Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    147s
  • max time network
    143s
  • platform
    android_x86
  • resource
    android-x86-arm-20240624-en
  • resource tags

    androidarch:armarch:x86image:android-x86-arm-20240624-enlocale:en-usos:android-9-x86system
  • submitted
    06/02/2025, 22:03

General

  • Target

    da6333788cc7a50b02def4842b22c3087fe54da4199e975694cca88369c744a4.apk

  • Size

    1.8MB

  • MD5

    5e30e770ec3c6eabfabce48e56fc0a7b

  • SHA1

    40f4cdef86ba4f1403c41f29938637b358abf22b

  • SHA256

    da6333788cc7a50b02def4842b22c3087fe54da4199e975694cca88369c744a4

  • SHA512

    efb867716b8a6b1c57d94beb8a6fae16ebe2056f14d997827a4ec35f953f9e9d49edb221f5af82deceef83ffdce3d6502ec0f168b14b403b11d140e28641d3ed

  • SSDEEP

    49152:E1PS3NaPrnXmYzPrtwdeTgzWWjQJj/n4V4xZFw0U+azq0KN0:E1PSsjXmYzjSsczPjy/nUoU+N+

Malware Config

Extracted

Family

octo

C2

https://otomatikbahcesulamasistemi.xyz/fHTKmZhmwRmq/

https://tarimsalverimsulamayontemi.xyz/fHTKmZhmwRmq/

https://damlamasulamateknolojileri.xyz/fHTKmZhmwRmq/

https://akillitarimsulamasistemleri.xyz/fHTKmZhmwRmq/

https://modernciftliksulamayontemi.xyz/fHTKmZhmwRmq/

https://verimlisulamataktikveyontem.xyz/fHTKmZhmwRmq/

https://tarlaotomatiksulamasistemleri.xyz/fHTKmZhmwRmq/

https://bahceveseraotomasyonsulama.xyz/fHTKmZhmwRmq/

https://sudepolamaveverimsulama.xyz/fHTKmZhmwRmq/

https://bitkisulamastratejiler.xyz/fHTKmZhmwRmq/

https://sebzesulamasistemcozumleri.xyz/fHTKmZhmwRmq/

https://akillibahcesulamauretimi.xyz/fHTKmZhmwRmq/

https://gelenekseltarimsulamamodeli.xyz/fHTKmZhmwRmq/

https://sulamaekipmanlariurunleri.xyz/fHTKmZhmwRmq/

https://akillidamlamaotomasyonsistemi.xyz/fHTKmZhmwRmq/

https://pratikverimlibitkisulama.xyz/fHTKmZhmwRmq/

https://topraksizserasulamasistemi.xyz/fHTKmZhmwRmq/

https://otomatiksektorelbitkisulama.xyz/fHTKmZhmwRmq/

https://verimlitarlavemodernsulama.xyz/fHTKmZhmwRmq/

https://bitkisagliginagoresulama.xyz/fHTKmZhmwRmq/

rc4.plain

Extracted

Family

octo

C2

https://otomatikbahcesulamasistemi.xyz/fHTKmZhmwRmq/

https://tarimsalverimsulamayontemi.xyz/fHTKmZhmwRmq/

https://damlamasulamateknolojileri.xyz/fHTKmZhmwRmq/

https://akillitarimsulamasistemleri.xyz/fHTKmZhmwRmq/

https://modernciftliksulamayontemi.xyz/fHTKmZhmwRmq/

https://verimlisulamataktikveyontem.xyz/fHTKmZhmwRmq/

https://tarlaotomatiksulamasistemleri.xyz/fHTKmZhmwRmq/

https://bahceveseraotomasyonsulama.xyz/fHTKmZhmwRmq/

https://sudepolamaveverimsulama.xyz/fHTKmZhmwRmq/

https://bitkisulamastratejiler.xyz/fHTKmZhmwRmq/

https://sebzesulamasistemcozumleri.xyz/fHTKmZhmwRmq/

https://akillibahcesulamauretimi.xyz/fHTKmZhmwRmq/

https://gelenekseltarimsulamamodeli.xyz/fHTKmZhmwRmq/

https://sulamaekipmanlariurunleri.xyz/fHTKmZhmwRmq/

https://akillidamlamaotomasyonsistemi.xyz/fHTKmZhmwRmq/

https://pratikverimlibitkisulama.xyz/fHTKmZhmwRmq/

https://topraksizserasulamasistemi.xyz/fHTKmZhmwRmq/

https://otomatiksektorelbitkisulama.xyz/fHTKmZhmwRmq/

https://verimlitarlavemodernsulama.xyz/fHTKmZhmwRmq/

https://bitkisagliginagoresulama.xyz/fHTKmZhmwRmq/

Attributes
  • target_apps

    at.spardat.bcrmobile

    at.spardat.netbanking

    com.bankaustria.android.olb

    com.bmo.mobile

    com.cibc.android.mobi

    com.rbc.mobile.android

    com.scotiabank.mobile

    com.td

    cz.airbank.android

    eu.inmite.prj.kb.mobilbank

    com.bankinter.launcher

    com.kutxabank.android

    com.rsi

    com.tecnocom.cajalaboral

    es.bancopopular.nbmpopular

    es.evobanco.bancamovil

    es.lacaixa.mobile.android.newwapicon

    com.dbs.hk.dbsmbanking

    com.FubonMobileClient

    com.hangseng.rbmobile

    com.MobileTreeApp

