Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

10

Static

static

6

009412ecaf...97.apk

android-9-x86

10

009412ecaf...97.apk

android-11-x64

10

Analysis

  • max time kernel
    149s
  • max time network
    151s
  • platform
    android-9_x86
  • resource
    android-x86-arm-20240910-en
  • resource tags

    arch:armarch:x86image:android-x86-arm-20240910-enlocale:en-usos:android-9-x86system
  • submitted
    04/02/2025, 22:01

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    009412ecaf725ec8fce6f3ef52580c202fec74b7fe30b7a4b2ae03bf53b6a097.apk

  • Size

    3.2MB

  • MD5

    287536ad2ef3215f55878af5f12d3a2c

  • SHA1

    42e67d629b355140d7d215d4f5903e098bae79bb

  • SHA256

    009412ecaf725ec8fce6f3ef52580c202fec74b7fe30b7a4b2ae03bf53b6a097

  • SHA512

    40ea2a76007cc5f0e0d85e652e3f92f43acd0a223bddb2614f0cbc786982b9c8ff068725da4861763f97d10c3dbc32aeb71dd549a9fc8b4d7a9e75585799f174

  • SSDEEP

    98304:vZI4eSJ378jN5fDN8EyUB6ZP8HR/rUswNScadNRBBiwxlGgE:vZIY8r+Eb4Zu1DNW

Score
10/10
octobankercollectioncredential_accessdefense_evasiondiscoveryevasionimpactinfostealerpersistenceratstealthtrojan

