Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    149s
  • max time network
    151s
  • platform
    android-9_x86
  • resource
    android-x86-arm-20240910-en
  • resource tags

    arch:armarch:x86image:android-x86-arm-20240910-enlocale:en-usos:android-9-x86system
  • submitted
    06/02/2025, 22:03

General

  • Target

    3ac63c673248d594050a080e0c3e272cbf8b7ad3c6ad13110141a930a968e550.apk

  • Size

    2.2MB

  • MD5

    bbfbdf26ad34026627d26acfa97a5dda

  • SHA1

    f3e8d09f5b2726016ad685b17793b687471ac33d

  • SHA256

    3ac63c673248d594050a080e0c3e272cbf8b7ad3c6ad13110141a930a968e550

  • SHA512

    9e1b3d030bac17e8c118eedaade133bc809f8b24ea9a85d633d7d56d15971b16efdc68f193e075e36ce816881106b86f519176767f8b01119d191d9e2018eea2

  • SSDEEP

    49152:yae0Uy5sb2GYlS0l/F5aEo9DW+7a8svNhojAoNolITGoKmd7A8JCgUnPimMncjHy:ySR5sdYlPl/PahWx8sF+9olONd6gUnP+

Malware Config

Extracted

Family

octo

C2

https://kobrasaldiristratejileri.xyz/MzhiMTg0NTAwOTY5S/

https://kobratehlikeanalizleri.xyz/MzhiMTg0NTAwOTY5S/

https://kobravesurprizhikayeler.xyz/MzhiMTg0NTAwOTY5S/

https://kobrayanasistemverileri.xyz/MzhiMTg0NTAwOTY5S/

https://kobrakulturvesavasanati.xyz/MzhiMTg0NTAwOTY5S/

https://kobrabilimvegizemlerdunyasi.xyz/MzhiMTg0NTAwOTY5S/

https://kobragesmisiylebilimtarihi.xyz/MzhiMTg0NTAwOTY5S/

https://kobraversanatinbirlestigi.xyz/MzhiMTg0NTAwOTY5S/

https://kobrataktiklersistematik.xyz/MzhiMTg0NTAwOTY5S/

https://kobralaryasadogasi.xyz/MzhiMTg0NTAwOTY5S/

https://kobravesavasfelsefesi.xyz/MzhiMTg0NTAwOTY5S/

https://kobratedbirvetaktik.xyz/MzhiMTg0NTAwOTY5S/

https://kobratehlikeveguvenlik.xyz/MzhiMTg0NTAwOTY5S/

https://kobravesavunmasistemi.xyz/MzhiMTg0NTAwOTY5S/

https://kobraveavlanmataktikleri.xyz/MzhiMTg0NTAwOTY5S/

https://kobrakisiselyetenekler.xyz/MzhiMTg0NTAwOTY5S/

https://kobratehlikeharitasi.xyz/MzhiMTg0NTAwOTY5S/

https://kobravesavasstratejileri.xyz/MzhiMTg0NTAwOTY5S/

https://kobrabilimveanaliz.xyz/MzhiMTg0NTAwOTY5S/

https://kobratehditveonleme.xyz/MzhiMTg0NTAwOTY5S/

rc4.plain

Extracted

Family

octo

C2

https://kobrasaldiristratejileri.xyz/MzhiMTg0NTAwOTY5S/

https://kobratehlikeanalizleri.xyz/MzhiMTg0NTAwOTY5S/

https://kobravesurprizhikayeler.xyz/MzhiMTg0NTAwOTY5S/

https://kobrayanasistemverileri.xyz/MzhiMTg0NTAwOTY5S/

https://kobrakulturvesavasanati.xyz/MzhiMTg0NTAwOTY5S/

https://kobrabilimvegizemlerdunyasi.xyz/MzhiMTg0NTAwOTY5S/

https://kobragesmisiylebilimtarihi.xyz/MzhiMTg0NTAwOTY5S/

https://kobraversanatinbirlestigi.xyz/MzhiMTg0NTAwOTY5S/

https://kobrataktiklersistematik.xyz/MzhiMTg0NTAwOTY5S/

https://kobralaryasadogasi.xyz/MzhiMTg0NTAwOTY5S/

https://kobravesavasfelsefesi.xyz/MzhiMTg0NTAwOTY5S/

https://kobratedbirvetaktik.xyz/MzhiMTg0NTAwOTY5S/

https://kobratehlikeveguvenlik.xyz/MzhiMTg0NTAwOTY5S/

https://kobravesavunmasistemi.xyz/MzhiMTg0NTAwOTY5S/

