Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    148s
  • max time network
    150s
  • platform
    android-9_x86
  • resource
    android-x86-arm-20240910-en
  • resource tags

    arch:armarch:x86image:android-x86-arm-20240910-enlocale:en-usos:android-9-x86system
  • submitted
    04/02/2025, 22:02

General

  • Target

    baf3719559aa0694caacb082d9c82b99492dc78588ae154fc6d2a5931332c8fc.apk

  • Size

    245KB

  • MD5

    78e1a95c19a6349462b83e7efcd0fec5

  • SHA1

    8315d5041ef81230a7e6807d24a2c44d3e1a402d

  • SHA256

    baf3719559aa0694caacb082d9c82b99492dc78588ae154fc6d2a5931332c8fc

  • SHA512

    10d4240a2f8c7beddc8966a56c88ff3a2fcd16e2b84b379538e62ded95e61b48dd3811de59d392ab4c550cc8fbd170df4817ef1a3675f0025b4d7449bbc3bac0

  • SSDEEP

    6144:6T4DEMzy6JNzY/yCfp1qA9lvao96Rg00r91/EuGG:k4DEMzyINzkNEg0Y9tnT

Malware Config

Extracted

Family

octo

C2

https://crystalhorizon.xyz/YTE5MzQ1ZWRkZjY1/

https://velvetdawn.xyz/YTE5MzQ1ZWRkZjY1/

https://shadowmist.xyz/YTE5MzQ1ZWRkZjY1/

https://whisperingvale.xyz/YTE5MzQ1ZWRkZjY1/

https://stormyclouds.xyz/YTE5MzQ1ZWRkZjY1/

https://sunsetmirage.xyz/YTE5MzQ1ZWRkZjY1/

https://goldenflare.xyz/YTE5MzQ1ZWRkZjY1/

https://frozendreams.xyz/YTE5MzQ1ZWRkZjY1/

https://midnightwhisper.xyz/YTE5MzQ1ZWRkZjY1/

https://seraphiclight.xyz/YTE5MzQ1ZWRkZjY1/

https://twilightstorm.xyz/YTE5MzQ1ZWRkZjY1/

https://azurehaven.xyz/YTE5MzQ1ZWRkZjY1/

https://lunarshade.xyz/YTE5MzQ1ZWRkZjY1/

Attributes
  • target_apps

    at.spardat.bcrmobile

    at.spardat.netbanking

    com.bankaustria.android.olb

    com.bmo.mobile

    com.cibc.android.mobi

    com.rbc.mobile.android

    com.scotiabank.mobile

    com.td

    cz.airbank.android

    eu.inmite.prj.kb.mobilbank

    com.bankinter.launcher

    com.kutxabank.android

    com.rsi

    com.tecnocom.cajalaboral

    es.bancopopular.nbmpopular

    es.evobanco.bancamovil

    es.lacaixa.mobile.android.newwapicon

    com.dbs.hk.dbsmbanking

    com.FubonMobileClient

    com.hangseng.rbmobile

    com.MobileTreeApp

    com.mtel.androidbea

    com.scb.breezebanking.hk

    hk.com.hsbc.hsbchkmobilebanking

    com.aff.otpdirekt

    com.ideomobile.hapoalim

    com.infrasofttech.indianBank

    com.mobikwik_new

    com.oxigen.oxigenwallet

    jp.co.aeonbank.android.passbook

AES_key

Signatures

Processes

  • com.sgakagak.agakagabs
    1⤵
    • Removes its main activity from the application launcher
    • Makes use of the framework's Accessibility service
    • Acquires the wake lock
    • Makes use of the framework's foreground persistence service
    • Performs UI accessibility actions on behalf of the user
    • Queries the mobile country code (MCC)
    • Requests accessing notifications (often used to intercept notifications before users become aware).
    • Requests disabling of battery optimizations (often used to enable hiding in the background).
    • Requests modifying system settings.
    • Registers a broadcast receiver at runtime (usually for listening for system events)
    • Uses Crypto APIs (Might try to encrypt user data)
    PID:4367

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • /data/data/com.sgakagak.agakagabs/.qcom.sgakagak.agakagabs

    Filesize

    48B

    MD5

    046a414913add6f5bb60072c7db819b6

    SHA1

    451ee4f6809260aec622d772fd329c7d0297a842

    SHA256

    b66c1320cb063a1d391c94273572ea6edae76c8c8b0a07f8d75c88686f0df72a

    SHA512

    4e6355f3051ed5e811ab030abde1f5be7f5e1cf33be99cd08477e9b6c015deb1d8bd75a09fb9c7176b8511c5ad0a67abc0902a3531e97564ccb6afc57496a47c

  • /data/data/com.sgakagak.agakagabs/kl.txt

    Filesize

    230B

    MD5

    61152ecbb7e4034dff080fda3c66dcfd

    SHA1

    8fb9b1ebfbc517d3920c4c3b0785b609f084e913

    SHA256

    a8503de65e716afe4d85757589ddb2805944f86356d98f94e8e22ae26698ac65

    SHA512

    3eb991707cb77c9e066f9801db63fc249d479b4c08293b4cb8c32be2da765f3ba7c9ccfb40263667e1612e9806e760b1450a5e95457e16094ba945c05cabcdb1

  • /data/data/com.sgakagak.agakagabs/kl.txt

    Filesize

    54B

    MD5

    13c582b404139f46acd75bb7d48ab86f

    SHA1

    7d961800c211fc30e36386af4bbc5175761af21d

    SHA256

    be101ef37f72dc91920e268764414027d907c8b4fae9a310f8d54eef4c1bf685

    SHA512

    cb85920439d88797dc4a881e61c0dbcfcf4f3c230f21aaa9550c388d701086618a42b34c5483b341954d07f71693dcc9dd304e3a698fc849954efd00fa7cf985

  • /data/data/com.sgakagak.agakagabs/kl.txt

    Filesize

    63B

    MD5

    9ac50d9238575687579595a2ac3460fe

    SHA1

    9f0efca11ba117b9f9bd08a3c0b3d1fcbf12e02b

    SHA256

    d14053eada7690d076cbc9f86eca508e5ac82b2b8f52e930792eb150ced05322

    SHA512

    3a8583a062107f17bf7faf24a9c84990ef3afa7fe68fe54b30173ae08f770e032108778dde4419182113aedc88208b92d4a88e5fd02ea5725d26eec5c1653fbe

  • /data/data/com.sgakagak.agakagabs/kl.txt

    Filesize

    45B

    MD5

    c346a0109ffc85a9cef9d01f5466803d

    SHA1

    6f81cc59dbda5586e9d11d37551344bb630f16a9

    SHA256

    2bbc52ee98cc9b8378ca3b5715c39ae7de621bf44d2e7d74063579029bcd731e

    SHA512

    922cd359d551e3ffeadff364d439efc9480447701d0b01888875c84c79bfc2f998863b1c1c04b9def9ef50dcc3335abc29b68aa413e3f326295833ae975fe595

  • /data/data/com.sgakagak.agakagabs/kl.txt

    Filesize

    423B

    MD5

    ae0f2137c9e3dc567b63493456dd26c6

    SHA1

    d3bf11551a1e8c294d5852ceda0967f1238ff769

    SHA256

    2c36e40194dcf4dd7cad353cc973c5ffbf8ab0a39204202df359c9390391a183

    SHA512

    af7d14b7863f82894268f5772c98a141ba4e318ffde973c8fcc14babd8dac3b78a0d96237f29e61deb2c5d9ef3b635d2f6c78e0735ae104f12ac1ff851032b81