Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    149s
  • max time network
    151s
  • platform
    android_x64
  • resource
    android-x64-arm64-20240624-en
  • resource tags

    androidarch:armarch:arm64arch:x64arch:x86image:android-x64-arm64-20240624-enlocale:en-usos:android-11-x64system
  • submitted
    04/02/2025, 22:01

General

  • Target

    11036b51f77ac127f7b0725d291c91169e032a65200e17bf1d20f5e56af293b6.apk

  • Size

    1.7MB

  • MD5

    ce0137d465c2fb9335bdefc5348d11bd

  • SHA1

    4ac64eb3ec437a174faffc53f61444999bbdaf04

  • SHA256

    11036b51f77ac127f7b0725d291c91169e032a65200e17bf1d20f5e56af293b6

  • SHA512

    aaa61947d32c65500a4944a9b3ef4fd6d428b23168e8b5c7f3f6894059637c028ea1e5851109db73981d47f4ab6b89b558f0dfaf8933871dfa85212af0b19e85

  • SSDEEP

    49152:FPpxBUnSSmgT1nbY4NTNQZGmWp4kOSfR7WbKCiJAB5vk:RRUnnmgpxsGaSfR6n5c

Malware Config

Extracted

Family

octo

C2

https://kobrasaldiristratejileri.xyz/MzhiMTg0NTAwOTY5S/

https://kobratehlikeanalizleri.xyz/MzhiMTg0NTAwOTY5S/

https://kobravesurprizhikayeler.xyz/MzhiMTg0NTAwOTY5S/

https://kobrayanasistemverileri.xyz/MzhiMTg0NTAwOTY5S/

https://kobrakulturvesavasanati.xyz/MzhiMTg0NTAwOTY5S/

https://kobrabilimvegizemlerdunyasi.xyz/MzhiMTg0NTAwOTY5S/

https://kobragesmisiylebilimtarihi.xyz/MzhiMTg0NTAwOTY5S/

https://kobraversanatinbirlestigi.xyz/MzhiMTg0NTAwOTY5S/

https://kobrataktiklersistematik.xyz/MzhiMTg0NTAwOTY5S/

https://kobralaryasadogasi.xyz/MzhiMTg0NTAwOTY5S/

https://kobravesavasfelsefesi.xyz/MzhiMTg0NTAwOTY5S/

https://kobratedbirvetaktik.xyz/MzhiMTg0NTAwOTY5S/

https://kobratehlikeveguvenlik.xyz/MzhiMTg0NTAwOTY5S/

https://kobravesavunmasistemi.xyz/MzhiMTg0NTAwOTY5S/

https://kobraveavlanmataktikleri.xyz/MzhiMTg0NTAwOTY5S/

https://kobrakisiselyetenekler.xyz/MzhiMTg0NTAwOTY5S/

https://kobratehlikeharitasi.xyz/MzhiMTg0NTAwOTY5S/

https://kobravesavasstratejileri.xyz/MzhiMTg0NTAwOTY5S/

https://kobrabilimveanaliz.xyz/MzhiMTg0NTAwOTY5S/

https://kobratehditveonleme.xyz/MzhiMTg0NTAwOTY5S/

rc4.plain

Extracted

Family

octo

C2

https://kobrasaldiristratejileri.xyz/MzhiMTg0NTAwOTY5S/

https://kobratehlikeanalizleri.xyz/MzhiMTg0NTAwOTY5S/

https://kobravesurprizhikayeler.xyz/MzhiMTg0NTAwOTY5S/

https://kobrayanasistemverileri.xyz/MzhiMTg0NTAwOTY5S/

https://kobrakulturvesavasanati.xyz/MzhiMTg0NTAwOTY5S/

https://kobrabilimvegizemlerdunyasi.xyz/MzhiMTg0NTAwOTY5S/

https://kobragesmisiylebilimtarihi.xyz/MzhiMTg0NTAwOTY5S/

https://kobraversanatinbirlestigi.xyz/MzhiMTg0NTAwOTY5S/

https://kobrataktiklersistematik.xyz/MzhiMTg0NTAwOTY5S/

https://kobralaryasadogasi.xyz/MzhiMTg0NTAwOTY5S/

https://kobravesavasfelsefesi.xyz/MzhiMTg0NTAwOTY5S/

https://kobratedbirvetaktik.xyz/MzhiMTg0NTAwOTY5S/

https://kobratehlikeveguvenlik.xyz/MzhiMTg0NTAwOTY5S/

https://kobravesavunmasistemi.xyz/MzhiMTg0NTAwOTY5S/

https://kobraveavlanmataktikleri.xyz/MzhiMTg0NTAwOTY5S/

https://kobrakisiselyetenekler.xyz/MzhiMTg0NTAwOTY5S/

https://kobratehlikeharitasi.xyz/MzhiMTg0NTAwOTY5S/

https://kobravesavasstratejileri.xyz/MzhiMTg0NTAwOTY5S/

https://kobrabilimveanaliz.xyz/MzhiMTg0NTAwOTY5S/

https://kobratehditveonleme.xyz/MzhiMTg0NTAwOTY5S/

Attributes
  • target_apps

    at.spardat.bcrmobile

    at.spardat.netbanking

    com.bankaustria.android.olb

    com.bmo.mobile

    com.cibc.android.mobi

    com.rbc.mobile.android

    com.scotiabank.mobile

    com.td

    cz.airbank.android

    eu.inmite.prj.kb.mobilbank