    com.mtel.androidbea

    com.scb.breezebanking.hk

    hk.com.hsbc.hsbchkmobilebanking

    com.aff.otpdirekt

    com.ideomobile.hapoalim

    com.infrasofttech.indianBank

    com.mobikwik_new

    com.oxigen.oxigenwallet

    jp.co.aeonbank.android.passbook

AES_key

Signatures

  • Octo

    Octo is a banking malware with remote access capabilities first seen in April 2022.

  • Octo family
  • Octo payload 2 IoCs
  • Removes its main activity from the application launcher 1 TTPs 1 IoCs
  • Loads dropped Dex/Jar 1 TTPs 2 IoCs

    Runs executable file dropped to the device during analysis.

  • Makes use of the framework's Accessibility service 4 TTPs 2 IoCs

    Retrieves information displayed on the phone screen using AccessibilityService.

  • Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
  • Queries the phone number (MSISDN for GSM devices) 1 TTPs
  • Acquires the wake lock 1 IoCs
  • Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs

    Application may abuse the framework's foreground service to continue running in the foreground.

  • Performs UI accessibility actions on behalf of the user 1 TTPs 4 IoCs

    Application may abuse the accessibility service to prevent their removal.

  • Queries the mobile country code (MCC) 1 TTPs 1 IoCs
  • Queries the unique device ID (IMEI, MEID, IMSI) 1 TTPs
  • Requests accessing notifications (often used to intercept notifications before users become aware). 1 TTPs 1 IoCs
  • Requests disabling of battery optimizations (often used to enable hiding in the background). 1 TTPs 1 IoCs
  • Requests modifying system settings. 1 IoCs
  • Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs
  • Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs

Processes

  • com.horse.excite
    1⤵
    • Removes its main activity from the application launcher
    • Loads dropped Dex/Jar
    • Makes use of the framework's Accessibility service
    • Acquires the wake lock
    • Makes use of the framework's foreground persistence service
    • Performs UI accessibility actions on behalf of the user
    • Queries the mobile country code (MCC)
    • Requests accessing notifications (often used to intercept notifications before users become aware).
    • Requests disabling of battery optimizations (often used to enable hiding in the background).
    • Requests modifying system settings.
    • Registers a broadcast receiver at runtime (usually for listening for system events)
    • Uses Crypto APIs (Might try to encrypt user data)
    PID:4251
    • /system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.horse.excite/app_desk/ZlIH.json --output-vdex-fd=41 --oat-fd=42 --oat-location=/data/user/0/com.horse.excite/app_desk/oat/x86/ZlIH.odex --compiler-filter=quicken --class-loader-context=&
      2⤵
      • Loads dropped Dex/Jar
      PID:4277

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • /data/data/com.horse.excite/.qcom.horse.excite

    Filesize

    48B

    MD5

    046a414913add6f5bb60072c7db819b6

    SHA1

    451ee4f6809260aec622d772fd329c7d0297a842

    SHA256

    b66c1320cb063a1d391c94273572ea6edae76c8c8b0a07f8d75c88686f0df72a

    SHA512

    4e6355f3051ed5e811ab030abde1f5be7f5e1cf33be99cd08477e9b6c015deb1d8bd75a09fb9c7176b8511c5ad0a67abc0902a3531e97564ccb6afc57496a47c

  • /data/data/com.horse.excite/app_desk/ZlIH.json

    Filesize

    153KB

    MD5

    d4283a7c2003b227b484e57568f98596

    SHA1

    93698a1eb6c59c75daaf947378a68d47e931004e

    SHA256

    b28785df73e188f3321922fccd81c63fe512303f9ac0ab058645dd080537c609

    SHA512

    b295b079df9ff89c2a0a3ad553a9bdcd9c3d586daf8371393a77970025c3dffac413c0d280585ad2d61caabb4b773c5b085d145a92af8e303c49d762b9de1bad

