Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    148s
  • max time network
    147s
  • platform
    android_x64
  • resource
    android-x64-arm64-20240624-en
  • resource tags

    androidarch:armarch:arm64arch:x64arch:x86image:android-x64-arm64-20240624-enlocale:en-usos:android-11-x64system
  • submitted
    06/02/2025, 22:03

General

  • Target

    7c5cb3e9966b35663fe10367b0f3a62ecfdbdedc0a7d82f5e5632baddf825639.apk

  • Size

    1.6MB

  • MD5

    c2b730d7c0282d6dcd052ee9623fd867

  • SHA1

    a30788fcb132c03d92bef5222cd92c0cbcc93c0f

  • SHA256

    7c5cb3e9966b35663fe10367b0f3a62ecfdbdedc0a7d82f5e5632baddf825639

  • SHA512

    cadd6b9db4110cba766cf45a5df87bf433d67f56360f8466b0fb0207274bbbdab861b1304f7637ed131ac5623c9e63763ff61eb97c45b09657bcda98bc4b1274

  • SSDEEP

    49152:AQPgb3mfqZt0IT1nbY4NJJiOb77bESrED7+zV+AI4t8q:Fgb3u8tXpxNxvbESQ7AIg8q

Malware Config

Extracted

Family

octo

C2

https://kobrasaldiristratejileri.xyz/MzhiMTg0NTAwOTY5S/

https://kobratehlikeanalizleri.xyz/MzhiMTg0NTAwOTY5S/

https://kobravesurprizhikayeler.xyz/MzhiMTg0NTAwOTY5S/

https://kobrayanasistemverileri.xyz/MzhiMTg0NTAwOTY5S/

https://kobrakulturvesavasanati.xyz/MzhiMTg0NTAwOTY5S/

https://kobrabilimvegizemlerdunyasi.xyz/MzhiMTg0NTAwOTY5S/

https://kobragesmisiylebilimtarihi.xyz/MzhiMTg0NTAwOTY5S/

https://kobraversanatinbirlestigi.xyz/MzhiMTg0NTAwOTY5S/

https://kobrataktiklersistematik.xyz/MzhiMTg0NTAwOTY5S/

https://kobralaryasadogasi.xyz/MzhiMTg0NTAwOTY5S/

https://kobravesavasfelsefesi.xyz/MzhiMTg0NTAwOTY5S/

https://kobratedbirvetaktik.xyz/MzhiMTg0NTAwOTY5S/

https://kobratehlikeveguvenlik.xyz/MzhiMTg0NTAwOTY5S/

https://kobravesavunmasistemi.xyz/MzhiMTg0NTAwOTY5S/

https://kobraveavlanmataktikleri.xyz/MzhiMTg0NTAwOTY5S/

https://kobrakisiselyetenekler.xyz/MzhiMTg0NTAwOTY5S/

https://kobratehlikeharitasi.xyz/MzhiMTg0NTAwOTY5S/

https://kobravesavasstratejileri.xyz/MzhiMTg0NTAwOTY5S/

https://kobrabilimveanaliz.xyz/MzhiMTg0NTAwOTY5S/

https://kobratehditveonleme.xyz/MzhiMTg0NTAwOTY5S/

rc4.plain

Extracted

Family

octo

C2

https://kobrasaldiristratejileri.xyz/MzhiMTg0NTAwOTY5S/

https://kobratehlikeanalizleri.xyz/MzhiMTg0NTAwOTY5S/

https://kobravesurprizhikayeler.xyz/MzhiMTg0NTAwOTY5S/

https://kobrayanasistemverileri.xyz/MzhiMTg0NTAwOTY5S/

https://kobrakulturvesavasanati.xyz/MzhiMTg0NTAwOTY5S/

https://kobrabilimvegizemlerdunyasi.xyz/MzhiMTg0NTAwOTY5S/

https://kobragesmisiylebilimtarihi.xyz/MzhiMTg0NTAwOTY5S/

https://kobraversanatinbirlestigi.xyz/MzhiMTg0NTAwOTY5S/

https://kobrataktiklersistematik.xyz/MzhiMTg0NTAwOTY5S/

https://kobralaryasadogasi.xyz/MzhiMTg0NTAwOTY5S/

https://kobravesavasfelsefesi.xyz/MzhiMTg0NTAwOTY5S/

https://kobratedbirvetaktik.xyz/MzhiMTg0NTAwOTY5S/

https://kobratehlikeveguvenlik.xyz/MzhiMTg0NTAwOTY5S/

https://kobravesavunmasistemi.xyz/MzhiMTg0NTAwOTY5S/

https://kobraveavlanmataktikleri.xyz/MzhiMTg0NTAwOTY5S/

https://kobrakisiselyetenekler.xyz/MzhiMTg0NTAwOTY5S/

https://kobratehlikeharitasi.xyz/MzhiMTg0NTAwOTY5S/

https://kobravesavasstratejileri.xyz/MzhiMTg0NTAwOTY5S/

https://kobrabilimveanaliz.xyz/MzhiMTg0NTAwOTY5S/

https://kobratehditveonleme.xyz/MzhiMTg0NTAwOTY5S/

Attributes
  • target_apps

    at.spardat.bcrmobile

    at.spardat.netbanking

    com.bankaustria.android.olb

    com.bmo.mobile

    com.cibc.android.mobi

    com.rbc.mobile.android

    com.scotiabank.mobile

    com.td

    cz.airbank.android