    com.bankinter.launcher

    com.kutxabank.android

    com.rsi

    com.tecnocom.cajalaboral

    es.bancopopular.nbmpopular

    es.evobanco.bancamovil

    es.lacaixa.mobile.android.newwapicon

    com.dbs.hk.dbsmbanking

    com.FubonMobileClient

    com.hangseng.rbmobile

    com.MobileTreeApp

    com.mtel.androidbea

    com.scb.breezebanking.hk

    hk.com.hsbc.hsbchkmobilebanking

    com.aff.otpdirekt

    com.ideomobile.hapoalim

    com.infrasofttech.indianBank

    com.mobikwik_new

    com.oxigen.oxigenwallet

    jp.co.aeonbank.android.passbook

AES_key

Signatures

  • Octo

    Octo is a banking malware with remote access capabilities first seen in April 2022.

  • Octo family
  • Octo payload 1 IoCs
  • Loads dropped Dex/Jar 1 TTPs 1 IoCs

    Runs executable file dropped to the device during analysis.

  • Makes use of the framework's Accessibility service 4 TTPs 2 IoCs

    Retrieves information displayed on the phone screen using AccessibilityService.

  • Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
  • Queries the phone number (MSISDN for GSM devices) 1 TTPs
  • Acquires the wake lock 1 IoCs
  • Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs

    Application may abuse the framework's foreground service to continue running in the foreground.

  • Performs UI accessibility actions on behalf of the user 1 TTPs 4 IoCs

    Application may abuse the accessibility service to prevent their removal.

  • Queries the mobile country code (MCC) 1 TTPs 1 IoCs
  • Reads information about phone network operator. 1 TTPs
  • Requests accessing notifications (often used to intercept notifications before users become aware). 1 TTPs 1 IoCs
  • Requests disabling of battery optimizations (often used to enable hiding in the background). 1 TTPs 1 IoCs
  • Requests modifying system settings. 1 IoCs
  • Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs

Processes

  • com.acoustic.autumn
    1⤵
    • Loads dropped Dex/Jar
    • Makes use of the framework's Accessibility service
    • Acquires the wake lock
    • Makes use of the framework's foreground persistence service
    • Performs UI accessibility actions on behalf of the user
    • Queries the mobile country code (MCC)
    • Requests accessing notifications (often used to intercept notifications before users become aware).
    • Requests disabling of battery optimizations (often used to enable hiding in the background).
    • Requests modifying system settings.
    • Uses Crypto APIs (Might try to encrypt user data)
    PID:4475

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • /data/user/0/com.acoustic.autumn/.qcom.acoustic.autumn

    Filesize

    48B

    MD5

    046a414913add6f5bb60072c7db819b6

    SHA1

    451ee4f6809260aec622d772fd329c7d0297a842

    SHA256

    b66c1320cb063a1d391c94273572ea6edae76c8c8b0a07f8d75c88686f0df72a

    SHA512

    4e6355f3051ed5e811ab030abde1f5be7f5e1cf33be99cd08477e9b6c015deb1d8bd75a09fb9c7176b8511c5ad0a67abc0902a3531e97564ccb6afc57496a47c

  • /data/user/0/com.acoustic.autumn/app_music/gW.json

    Filesize

    153KB

    MD5

    2b0a75c62713066169f9132ea62bfb1d

    SHA1

    34cfacaa7c5845d5f284184fa8d5a63ca2b8cb36

    SHA256

    9061a051f635e14abaed8ce2ffac90b478c9313a4208cfc2ae81fde1e323574f

    SHA512

    9a8268cafe691f1670ec23830384ea8f0bdd2efa042e4257aaa648d198bfe353e73b7c595460415fa9fa820077d64563f5c49af43a1bc93f1151a9d1758a5640

