Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    149s
  • max time network
    151s
  • platform
    android-9_x86
  • resource
    android-x86-arm-20240910-en
  • resource tags

    arch:armarch:x86image:android-x86-arm-20240910-enlocale:en-usos:android-9-x86system
  • submitted
    04/02/2025, 22:01

General

  • Target

    11036b51f77ac127f7b0725d291c91169e032a65200e17bf1d20f5e56af293b6.apk

  • Size

    1.7MB

  • MD5

    ce0137d465c2fb9335bdefc5348d11bd

  • SHA1

    4ac64eb3ec437a174faffc53f61444999bbdaf04

  • SHA256

    11036b51f77ac127f7b0725d291c91169e032a65200e17bf1d20f5e56af293b6

  • SHA512

    aaa61947d32c65500a4944a9b3ef4fd6d428b23168e8b5c7f3f6894059637c028ea1e5851109db73981d47f4ab6b89b558f0dfaf8933871dfa85212af0b19e85

  • SSDEEP

    49152:FPpxBUnSSmgT1nbY4NTNQZGmWp4kOSfR7WbKCiJAB5vk:RRUnnmgpxsGaSfR6n5c

Malware Config

Extracted

Family

octo

C2

https://kobrasaldiristratejileri.xyz/MzhiMTg0NTAwOTY5S/

https://kobratehlikeanalizleri.xyz/MzhiMTg0NTAwOTY5S/

https://kobravesurprizhikayeler.xyz/MzhiMTg0NTAwOTY5S/

https://kobrayanasistemverileri.xyz/MzhiMTg0NTAwOTY5S/

https://kobrakulturvesavasanati.xyz/MzhiMTg0NTAwOTY5S/

https://kobrabilimvegizemlerdunyasi.xyz/MzhiMTg0NTAwOTY5S/

https://kobragesmisiylebilimtarihi.xyz/MzhiMTg0NTAwOTY5S/

https://kobraversanatinbirlestigi.xyz/MzhiMTg0NTAwOTY5S/

https://kobrataktiklersistematik.xyz/MzhiMTg0NTAwOTY5S/

https://kobralaryasadogasi.xyz/MzhiMTg0NTAwOTY5S/

https://kobravesavasfelsefesi.xyz/MzhiMTg0NTAwOTY5S/

https://kobratedbirvetaktik.xyz/MzhiMTg0NTAwOTY5S/

https://kobratehlikeveguvenlik.xyz/MzhiMTg0NTAwOTY5S/

https://kobravesavunmasistemi.xyz/MzhiMTg0NTAwOTY5S/

https://kobraveavlanmataktikleri.xyz/MzhiMTg0NTAwOTY5S/

https://kobrakisiselyetenekler.xyz/MzhiMTg0NTAwOTY5S/

https://kobratehlikeharitasi.xyz/MzhiMTg0NTAwOTY5S/

https://kobravesavasstratejileri.xyz/MzhiMTg0NTAwOTY5S/

https://kobrabilimveanaliz.xyz/MzhiMTg0NTAwOTY5S/

https://kobratehditveonleme.xyz/MzhiMTg0NTAwOTY5S/

rc4.plain

Extracted

Family

octo

C2

https://kobrasaldiristratejileri.xyz/MzhiMTg0NTAwOTY5S/

https://kobratehlikeanalizleri.xyz/MzhiMTg0NTAwOTY5S/

https://kobravesurprizhikayeler.xyz/MzhiMTg0NTAwOTY5S/

https://kobrayanasistemverileri.xyz/MzhiMTg0NTAwOTY5S/

https://kobrakulturvesavasanati.xyz/MzhiMTg0NTAwOTY5S/

https://kobrabilimvegizemlerdunyasi.xyz/MzhiMTg0NTAwOTY5S/

https://kobragesmisiylebilimtarihi.xyz/MzhiMTg0NTAwOTY5S/

https://kobraversanatinbirlestigi.xyz/MzhiMTg0NTAwOTY5S/

https://kobrataktiklersistematik.xyz/MzhiMTg0NTAwOTY5S/

https://kobralaryasadogasi.xyz/MzhiMTg0NTAwOTY5S/

https://kobravesavasfelsefesi.xyz/MzhiMTg0NTAwOTY5S/

https://kobratedbirvetaktik.xyz/MzhiMTg0NTAwOTY5S/

https://kobratehlikeveguvenlik.xyz/MzhiMTg0NTAwOTY5S/

https://kobravesavunmasistemi.xyz/MzhiMTg0NTAwOTY5S/

https://kobraveavlanmataktikleri.xyz/MzhiMTg0NTAwOTY5S/

https://kobrakisiselyetenekler.xyz/MzhiMTg0NTAwOTY5S/

https://kobratehlikeharitasi.xyz/MzhiMTg0NTAwOTY5S/

https://kobravesavasstratejileri.xyz/MzhiMTg0NTAwOTY5S/

https://kobrabilimveanaliz.xyz/MzhiMTg0NTAwOTY5S/

https://kobratehditveonleme.xyz/MzhiMTg0NTAwOTY5S/

Attributes
  • target_apps

    at.spardat.bcrmobile

    at.spardat.netbanking

    com.bankaustria.android.olb

    com.bmo.mobile

    com.cibc.android.mobi

    com.rbc.mobile.android

    com.scotiabank.mobile

    com.td

    cz.airbank.android

    eu.inmite.prj.kb.mobilbank

    com.bankinter.launcher

    com.kutxabank.android

    com.rsi

    com.tecnocom.cajalaboral

    es.bancopopular.nbmpopular

    es.evobanco.bancamovil

    es.lacaixa.mobile.android.newwapicon

    com.dbs.hk.dbsmbanking

    com.FubonMobileClient

    com.hangseng.rbmobile

    com.MobileTreeApp