  • /data/data/com.horse.excite/app_desk/ZlIH.json

    Filesize

    153KB

    MD5

    ab37bd4ebe6fdfaad32cac20adf95a0c

    SHA1

    4917fcd4c71d672a6afdc0500f2dcc8de1179ed0

    SHA256

    54bff3c10082f9c1f5c9a0a01e9d08cb3fde586e36a6151392d8e75f9b431b15

    SHA512

    563d7ae4f23b6dab7eb006c0474612aef6207a41dbef6b6da07e494d03f092429b320a2d0d0a5a310b6247b99437e2517d449f916f97605bb148b99ee759df9f

  • /data/data/com.horse.excite/kl.txt

    Filesize

    63B

    MD5

    62622efe31b44885a62d82141d3c9fd6

    SHA1

    cedcfb652b81556eafd8cd5df1f75f4bcb90e1ff

    SHA256

    6e7601937011eee3e294e1efc4e26da9e197ce3e99aa5da703612bc23abb19e9

    SHA512

    d4134bac176c062bca0ad4a0a7b0476bcdcf08e848f07275d3b9ea587c9e0238dca96e383a1e6bbac9ef8ebf84507e17d7e10547faf122c63ec4d220bf233d64

  • /data/data/com.horse.excite/kl.txt

    Filesize

    423B

    MD5

    e437534a65771293420347ed8e3a735c

    SHA1

    590e7db8c0676c71c8307174f33e9acb264380ca

    SHA256

    aaafcb9b154915da2fa3dce20125bfe7ed7f4d5bbd7abbff08288b2385b375f3

    SHA512

    d09bebdcbe8f7487f4ecb92c5f002a7f2374a21aec59a849d8602f5cdc065d941286105742dab1d31ebdac65669a0c2cd63631df878f6dbdf3c3dac07276b9c2

  • /data/data/com.horse.excite/kl.txt

    Filesize

    230B

    MD5

    d243710858a41efba829c894683d5350

    SHA1

    1feb2eefd693cea6d5c5a4ccd74f2d766bc77642

    SHA256

    28a8e7493fb2ae069c637e228c8e4afd755d6c2a7a897cbafd4584ec47a6a60a

    SHA512

    b86557aa919bef4097e53760a044edf16e437f3f1d96f9574714d6c0729fc58ab4000791d903bf6378b99632b2b9f2384618b4d2816eab86ebaf1725d0886583

  • /data/data/com.horse.excite/kl.txt

    Filesize

    79B

    MD5

    210afa97eea1abc9b7a7e367cb9ce676

    SHA1

    120498a226de2e2011791df3925c6b5939dfb3ec

    SHA256

    ac6499bfc5ce2f1a97e8dc3336086fc67b0d9d7714f20097f9ca2b956a7f9068

    SHA512

    7d4af58e3fac39def0f4608fa47d5c5c9b164d2b771a6add1e813b4fae0266d43299fd9d122ab37fcd939c46bd79edd0cdb5298f3bb028fdadb2bbe0e1b6449f

  • /data/data/com.horse.excite/kl.txt

    Filesize

    54B

    MD5

    40ee881274c360b965b2e20acbfeb89f

    SHA1

    2f9a8a3733f6dda93a4b5af28e3e3dea25ba2d79

    SHA256

    4ee409aa5d2599937e6576ba6676e2e7c5b7072a9fa7bd9a0a3f119d5fe7de6b

    SHA512

    b55059ddc87bbbe21e0f5ec64f74b203a03006dd7104b0577000c7084aa04c0f6132d7a1e44e3cf09128324ac164cbdadfad272884cf1e6d1a1043d17799f689

  • /data/user/0/com.horse.excite/app_desk/ZlIH.json

    Filesize

    450KB

    MD5

    13d1a22001e516ab4372851897ccc993

    SHA1

    6a9d120e166537def33c86e067233c001f60d4ff

    SHA256

    b04b2133b79aee5716f9d9b915a39082c344c1db83c5d318b5c6dbda0cb75f44

    SHA512

    136fd434aeed01f6903dce2d3b3b9c12e102e3ae9c83b564ed95622214e365ebf69d1a6c1844f8d2a9e21b753840e29b76a6ef44f0882c125a217f3bb0870075

  • /data/user/0/com.horse.excite/app_desk/ZlIH.json

    Filesize

    450KB

    MD5

    d17c9eaf047f12587a745dd4dfc86c6b

    SHA1

    1597a85a3611cd55ee7bd09ccff2948ef52bd0b3

    SHA256

    2ab433a9038142521524acbdf734c97119a7f9c6593c3d811f5dace240e0e9d9

    SHA512

    6cab4b59656fe8a1cc8bf9ad8ddeb1beda9c134081bed321964cdb150c79f3ec41ae74a283c69168d1b187dd2384ee86a1284a7c6ed8fde8e4504f98d8131256