Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    149s
  • max time network
    159s
  • platform
    android-13_x64
  • resource
    android-33-x64-arm64-20240910-en
  • resource tags

    arch:arm64arch:x64arch:x86image:android-33-x64-arm64-20240910-enlocale:en-usos:android-13-x64system
  • submitted
    06/02/2025, 22:03

General

  • Target

    fc397c77acc04320d15f03c430bd76c61a0d8f33e211e8b8b101c0d7fb3ee5b3.apk

  • Size

    1.8MB

  • MD5

    10e7eed73b390d54590ad1c84b7d31b7

  • SHA1

    0ed5aaf4b17a4dd5f3459253f49fd386c33b14a0

  • SHA256

    fc397c77acc04320d15f03c430bd76c61a0d8f33e211e8b8b101c0d7fb3ee5b3

  • SHA512

    2bd970fb529513624830412a09a3caff4dd93caec31b9a68bc0a5188ee78546051b471704fdab52ae0a5eca76d53c880683517486f1e1df5df3597efbeb8284b

  • SSDEEP

    49152:zsRDTfic4quojO7wD/KPmU/7yBFOQuC7AW3dM8F:zsR/fX4ojKeU/7kFeCn3dM8F

Malware Config

Extracted

Family

octo

C2

https://kobrasaldiristratejileri.xyz/MzhiMTg0NTAwOTY5S/

https://kobratehlikeanalizleri.xyz/MzhiMTg0NTAwOTY5S/

https://kobravesurprizhikayeler.xyz/MzhiMTg0NTAwOTY5S/

https://kobrayanasistemverileri.xyz/MzhiMTg0NTAwOTY5S/

https://kobrakulturvesavasanati.xyz/MzhiMTg0NTAwOTY5S/

https://kobrabilimvegizemlerdunyasi.xyz/MzhiMTg0NTAwOTY5S/

https://kobragesmisiylebilimtarihi.xyz/MzhiMTg0NTAwOTY5S/

https://kobraversanatinbirlestigi.xyz/MzhiMTg0NTAwOTY5S/

https://kobrataktiklersistematik.xyz/MzhiMTg0NTAwOTY5S/

https://kobralaryasadogasi.xyz/MzhiMTg0NTAwOTY5S/

https://kobravesavasfelsefesi.xyz/MzhiMTg0NTAwOTY5S/

https://kobratedbirvetaktik.xyz/MzhiMTg0NTAwOTY5S/

https://kobratehlikeveguvenlik.xyz/MzhiMTg0NTAwOTY5S/

https://kobravesavunmasistemi.xyz/MzhiMTg0NTAwOTY5S/

https://kobraveavlanmataktikleri.xyz/MzhiMTg0NTAwOTY5S/

https://kobrakisiselyetenekler.xyz/MzhiMTg0NTAwOTY5S/

https://kobratehlikeharitasi.xyz/MzhiMTg0NTAwOTY5S/

https://kobravesavasstratejileri.xyz/MzhiMTg0NTAwOTY5S/

https://kobrabilimveanaliz.xyz/MzhiMTg0NTAwOTY5S/

https://kobratehditveonleme.xyz/MzhiMTg0NTAwOTY5S/

rc4.plain

Extracted

Family

octo

C2

https://kobrasaldiristratejileri.xyz/MzhiMTg0NTAwOTY5S/

https://kobratehlikeanalizleri.xyz/MzhiMTg0NTAwOTY5S/

https://kobravesurprizhikayeler.xyz/MzhiMTg0NTAwOTY5S/

https://kobrayanasistemverileri.xyz/MzhiMTg0NTAwOTY5S/

https://kobrakulturvesavasanati.xyz/MzhiMTg0NTAwOTY5S/

https://kobrabilimvegizemlerdunyasi.xyz/MzhiMTg0NTAwOTY5S/

https://kobragesmisiylebilimtarihi.xyz/MzhiMTg0NTAwOTY5S/

https://kobraversanatinbirlestigi.xyz/MzhiMTg0NTAwOTY5S/

https://kobrataktiklersistematik.xyz/MzhiMTg0NTAwOTY5S/

https://kobralaryasadogasi.xyz/MzhiMTg0NTAwOTY5S/

https://kobravesavasfelsefesi.xyz/MzhiMTg0NTAwOTY5S/

https://kobratedbirvetaktik.xyz/MzhiMTg0NTAwOTY5S/

https://kobratehlikeveguvenlik.xyz/MzhiMTg0NTAwOTY5S/

https://kobravesavunmasistemi.xyz/MzhiMTg0NTAwOTY5S/

https://kobraveavlanmataktikleri.xyz/MzhiMTg0NTAwOTY5S/

https://kobrakisiselyetenekler.xyz/MzhiMTg0NTAwOTY5S/

https://kobratehlikeharitasi.xyz/MzhiMTg0NTAwOTY5S/

https://kobravesavasstratejileri.xyz/MzhiMTg0NTAwOTY5S/

https://kobrabilimveanaliz.xyz/MzhiMTg0NTAwOTY5S/

https://kobratehditveonleme.xyz/MzhiMTg0NTAwOTY5S/

Attributes
  • target_apps

    at.spardat.bcrmobile

    at.spardat.netbanking

    com.bankaustria.android.olb

    com.bmo.mobile

    com.cibc.android.mobi

    com.rbc.mobile.android

    com.scotiabank.mobile

    com.td

    cz.airbank.android