    eu.inmite.prj.kb.mobilbank

    com.bankinter.launcher

    com.kutxabank.android

    com.rsi

    com.tecnocom.cajalaboral

    es.bancopopular.nbmpopular

    es.evobanco.bancamovil

    es.lacaixa.mobile.android.newwapicon

    com.dbs.hk.dbsmbanking

    com.FubonMobileClient

    com.hangseng.rbmobile

    com.MobileTreeApp

    com.mtel.androidbea

    com.scb.breezebanking.hk

    hk.com.hsbc.hsbchkmobilebanking

    com.aff.otpdirekt

    com.ideomobile.hapoalim

    com.infrasofttech.indianBank

    com.mobikwik_new

    com.oxigen.oxigenwallet

    jp.co.aeonbank.android.passbook

AES_key

Signatures

  • Octo

    Octo is a banking malware with remote access capabilities first seen in April 2022.

  • Octo family
  • Octo payload 1 IoCs
  • Loads dropped Dex/Jar 1 TTPs 1 IoCs

    Runs executable file dropped to the device during analysis.

  • Makes use of the framework's Accessibility service 4 TTPs 2 IoCs

    Retrieves information displayed on the phone screen using AccessibilityService.

  • Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
  • Queries the phone number (MSISDN for GSM devices) 1 TTPs
  • Acquires the wake lock 1 IoCs
  • Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs

    Application may abuse the framework's foreground service to continue running in the foreground.

  • Performs UI accessibility actions on behalf of the user 1 TTPs 4 IoCs

    Application may abuse the accessibility service to prevent their removal.

  • Queries the mobile country code (MCC) 1 TTPs 1 IoCs
  • Reads information about phone network operator. 1 TTPs
  • Requests accessing notifications (often used to intercept notifications before users become aware). 1 TTPs 1 IoCs
  • Requests disabling of battery optimizations (often used to enable hiding in the background). 1 TTPs 1 IoCs
  • Requests modifying system settings. 1 IoCs
  • Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs

Processes

  • com.mean.project
    1⤵
    • Loads dropped Dex/Jar
    • Makes use of the framework's Accessibility service
    • Acquires the wake lock
    • Makes use of the framework's foreground persistence service
    • Performs UI accessibility actions on behalf of the user
    • Queries the mobile country code (MCC)
    • Requests accessing notifications (often used to intercept notifications before users become aware).
    • Requests disabling of battery optimizations (often used to enable hiding in the background).
    • Requests modifying system settings.
    • Uses Crypto APIs (Might try to encrypt user data)
    PID:4499

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • /data/user/0/com.mean.project/.qcom.mean.project

    Filesize

    48B

    MD5

    046a414913add6f5bb60072c7db819b6

    SHA1

    451ee4f6809260aec622d772fd329c7d0297a842

    SHA256

    b66c1320cb063a1d391c94273572ea6edae76c8c8b0a07f8d75c88686f0df72a

    SHA512

    4e6355f3051ed5e811ab030abde1f5be7f5e1cf33be99cd08477e9b6c015deb1d8bd75a09fb9c7176b8511c5ad0a67abc0902a3531e97564ccb6afc57496a47c

  • /data/user/0/com.mean.project/app_hole/jT.json

    Filesize

    153KB

    MD5

    1e68f7bd8f616148db84fcded9797740

    SHA1

    9c99e7e01b409ab613663987a83e42baa6ee025a

    SHA256

    ad80b7e82bbacdef579728290f8eda40e24390c1d90da5b7652f0091205e52bd

    SHA512

    9b813873db3312ba3507891982f7b250f20dfa5a69acd0628fa8b202727ebeaddffaa2ecc56892328366a84aaad8aef364591836734815e86711bef0eb777f3f

