisurencenyenifikir.xyz/MzhiMTg0NTAwOTY5/

https://yenisurencenkulturu.xyz/MzhiMTg0NTAwOTY5/

https://yenisurencenvizyon.xyz/MzhiMTg0NTAwOTY5/

https://yenisurencenplatform.xyz/MzhiMTg0NTAwOTY5/

https://yenisurencenyasam.xyz/MzhiMTg0NTAwOTY5/

https://yenisurencengundem.xyz/MzhiMTg0NTAwOTY5/

https://yenisurencentech.xyz/MzhiMTg0NTAwOTY5/

https://yenisurencensanat.xyz/MzhiMTg0NTAwOTY5/

https://yenisurencenekonomi.xyz/MzhiMTg0NTAwOTY5/

https://yenisurencenyollar.xyz/MzhiMTg0NTAwOTY5/

https://yenisurencenhaber.xyz/MzhiMTg0NTAwOTY5/

https://yenisurencenbilgi.xyz/MzhiMTg0NTAwOTY5/

https://yenisurencengelis.xyz/MzhiMTg0NTAwOTY5/

https://yenisurencenpaylas.xyz/MzhiMTg0NTAwOTY5/

https://yenisurencenkulture.xyz/MzhiMTg0NTAwOTY5/

https://yenisurencenbaris.xyz/MzhiMTg0NTAwOTY5/

https://yenisurencenkonferans.xyz/MzhiMTg0NTAwOTY5/

https://yenisurencensistem.xyz/MzhiMTg0NTAwOTY5/

https://yenisurencenprojeler.xyz/MzhiMTg0NTAwOTY5/

Attributes
  • target_apps

    at.spardat.bcrmobile

    at.spardat.netbanking

    com.bankaustria.android.olb

    com.bmo.mobile

    com.cibc.android.mobi

    com.rbc.mobile.android

    com.scotiabank.mobile

    com.td

    cz.airbank.android

    eu.inmite.prj.kb.mobilbank

    com.bankinter.launcher

    com.kutxabank.android

    com.rsi

    com.tecnocom.cajalaboral

    es.bancopopular.nbmpopular

    es.evobanco.bancamovil

    es.lacaixa.mobile.android.newwapicon

    com.dbs.hk.dbsmbanking

    com.FubonMobileClient

    com.hangseng.rbmobile

    com.MobileTreeApp

    com.mtel.androidbea

    com.scb.breezebanking.hk

    hk.com.hsbc.hsbchkmobilebanking

    com.aff.otpdirekt

    com.ideomobile.hapoalim

    com.infrasofttech.indianBank

    com.mobikwik_new

    com.oxigen.oxigenwallet

    jp.co.aeonbank.android.passbook

AES_key

Signatures

  • Octo

    Octo is a banking malware with remote access capabilities first seen in April 2022.

  • Octo family
  • Octo payload 1 IoCs
  • Loads dropped Dex/Jar 1 TTPs 1 IoCs

    Runs executable file dropped to the device during analysis.

  • Makes use of the framework's Accessibility service 4 TTPs 2 IoCs

    Retrieves information displayed on the phone screen using AccessibilityService.

  • Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
  • Queries the phone number (MSISDN for GSM devices) 1 TTPs
  • Acquires the wake lock 1 IoCs
  • Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs

    Application may abuse the framework's foreground service to continue running in the foreground.

  • Performs UI accessibility actions on behalf of the user 1 TTPs 5 IoCs

    Application may abuse the accessibility service to prevent their removal.

  • Queries the mobile country code (MCC) 1 TTPs 1 IoCs
  • Reads information about phone network operator. 1 TTPs
  • Requests accessing notifications (often used to intercept notifications before users become aware). 1 TTPs 1 IoCs
  • Requests disabling of battery optimizations (often used to enable hiding in the background). 1 TTPs 1 IoCs
  • Requests modifying system settings. 1 IoCs
  • Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs

Processes

  • com.teschvi2sions.smarupts
    1⤵
    • Loads dropped Dex/Jar
    • Makes use of the framework's Accessibility service
    • Acquires the wake lock
    • Makes use of the framework's foreground persistence service
    • Performs UI accessibility actions on behalf of the user
    • Queries the mobile country code (MCC)
    • Requests accessing notifications (often used to intercept notifications before users become aware).
    • Requests disabling of battery optimizations (often used to enable hiding in the background).
    • Requests modifying system settings.
    • Uses Crypto APIs (Might try to encrypt user data)
    PID:4724

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • /data/user/0/com.teschvi2sions.smarupts/.qcom.teschvi2sions.smarupts

