Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    145s
  • max time network
    137s
  • platform
    android_x86
  • resource
    android-x86-arm-20240624-en
  • resource tags

    androidarch:armarch:x86image:android-x86-arm-20240624-enlocale:en-usos:android-9-x86system
  • submitted
    05/02/2025, 22:00

General

  • Target

    6ab4ad289d276a09bd1f6b6a9165f6a339d086112f1f8307bdb406cb98faca20.apk

  • Size

    2.7MB

  • MD5

    98ff3f7f57f3ac777cc17aa6bd406e90

  • SHA1

    eb67383d3986f1b912e2a38f563376f64072ec17

  • SHA256

    6ab4ad289d276a09bd1f6b6a9165f6a339d086112f1f8307bdb406cb98faca20

  • SHA512

    db72a8dbd6d5d2efd4104c8ae9fa5fc95290bc3ff05ca211d965c3059eea503a4f177f4b599f9f2770c778d0b5b74e149af9cf75c05149b1cb194ba51418c73e

  • SSDEEP

    49152:PEZyF6Kjcf1ObPyI4trAm8a8KLGBHzFOTkCMmn6U9BrVT9mDl8r601sS8IQG:gyFFjEI4iZaUzYH99yIl

Malware Config

Extracted

Family

octo

C2

https://94.156.166.6:7117/gate/

https://94.156.166.6:8080/rootmd50ma/panelcgfuzwxleg9kdxnvy3rv/gate/

https://94.156.166.6:80/builderxxxzzz/gate/

Attributes
  • target_apps

    at.spardat.bcrmobile

    at.spardat.netbanking

    com.bankaustria.android.olb

    com.bmo.mobile

    com.cibc.android.mobi

    com.rbc.mobile.android

    com.scotiabank.mobile

    com.td

    cz.airbank.android

    eu.inmite.prj.kb.mobilbank

    com.bankinter.launcher

    com.kutxabank.android

    com.rsi

    com.tecnocom.cajalaboral

    es.bancopopular.nbmpopular

    es.evobanco.bancamovil

    es.lacaixa.mobile.android.newwapicon

    com.dbs.hk.dbsmbanking

    com.FubonMobileClient

    com.hangseng.rbmobile

    com.MobileTreeApp

    com.mtel.androidbea

    com.scb.breezebanking.hk

    hk.com.hsbc.hsbchkmobilebanking

    com.aff.otpdirekt

    com.ideomobile.hapoalim

    com.infrasofttech.indianBank

    com.mobikwik_new

    com.oxigen.oxigenwallet

    jp.co.aeonbank.android.passbook

AES_key

Signatures

Processes

  • com.nameown12
    1⤵
    • Removes its main activity from the application launcher
    • Makes use of the framework's Accessibility service
    • Acquires the wake lock
    • Makes use of the framework's foreground persistence service
    • Performs UI accessibility actions on behalf of the user
    • Queries the mobile country code (MCC)
    • Requests accessing notifications (often used to intercept notifications before users become aware).
    • Requests disabling of battery optimizations (often used to enable hiding in the background).
    • Requests modifying system settings.
    • Registers a broadcast receiver at runtime (usually for listening for system events)
    • Uses Crypto APIs (Might try to encrypt user data)
    PID:4255

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • /data/data/com.nameown12/.qcom.nameown12

    Filesize

    48B

    MD5

    046a414913add6f5bb60072c7db819b6

    SHA1

    451ee4f6809260aec622d772fd329c7d0297a842

    SHA256

    b66c1320cb063a1d391c94273572ea6edae76c8c8b0a07f8d75c88686f0df72a

    SHA512

    4e6355f3051ed5e811ab030abde1f5be7f5e1cf33be99cd08477e9b6c015deb1d8bd75a09fb9c7176b8511c5ad0a67abc0902a3531e97564ccb6afc57496a47c

  • /data/data/com.nameown12/kl.txt

    Filesize

    230B

    MD5

    bbf15a5febba698e4d3a84fc14932ccd

    SHA1

    8c3359feddc2132ad12c2f25ce226476d5e0b180

    SHA256

    5a2d6d9d955a78fa6ce1f9712efa76fffc8dd8e605d97bf07f8f8f0cd76da494

    SHA512

    26987415c3b698bcaa0a4ad3b63ab7e3fc813e7ad3bc97d95a64f6fffb1d65dceb75e2b68845d321c3b7b4d47c0fe2f942746c4d550c5df0c4d805031c1a3939

  • /data/data/com.nameown12/kl.txt

    Filesize

    54B

    MD5

    f791947b7f4cd3f643651973dad2fcf3

    SHA1

    1a5fd54fc5e27581af986ce7ef5a320a0daae19d

    SHA256

    0ec7a779387efd0fb5c53c9292e3fae06aa2394f0baf1ae1518bc3731be2f9ce

    SHA512

    c2224177fb6485af80c4e9940c9abdd79b9f8436806bb5e51192992be8bda75c903d066d9ddb79e2c2ee007885ab0f530cd2aa03833a35dcfdbe5ae3c916d1a1

  • /data/data/com.nameown12/kl.txt

    Filesize

    68B

    MD5

    5c7f7a34bc026ad8cf4a4add91668a07

    SHA1

    fafe31ade0fd7117ed4d8b92fdec715d357221d1

    SHA256

    dd663336d7e1f852d5c5a15cf3789217156541953c97766e8b53c4ff68d205ce

    SHA512

    a98f7dbf9973efc147f5c64a77155712f3eee8cbb0a8b16f567ea11a53ff81a6a1f9783a37b395213fb9fe4374e29cfa58bd89b2bee29e335357878fbce1f53b

  • /data/data/com.nameown12/kl.txt

    Filesize

    63B

    MD5

    8649d3b1960d98aca48dbacca0542048

    SHA1

    fc65616016f9e4ea7755e33941916816c0373cce

    SHA256

    2f2a8f3875bdbedb2b7404c7250bba4f0090e6c9d6011dade34ecd05a1333c15

    SHA512

    dcd072e6680aa7015a7b00697a1353486f24b4dd21284c0edb990205f43dd386d2a76a7be2f92b329b8608ac7644ad706f3a8ef92a8141206e44d6fd08c87471

  • /data/data/com.nameown12/kl.txt

    Filesize

    423B

    MD5

    8d439eafe61b789db94380b0d7a52c99

    SHA1

    894de22cffdbaa6b94a3b3c3ebdbf3f6fa62125b

    SHA256

    777143a790da2f91fbc84cc7cd6bca4f8334b901558e50a8a697e109f36ec6c2

    SHA512

    b2eb33ed30031146ce3aa3601a9a4be50a5b0a9d84dc44645301999f8be3091901e0de15aa6e88ee2d63152c2465e14daa5078de97ce4d237d0588a23fa0ec1b