  • /data/user/0/com.acoustic.autumn/app_music/gW.json

    Filesize

    153KB

    MD5

    207457e3e6b5448fced43beffbb186b2

    SHA1

    9eec688ff8af0fc19410efcf97231aee9c96cdfb

    SHA256

    fa57f61d3d81b3424b405a99bc21214ad95112eb023b2b7e60d5bd41fc22cb7c

    SHA512

    6b01f3104199cb9ccb9f0bd488f96d7ee1b9d9791df00a9f958cf08fde74f6fe43efdf0b150d29dca6d54a9ee5fc0806dd1020a09dae4e1d929f86954d78f9ec

  • /data/user/0/com.acoustic.autumn/app_music/gW.json

    Filesize

    450KB

    MD5

    a77c0406635af1f7b293cb2b9c99ac86

    SHA1

    3fa7f818eae5cad1305b27c1e5beb8256ba981aa

    SHA256

    2ec3bb168d1cf02585d764a35bd016055a09415498bff650b870d8e193d5154e

    SHA512

    0980fa36eae2d87731ce3ec0533695fbbbf7ead4730f4844873fc926dd2b7aca039ba84645558c621128f00f14239cd6ca1de6473adc47d5eac4d07a2b17e979

  • /data/user/0/com.acoustic.autumn/kl.txt

    Filesize

    58B

    MD5

    fcd00ee9c23748724ed61eff956b41ec

    SHA1

    2e1d9d9bce6199465b0e53e911104e176747eb06

    SHA256

    e65aa8ef76271f100c34540a1e55e90c005446d87d25cbbeb830c49603ca0b7e

    SHA512

    b7dbd58e25a15cd000487d2a1056828d56e01c754b58e6ae0f26ec66bdd65848c1a99870b6dcd11b49b3a9bfe3af97a0c5bea2837c1e0414ddf1d5d04cdafdb7

  • /data/user/0/com.acoustic.autumn/kl.txt

    Filesize

    45B

    MD5

    b640695dcf3dddb5e789c02dd3844efb

    SHA1

    ffceff512048b071157ad33dc16c0fe6fc360349

    SHA256

    0a7ba84c0fac9d43e28aa0f2c65236ffaf24062f800ad64c8d27e4166d11e9ab

    SHA512

    2c5bd92ef48121573466605d96fc2e90c8bb4a240176142e837eb44f646ff4693578e7d7cc7b0f718dc00291f78a1bc3521c914457edc19ce6af7ccdff043bb0

  • /data/user/0/com.acoustic.autumn/kl.txt

    Filesize

    66B

    MD5

    9e1649cf928233d63c83373d1840217e

    SHA1

    568c1c6ea245e96919fe0c34448d4dd1417338ea

    SHA256

    224630c5a28c011658751281121430e533326fe3c045a7f7b42d8ae5e5434a14

    SHA512

    22dfe17dbdb623ad688c384a31bac20119a7988cd7ed9743345d73475798acfe7b091a6388a9b2c5184be904ebd7370547d3fdf2f5cee93c13a02f29d00697ff

  • /data/user/0/com.acoustic.autumn/kl.txt

    Filesize

    84B

    MD5

    07cf4bf46ae215087ed933b858cdfe0e

    SHA1

    1b635a728f7e0c96ff4dafaffa9bf1936878ec3b

    SHA256

    e69a5f6b291396387a2f16af7399afe3790f4f16d8a2baf37939eea515983257

    SHA512

    672f76c0c77b55576583a0fffa944cfb0f910fd9bdb0bac5e2b780f8ae56adbae12aeca8b584deb082d56f10617021e60127de3a4c680884d33dd1573f17b677

  • /data/user/0/com.acoustic.autumn/kl.txt

    Filesize

    63B

    MD5

    71e4470ead4ffb01a8c58af0ae16ad90

    SHA1

    f3018b046578286fde0dea526a396f31f97f66e6

    SHA256

    d37a29b41a466971991954dd12e8dce5be09dbbec5deb6ada266ab41601846e2

    SHA512

    a96bdd308d9521353931d676cf04c508563966a8fc680083ea226e2abc9469fd5734a8987a353d2fce29e7a6783e1e454c8e46d0b3ec8fdc79a2d5fb92c58551