Malware Config

Extracted

Family

octo

C2

https://kkcanertarihcesi.xyz/MzhiMTg0NTAwOTY5S/

https://tutmlhizmetleri.xyz/MzhiMTg0NTAwOTY5S/

https://tutmlsistemleri.xyz/MzhiMTg0NTAwOTY5S/

https://tutmlplatformlari.xyz/MzhiMTg0NTAwOTY5S/

https://tutmlhaberportali.xyz/MzhiMTg0NTAwOTY5S/

https://tutmlguncelveriler.xyz/MzhiMTg0NTAwOTY5S/

https://tutmlteknolojidunyasi.xyz/MzhiMTg0NTAwOTY5S/

https://tutmlgelismeler.xyz/MzhiMTg0NTAwOTY5S/

https://tutmlarsivkayitlari.xyz/MzhiMTg0NTAwOTY5S/

https://tutmlprojelerplatformu.xyz/MzhiMTg0NTAwOTY5S/

https://tutmlbilgipaylasimi.xyz/MzhiMTg0NTAwOTY5S/

https://tutmliletisimagaci.xyz/MzhiMTg0NTAwOTY5S/

https://tutmlanalizverileri.xyz/MzhiMTg0NTAwOTY5S/

https://tutmlstratejiplani.xyz/MzhiMTg0NTAwOTY5S/

https://tutmlsistemyonetimi.xyz/MzhiMTg0NTAwOTY5S/

https://tutmlvizyonrehberi.xyz/MzhiMTg0NTAwOTY5S/

https://tutmlgeleceksenaryosu.xyz/MzhiMTg0NTAwOTY5S/

https://tutmlsosyalkullanimi.xyz/MzhiMTg0NTAwOTY5S/

https://tutmlonlinetoplum.xyz/MzhiMTg0NTAwOTY5S/

https://tutmlodaklisisim.xyz/MzhiMTg0NTAwOTY5S/
rc4.plain

Extracted

Family

octo

C2

https://kkcanertarihcesi.xyz/MzhiMTg0NTAwOTY5S/

https://tutmlhizmetleri.xyz/MzhiMTg0NTAwOTY5S/

https://tutmlsistemleri.xyz/MzhiMTg0NTAwOTY5S/

https://tutmlplatformlari.xyz/MzhiMTg0NTAwOTY5S/

https://tutmlhaberportali.xyz/MzhiMTg0NTAwOTY5S/

https://tutmlguncelveriler.xyz/MzhiMTg0NTAwOTY5S/

https://tutmlteknolojidunyasi.xyz/MzhiMTg0NTAwOTY5S/

https://tutmlgelismeler.xyz/MzhiMTg0NTAwOTY5S/

https://tutmlarsivkayitlari.xyz/MzhiMTg0NTAwOTY5S/

https://tutmlprojelerplatformu.xyz/MzhiMTg0NTAwOTY5S/

https://tutmlbilgipaylasimi.xyz/MzhiMTg0NTAwOTY5S/

https://tutmliletisimagaci.xyz/MzhiMTg0NTAwOTY5S/

https://tutmlanalizverileri.xyz/MzhiMTg0NTAwOTY5S/

https://tutmlstratejiplani.xyz/MzhiMTg0NTAwOTY5S/

https://tutmlsistemyonetimi.xyz/MzhiMTg0NTAwOTY5S/

https://tutmlvizyonrehberi.xyz/MzhiMTg0NTAwOTY5S/

https://tutmlgeleceksenaryosu.xyz/MzhiMTg0NTAwOTY5S/

https://tutmlsosyalkullanimi.xyz/MzhiMTg0NTAwOTY5S/

https://tutmlonlinetoplum.xyz/MzhiMTg0NTAwOTY5S/

https://tutmlodaklisisim.xyz/MzhiMTg0NTAwOTY5S/
Attributes
  • target_apps

    at.spardat.bcrmobile

    at.spardat.netbanking

    com.bankaustria.android.olb

    com.bmo.mobile

    com.cibc.android.mobi

    com.rbc.mobile.android

    com.scotiabank.mobile

    com.td

    cz.airbank.android

    eu.inmite.prj.kb.mobilbank

    com.bankinter.launcher

    com.kutxabank.android

    com.rsi

    com.tecnocom.cajalaboral

    es.bancopopular.nbmpopular

    es.evobanco.bancamovil

    es.lacaixa.mobile.android.newwapicon

    com.dbs.hk.dbsmbanking

    com.FubonMobileClient

    com.hangseng.rbmobile

    com.MobileTreeApp

    com.mtel.androidbea

    com.scb.breezebanking.hk

    hk.com.hsbc.hsbchkmobilebanking

    com.aff.otpdirekt

    com.ideomobile.hapoalim

    com.infrasofttech.indianBank

    com.mobikwik_new

    com.oxigen.oxigenwallet

    jp.co.aeonbank.android.passbook

AES_key

Signatures

  • Octo

    Octo is a banking malware with remote access capabilities first seen in April 2022.

    bankertrojaninfostealerratocto
  • Octo family
    octo
  • Octo payload 2 IoCs
  • Removes its main activity from the application launcher 1 TTPs 1 IoCs
    stealthtrojanevasion
  • Loads dropped Dex/Jar 1 TTPs 2 IoCs

    Runs executable file dropped to the device during analysis.

    evasion
  • Makes use of the framework's Accessibility service 4 TTPs 2 IoCs

    Retrieves information displayed on the phone screen using AccessibilityService.

    collectiondefense_evasioncredential_access
  • Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
    bankerdiscovery
  • Queries the phone number (MSISDN for GSM devices) 1 TTPs
    discovery
  • Acquires the wake lock 1 IoCs
  • Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs

    Application may abuse the framework's foreground service to continue running in the foreground.

    defense_evasionpersistence
  • Performs UI accessibility actions on behalf of the user 1 TTPs 4 IoCs

    Application may abuse the accessibility service to prevent their removal.

    evasion
  • Queries the mobile country code (MCC) 1 TTPs 1 IoCs
    discovery
  • Queries the unique device ID (IMEI, MEID, IMSI) 1 TTPs
    discovery
  • Requests accessing notifications (often used to intercept notifications before users become aware). 1 TTPs 1 IoCs
    collectioncredential_access
  • Requests disabling of battery optimizations (often used to enable hiding in the background). 1 TTPs 1 IoCs
    defense_evasion
  • Requests modifying system settings. 1 IoCs
    defense_evasion
  • Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs
    persistence
  • Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs
    impact