https://kobraveavlanmataktikleri.xyz/MzhiMTg0NTAwOTY5S/

https://kobrakisiselyetenekler.xyz/MzhiMTg0NTAwOTY5S/

https://kobratehlikeharitasi.xyz/MzhiMTg0NTAwOTY5S/

https://kobravesavasstratejileri.xyz/MzhiMTg0NTAwOTY5S/

https://kobrabilimveanaliz.xyz/MzhiMTg0NTAwOTY5S/

https://kobratehditveonleme.xyz/MzhiMTg0NTAwOTY5S/

Attributes
  • target_apps

    at.spardat.bcrmobile

    at.spardat.netbanking

    com.bankaustria.android.olb

    com.bmo.mobile

    com.cibc.android.mobi

    com.rbc.mobile.android

    com.scotiabank.mobile

    com.td

    cz.airbank.android

    eu.inmite.prj.kb.mobilbank

    com.bankinter.launcher

    com.kutxabank.android

    com.rsi

    com.tecnocom.cajalaboral

    es.bancopopular.nbmpopular

    es.evobanco.bancamovil

    es.lacaixa.mobile.android.newwapicon

    com.dbs.hk.dbsmbanking

    com.FubonMobileClient

    com.hangseng.rbmobile

    com.MobileTreeApp

    com.mtel.androidbea

    com.scb.breezebanking.hk

    hk.com.hsbc.hsbchkmobilebanking

    com.aff.otpdirekt

    com.ideomobile.hapoalim

    com.infrasofttech.indianBank

    com.mobikwik_new

    com.oxigen.oxigenwallet

    jp.co.aeonbank.android.passbook

AES_key

Signatures

Processes

  • com.bar.tornado
    1⤵
    • Removes its main activity from the application launcher
    • Loads dropped Dex/Jar
    • Makes use of the framework's Accessibility service
    • Acquires the wake lock
    • Makes use of the framework's foreground persistence service
    • Performs UI accessibility actions on behalf of the user
    • Queries the mobile country code (MCC)
    • Requests accessing notifications (often used to intercept notifications before users become aware).
    • Requests disabling of battery optimizations (often used to enable hiding in the background).
    • Requests modifying system settings.
    • Registers a broadcast receiver at runtime (usually for listening for system events)
    • Uses Crypto APIs (Might try to encrypt user data)
    PID:4324

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • /data/data/com.bar.tornado/.qcom.bar.tornado

    Filesize

    48B

    MD5

    046a414913add6f5bb60072c7db819b6

    SHA1

    451ee4f6809260aec622d772fd329c7d0297a842

    SHA256

    b66c1320cb063a1d391c94273572ea6edae76c8c8b0a07f8d75c88686f0df72a

    SHA512

    4e6355f3051ed5e811ab030abde1f5be7f5e1cf33be99cd08477e9b6c015deb1d8bd75a09fb9c7176b8511c5ad0a67abc0902a3531e97564ccb6afc57496a47c

  • /data/data/com.bar.tornado/app_gauge/uFm.json

    Filesize

    153KB

    MD5

    9173ea620e5309933d62ebb9d49e3be1

    SHA1

    eaf3df909f556edd0c5ce0a36097ba973b9bc187

    SHA256

    fde8f92e3655057922e8d3057d23f69283af25cdee4abd1c0e4a02ee619442e0

    SHA512

    deac2c47759270258bbeedbcd58924598557e039772279196a2d2c0c1f50f811a6689970777b7ff4b173a4246e8c61f142965f6a7a964003c63b838fd749778b