    eu.inmite.prj.kb.mobilbank

    com.bankinter.launcher

    com.kutxabank.android

    com.rsi

    com.tecnocom.cajalaboral

    es.bancopopular.nbmpopular

    es.evobanco.bancamovil

    es.lacaixa.mobile.android.newwapicon

    com.dbs.hk.dbsmbanking

    com.FubonMobileClient

    com.hangseng.rbmobile

    com.MobileTreeApp

    com.mtel.androidbea

    com.scb.breezebanking.hk

    hk.com.hsbc.hsbchkmobilebanking

    com.aff.otpdirekt

    com.ideomobile.hapoalim

    com.infrasofttech.indianBank

    com.mobikwik_new

    com.oxigen.oxigenwallet

    jp.co.aeonbank.android.passbook

AES_key

Signatures

  • Octo

    Octo is a banking malware with remote access capabilities first seen in April 2022.

  • Octo family
  • Octo payload 1 IoCs
  • Loads dropped Dex/Jar 1 TTPs 1 IoCs

    Runs executable file dropped to the device during analysis.

  • Makes use of the framework's Accessibility service 4 TTPs 2 IoCs

    Retrieves information displayed on the phone screen using AccessibilityService.

  • Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
  • Queries the phone number (MSISDN for GSM devices) 1 TTPs
  • Acquires the wake lock 1 IoCs
  • Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs

    Application may abuse the framework's foreground service to continue running in the foreground.

  • Performs UI accessibility actions on behalf of the user 1 TTPs 7 IoCs

    Application may abuse the accessibility service to prevent their removal.

  • Queries the mobile country code (MCC) 1 TTPs 1 IoCs
  • Reads information about phone network operator. 1 TTPs
  • Requests accessing notifications (often used to intercept notifications before users become aware). 1 TTPs 1 IoCs
  • Requests disabling of battery optimizations (often used to enable hiding in the background). 1 TTPs 1 IoCs
  • Requests modifying system settings. 1 IoCs
  • Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs

Processes

  • com.team.lend
    1⤵
    • Loads dropped Dex/Jar
    • Makes use of the framework's Accessibility service
    • Acquires the wake lock
    • Makes use of the framework's foreground persistence service
    • Performs UI accessibility actions on behalf of the user
    • Queries the mobile country code (MCC)
    • Requests accessing notifications (often used to intercept notifications before users become aware).
    • Requests disabling of battery optimizations (often used to enable hiding in the background).
    • Requests modifying system settings.
    • Uses Crypto APIs (Might try to encrypt user data)
    PID:4477

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • /data/user/0/com.team.lend/.qcom.team.lend

    Filesize

    48B

    MD5

    046a414913add6f5bb60072c7db819b6

    SHA1

    451ee4f6809260aec622d772fd329c7d0297a842

    SHA256

    b66c1320cb063a1d391c94273572ea6edae76c8c8b0a07f8d75c88686f0df72a

    SHA512

    4e6355f3051ed5e811ab030abde1f5be7f5e1cf33be99cd08477e9b6c015deb1d8bd75a09fb9c7176b8511c5ad0a67abc0902a3531e97564ccb6afc57496a47c

  • /data/user/0/com.team.lend/app_feature/jina.json

    Filesize

    153KB

    MD5

    de38697aeb134fee3a438e49c9065e92

    SHA1

    554051c87141ccb8a989c1786f920cca5162a3ae

    SHA256

    aae430bb349592ae013841c1648a52acb5bac0cda7791c4ca0c9c50bee693bd6

    SHA512

    a94abf4aef242d746e69d108126ac9798fe9f3103ebf4506cc19560c9bf21d37df07fdede3e36742238cc2ad5532be9812d1d1a7866d8437acf9dc12a5d8d886