Processes

  • com.chaos.frame
    1⤵
    • Removes its main activity from the application launcher
    • Loads dropped Dex/Jar
    • Makes use of the framework's Accessibility service
    • Acquires the wake lock
    • Makes use of the framework's foreground persistence service
    • Performs UI accessibility actions on behalf of the user
    • Queries the mobile country code (MCC)
    • Requests accessing notifications (often used to intercept notifications before users become aware).
    • Requests disabling of battery optimizations (often used to enable hiding in the background).
    • Requests modifying system settings.
    • Registers a broadcast receiver at runtime (usually for listening for system events)
    • Uses Crypto APIs (Might try to encrypt user data)
    PID:4223
    • /system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.chaos.frame/app_image/xs.json --output-vdex-fd=41 --oat-fd=42 --oat-location=/data/user/0/com.chaos.frame/app_image/oat/x86/xs.odex --compiler-filter=quicken --class-loader-context=&
      2⤵
      • Loads dropped Dex/Jar
      PID:4248

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Event Triggered Execution

1
T1624

Broadcast Receivers

1
T1624.001

Foreground Persistence

1
T1541

Privilege Escalation

Defense Evasion

Download New Code at Runtime

1
T1407

Foreground Persistence

1
T1541

Hide Artifacts

2
T1628

Suppress Application Icon

1
T1628.001

User Evasion

1
T1628.002

Impair Defenses

1
T1629

Prevent Application Removal

1
T1629.001

Input Injection

1
T1516

Credential Access

Access Notifications

1
T1517

Input Capture

2
T1417

GUI Input Capture

1
T1417.002

Keylogging

1
T1417.001

Discovery

Software Discovery

1
T1418

Security Software Discovery

1
T1418.001

System Network Configuration Discovery

3
T1422

Lateral Movement

Collection

Access Notifications

1
T1517

Input Capture

2
T1417

GUI Input Capture

1
T1417.002

Keylogging

1
T1417.001

Screen Capture

1
T1513

Command and Control

Exfiltration

Impact

Data Encrypted for Impact

1
T1471

Input Injection

1
T1516

Replay Monitor

Loading Replay Monitor...

Downloads

  • /data/data/com.chaos.frame/.qcom.chaos.frame
    Filesize

    48B

    MD5

    046a414913add6f5bb60072c7db819b6

    SHA1

    451ee4f6809260aec622d772fd329c7d0297a842

    SHA256

    b66c1320cb063a1d391c94273572ea6edae76c8c8b0a07f8d75c88686f0df72a

    SHA512

    4e6355f3051ed5e811ab030abde1f5be7f5e1cf33be99cd08477e9b6c015deb1d8bd75a09fb9c7176b8511c5ad0a67abc0902a3531e97564ccb6afc57496a47c

    Download Submit

  • /data/data/com.chaos.frame/app_image/xs.json
    Filesize

    153KB

    MD5

    248a6708505ba7d828c70b2233a006f5

    SHA1

    38e968fd5b4c27130a02cdf6727c9616c1b7293d

    SHA256

    8c265b2e3ae969b65b9f213da8bc9121006824335d40b419ebb991ef0398e135

    SHA512

    850b4aac8bd66ffdc2eed29fcd44f57c81b71a149703b447593fc88ab045444482f99780596cc380fbe2ab5780c84db39c365870765e6cddda545092791d23bc

    Download Submit

  • /data/data/com.chaos.frame/app_image/xs.json
    Filesize

    153KB

    MD5

    ab7fdb4a74041b1673eb1a1e0da18c88

    SHA1

    5d85a9fab422094ce862ed2add0bd47961d1122a

    SHA256

    02bb03b0df881361bcfeb99af13fda304753a504e1dbaf5c6f0ad8697a2594b2

    SHA512

    d6af1224412892f36bba9ef1681ab9fd69eb3d1c9a8d9a6e4b529ab0cde4bd78a296b827189bf50e6ef1e9d8561019ac4592965f30cfbd6e8245f575d11c4fb1