    Filesize

    48B

    MD5

    046a414913add6f5bb60072c7db819b6

    SHA1

    451ee4f6809260aec622d772fd329c7d0297a842

    SHA256

    b66c1320cb063a1d391c94273572ea6edae76c8c8b0a07f8d75c88686f0df72a

    SHA512

    4e6355f3051ed5e811ab030abde1f5be7f5e1cf33be99cd08477e9b6c015deb1d8bd75a09fb9c7176b8511c5ad0a67abc0902a3531e97564ccb6afc57496a47c

  • /data/user/0/com.teschvi2sions.smarupts/app_patch/gYtTbi.json

    Filesize

    153KB

    MD5

    744d5e8ee415e7faa5bba976612e91d7

    SHA1

    9579d8f623ef991b646a8ad12f4bb29da927ecab

    SHA256

    f32f344030dd2b37476aa5f00c4705285acf902b15bb3b5243913bfd739a481c

    SHA512

    ee5a34725747974879677aa177e76e2d3fb7a1473d8b66a6f097d4488104335ebaec2cebad925991b76362d56b434bbc33b6ecfbc7a44baef5b7c4e0cd40392a

  • /data/user/0/com.teschvi2sions.smarupts/app_patch/gYtTbi.json

    Filesize

    153KB

    MD5

    6d1cdd742451166dfd4d86f45ec9406e

    SHA1

    fbd855933a4d55dc6eb3ed765cb2766fb4b461aa

    SHA256

    b24d9443d462e8184239dab554e97b919e0ef59d408d3feb640d9032c87aa984

    SHA512

    cb05809e7bb22171d38cac8c426edf4ff52ea0a351756ccdce248f833f1ac5ee5ab4b01e2e0e4054689357beca8e78068e59c10cc1b277e548dfe9af142c4012

  • /data/user/0/com.teschvi2sions.smarupts/app_patch/gYtTbi.json

    Filesize

    450KB

    MD5

    e8465cf59f11c96e844305edb130e0ca

    SHA1

    0037b257f87181bc230e97b361f999ad6e045093

    SHA256

    15dde7b7e38f369bcb8fcd28656d1bcafdbc845b7a39ea6f7d8030b19c9c141a

    SHA512

    c3e405cfede5b1b70f31aaf3e61fad087996a4f6fcbb74cfe520f56746f89e24f662ad983150c8368cecc6a4ed27c68784ba526f74b9bc3783e0129e781b0786

  • /data/user/0/com.teschvi2sions.smarupts/kl.txt

    Filesize

    466B

    MD5

    9569a9327286d12f5c41d88e829e5d39

    SHA1

    073c8034df98f9cc8d293412e7db410a6df36959

    SHA256

    2aa8f77d40a151054eeba2470e0c7e549f9d0288ee3992f9f71bdcaeabe36119

    SHA512

    6c86a0f3602ad897acf290bf1c62e9dede5e08ed821b047817340f857d731a09bc2e6a66a9ad958517ee21745893c6334d7f343c64fb566b68796ac7cd543fcf

  • /data/user/0/com.teschvi2sions.smarupts/kl.txt

    Filesize

    45B

    MD5

    fef1b12100198e70573e842a836840a6

    SHA1

    88de1f3ba7ef023f27e9feb0ee1de6578ac92565

    SHA256

    b1fae5ce42ed4301075ce83834d1ce905fed4703f2b55a4bf3c5bf25e3792c0a

    SHA512

    44b7fef94b1cbd199b47a8ddeb8bdda8f0b89954f99cbc85b482117965fc9f750894760b8356a559815b8cf62c766e260f57425bb3109d55046cdaa36f92add7

  • /data/user/0/com.teschvi2sions.smarupts/kl.txt

    Filesize

    66B

    MD5

    cec8dc41aa5247f9bdabed39bfdc304a

    SHA1

    da78d725471501c91e3d65388287e88a3ac410d8

    SHA256

    b1a2034afe8b76ba9b2a7b0b3419a74d727f33863e8106e71bb014f87d19a99d

    SHA512

    55b58332c2df913d6ddcb372e01d8783786d9169e254ef0c1655c16be5d7e97e6cbf8151c73e4553bc5cdb18460ed9417ac401bf659fba44e958fd131d8f0f24

  • /data/user/0/com.teschvi2sions.smarupts/kl.txt

    Filesize

    84B

    MD5

    91496beaf5cebf49c3ce0f3ed9313ac2

    SHA1

    5e5668a63db8838dce37257106da763211d893ca

    SHA256

    4c66cf29d3ac92cd8866018d822c9178c7816fa2cd4b6a796e06f2db85cc3e49

    SHA512

    9630a72396a970f579660b4ad22d72df971fc0429db49902bdf79c7617a3d96500e35fefe0a19f164ff8a44c3267e4449f379c89e9058f49cf37cc4f720c7b83

