Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    149s
  • max time network
    149s
  • platform
    android_x64
  • resource
    android-x64-20240624-en
  • resource tags

    androidarch:x64arch:x86image:android-x64-20240624-enlocale:en-usos:android-10-x64system
  • submitted
    05/02/2025, 22:01

General

  • Target

    4a1c4ec54d98833c80738fdf8edcf62e90488494a8e70ad1f7f3fc4b89d5df38.apk

  • Size

    2.7MB

  • MD5

    f86837976aba607f085281d27a303a6f

  • SHA1

    badb5fb0df5eabf38eeab54f0043a56b498b93af

  • SHA256

    4a1c4ec54d98833c80738fdf8edcf62e90488494a8e70ad1f7f3fc4b89d5df38

  • SHA512

    5fb8d834318f79706080800048453342dbe5e21bf7b77d631bf688b3c6bbe19bd5ece0759ae0b450f2d9f7afd4ce48a093bf1535a57de1b2a36515dc2e3d6e60

  • SSDEEP

    49152:SETl6Kjcf1ObPyI4trAm8a8KLGBHzFOTkCMmn6U9BrVT9mDl8r601sS8IQR:S8FjEI4iZaUzYH99yI2

Malware Config

Extracted

Family

octo

C2

https://94.156.166.76:7117/gate/

https://94.156.166.76:8080/rootmd50ma/panelcgfuzwxleg9kdxnvy3rv/gate/

https://94.156.166.76:80/builderxxxzzz/gate/

Attributes
  • target_apps

    at.spardat.bcrmobile

    at.spardat.netbanking

    com.bankaustria.android.olb

    com.bmo.mobile

    com.cibc.android.mobi

    com.rbc.mobile.android

    com.scotiabank.mobile

    com.td

    cz.airbank.android

    eu.inmite.prj.kb.mobilbank

    com.bankinter.launcher

    com.kutxabank.android

    com.rsi

    com.tecnocom.cajalaboral

    es.bancopopular.nbmpopular

    es.evobanco.bancamovil

    es.lacaixa.mobile.android.newwapicon

    com.dbs.hk.dbsmbanking

    com.FubonMobileClient

    com.hangseng.rbmobile

    com.MobileTreeApp

    com.mtel.androidbea

    com.scb.breezebanking.hk

    hk.com.hsbc.hsbchkmobilebanking

    com.aff.otpdirekt

    com.ideomobile.hapoalim

    com.infrasofttech.indianBank

    com.mobikwik_new

    com.oxigen.oxigenwallet

    jp.co.aeonbank.android.passbook

AES_key

Signatures

Processes

  • com.nameown12
    1⤵
    • Makes use of the framework's Accessibility service
    • Acquires the wake lock
    • Makes use of the framework's foreground persistence service
    • Performs UI accessibility actions on behalf of the user
    • Queries the mobile country code (MCC)
    • Registers a broadcast receiver at runtime (usually for listening for system events)
    • Uses Crypto APIs (Might try to encrypt user data)
    PID:5001

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • /data/data/com.nameown12/.qcom.nameown12

    Filesize

    48B

    MD5

    046a414913add6f5bb60072c7db819b6

    SHA1

    451ee4f6809260aec622d772fd329c7d0297a842

    SHA256

    b66c1320cb063a1d391c94273572ea6edae76c8c8b0a07f8d75c88686f0df72a

    SHA512

    4e6355f3051ed5e811ab030abde1f5be7f5e1cf33be99cd08477e9b6c015deb1d8bd75a09fb9c7176b8511c5ad0a67abc0902a3531e97564ccb6afc57496a47c

  • /data/data/com.nameown12/kl.txt

    Filesize

    230B

    MD5

    556637e2e1f957c918414728cf3b19c0

    SHA1

    14db2de107eab937ae1c10c6ec2008b2af8667b0

    SHA256

    143f6f0a9ed88e3a51166d32d07c68be2d55c19fa844834d72d7f71e590c4014

    SHA512

    79e3349f4f1e6c13ec5d45697f3c377d23736c55d1ba081b83b3a9b242e7a9b5bfd6bb689c0ae57073aff564ff1f7565fa2bb95acf4669cb79ac44d8090df35a

  • /data/data/com.nameown12/kl.txt

    Filesize

    45B

    MD5

    b28e5a7730d1547f5fb9257c0155aaf3

    SHA1

    c7a02ddeb55eec45b856d83a250e3b220cf19f33

    SHA256

    54a18feaa86336847495a3fbb797a12f0a9ca109cfb4cd48a55086bc368d8f73

    SHA512

    2e76cd441b0e2ae509aa3054a84b831f335373b8d6f4e7bc7fcfd08c529ef5d693251a9ef5dd734d0d6dc91d8532a7d6cf1fbc88ca83caf6c4fac69e9be800f1

  • /data/data/com.nameown12/kl.txt

    Filesize

    63B

    MD5

    1f38d1ba9e784c033925ed55ea829f63

    SHA1

    96016a8bd77e45e371629d954ba886dbe2577ee8

    SHA256

    c136d42ebbfc64cb242043fbf6e37e111867ba4f04989c87f9116c5017d009cc

    SHA512

    0d9cc1ddfe9f0aea734ee81b34325057f627a51fd800586d4975dbcfaeaf8d1249e21dc0358ea688555be4c3df3570a61f2880730e79f2709ae986c302c97b43

  • /data/data/com.nameown12/kl.txt

    Filesize

    45B

    MD5

    876aa778f4a6d7ce3ab333eb9089c256

    SHA1

    213d5da3f69ab581949cf31641e8c2905e8a8651

    SHA256

    55e8f742e28ccd914b17b4c9656a6107cfb36d757d4601be17cee4fc317d9246

    SHA512

    fcdd5c78e22ec11ecb328ebc0b330026adab5e0ef5a4c31a1a55831d2161c8533f1e4e240431420c3ab23d334ef04d4c514d430d689ce7eee6942046ce02d7e0

  • /data/data/com.nameown12/kl.txt

    Filesize

    423B

    MD5

    ab0cc0f51e60cbd0e66875d23d0db5b4

    SHA1

    2bc36ef96c918fc0cf3dda9d7e2430bd1bdda12c

    SHA256

    ca52f630ef4e6020b701afebd1d7ab53d6f4815ae0884eb3dafaf31d32fbf1b6

    SHA512

    ec38859785c60622c0005578fc4d9d659ac5b366d0b05aa59b90baf010addb46289129c19abb0c7ff4749b0933e351eebda4d9c00e2acb7a95f78873340630c4