    Download Submit

  • /data/data/com.chaos.frame/kl.txt
    Filesize

    45B

    MD5

    9d3c13d4cccb3d98a004f6bfc4c78c7f

    SHA1

    7ae44cc1289f4c5f1a203be99b24ce10085bdff0

    SHA256

    3db49ac2d5854ffab17c4eca005528a1bc00f53ae3696eb3e3b539bc915fec77

    SHA512

    b8afa45b5f5ac9f39a6ca447c5f7afeb0ddb45154dfb27ba12cd862878b794e8479b33e1f6cf9cdb673c5a096b90e4f49ba52f747f9644dbfd132d6e03c6f482

    Download Submit

  • /data/data/com.chaos.frame/kl.txt
    Filesize

    423B

    MD5

    da263d6942c0e31f3079391d28f297ba

    SHA1

    73a9b62b2a6efef1f913c2cb8b866daf8416b12a

    SHA256

    6fd6f258a59ba333d4cda9d57d8d9ba3f489d2912ad2ecdc1692b571c06530e7

    SHA512

    438fcf37da9221134ef2839df0adc0475d31d0e09b7b5510b158384a4c388fee8a0a1ca475bc0f06cce4f5d1ac8071e9677f3935973d6c2af036ce4e323e642a

    Download Submit

  • /data/data/com.chaos.frame/kl.txt
    Filesize

    230B

    MD5

    c808e11b514aa285c6c00006c147f93e

    SHA1

    e8bb136095724c00ad94ba540374395fb318d845

    SHA256

    077db566cca14ff83d1c56486084eadc01c47d9be7dc5d912c5ec658cca5bc57

    SHA512

    1448464a3e4978ed45dea78bba3cdff42fd66986852aea8692284e5880545cd46366ffb60d4fde5bbc9d6c426e46e840eaf47a40089842faabc7b6ba79019411

    Download Submit

  • /data/data/com.chaos.frame/kl.txt
    Filesize

    54B

    MD5

    7ca2ba8c7930631a8809fc6cfd1fa984

    SHA1

    924ade72a4cd8defef24444c2f10dd63c49e75d1

    SHA256

    9d7f7152dd6291904ba3109b2f3c09b67fd42c3db6b7b5204b36781f6e3b7ad7

    SHA512

    90ed4d37a1518301b99cf94a53e288aa8be83fa1bd60b4bceb256de8d90fd24bedb21cf57afe30c023cd88855805eba215fea5e1c3af9b0d15155a6674ac83c6

    Download Submit

  • /data/data/com.chaos.frame/kl.txt
    Filesize

    63B

    MD5

    db9d4c1c27c648231d316cdfebeb727b

    SHA1

    bd5e87d3f487d794c952125f8b8f60a3ecc3950d

    SHA256

    91eb732277475cd56f2c607da250066526e3c7472d18c2681e966ef52296f979

    SHA512

    566c143306a054205ec246b1481b9c9c48f813e1bf2726515aaa5ce1a7965630a69deb0cd4cc22c076fc1876cee6f1ba062744df157ce79c3ba6c70f708444f9

    Download Submit

  • /data/user/0/com.chaos.frame/app_image/xs.json
    Filesize

    450KB

    MD5

    0515a3aed9c478c22665459a6edc1af1

    SHA1

    00c19b43703879c5c3d8753c29ee3fdfe8028ba4

    SHA256

    67b60aa4e7bfe07f93e3bcfdf8c005840d98027270021690c0778687df84eec2

    SHA512

    faf9097018d121b0ca8313466c9fbbee619ecc9075779b3e03e1b7f5a60277f63e83a707ef012fabf845b16cef3e7d9424138b12f517c17fa8a8463698968a86

    Download Submit

  • /data/user/0/com.chaos.frame/app_image/xs.json
    Filesize

    450KB

    MD5

    fc3a467820937f39feb79885490fa3df

    SHA1

    81effc1116ced76ebbd694219ff8e6dbf1824958

    SHA256

    d4b8074e060621a67df0d1c4b3b9d27c18c678fe92d7bd544c1027bcebdc4064

    SHA512

    58fe36bfe4667853756eb8c34f65e6a8292278e4c84b0f82a88c2d3e441fa8e50126722fb4884f391b6adb804eebbf4f8f00769e20d61ede7e09f252373b5a5f

    Download Submit