Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    148s
  • max time network
    145s
  • platform
    android_x64
  • resource
    android-33-x64-arm64-20240624-en
  • resource tags

    androidarch:arm64arch:x64image:android-33-x64-arm64-20240624-enlocale:en-usos:android-13-x64system
  • submitted
    04/02/2025, 22:02

General

  • Target

    70e0996596eb70ca7b9fe232482507226724d91d9864b810c3faaf6bf776c581.apk

  • Size

    2.0MB

  • MD5

    bd53dd03a7c57d10a64d0a6aabff94d0

  • SHA1

    ba219cb630dd2d5e7a1003c982323cd645cf11bb

  • SHA256

    70e0996596eb70ca7b9fe232482507226724d91d9864b810c3faaf6bf776c581

  • SHA512

    6139583bfb09e659eb0c6b6a6a40f29fb20fd449d5a2a8fca20681482655d2a3e822c5beaf48bea7e1fdec7cf6521b56cf5cc899aeb44f1c9f99c52a4ed33469

  • SSDEEP

    49152:fyyRtwuNnCAmiG431IY/e0zoUy0gF/480B42fOrTPrqlGLHUtJ49FdNLlKeBmXTt:6yDwuN9N1Inj0gFWlxlGgkFdNRBBikWr

Malware Config

Extracted

Family

octo

C2

https://kkcanertarihcesi.xyz/MzhiMTg0NTAwOTY5S/

https://tutmlhizmetleri.xyz/MzhiMTg0NTAwOTY5S/

https://tutmlsistemleri.xyz/MzhiMTg0NTAwOTY5S/

https://tutmlplatformlari.xyz/MzhiMTg0NTAwOTY5S/

https://tutmlhaberportali.xyz/MzhiMTg0NTAwOTY5S/

https://tutmlguncelveriler.xyz/MzhiMTg0NTAwOTY5S/

https://tutmlteknolojidunyasi.xyz/MzhiMTg0NTAwOTY5S/

https://tutmlgelismeler.xyz/MzhiMTg0NTAwOTY5S/

https://tutmlarsivkayitlari.xyz/MzhiMTg0NTAwOTY5S/

https://tutmlprojelerplatformu.xyz/MzhiMTg0NTAwOTY5S/

https://tutmlbilgipaylasimi.xyz/MzhiMTg0NTAwOTY5S/

https://tutmliletisimagaci.xyz/MzhiMTg0NTAwOTY5S/

https://tutmlanalizverileri.xyz/MzhiMTg0NTAwOTY5S/

https://tutmlstratejiplani.xyz/MzhiMTg0NTAwOTY5S/

https://tutmlsistemyonetimi.xyz/MzhiMTg0NTAwOTY5S/

https://tutmlvizyonrehberi.xyz/MzhiMTg0NTAwOTY5S/

https://tutmlgeleceksenaryosu.xyz/MzhiMTg0NTAwOTY5S/

https://tutmlsosyalkullanimi.xyz/MzhiMTg0NTAwOTY5S/

https://tutmlonlinetoplum.xyz/MzhiMTg0NTAwOTY5S/

https://tutmlodaklisisim.xyz/MzhiMTg0NTAwOTY5S/

rc4.plain

Extracted

Family

octo

C2

https://kkcanertarihcesi.xyz/MzhiMTg0NTAwOTY5S/

https://tutmlhizmetleri.xyz/MzhiMTg0NTAwOTY5S/

https://tutmlsistemleri.xyz/MzhiMTg0NTAwOTY5S/

https://tutmlplatformlari.xyz/MzhiMTg0NTAwOTY5S/

https://tutmlhaberportali.xyz/MzhiMTg0NTAwOTY5S/

https://tutmlguncelveriler.xyz/MzhiMTg0NTAwOTY5S/

https://tutmlteknolojidunyasi.xyz/MzhiMTg0NTAwOTY5S/

https://tutmlgelismeler.xyz/MzhiMTg0NTAwOTY5S/

https://tutmlarsivkayitlari.xyz/MzhiMTg0NTAwOTY5S/

https://tutmlprojelerplatformu.xyz/MzhiMTg0NTAwOTY5S/

https://tutmlbilgipaylasimi.xyz/MzhiMTg0NTAwOTY5S/

https://tutmliletisimagaci.xyz/MzhiMTg0NTAwOTY5S/

https://tutmlanalizverileri.xyz/MzhiMTg0NTAwOTY5S/

https://tutmlstratejiplani.xyz/MzhiMTg0NTAwOTY5S/

https://tutmlsistemyonetimi.xyz/MzhiMTg0NTAwOTY5S/

https://tutmlvizyonrehberi.xyz/MzhiMTg0NTAwOTY5S/

https://tutmlgeleceksenaryosu.xyz/MzhiMTg0NTAwOTY5S/

https://tutmlsosyalkullanimi.xyz/MzhiMTg0NTAwOTY5S/

https://tutmlonlinetoplum.xyz/MzhiMTg0NTAwOTY5S/

https://tutmlodaklisisim.xyz/MzhiMTg0NTAwOTY5S/

Attributes
  • target_apps

    at.spardat.bcrmobile

    at.spardat.netbanking

    com.bankaustria.android.olb

    com.bmo.mobile