  • /data/user/0/com.mean.project/app_hole/jT.json

    Filesize

    153KB

    MD5

    d3a54e74659d6df9e7a057e7b68377ef

    SHA1

    786477632288585063bf56a42288096633a9ae56

    SHA256

    d88aac98e9196a1ad70ee2bbde74924f9f87bb6b034c3c57f34f696e13d90a2b

    SHA512

    b0649b1842007228e99bdc28eb735b7bdc92c77922b810bf82266df527be0bde084f3afe9e1b9daad3ab782999b3f5d4bf61ab09c9da42c2d53093052f5b622d

  • /data/user/0/com.mean.project/app_hole/jT.json

    Filesize

    451KB

    MD5

    939dd03ad48c93af9b894ccddb7e6ded

    SHA1

    004b475673bc3e315df8616744df5134aee1782f

    SHA256

    00e1f505ce9a90f054683a97a0c0e9dc94da55586512eb49896ff357cdff1142

    SHA512

    04bd848fdbd43db96884a7a85ecaa90bd7f86daacf7aa6f0cca3efc0d3b06a1de17b67ef5764a0eec918584147b8cf835f13bffa4016517343c507d2c5c17532

  • /data/user/0/com.mean.project/kl.txt

    Filesize

    58B

    MD5

    7c185961e7eefe0131217bbd3c1e1025

    SHA1

    78ec006d3bd8531117a628480e6459739761ed4e

    SHA256

    e9afc5c7bca275c445194754ff0dabc36564d62aa88758e4baf50c39b11bdeb4

    SHA512

    c3c86d419cdfdfc15ab729e1a025e8710a65172c38f0f00ec8cc0ed95bace7e70839a5768421f0758eaa7b2a65d11cfe61114d251a3cdda3c25f9e666729e8b5

  • /data/user/0/com.mean.project/kl.txt

    Filesize

    63B

    MD5

    23ba97d0f3e41eabaee6ed2651ae02eb

    SHA1

    c070ce045272522e45b285b13144b8c5094ca3c4

    SHA256

    df31d9e648b354d6431d9adbdea4733945206dfd569f2cf06e891b6832eb859f

    SHA512

    ceb6c0199d7ef26f83a1c371ba805d592182cb04120c99f0b94d9ffaf8e76f6b559aba585de53e8ce80ed7c044924b351ca45ed87fc7a1a47b2dc22d97ec7783

  • /data/user/0/com.mean.project/kl.txt

    Filesize

    45B

    MD5

    fd31b12c2847e6911636f3e4bad8a016

    SHA1

    b2cdd69fd59bb676fb3862dbff3825da3f58264f

    SHA256

    57621469c90e4f677ad6daca21d13034d7ffa9c86e66e1134da5b2a3aa405db0

    SHA512

    c33f79754bd180ee033d0a3fd52dfc27967c6df6e0ad042a98dae68b5924f46ff84948260889a3a1bc943011b1bd8c7d5391764eac987c4b122a389479f710b7

  • /data/user/0/com.mean.project/kl.txt

    Filesize

    66B

    MD5

    069fe6a509217bbeadcce68db1e9b3e7

    SHA1

    3bb17d1b2c286386290661d55dff4edc62e98697

    SHA256

    5a958ced7275102f79fa4572a6efe92cb646462ae7562cea11315f8ce33aed54

    SHA512

    5ceac190c4e09fbe25c3f867e9e96bb1d1adeef6a1bd709ee5f9f0c345e6ca357bd5ac3f0772dddcfe81f242abe74b81ff2f50d94b370c19966fca0f8a2b4778

  • /data/user/0/com.mean.project/kl.txt

    Filesize

    84B

    MD5

    36c3b494adea6597b18606eb9603bf8a

    SHA1

    81986492863fb8006a4d05faa933526e669e6922

    SHA256

    1f287890d8f9cc66a0c6f7770e09f54a6942b34eb369d320e7c07c229ca9b20c

    SHA512

    9d8371de8400b33de48e54589d346d3cc9b3eb789b236df7732e1e12b8207dc219c19501f6f588cccf613dd5ea38f27da9d2a240416b0c6f3c4d03cab005a0e1