  • /data/data/com.bar.tornado/app_gauge/uFm.json

    Filesize

    153KB

    MD5

    af9d39d89d647e67284c79ff2331f6f6

    SHA1

    2483093f06ce02360142bdb4b8f20577389fd28c

    SHA256

    3438dae5379b0d490a6708d46af4b0d7fb445205aac61a3197b42aa93f224ab4

    SHA512

    11e616cf9397b5dcd4c87c192d69df6bf753b16915bcd173393abc12ee986cdd014219b4672b85bf122cb64e255277e3238b8480a1b4541a761ec3aea4aecb7b

  • /data/data/com.bar.tornado/kl.txt

    Filesize

    45B

    MD5

    6e8b281a472a8624f31b3cf50325cf22

    SHA1

    9871dd54bcc5588b1d1b80edec449defbc9c0225

    SHA256

    65d472e4c6b0c4df51943cbb72be95e7ae210d609ef61fc59212d437c29c2486

    SHA512

    2cf1000057911b6bcb272fc3539a9c862d06e238c7ff8acdcdb14947de46f7ca65ef6a172d27edf855bddf63cf7e4537450a8661f2b57d0af8552049ad88b114

  • /data/data/com.bar.tornado/kl.txt

    Filesize

    423B

    MD5

    31d427d0f754df70e1ff06df749afdc9

    SHA1

    37011d399b1df088f12f0f5cc9c63b3e5753cf5c

    SHA256

    fe1daa422fb616bee0eca90fa874ae60759e3b4e71ff68adedf4f62d19a8f07c

    SHA512

    78e009c0341a50ccd183df4bd73216a9b47db18bc64f4fb53395d4a3c3d3e82946aabe35b23f4f8e404e9d363f22f42e8203a077b02a8d8aef827618b4a1b425

  • /data/data/com.bar.tornado/kl.txt

    Filesize

    230B

    MD5

    1608d1dea8213e31014b3c27bfff1904

    SHA1

    64a939b1c73a3b14aa87e3d6f2322165a48be5c9

    SHA256

    d8a587fec8756592109078f1767cef101e682b14f59cb3c726c2a613ab93167c

    SHA512

    e689b7abd7ef50807471ecc1cab2db088dfddc6a61d82cde82a827778116920fcc9a7b484161f247d3fdf39af0793709e25a0fde4d0f035a06e9b95573bdc985

  • /data/data/com.bar.tornado/kl.txt

    Filesize

    54B

    MD5

    cf568e97a012572adeef01d2e287f821

    SHA1

    fb2e3f5e6f796ffea3b87f9a7113aa0017b79b9d

    SHA256

    5bd5abd141dea335ccd96ce8864fe3f104018978e618d8419b172148841ee38a

    SHA512

    8cd2374e59c2d3ad1c20ec03e4f29113f42b42188f76f4579a5f178e5077c84b0c2905ec4b1d62cf4586324a3db8eeeee7043924229d93c37b423543cf66de62

  • /data/data/com.bar.tornado/kl.txt

    Filesize

    63B

    MD5

    dd833b08bff780723f25831608b1f070

    SHA1

    cab15244ec1d34459998d663b8c6e1d44bf04c89

    SHA256

    84c486bb05c568dd6dab382c3fc8ce60dd0cd1978b3f87f989ad88b4138df2c1

    SHA512

    e5fc51cb630282122f55db075223819b273b9b4ae345c975a465e47015b0c648d0c42b5da57f43d3ba3b0372e5181de379b28b2a87af88fd0e7efee2fbcc6d46

  • /data/user/0/com.bar.tornado/app_gauge/uFm.json

    Filesize

    451KB

    MD5

    5efb9eb14fd8df1b12980ea84c08bf93

    SHA1

    46bfa2f7184dc7a70c46219c66ae2c5996abb50a

    SHA256

    892317e6716cdc87b64c6d5cfdca52ec74790f6c1e53b4edbddff39b2db75890

    SHA512

    503276252f85e88a1ec63bd9b102d85e30dad1e2e03ede607f6b7d979ce401fdc5d568c157e6adcc49f643a957efcdfd510f2597b3bceb673ab457a28fc05650