    com.cibc.android.mobi

    com.rbc.mobile.android

    com.scotiabank.mobile

    com.td

    cz.airbank.android

    eu.inmite.prj.kb.mobilbank

    com.bankinter.launcher

    com.kutxabank.android

    com.rsi

    com.tecnocom.cajalaboral

    es.bancopopular.nbmpopular

    es.evobanco.bancamovil

    es.lacaixa.mobile.android.newwapicon

    com.dbs.hk.dbsmbanking

    com.FubonMobileClient

    com.hangseng.rbmobile

    com.MobileTreeApp

    com.mtel.androidbea

    com.scb.breezebanking.hk

    hk.com.hsbc.hsbchkmobilebanking

    com.aff.otpdirekt

    com.ideomobile.hapoalim

    com.infrasofttech.indianBank

    com.mobikwik_new

    com.oxigen.oxigenwallet

    jp.co.aeonbank.android.passbook

AES_key

Signatures

  • Octo

    Octo is a banking malware with remote access capabilities first seen in April 2022.

  • Octo family
  • Octo payload 1 IoCs
  • Loads dropped Dex/Jar 1 TTPs 1 IoCs

    Runs executable file dropped to the device during analysis.

  • Makes use of the framework's Accessibility service 4 TTPs 2 IoCs

    Retrieves information displayed on the phone screen using AccessibilityService.

  • Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
  • Queries the phone number (MSISDN for GSM devices) 1 TTPs
  • Acquires the wake lock 1 IoCs
  • Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs

    Application may abuse the framework's foreground service to continue running in the foreground.

  • Performs UI accessibility actions on behalf of the user 1 TTPs 3 IoCs

    Application may abuse the accessibility service to prevent their removal.

  • Queries the mobile country code (MCC) 1 TTPs 1 IoCs
  • Reads information about phone network operator. 1 TTPs
  • Requests accessing notifications (often used to intercept notifications before users become aware). 1 TTPs 1 IoCs
  • Requests disabling of battery optimizations (often used to enable hiding in the background). 1 TTPs 1 IoCs
  • Requests modifying system settings. 1 IoCs
  • Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs

Processes

  • com.drop.shine
    1⤵
    • Loads dropped Dex/Jar
    • Makes use of the framework's Accessibility service
    • Acquires the wake lock
    • Makes use of the framework's foreground persistence service
    • Performs UI accessibility actions on behalf of the user
    • Queries the mobile country code (MCC)
    • Requests accessing notifications (often used to intercept notifications before users become aware).
    • Requests disabling of battery optimizations (often used to enable hiding in the background).
    • Requests modifying system settings.
    • Uses Crypto APIs (Might try to encrypt user data)
    PID:4338

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • /data/user/0/com.drop.shine/.qcom.drop.shine

    Filesize

    48B

    MD5

    046a414913add6f5bb60072c7db819b6

    SHA1

    451ee4f6809260aec622d772fd329c7d0297a842

    SHA256

    b66c1320cb063a1d391c94273572ea6edae76c8c8b0a07f8d75c88686f0df72a

    SHA512

    4e6355f3051ed5e811ab030abde1f5be7f5e1cf33be99cd08477e9b6c015deb1d8bd75a09fb9c7176b8511c5ad0a67abc0902a3531e97564ccb6afc57496a47c