  • /data/user/0/com.mean.project/kl.txt

    Filesize

    63B

    MD5

    8fa3c010a7c89c912cf90237968e574a

    SHA1

    577718e25e73146f9acdcaae33cd22c282ba4d4c

    SHA256

    3be8e32c0cfa12f3dd28c6ae65efae62f6e359a80090a2c1f8405860b9fc1563

    SHA512

    3934db06ad57def2f61067cf9391188590806ed3bfccef15de7e5af861cb3de7b4dc97312d0c3796c5ce3f1ed9858a213ecd4811e2b12f94fdfb2c72831d21cc

  • /data/user/0/com.mean.project/kl.txt

    Filesize

    58B

    MD5

    40a6263e4741f4fedef1ed53cc509ea6

    SHA1

    31a67e77562a57c1d428d42614a4944cacbe0574

    SHA256

    c5d4d2effb71a069aa17c995c39cb02956cb55106f415a760fa063b5e0dfd508

    SHA512

    de2fe56fe70c7e5f8cd083d1f5c2eaf115ad79057946b6c4eb537440184240bd8ff07493b7875856e03095557058847752817ddb624d0e1de545d7d1f556554d

  • /data/user/0/com.mean.project/kl.txt

    Filesize

    230B

    MD5

    4cca46e24b63ab59512bd03af5d0f44f

    SHA1

    363ceee6e065c40257afd8eb5d087730fbaf657e

    SHA256

    fafc279e15dae49fd2bda02311cf04fe02e05ae8f0eda7b4ce71b5778424afc7

    SHA512

    3a7b59bd66151bee455424d936ea68cbc5ee7fb0ab4d89f51b2c8961803c753d84a7590e43745563564e91ee3e2cb492492f943d808b5e0c5216ccfba5683341

  • /data/user/0/com.mean.project/kl.txt

    Filesize

    63B

    MD5

    73ebec3dd72e5c69de3979d0c3f325f2

    SHA1

    0a0ccec6ef4ab0231ef30fedf76d9d60d8615c9d

    SHA256

    560b171e7fb01461da1d23e0df245626246082021938b36443a7e8dd7fd12726

    SHA512

    e7606ebc928d206c974e06f42f0302c04a94cb808c6d9b9f93546d7660235515bf39e1176f844a0764627c1c9527d841ca186b12c24a11d2c8086bce2762ca60

  • /data/user/0/com.mean.project/kl.txt

    Filesize

    68B

    MD5

    e2349dc784df77855c9ebaf9b3581a14

    SHA1

    d254712adb12cd20b8f3f821dfccf15319f86d9a

    SHA256

    00ce65ed563657797e18769f159b2b52c862e049962efcb2142d6cd70824dfec

    SHA512

    431cc12c7df04157caf5915b8f8ca63d919709cd14fc6ab7fa6f336a7afce61325dad6f2df303ccc0b7e576ea06337f37cbf485e941899576f13288aed39b624

  • /data/user/0/com.mean.project/kl.txt

    Filesize

    45B

    MD5

    b2eacb15969bba758b4c890451ea8f3a

    SHA1

    5a1a5e3969580e8a1a4fe6811164be451610f5c4

    SHA256

    116b13950d93ae544f53f8e90325516be9535efc82f45980dc18568e7c8d7038

    SHA512

    7bd128f63d5c41ee3518f89229487d03cbbde33649847ba7b7628c28f32ba017859a5cc9cb606be36206c885e0d34589586206623d499f850fbe39d1aad8b3d3

  • /data/user/0/com.mean.project/kl.txt

    Filesize

    466B

    MD5

    30ccbc0ec7f8233ecef60f563f3fac0d

    SHA1

    98a5d33bcf293fc39b9cf0b4751b969ae066a672

    SHA256

    d7d673b72ed23ab642eb82468e8ffe3c9d286c9652327604932f1247823ccf28

    SHA512

    8c80ba5792d397c4de10a1d8dfcfe5fb503304fde0043b2498e9621177ffc5b52463cee1d39029eb5416a35815ec907da12c2d9a52fab22079428c99736a044e

  • /data/user/0/com.mean.project/kl.txt

    Filesize

    63B

    MD5

    20936f6eb88f14e7ce7ee2742abec5d4

    SHA1

    38f8706f36cc4b9e93ca1e1477c2d41e2fe07be4

    SHA256

    ba73f8cf8f005419ecf2e45585bb81ff1cc4fb8e708062641690de62d521959c

    SHA512

    a68a235d4efe0888bf6c6de7c07befabece6c5e98f5e9a856d705a28b8f92fc1c80beff073818586d336ad7fd593441e03edea496228c886c91f1eab86a1e57c