Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
148s -
max time network
134s -
platform
android_x64 -
resource
android-33-x64-arm64-20240624-en -
resource tags
androidarch:arm64arch:x64image:android-33-x64-arm64-20240624-enlocale:en-usos:android-13-x64system -
submitted
05/02/2025, 22:04
Static task
static1
Behavioral task
behavioral1
Sample
74d3a42bc06f1aa2ec24065a14d761cb607419b64065c1aee109b1c919178b84.apk
Resource
android-x86-arm-20240910-en
Behavioral task
behavioral2
Sample
74d3a42bc06f1aa2ec24065a14d761cb607419b64065c1aee109b1c919178b84.apk
Resource
android-33-x64-arm64-20240624-en
General
-
Target
74d3a42bc06f1aa2ec24065a14d761cb607419b64065c1aee109b1c919178b84.apk
-
Size
3.2MB
-
MD5
52c3ac433c19976fe9f16e376723ffa6
-
SHA1
d226f18611907a3da663ab05c0e2285274bb01d4
-
SHA256
74d3a42bc06f1aa2ec24065a14d761cb607419b64065c1aee109b1c919178b84
-
SHA512
14862adfe80e9d9ae025ae0bf591cb980e438979be4335d06410da00fb87739faa5fc7c1070694c5fa13c29a71f8ecde3a58687bc6196877c87acd3aece4bb19
-
SSDEEP
98304:7eRI1mVNaQO62uMw4BPSnb9ckIncTOD18eb:961MjSJkcTOJR
Malware Config
Extracted
octo
https://karakterolipsbilgilendirme.xyz/hxDNtg7DB3tk/
https://karakterolipsdostlukhik.xyz/hxDNtg7DB3tk/
https://karakterolipssinemaevreni.xyz/hxDNtg7DB3tk/
https://karakterolipssanatvesahne.xyz/hxDNtg7DB3tk/
https://karakterolipskulturkonusu.xyz/hxDNtg7DB3tk/
https://karakterolipstarihiyolu.xyz/hxDNtg7DB3tk/
https://karakterolipsmasallar.xyz/hxDNtg7DB3tk/
https://karakterolipskonferansi.xyz/hxDNtg7DB3tk/
https://karakterolipsgezegenhik.xyz/hxDNtg7DB3tk/
https://karakterolipsdunyasi.xyz/hxDNtg7DB3tk/
https://karakterolipsshowsanat.xyz/hxDNtg7DB3tk/
https://karakterolipsicimsessiz.xyz/hxDNtg7DB3tk/
https://karakterolipsfelsefesi.xyz/hxDNtg7DB3tk/
https://karakterolipsyolculugu.xyz/hxDNtg7DB3tk/
https://karakterolipsrenkleri.xyz/hxDNtg7DB3tk/
https://karakterolipssunumlar.xyz/hxDNtg7DB3tk/
https://karakterolipsduygular.xyz/hxDNtg7DB3tk/
https://karakterolipsgizemleri.xyz/hxDNtg7DB3tk/
https://karakterolipskaynak.xyz/hxDNtg7DB3tk/
https://karakterolipsseruven.xyz/hxDNtg7DB3tk/
Extracted
octo
https://karakterolipsbilgilendirme.xyz/hxDNtg7DB3tk/
https://karakterolipsdostlukhik.xyz/hxDNtg7DB3tk/
https://karakterolipssinemaevreni.xyz/hxDNtg7DB3tk/
https://karakterolipssanatvesahne.xyz/hxDNtg7DB3tk/
https://karakterolipskulturkonusu.xyz/hxDNtg7DB3tk/
https://karakterolipstarihiyolu.xyz/hxDNtg7DB3tk/
https://karakterolipsmasallar.xyz/hxDNtg7DB3tk/
https://karakterolipskonferansi.xyz/hxDNtg7DB3tk/
https://karakterolipsgezegenhik.xyz/hxDNtg7DB3tk/
https://karakterolipsdunyasi.xyz/hxDNtg7DB3tk/
https://karakterolipsshowsanat.xyz/hxDNtg7DB3tk/
https://karakterolipsicimsessiz.xyz/hxDNtg7DB3tk/
https://karakterolipsfelsefesi.xyz/hxDNtg7DB3tk/
https://karakterolipsyolculugu.xyz/hxDNtg7DB3tk/
https://karakterolipsrenkleri.xyz/hxDNtg7DB3tk/
https://karakterolipssunumlar.xyz/hxDNtg7DB3tk/
https://karakterolipsduygular.xyz/hxDNtg7DB3tk/
https://karakterolipsgizemleri.xyz/hxDNtg7DB3tk/
https://karakterolipskaynak.xyz/hxDNtg7DB3tk/
https://karakterolipsseruven.xyz/hxDNtg7DB3tk/
Signatures
-
Octo
Octo is a banking malware with remote access capabilities first seen in April 2022.