    com.mtel.androidbea

    com.scb.breezebanking.hk

    hk.com.hsbc.hsbchkmobilebanking

    com.aff.otpdirekt

    com.ideomobile.hapoalim

    com.infrasofttech.indianBank

    com.mobikwik_new

    com.oxigen.oxigenwallet

    jp.co.aeonbank.android.passbook

AES_key

Signatures

  • Octo

    Octo is a banking malware with remote access capabilities first seen in April 2022.

  • Octo family
  • Octo payload 2 IoCs
  • Removes its main activity from the application launcher 1 TTPs 1 IoCs
  • Loads dropped Dex/Jar 1 TTPs 2 IoCs

    Runs executable file dropped to the device during analysis.

  • Makes use of the framework's Accessibility service 4 TTPs 2 IoCs

    Retrieves information displayed on the phone screen using AccessibilityService.

  • Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
  • Queries the phone number (MSISDN for GSM devices) 1 TTPs
  • Acquires the wake lock 1 IoCs
  • Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs

    Application may abuse the framework's foreground service to continue running in the foreground.

  • Performs UI accessibility actions on behalf of the user 1 TTPs 4 IoCs

    Application may abuse the accessibility service to prevent their removal.

  • Queries the mobile country code (MCC) 1 TTPs 1 IoCs
  • Queries the unique device ID (IMEI, MEID, IMSI) 1 TTPs
  • Requests accessing notifications (often used to intercept notifications before users become aware). 1 TTPs 1 IoCs
  • Requests disabling of battery optimizations (often used to enable hiding in the background). 1 TTPs 1 IoCs
  • Requests modifying system settings. 1 IoCs
  • Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs
  • Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs

Processes

  • com.acoustic.autumn
    1⤵
    • Removes its main activity from the application launcher
    • Loads dropped Dex/Jar
    • Makes use of the framework's Accessibility service
    • Acquires the wake lock
    • Makes use of the framework's foreground persistence service
    • Performs UI accessibility actions on behalf of the user
    • Queries the mobile country code (MCC)
    • Requests accessing notifications (often used to intercept notifications before users become aware).
    • Requests disabling of battery optimizations (often used to enable hiding in the background).
    • Requests modifying system settings.
    • Registers a broadcast receiver at runtime (usually for listening for system events)
    • Uses Crypto APIs (Might try to encrypt user data)
    PID:4267
    • /system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.acoustic.autumn/app_music/gW.json --output-vdex-fd=41 --oat-fd=42 --oat-location=/data/user/0/com.acoustic.autumn/app_music/oat/x86/gW.odex --compiler-filter=quicken --class-loader-context=&
      2⤵
      • Loads dropped Dex/Jar
      PID:4294

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • /data/data/com.acoustic.autumn/.qcom.acoustic.autumn

    Filesize

    48B

    MD5

    046a414913add6f5bb60072c7db819b6

    SHA1

    451ee4f6809260aec622d772fd329c7d0297a842

    SHA256

    b66c1320cb063a1d391c94273572ea6edae76c8c8b0a07f8d75c88686f0df72a

    SHA512

    4e6355f3051ed5e811ab030abde1f5be7f5e1cf33be99cd08477e9b6c015deb1d8bd75a09fb9c7176b8511c5ad0a67abc0902a3531e97564ccb6afc57496a47c

  • /data/data/com.acoustic.autumn/app_music/gW.json

    Filesize

    153KB

    MD5

    2b0a75c62713066169f9132ea62bfb1d

    SHA1

    34cfacaa7c5845d5f284184fa8d5a63ca2b8cb36

    SHA256

    9061a051f635e14abaed8ce2ffac90b478c9313a4208cfc2ae81fde1e323574f

    SHA512

    9a8268cafe691f1670ec23830384ea8f0bdd2efa042e4257aaa648d198bfe353e73b7c595460415fa9fa820077d64563f5c49af43a1bc93f1151a9d1758a5640

