Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    65s
  • max time network
    148s
  • platform
    android-10_x64
  • resource
    android-x64-20240910-en
  • resource tags

    arch:x64arch:x86image:android-x64-20240910-enlocale:en-usos:android-10-x64system
  • submitted
    22/01/2025, 22:02

General

  • Target

    697fb5ed69edc8f5733073e954dcd27f654cc37f59e051d28f1623bee6afa55f.apk

  • Size

    2.7MB

  • MD5

    0d730e6222b8697bc03d7e189d3d2c43

  • SHA1

    fbfd23ba3defa8898fd7e289bc6e3b497152f71b

  • SHA256

    697fb5ed69edc8f5733073e954dcd27f654cc37f59e051d28f1623bee6afa55f

  • SHA512

    937d31881993388d26e21aa56d89d58a3b2581aa6ab20fe0a9eb22bc114201e97634cc8bfbfc7f24c9d072dd35a511729bc877861590b6008db11e26f15d967d

  • SSDEEP

    49152:IAI6Kjcf1ObPyI4trAm8a8KLGBHzFOTkCMmn6U9BrVT9mDl8r601sS8IQj:IZFjEI4iZaUzYH99yIS

Malware Config

Extracted

Family

octo

C2

https://94.103.125.53:7117/gate/

https://94.103.125.53:8080/rootmd50ma/panelcgfuzwxleg9kdxnvy3rv/gate/

https://94.103.125.53:80/builderxxxzzz/gate/

Attributes
  • target_apps

    at.spardat.bcrmobile

    at.spardat.netbanking

    com.bankaustria.android.olb

    com.bmo.mobile

    com.cibc.android.mobi

    com.rbc.mobile.android

    com.scotiabank.mobile

    com.td

    cz.airbank.android

    eu.inmite.prj.kb.mobilbank

    com.bankinter.launcher

    com.kutxabank.android

    com.rsi

    com.tecnocom.cajalaboral

    es.bancopopular.nbmpopular

    es.evobanco.bancamovil

    es.lacaixa.mobile.android.newwapicon

    com.dbs.hk.dbsmbanking

    com.FubonMobileClient

    com.hangseng.rbmobile

    com.MobileTreeApp

    com.mtel.androidbea

    com.scb.breezebanking.hk

    hk.com.hsbc.hsbchkmobilebanking

    com.aff.otpdirekt

    com.ideomobile.hapoalim

    com.infrasofttech.indianBank

    com.mobikwik_new

    com.oxigen.oxigenwallet

    jp.co.aeonbank.android.passbook

AES_key

Signatures

Processes

  • com.nameown12
    1⤵
    • Makes use of the framework's Accessibility service
    • Acquires the wake lock
    • Makes use of the framework's foreground persistence service
    • Performs UI accessibility actions on behalf of the user
    • Queries the mobile country code (MCC)
    • Registers a broadcast receiver at runtime (usually for listening for system events)
    • Uses Crypto APIs (Might try to encrypt user data)
    PID:5240

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • /data/data/com.nameown12/.qcom.nameown12

    Filesize

    48B

    MD5

    046a414913add6f5bb60072c7db819b6

    SHA1

    451ee4f6809260aec622d772fd329c7d0297a842

    SHA256

    b66c1320cb063a1d391c94273572ea6edae76c8c8b0a07f8d75c88686f0df72a

    SHA512

    4e6355f3051ed5e811ab030abde1f5be7f5e1cf33be99cd08477e9b6c015deb1d8bd75a09fb9c7176b8511c5ad0a67abc0902a3531e97564ccb6afc57496a47c

  • /data/data/com.nameown12/kl.txt

    Filesize

    230B

    MD5

    96f16c8d595ce65f943774d7d714b8a7

    SHA1

    93d1b814068c696a8b237b7a387dfed31f13cee4

    SHA256

    284bb110c4b528992f423c1b043525b0733af7a0028065dfeb6b1c6bd295c2a6

    SHA512

    5a786a38338427d8c055cf42072fdfd6bd4f37370befaa519ba09b286674a375a56970192426145b015c6142c984f255da623ca8a5393bc726ef83490dca02d9

  • /data/data/com.nameown12/kl.txt

    Filesize

    54B

    MD5

    6d1665ef693237ffa6e5bd308be81786

    SHA1

    90058244439d23ba04d2a2891d34c1e075af5504

    SHA256

    f9c4205a0b41fc17a10818dc17d758451ac392b5d3c30c4f1d046d9eeeb2debf

    SHA512

    7a02d4136cad0b2bf79bb91abec88937edf41097ecf7799c3ee551a36f7a1245a68f81f888e4f3dbdaa7c678fc84f9db8d7ac37603ab293d3e0ace3408cc86e4

  • /data/data/com.nameown12/kl.txt

    Filesize

    63B

    MD5

    c1d70ebbdeba7ce56ad70ff172802034

    SHA1

    dcf1c969de765cdec4fa6f9cef6126ac3c98f411

    SHA256

    ee726a7f1f9ea91321b9faa8218ad45d8399d27124d5bbc568b56fc76f913647

    SHA512

    3df2cd18c27d142bb06d7f0def0ba025b621fa6c6745d3e39e837789947ba3db84e936fa31f72c0ff8103b32f05945cb60971a1d25fc2d3e5e06b44a3a6168c4

  • /data/data/com.nameown12/kl.txt

    Filesize

    45B

    MD5

    0e4c5989480ca2b98e6ec95a7ccb648f

    SHA1

    0d9e8321c8e58b0ce6a2f234a81bbc2f97769f4a

    SHA256

    6ee5acedc13a3a82994f8924a139ab721ced9e72e40e33dbed99caba758c2d91

    SHA512

    eadab6fd2944c13e571e0fdb7ab92ad4fc8ad48dbf605ad570677532d3bdcbc7ce8ea4af06d0bae186fc4d864ad7df1151cc50ff354d15396e970cb1bcf61fb3

  • /data/data/com.nameown12/kl.txt

    Filesize

    423B

    MD5

    d89b42dd5ae0d9b2a8ed35210659532f

    SHA1

    ff93251131219b45d132e8ad3459f7c75711b0c0

    SHA256

    02dcd74810fa565788662eb3545f7a09cbd3708288f26c660d32028e2b9b35f4

    SHA512

    54a5f7c68845431f5b3fd594306a827591a4abb6a074afc5f3e3f2f91e426f2df0e3ece85855a4be7d1f8a5bfca55de6ef715b764635f7ad2bfb0bc2610dcf1e