-
Octo family
-
Octo payload 1 IoCs
resource yara_rule behavioral2/memory/4355-0.dex family_octo -
Loads dropped Dex/Jar 1 TTPs 1 IoCs
Runs executable file dropped to the device during analysis.
ioc pid Process /data/user/0/homeworkout.homewosrkouts.noequipment/app_main/tMXOK.json 4355 homeworkout.homewosrkouts.noequipment -
Makes use of the framework's Accessibility service 4 TTPs 2 IoCs
Retrieves information displayed on the phone screen using AccessibilityService.
description ioc Process Framework service call android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId homeworkout.homewosrkouts.noequipment Framework service call android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByViewId homeworkout.homewosrkouts.noequipment -
Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
-
Queries the phone number (MSISDN for GSM devices) 1 TTPs
-
Acquires the wake lock 1 IoCs
description ioc Process Framework service call android.os.IPowerManager.acquireWakeLock homeworkout.homewosrkouts.noequipment -
Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs
Application may abuse the framework's foreground service to continue running in the foreground.
description ioc Process Framework service call android.app.IActivityManager.setServiceForeground homeworkout.homewosrkouts.noequipment -
Performs UI accessibility actions on behalf of the user 1 TTPs 4 IoCs
Application may abuse the accessibility service to prevent their removal.
ioc Process android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction homeworkout.homewosrkouts.noequipment android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction homeworkout.homewosrkouts.noequipment android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction homeworkout.homewosrkouts.noequipment android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction homeworkout.homewosrkouts.noequipment -
Queries the mobile country code (MCC) 1 TTPs 1 IoCs
description ioc Process Framework service call com.android.internal.telephony.ITelephony.getNetworkCountryIsoForPhone homeworkout.homewosrkouts.noequipment -
Reads information about phone network operator. 1 TTPs
-
Requests accessing notifications (often used to intercept notifications before users become aware). 1 TTPs 1 IoCs
description ioc Process Intent action android.settings.ACTION_NOTIFICATION_LISTENER_SETTINGS homeworkout.homewosrkouts.noequipment -
Requests disabling of battery optimizations (often used to enable hiding in the background). 1 TTPs 1 IoCs
description ioc Process Intent action android.settings.REQUEST_IGNORE_BATTERY_OPTIMIZATIONS homeworkout.homewosrkouts.noequipment -
Requests modifying system settings. 1 IoCs
description ioc Process Intent action android.settings.action.MANAGE_WRITE_SETTINGS homeworkout.homewosrkouts.noequipment -
Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs
description ioc Process Framework API call javax.crypto.Cipher.doFinal homeworkout.homewosrkouts.noequipment
Processes
-
homeworkout.homewosrkouts.noequipment1⤵
- Loads dropped Dex/Jar
- Makes use of the framework's Accessibility service
- Acquires the wake lock
- Makes use of the framework's foreground persistence service
- Performs UI accessibility actions on behalf of the user
- Queries the mobile country code (MCC)
- Requests accessing notifications (often used to intercept notifications before users become aware).
- Requests disabling of battery optimizations (often used to enable hiding in the background).
- Requests modifying system settings.
- Uses Crypto APIs (Might try to encrypt user data)
PID:4355
Network
MITRE ATT&CK Mobile v15
Defense Evasion
Download New Code at Runtime
1Foreground Persistence
1Hide Artifacts
1User Evasion
1Impair Defenses
1Prevent Application Removal
1Input Injection
1Credential Access
Access Notifications
1Input Capture
2GUI Input Capture
1Keylogging
1Discovery
Software Discovery
1Security Software Discovery
1System Network Configuration Discovery
3Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
153KB
MD505ad81ec71f19f06d0723f19199c5f0a
SHA14b036eac256571f34be055bed57e8de425456df7
SHA256934dcb799fd83f512cee9571cc6611293e5400fb859aaa324318faccde633514
SHA512503435cb5c84572b1c4f5fbed6fc3605977dfb258becd67652f038123837a8e99f18a72110ba6e686f41c25ae65225556d3cd456f1ef737aa738da9d37c65224
-
Filesize
153KB
MD5f8f6df99e5803506123206748c5d31a4
SHA162b79b54f5913218f7176fb4f7c80ad0a2b86cfb
SHA256ed898850b92129a53a35e04bee5ddb8ec296b7adcf4d26f13f8a2309938e3aaf
SHA512653b967bc263c96b9c0d58eb5ed475f6d8c741f7a4e79b3d5878fa7947bc2752673a61680bdc399552821c9d8cbe0da5788d9031e49d39dc71e314479d5c62b4
-
Filesize
450KB
MD56666d3b2a41fafb1a0a6520a3863769d
SHA1d83248a52e6d8a5dbbae0104418b1cd16e11ddd4
SHA25623f92d2e21bc96e7f730645ca80ffc9560a17567991628d82ace4e2ab872545a
SHA512f9c405f05e6427c645b4ec10a7a04bb4df150fb96a463b932c278cbb717db7db090787e5c67769c06fdf356f2c4b6707829c1a3bd804b75330bb45b8978fec58