  • /data/user/0/com.teschvi2sions.smarupts/kl.txt

    Filesize

    68B

    MD5

    d089afa890e3261cb0ee83fe16714e6b

    SHA1

    d2c65cde97baabdd6aaab274e737d04fb3c0daf7

    SHA256

    ee0b6328cd6d05042d6163ec89850293c4d96719f3c43e820188d956c9fe989a

    SHA512

    2667eff8c3722311a292f9e0706d5d4025c8df7dd71a32d9394d0868da819f921bed912d4d551b894d4d9cc043f168e8bc49dda0ca16df5799d575e731603260

  • /data/user/0/com.teschvi2sions.smarupts/kl.txt

    Filesize

    68B

    MD5

    e2a04108e08f37b80918ca6622fec9b0

    SHA1

    d98198e1fe5b8ca59a72e7846c3f9f459ddceff5

    SHA256

    4cc79b593a8eaed1790cd0c1672ce3060d6a15701566960554eea438cff20d90

    SHA512

    fe77557677b1682cbdd2d9736b08f7f428e2116c62a690f6ce899e8cd999f9a6028159ce224c9a7e46a5358c2fe590096a757c9abab0c31c07989cf6008b8c34

  • /data/user/0/com.teschvi2sions.smarupts/kl.txt

    Filesize

    230B

    MD5

    b4845bcf1c1e5cecbe224027b2f4d15b

    SHA1

    3a3e65da41f5111bc40b1782b224bf32e60161a5

    SHA256

    91d7ffe777f4fb2e9cbd834815158daafab1cd0f233d1a58acc977f414260039

    SHA512

    c20aa2c31fd62d85ee2f9e2c64f9949e24ecf3707a484bf024771ae0a1a7f5ee8f2e650eb59cb4ab8f0dcb377bb0bf62295a0f273a9bcf26fc76789ad66d0427

  • /data/user/0/com.teschvi2sions.smarupts/kl.txt

    Filesize

    54B

    MD5

    f6a528014bbe3c0d22d563e0df83e3cb

    SHA1

    e2f04cd25a5a20b9ae9d4d94d9c74ec5cfeec504

    SHA256

    ff308bd26bfb6c1602fa225defb67c4d7d5e5e18089cef27ab42f6948193d284

    SHA512

    6ca84d1858452aba476832724a75c7c1c5f1f4e91305a99d44e1ef8740ad89557279bcda13f1a5dd1f52f686dd64e290d8b855f588bfd90009cb95479997011f

  • /data/user/0/com.teschvi2sions.smarupts/kl.txt

    Filesize

    63B

    MD5

    e957e0edd8649092273a5b79e8cdb7dc

    SHA1

    2f3d80dfae1547cc20f62a4244333cfe765aa59b

    SHA256

    9ac6c850452ea863a1da051800c3fcdd6ead034a35c8000c61bb61422828bbfc

    SHA512

    1a91b48237ca8138eb648bccaa4e56d70ebca7e3e93c96d00b559f86ae94711d6cc51ea9c60d6373a7857a6f54b2592feb3a2173ea2772d795a658a5c5cb4c6a

  • /data/user/0/com.teschvi2sions.smarupts/kl.txt

    Filesize

    45B

    MD5

    c63add3cb89f974a27feba3aa5db8e9f

    SHA1

    362b76ce0fd74de300b45d6393658d85fc69caf5

    SHA256

    70066d2adda8222d2e7df133cd305fcdb937a7e8c7ad7706890208d0fee01528

    SHA512

    abe9056636501dc084087d31aff462ccdd8e4503e9aa60f818ff9737c281832dada4f983512f06e84b8c41f26c203f8fbedde0b29baf0113b6d930c6dcd5c95b

  • /data/user/0/com.teschvi2sions.smarupts/kl.txt

    Filesize

    63B

    MD5

    e9ed66dc9916664f04ed8c17208e054c

    SHA1

    ce079464877df44f43b55454808144dd30875f4d

    SHA256

    dcfc061f938118050a59ef6b8db95a8553b82899335f05ae75b9e5564423c418

    SHA512

    74b8efa4fdc13f5af964ed70d8e2bb5e7663f762150b91795f2371cd5da5168640dd914ff33f51729afbc6d723c7c3e3004572ac346c43e8ea520f6abe3f68e1