  • /data/user/0/com.drop.shine/app_tortoise/BPqn.json

    Filesize

    153KB

    MD5

    33e4b66346c77178c660b9f0f7ece836

    SHA1

    a55001bef21503f33ac2fcfb18b89ad44428bb03

    SHA256

    27671887f70979da9e5dcb09958169cbca9fb348ad6e31ad5ed85d92c221b3a6

    SHA512

    84003e1209567dead14be4c0d97d10891f69330981d9b3b73f6e6b915b616c369b2ddf0ac8d6dcfd80e616af1a8d1f38da93e84cb4cb12751b32315edb7b6ec3

  • /data/user/0/com.drop.shine/app_tortoise/BPqn.json

    Filesize

    153KB

    MD5

    25c88e3feadf3c61f6416f79f066def0

    SHA1

    0b24ed5c6399b2e13798bdebdbf73bee30062d60

    SHA256

    e5ef5b162a3b913df1c236f618e46324f8bdd55d6b880fc0d1fd69cde923d28e

    SHA512

    f29cc4234fd3a3d98a2cc8bdd2f8971ffd6b0963abcb549a1f8d6f09ac0c2187c2475033e5be7c2ff394848c6a737a87ec8cb489aefdc3ccc64b84114d8f1ae4

  • /data/user/0/com.drop.shine/app_tortoise/BPqn.json

    Filesize

    450KB

    MD5

    0008c6ccc280bc1f8827007df6a6c35c

    SHA1

    0dc6b68d6b54e8b0f9c833b242c9b618612f771e

    SHA256

    53fe7196b5d42b4175029d4a6a5fb9e5acb67c4614996db5ba51450c67db2bed

    SHA512

    e7daa937191e87c09b491a3c125ff7742635f73a4778af9c13ba431a4e1332f6dc32438690dec2241424f14bd6ff012b4bfb02c75d3cc0a9be562d5a0dadc421

  • /data/user/0/com.drop.shine/kl.txt

    Filesize

    60B

    MD5

    b9c12da75f0e4340f592920d4c903b43

    SHA1

    8c74c7309a93ae96174c7656df8cf3d70c523ebf

    SHA256

    757597b96f4eda936343ec6d4695e42355536403fdc63ac2356d6302625f1a6b

    SHA512

    cfb97f0a8e2a9098c83c806ab8d1cd267769989a09768b1f87da38045a465268f5aaf871bcabd1aef42758522cce0ec9e809c61e72ada5d6bc35a5a90ad696b6

  • /data/user/0/com.drop.shine/kl.txt

    Filesize

    52B

    MD5

    ac5ee9012b5e4d7ce1972b841936295e

    SHA1

    989a8ba71705c5d0607d0f7daf2aab4579f141d4

    SHA256

    b0bad0c036f1090fd126712a5d8bbf9d9b5848b72e1239458bd076133cb2b480

    SHA512

    f217d64a9d7fcecf380976148ab96611b2159803c9dd69d9a5a351053c3f1a8a2e7974f6a85104c3ddda3b13ac2103ea4d6e1c4ef6a31f50563c5796b615407f

  • /data/user/0/com.drop.shine/kl.txt

    Filesize

    70B

    MD5

    45fc0780f2034fccf40d4b8899e83495

    SHA1

    4048374ca47d500e746fe21643426e86caa760bb

    SHA256

    3452c6ab885e74c1470c1dcaa9890d42d3303e19154182a091759d7dd8082a1d

    SHA512

    b207da9b0795b207f4ccd961708fad5866fd9779ed16d4486f30fe1381fcce52a9f06dc44b97d924e7ae9189c78188456be416d21d71b745c005f992cc4c2a7f

  • /data/user/0/com.drop.shine/kl.txt

    Filesize

    55B

    MD5

    1f099a58b1d0cdf74a8bcb6a08c4daad

    SHA1

    7501be6995c9275db777eca0233379a2101c5bc5

    SHA256

    990b459b11165ca4a158ce2f203f3f10e042a8aefd40849bf80e3d23bde634d2

    SHA512

    35b882c2e4dcaf97f7d199f7601501976899636b8799c8b027497bbc4de2f8478647a6dc7cd72b9425533b987ff072b41e08166c35a296a60ebd46d73d728e28