  • /data/user/0/com.team.lend/app_feature/jina.json

    Filesize

    153KB

    MD5

    da60d4550500c7d05c928e0eccfd92c3

    SHA1

    0682c0ee6053a6258592c7e70b9a4da58e9f571f

    SHA256

    2769665ca14a177c74b8b198f2f30ed1534176982bee2c243f46b30e2d8be326

    SHA512

    5a7efc0dcff14a03e4541e63e7b7a07545dc1e83cefa0da745f60c40f008f49bb5a2a9c6614a63ad84ded9f73a14f3af9e21b7ac4db51b61e6a175e566f04acd

  • /data/user/0/com.team.lend/app_feature/jina.json

    Filesize

    450KB

    MD5

    6c5866e6783010f1ebbf56a76c8e773f

    SHA1

    59b641c63a2fefe5f0c74326222f6367cf84cd32

    SHA256

    f1324c5634a53b709210b82bb8dd0db0234a627ce177cd35fbf5ba60ae420b8b

    SHA512

    e14f9d40deec5f2914c3fe5795b074d7f0b41edd0d1d988b761cba042e4e424bf665ea403f82a72eb58d9c80a1fe0f6962f691c212aca95a093899e5815be82e

  • /data/user/0/com.team.lend/kl.txt

    Filesize

    55B

    MD5

    6c195e35a21d2d383dfa3dcbb7505809

    SHA1

    574cd605529cfea305b94360602c202014e86d9c

    SHA256

    9712fbf5ea7a51a2ed23994187696a15edcd78debb367fc24244cd3121a7e6fd

    SHA512

    d147b4b22d53f4c1813e16296e9a5bc7d800927cac5fe21cb529f82d18c32dc2ef3b9449a6eb79a41de966f3cb2fc8ef1fd41a9e1c0fa3c4ee8c0ab4f7e0f8c7

  • /data/user/0/com.team.lend/kl.txt

    Filesize

    45B

    MD5

    04f588ffc0e9b65f77e2f98e16125c13

    SHA1

    0dcbdb938bfa0307c12ff60691db99e9a12a774a

    SHA256

    0a2b6d4fdd249b0e10f4f40d46f1d2ede6c9c62af5b958def4b6307e8f8d56cb

    SHA512

    5395a7e77e80b8131c57522ca909a85f313ea487a8d43ca1c5b1c9356645af87e496dd3aab6dbaddde4af3b20efa7ce7b12d98293ba05122e204e4bb3214e693

  • /data/user/0/com.team.lend/kl.txt

    Filesize

    490B

    MD5

    c0ac7be5f7c9868c63303155b983a267

    SHA1

    1aab03608790280f84bdbe32400f975f809b59cd

    SHA256

    548f30426886e74f6485dbff7045fecaaa671ac8e895f5e7d6abad8a6fb16e69

    SHA512

    0f7c274eb6e9b90a227da538c0f1ecb5e80f421d02268fe489aa5bbd61dd85b7b3b2be33e0039cd0fa462dfa71f50c496e0f23c54cf65fadcca83025c2b09047

  • /data/user/0/com.team.lend/kl.txt

    Filesize

    60B

    MD5

    09b3339543f27b6fc5533474623d66d2

    SHA1

    164e7fd78f7dbde63e5acd78cc7bf2fc89ac4245

    SHA256

    12a74d3d7d0cc74da619627a33a42282cf8c98c24c71334ba30770858f7467f0

    SHA512

    542c11894c776dc17335ddde32ebb9d60f2ab1897f37167c12733bcc6d1e7bbafbe241ce00f06e73ca5b6c8911f4fe9fc88b632dc33913e49b79082bb34b3401

  • /data/user/0/com.team.lend/kl.txt

    Filesize

    52B

    MD5

    3a7da00403730da8b871c123d72f212b

    SHA1

    e6f9514c7921561f061f74a6b305823c708e2a9c

    SHA256

    9366ef46f3489644b86564840436221d0121329044b67a42a7c4d2ea1de7f64a

    SHA512

    220ab242ef8968477c1f0a6bff67a3ba633e3c60c7c1614ab2f6a9a58d250a2ee6fed1ef5f30ddb69c86c4ea78aca5da9f08e2aac286a9d9727b64c372540881

  • /data/user/0/com.team.lend/kl.txt

    Filesize

    66B

    MD5

    c4b18223c24dd37604d3653f09534326

    SHA1

    766335131f6c91a11a9aca438f53935c60409cd3

    SHA256

    45c048971f66ea086a679f5834d9a4b299d0360d1c018ab6c2d04fc987d15d84

    SHA512

    6ff64304c64e319809bb165cca7fa2613e173b9f90f8d6aa99ce717d25e07c6362a27b41d08cb727deb893d26c7a8b3dcc6aaca4d952be572db830dc01e15372