  • /data/user/0/com.acoustic.autumn/kl.txt

    Filesize

    58B

    MD5

    4ccb7bbef3ba91ff4869e52bd041b76a

    SHA1

    6a73382dad7e6848259bff82807e3fdae7c9115d

    SHA256

    3f25f19b92335ee42286320f3558ddc0d6ed377ccfbffbaad896efba5e002d2c

    SHA512

    1eb156709ed727bc254c99651b8824afe04a56239f92376db12d60247e2cb8892f907cba813a31c9e01beff56fa002b40654aa20ee50a2f769304ae5c602435c

  • /data/user/0/com.acoustic.autumn/kl.txt

    Filesize

    63B

    MD5

    d3ac9178628d04244702dff900d40faf

    SHA1

    167ccb524ff5d88866a17af138709b3a0d87ec65

    SHA256

    714ad3df4d96cc2827ebfcd9c8e993760890f4d20e45feaddf8a082d19ec1250

    SHA512

    bacab7886495bf67993ccc0067e3a112ee6f4b3a045e276e495b0d38255b6f0081591841221c7dc63b6f39c0ffc033dcc6034193a2bda176f82a6c43709dc20d

  • /data/user/0/com.acoustic.autumn/kl.txt

    Filesize

    230B

    MD5

    a03d5af701606555237d45d87e544014

    SHA1

    e883fbaa1e0c1a3390f8af444116c7c69b81e3d8

    SHA256

    051bc8bbb39664a549f07ea36f1109e19ba41d44014648dc1ff8f2a7112599a8

    SHA512

    445287ff0d11484bd77be571f7c549393d873939e94b0ef99bc86030d52f1332c5b5c5fe60703a85ac5259a9da2481be06e9e78e36df222094f7ff579314b154

  • /data/user/0/com.acoustic.autumn/kl.txt

    Filesize

    63B

    MD5

    59bee57d83ca0b97d356d7c189799309

    SHA1

    966bb9ab00022c2e52feb076e59ddc053121fc79

    SHA256

    8430fdeed370db413f298facc1cf06d715f61171e5fdbba00dad8ad5968a89f5

    SHA512

    d420b3ccf6c209591e1de3d6e8247997aee5c4941d75dcde670de3d3ab903a9ab2c803459c53e0de6c33c6a642a61e13e98352a48e82a03575ed2aae7b1077f9

  • /data/user/0/com.acoustic.autumn/kl.txt

    Filesize

    68B

    MD5

    21bc499116e8e7d65f17c7feee121f32

    SHA1

    7fc76d32acd6656fbf5e8a1e1a0465aa0a1df30b

    SHA256

    f6dcc9193884344a9f669bf0414a6ab6dc29fb7e710f1a313437623f8e4cabf5

    SHA512

    b3ebd300df7fe486a4105337315dc7407ccc88e9bb803d752f619a65986aafcf0ff70d3cefe88629f9beae9de398187a2e49eb43a558b9dbd774fe7abf15d867

  • /data/user/0/com.acoustic.autumn/kl.txt

    Filesize

    45B

    MD5

    1e09267e3e7a2db876195569c9d7ee06

    SHA1

    d511e0b8995ef9f5afa38cbd4b9fc13390290322

    SHA256

    01d4241f334764802ded3115ecff7749d7240b16654a380c8ce99e408ff28bbf

    SHA512

    c118c21ff86e8e426ccf4db9f44fb7b3b62c743225dbf1587dd3412b93d9be28ab018eba421d1e65bae51033e54ce018498770b9a1be120a36578adc55f75225

  • /data/user/0/com.acoustic.autumn/kl.txt

    Filesize

    466B

    MD5

    d092ffc48c9e0b1753b7895525003e73

    SHA1

    56cffc634f18bb326f1ac1974ba5756089c22954

    SHA256

    c4216fa4bfe9ae08da235e35fcce7b0cc098831002f9299e486b1c4115b41b6a

    SHA512

    591050e63ade08639f82484fca121f1d55d6838f9bec62531ccfdc6569c47792f619c2714293e61181fb32825767bccd5c86a99df566196e84a58e3da39e652b

  • /data/user/0/com.acoustic.autumn/kl.txt

    Filesize

    63B

    MD5

    6e4d2dd77ae2b4e45c8ef2bdf23cac9c

    SHA1

    db94b7d881426bb8318a9d89d676580617192110

    SHA256

    6ee2dc67603934e30d5926b675aeb47f00cbe50e1ae7b5bf35f3edeb64b6a3fb

    SHA512

    afaa60e8fd56962d552bdd1de556f1c9310353b3e6d140e65482c4cc244fdb3a86f558ae69405f54330e545b34d09936ad138024757cd03e03a1b24c9c53fa4a