  • /data/user/0/com.drop.shine/kl.txt

    Filesize

    45B

    MD5

    941c3469e8274bdde132b93212bcb547

    SHA1

    2c66aa47a70e1e82a6b457fae6c683992ff59821

    SHA256

    0559dbb2eb1ddf6dfcecae60aafcf647bbd360036c15d23df00785a7ee241f27

    SHA512

    135b5dae926347528af9e8aeec5d001d37b03cbf4f4c18888ecf491ecfa9ae939890f10f5091f51818415d1cbff514fda9442e75f5e24e8660d74dfef5d3896c

  • /data/user/0/com.drop.shine/kl.txt

    Filesize

    70B

    MD5

    a730ba08a06e4623d1925615fc2a0218

    SHA1

    4f286df3442fb3f8fd0f44c8c51c2e3d806194b4

    SHA256

    9afdd58c46833ee11b73bf40263cacc30d1e53288b32202031429c731a25f777

    SHA512

    709e28a58d19345c41c8ced2be41e2bf9a8d65c998367ff50e8ac880335a572f19801c2e3d5e72f107a8c310bca2547aa163f667b0ed235b784e105b67ee1c14

  • /data/user/0/com.drop.shine/kl.txt

    Filesize

    45B

    MD5

    fa1b0285e9cd1bb5bab93251a179d88a

    SHA1

    480de886a193a3f72203fd8852cc1b9740258e57

    SHA256

    d48bfbe2797ffce40c0ec18968eb8e7ee03bd470c53d8153ea92b4fa0744b7b2

    SHA512

    ec336cbdc627cf30020d5916556c4c9cd3ebe0cf2bfbcf05c46b9c665e486c0e77a0357620340668edc63c85c1c5599cbd2658a3ac8dd8bbd3f2a7b9218f2136

  • /data/user/0/com.drop.shine/kl.txt

    Filesize

    79B

    MD5

    5f20ab37f36d16b37b6fd4fe814085e4

    SHA1

    3802c2878a5fae4097334a5f203a4fa8c759ccd8

    SHA256

    ab6b764449977701053e38262e75cf58ff85973e76e4ba1aa27fa0feb132f51f

    SHA512

    0803f58e8f38e8f60e4b6e85e2af8dcabc27e2d5d2ca98bc3626a5793fa036171a42d5e7a5f234eac3169048f7d8a12c96360bd0957a243aa2eaebcc3d2126ed

  • /data/user/0/com.drop.shine/kl.txt

    Filesize

    490B

    MD5

    86fe5f2ef817f7cd160da6950fe013c5

    SHA1

    07cf075cc4b9a2f2d75df1636b1f6550f096539c

    SHA256

    237f2061f884fda3590dfbd6ffaaf2d50747922502d9928b18e7d12329850732

    SHA512

    e9dba56954fd3732186b86bb3ec89970d96e4acc4895bcf2bcc3fb1c40eb7cb1576ccfcc264fc32bc930aece86d999319cbc2229fb8df27f8f0f677c74360ce2

  • /data/user/0/com.drop.shine/kl.txt

    Filesize

    66B

    MD5

    c7a60d68ead20aa2d3c81ea2a437994a

    SHA1

    d7a57102c81b7988e0771f38f248b8f7f5557e7e

    SHA256

    6b1eabcb1bb9bfe21de62559a577a521efb2ed8ecf27078a5d1ec93a9a7f3153

    SHA512

    125f6bf6f3777d6ae203f73cd29bdaa4b343dca8bf0d65b84ab9627c0c8f58a6e505ab6b86faa3f37fb8a1b4f43f4684eb8f22ed08e1df41a98592dbf70a830c

  • /data/user/0/com.drop.shine/kl.txt

    Filesize

    84B

    MD5

    659cbae2208e6d4de9bb7bee3a37a2d4

    SHA1

    39f33f01768698f84b95b550b840393685d356ed

    SHA256

    2cdc2588b47014da54513cb0ac8a7c0d0e6b630692c3f52faeed844648de865d

    SHA512

    d769be0ea1691ff56606258ec90f586e0ea30215c53ed5e20d4eb00188b6875f73c612c204d43026218d102a3d10e5dd2630f716e6fda82491878e43194f4765

  • /data/user/0/com.drop.shine/kl.txt

    Filesize

    68B

    MD5

    5e8396f3d376b6b643508c0fd402a7de

    SHA1

    30d1fd015cf069be74702bfad765716f1dc0fb4f

    SHA256

    bfa9cd5166c5290238675bd3946a0ede82a35322cf529e72fbd142ec0ddc4690

    SHA512

    2209bde32289b19bb28550b1bd342f0f566ec640417d8a8d8a34b6d2a914fd6869138665d2bf823fd37692681cc1f2be462cbe843805fd743aa7871ce5ce1c97