  • /data/user/0/com.team.lend/kl.txt

    Filesize

    84B

    MD5

    d8261fe3790d46337db146a195723fd7

    SHA1

    7694efe5d9bdca7ca123054b8ccd853c0b1c51de

    SHA256

    c2817cfdeb1208d3b0189641627723f912b55460cb922960c2b52a904744b8cf

    SHA512

    c832ad936914439358b29301299b6c4c18d1460d28b82331069828bb448d7a2543c2e3794b843440fc46786beff20cc091926e8116baa29c4919e331c6fcdf68

  • /data/user/0/com.team.lend/kl.txt

    Filesize

    68B

    MD5

    8c117831532afcb7ff9f014ae2165864

    SHA1

    51e1d0bce94f5cc8bead901cf0b819f4886eb14a

    SHA256

    8b1afa9ce15ce4d12b85c967295b2c05a403573e8fd2488bafe24e600402e119

    SHA512

    b447cabadc165a4745e86378c6374fdb82f654022dbc9ff33106f4c8c05f2e48ce4c900d6f9d2a977c1c462b34fe75025fc5ae946589c1e41305a73c862c872d

  • /data/user/0/com.team.lend/kl.txt

    Filesize

    214B

    MD5

    1131d436ed24f7105d6bc24abaeac01e

    SHA1

    7f1a36730a6c2ac0af6a3eb3470f7b16663f8c82

    SHA256

    b99b8e1f6c93f937bc81e8b825e436b8b6226ed6977a6b7e57be26654efe20b8

    SHA512

    3d2bdaac8899b630811f05746e3696ba0b4c5197d5e2465cd8de56c09eeafc3af9f3b27d60a6b9fbb268ea0554574099a916ff9b3c8c43b7093851c3dcb31671

  • /data/user/0/com.team.lend/kl.txt

    Filesize

    54B

    MD5

    a9f7aa267bed69828b13dbd75410782a

    SHA1

    169a33e13f8ec777e4325c31bba249fbd2a5fa9e

    SHA256

    bbdf1ccb4915156c595a32570cdc53874461c2f98ea8307b8e0085d320194587

    SHA512

    af5b83fe47e8330c2e00f0abc55485e3aae8e146a7e3e3ba876bcdb0bf6fb13bcddd3d412ab656c31d5220779eb86f43388232bbd637ed3a0bee320ba6d3154c

  • /data/user/0/com.team.lend/kl.txt

    Filesize

    68B

    MD5

    bbbbaa24bd80ce84f51ac27683a57d0c

    SHA1

    1f01ab4613daf987d49464c7820d93ad5f77b957

    SHA256

    909c82ce62ef36c43a27036b8f4698a2aa877576abc97111cd98615413ff990c

    SHA512

    f0cc155a7c97475eac84267c828229a5a4987d4a70a913b1ca784d798e0a571f5dda82073ede5dfca1a535c9998ecdd0f5d472c5d7c3eada34998c94611402f5

  • /data/user/0/com.team.lend/kl.txt

    Filesize

    60B

    MD5

    72e99ea34bd9f14191bf3ef88f46f1c6

    SHA1

    5cd5a82dff8ad02db32acdecd1b9c8c1da2f0832

    SHA256

    f4ab28773a22b88e479d08d7722259bd1386d158e263a72d041c657467aa1c58

    SHA512

    0ef5de0835929a6eeffea7051085a955babdf8fcba14308a0c86c01f61e3cd41bfe7b67436b0a9b5fd2febbd36a701420c52995cb90eae374523ed679093853e

  • /data/user/0/com.team.lend/kl.txt

    Filesize

    52B

    MD5

    c68792d1e023597fd33f8dd6bf2aba0b

    SHA1

    681d9e74b3aa9490e85bd586b86a6eab7d89e161

    SHA256

    8b81633105f3c40271e52bebb4a2dec758af7bfb71e0983fdca8b4e26054c187

    SHA512

    9a5db116de9f33181c9326659b30b376fe293c45688cdd574de8035f543bf40bab4d8cc12c408ada87b55915090c3d1f219e98c5dfa7c4bc1d5fd93871c93a05

  • /data/user/0/com.team.lend/kl.txt

    Filesize

    70B

    MD5

    e013c2b3adb08f97d34a43f89ba7be6c

    SHA1

    3e5fc9c7f45a08ae6a9f0b781492626abfbba900

    SHA256

    8d82059a7aadf95b2c6853614cf828ac3246e846a4ea9eb13ccaf4ba3489ad00

    SHA512

    633e574426ad3c51a7c7d5a0ecfe2d778b5a6c8ab5f3f868ee3b6837e63894b17fd9f23a353327f5098c5a04da5274854855233efde81f781586b4256760a4a9