  • /data/data/com.acoustic.autumn/app_music/gW.json

    Filesize

    153KB

    MD5

    207457e3e6b5448fced43beffbb186b2

    SHA1

    9eec688ff8af0fc19410efcf97231aee9c96cdfb

    SHA256

    fa57f61d3d81b3424b405a99bc21214ad95112eb023b2b7e60d5bd41fc22cb7c

    SHA512

    6b01f3104199cb9ccb9f0bd488f96d7ee1b9d9791df00a9f958cf08fde74f6fe43efdf0b150d29dca6d54a9ee5fc0806dd1020a09dae4e1d929f86954d78f9ec

  • /data/data/com.acoustic.autumn/kl.txt

    Filesize

    45B

    MD5

    628ea3322a9986e49818b4fcc811257e

    SHA1

    46e86c9e9cb52019144659af8f2efb429ebab05d

    SHA256

    b3b833ca128a785c56eedbb98258b49f053e88ed1e39b9562b7c0cc5ead89c9f

    SHA512

    fadbfb44832353e2a9072e0ed7e1cf9eb6bd8cf43081fe6f05d825343a2e0ea2da122ad037ee44077b34d48671315c69e39032a14ff96b3e22a9ae07293f5c49

  • /data/data/com.acoustic.autumn/kl.txt

    Filesize

    423B

    MD5

    15043b78c6f22aa67dd2445eb12f1825

    SHA1

    9ff8ff5202f9809474da9ae7379a13849360b22d

    SHA256

    a5c5bf70c2b2ef1d8508731332463efcb628a06734c42ccb0c6af63eb32f9f43

    SHA512

    ee7361f92121554fc0489e550ba91c5f7ee2a63d5cc74313d33533724a3e6aa6d8708a4c3fbb0d84b30bb388e26389d017132d886f35ba07e86fbcd6f76dbf1f

  • /data/data/com.acoustic.autumn/kl.txt

    Filesize

    230B

    MD5

    ed7422a44ec891b46ed9b601e32af2b0

    SHA1

    e5ee27daa1d2652c2d8bf0667c673facd93e4c3b

    SHA256

    069756c35ed0f3d0277af837c01a8a4110a5faeff23d95ee9a3e11550cd34a80

    SHA512

    6dea0a06192fb8227e8844a9ef02338d92fa61bbb791020e91285804b7daa90d138ef3049970e5ec0949aa07bc8ba29dbebe48650b6c23e2cc8d2ed41261e540

  • /data/data/com.acoustic.autumn/kl.txt

    Filesize

    54B

    MD5

    2c5b4d9286cc5f83da7eec24be2d5efa

    SHA1

    ce2572c790698b2679c0ffc6d81a09848f874f48

    SHA256

    9dc31b0027dda8bef3d882923b78794aad01ea9ff40217b0a7ac733414b929a3

    SHA512

    497c448c6a3bdd0d4fb1d61987ce555963ff7d82498b517e6c68a736b13f532254194e32e4b0fa35fbfa9e9fc0251a8c9b616c138f406bba94f001d569f5b337

  • /data/data/com.acoustic.autumn/kl.txt

    Filesize

    63B

    MD5

    7f838626c4a6dbad8db7b080f666d128

    SHA1

    c3c1f5d2a55a9d3c6d292742a7300e8675e5d2e2

    SHA256

    50876f913c179ca5c52c294fcff94c90753fdbe96f01a2d16daf492d8f5d602b

    SHA512

    0792c92958ae0c5413531b405c47283d4a69132b6b546b000d03c76757a5e768a0ca3133c862a67fb47a93ac7dd18d8d9c0a661bf2f2a257743607334749f0de

  • /data/user/0/com.acoustic.autumn/app_music/gW.json

    Filesize

    450KB

    MD5

    08f1edbcf18e37d3500dfeaf76d0dcec

    SHA1

    4600f5ae8aa06e879d39761207c2d92767f9352a

    SHA256

    c486307cff094d877ae62df0eb351cbd37986144ae12eca9b0fc73f9bd6aac22

    SHA512

    7c451670a37706525b677afde2bf488604333b52a928cb1d6b3d937046dfdc21e37a0d4a9f3064fed94a6b4a1e42fb5a1a79d062d3d5210cfdce878b359ea4f9

  • /data/user/0/com.acoustic.autumn/app_music/gW.json

    Filesize

    450KB

    MD5

    a77c0406635af1f7b293cb2b9c99ac86

    SHA1

    3fa7f818eae5cad1305b27c1e5beb8256ba981aa

    SHA256

    2ec3bb168d1cf02585d764a35bd016055a09415498bff650b870d8e193d5154e

    SHA512

    0980fa36eae2d87731ce3ec0533695fbbbf7ead4730f4844873fc926dd2b7aca039ba84645558c621128f00f14239cd6ca1de6473adc47d5eac4d07a2b17e979