  • /data/user/0/com.drop.shine/kl.txt

    Filesize

    68B

    MD5

    42ba318958e81934dd82b0eb75d18a84

    SHA1

    d37949c67bfa16fa977cc9a9dc2f124fbee42009

    SHA256

    18c60d37078d4704caf49e190aa570fd376d99cdde29c0a6d478fa6366c97cef

    SHA512

    6089c741c7ec103702c37f245f625d87c94f9f4c69707c514ffa4314b7563463e4790f87e018569086974019ea72aaeec9789131a09b9d67e168c1865cded2f9

  • /data/user/0/com.drop.shine/kl.txt

    Filesize

    214B

    MD5

    9713dfd160e13a6ef70c491f6192ea45

    SHA1

    6386b3c97d7f75d89e7a5400e2778b1d3fc9747a

    SHA256

    1300dc969ea616e64a1d911ef7bab70c68b44d575c9e45e73a67254bb9f51514

    SHA512

    1ee9ca6cba311f31334f6670ff30dd23c4a5cfff3b773e5107454d50793b4e9e4d607cac08bec230620e7a7c6b3ccae1d70e62c06e21599a69a2d917b6d437d9

  • /data/user/0/com.drop.shine/kl.txt

    Filesize

    53B

    MD5

    0bf438e2c2fc595f36b452b70b035274

    SHA1

    53010ff053996a7c99cde2dbcf04fcc0be39a2b2

    SHA256

    23a1d2ca8125f79a3b976103d42c8fcc99abfbe8618f1f882244a7a4caa67ebf

    SHA512

    1219c5492c46f368bac6aba3a690fefdb4851f33a09d6d1e590b280f2a7027591d0995164a5f22866276b27a4cbc331d2d8430992fa0c4027bd803b7469f6315

  • /data/user/0/com.drop.shine/kl.txt

    Filesize

    68B

    MD5

    44071210f910ccd877c4fbe8d069105a

    SHA1

    ecc17191566e8fa0ea8d360500792ba225f43dee

    SHA256

    0db7c8d34a5390edb32aee8a5241d3809e5c3a258c0f2813fbf7752ca03257e5

    SHA512

    3a82ef02755cdb07ae20b9b8a5bb9b92d81aac105e1f537249379405fcc6f3581e2632c7730461621ecfe4fd199c0b292b39b74967f06b00c12e80551f8993b2

  • /data/user/0/com.drop.shine/kl.txt

    Filesize

    214B

    MD5

    92ed212f5f87da214803765366254bd6

    SHA1

    c4fdf3ae5cb31617d1f68e376103a4c87a9ceb3e

    SHA256

    5c5e5253aaf73cfe71f612650becc80c5e3fc3b764db96cbcd97d1bbf24d44e0

    SHA512

    6aa1322c3a95fa04f0dc6ed86f91175ef264a8c08a350ac5218d122237f41a8a94e7a1a4e85e02d0d8f60ae3d47c2d4c278317a3a384fd01ab4a67a86025bc47

  • /data/user/0/com.drop.shine/kl.txt

    Filesize

    54B

    MD5

    23930323043a58724bbf20fd67d13d91

    SHA1

    eafdbb47b63101be5a68640d9431191afb802db8

    SHA256

    1099130ec85712748e3ca96566702309f3e92b171adb02738e0619bc62b17b7d

    SHA512

    26d108f9d132c161375000af0c86d7a02e8672d6bd906a8020d55520a12de396537303093577eb7eca30a0689c0566f743b206acdf876595d5b4fb2690e2e032

  • /data/user/0/com.drop.shine/kl.txt

    Filesize

    68B

    MD5

    ca416936e47048f5a257de89bf7e8322

    SHA1

    16d9ac5b718da89b75e0d50a2dbd871871be7fe5

    SHA256

    291b0b24abda85c90175903eeba32f45d779db8c0adb064231ed624536d6d1c2

    SHA512

    7bdeb106de5d3629bfb1dcbd104556b1214d153be1df912f21c4f1e13046d2cdb4eab567f3788a9b0897480b7fa28de767342a51f5d310f882e06a7522cf2785