Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    148s
  • max time network
    151s
  • platform
    android-10_x64
  • resource
    android-x64-20240910-en
  • resource tags

    arch:x64arch:x86image:android-x64-20240910-enlocale:en-usos:android-10-x64system
  • submitted
    07/02/2025, 22:01

General

  • Target

    9fb57ff626667b92accc465f22870a72969594f76302a31ae89c9379c657a9f8.apk

  • Size

    1.6MB

  • MD5

    99d1270e206c3a023415337326cacea8

  • SHA1

    6b81d487404150660671f1464304a1026b314a25

  • SHA256

    9fb57ff626667b92accc465f22870a72969594f76302a31ae89c9379c657a9f8

  • SHA512

    350709143c15da0a41cac7573ab79c56b7c3dd3f0c59efca8a402b5fed7d42430636e8aff40ee12591fe2190710966ab77da13f90eedde549f41e2733776b915

  • SSDEEP

    49152:pDTPcSovBHbC9p4BBXQR8zRH44WHJgs00uyZVBBK9H1:pDTPfo5HbDSREGrJgs3uIPBI1

Malware Config

Extracted

Family

octo

C2

https://otomatikbahcesulamasistemi.xyz/fHTKmZhmwRmq/

https://tarimsalverimsulamayontemi.xyz/fHTKmZhmwRmq/

https://damlamasulamateknolojileri.xyz/fHTKmZhmwRmq/

https://akillitarimsulamasistemleri.xyz/fHTKmZhmwRmq/

https://modernciftliksulamayontemi.xyz/fHTKmZhmwRmq/

https://verimlisulamataktikveyontem.xyz/fHTKmZhmwRmq/

https://tarlaotomatiksulamasistemleri.xyz/fHTKmZhmwRmq/

https://bahceveseraotomasyonsulama.xyz/fHTKmZhmwRmq/

https://sudepolamaveverimsulama.xyz/fHTKmZhmwRmq/

https://bitkisulamastratejiler.xyz/fHTKmZhmwRmq/

https://sebzesulamasistemcozumleri.xyz/fHTKmZhmwRmq/

https://akillibahcesulamauretimi.xyz/fHTKmZhmwRmq/

https://gelenekseltarimsulamamodeli.xyz/fHTKmZhmwRmq/

https://sulamaekipmanlariurunleri.xyz/fHTKmZhmwRmq/

https://akillidamlamaotomasyonsistemi.xyz/fHTKmZhmwRmq/

https://pratikverimlibitkisulama.xyz/fHTKmZhmwRmq/

https://topraksizserasulamasistemi.xyz/fHTKmZhmwRmq/

https://otomatiksektorelbitkisulama.xyz/fHTKmZhmwRmq/

https://verimlitarlavemodernsulama.xyz/fHTKmZhmwRmq/

https://bitkisagliginagoresulama.xyz/fHTKmZhmwRmq/

rc4.plain

Extracted

Family

octo

C2

https://otomatikbahcesulamasistemi.xyz/fHTKmZhmwRmq/

https://tarimsalverimsulamayontemi.xyz/fHTKmZhmwRmq/

https://damlamasulamateknolojileri.xyz/fHTKmZhmwRmq/

https://akillitarimsulamasistemleri.xyz/fHTKmZhmwRmq/

https://modernciftliksulamayontemi.xyz/fHTKmZhmwRmq/

https://verimlisulamataktikveyontem.xyz/fHTKmZhmwRmq/

https://tarlaotomatiksulamasistemleri.xyz/fHTKmZhmwRmq/

https://bahceveseraotomasyonsulama.xyz/fHTKmZhmwRmq/

https://sudepolamaveverimsulama.xyz/fHTKmZhmwRmq/

https://bitkisulamastratejiler.xyz/fHTKmZhmwRmq/

https://sebzesulamasistemcozumleri.xyz/fHTKmZhmwRmq/

https://akillibahcesulamauretimi.xyz/fHTKmZhmwRmq/

https://gelenekseltarimsulamamodeli.xyz/fHTKmZhmwRmq/

https://sulamaekipmanlariurunleri.xyz/fHTKmZhmwRmq/

https://akillidamlamaotomasyonsistemi.xyz/fHTKmZhmwRmq/

https://pratikverimlibitkisulama.xyz/fHTKmZhmwRmq/

https://topraksizserasulamasistemi.xyz/fHTKmZhmwRmq/

https://otomatiksektorelbitkisulama.xyz/fHTKmZhmwRmq/

https://verimlitarlavemodernsulama.xyz/fHTKmZhmwRmq/

https://bitkisagliginagoresulama.xyz/fHTKmZhmwRmq/

Attributes
  • target_apps

    at.spardat.bcrmobile

    at.spardat.netbanking

    com.bankaustria.android.olb

    com.bmo.mobile

    com.cibc.android.mobi

    com.rbc.mobile.android

    com.scotiabank.mobile

    com.td

    cz.airbank.android

    eu.inmite.prj.kb.mobilbank

    com.bankinter.launcher

    com.kutxabank.android

    com.rsi

    com.tecnocom.cajalaboral

    es.bancopopular.nbmpopular

    es.evobanco.bancamovil

    es.lacaixa.mobile.android.newwapicon

    com.dbs.hk.dbsmbanking

    com.FubonMobileClient

    com.hangseng.rbmobile

    com.MobileTreeApp

    com.mtel.androidbea

    com.scb.breezebanking.hk

    hk.com.hsbc.hsbchkmobilebanking

    com.aff.otpdirekt

    com.ideomobile.hapoalim

    com.infrasofttech.indianBank

    com.mobikwik_new

    com.oxigen.oxigenwallet

    jp.co.aeonbank.android.passbook

AES_key

Signatures

  • Octo

    Octo is a banking malware with remote access capabilities first seen in April 2022.

  • Octo family
  • Octo payload 1 IoCs
  • Loads dropped Dex/Jar 1 TTPs 1 IoCs

    Runs executable file dropped to the device during analysis.

  • Makes use of the framework's Accessibility service 4 TTPs 2 IoCs

    Retrieves information displayed on the phone screen using AccessibilityService.

  • Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
  • Queries the phone number (MSISDN for GSM devices) 1 TTPs
  • Acquires the wake lock 1 IoCs
  • Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs

    Application may abuse the framework's foreground service to continue running in the foreground.

  • Performs UI accessibility actions on behalf of the user 1 TTPs 4 IoCs

    Application may abuse the accessibility service to prevent their removal.

  • Queries the mobile country code (MCC) 1 TTPs 1 IoCs
  • Reads information about phone network operator. 1 TTPs
  • Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs
  • Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs

Processes

  • com.amused.mail
    1⤵
    • Loads dropped Dex/Jar
    • Makes use of the framework's Accessibility service
    • Acquires the wake lock
    • Makes use of the framework's foreground persistence service
    • Performs UI accessibility actions on behalf of the user
    • Queries the mobile country code (MCC)
    • Registers a broadcast receiver at runtime (usually for listening for system events)
    • Uses Crypto APIs (Might try to encrypt user data)
    PID:5102

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • /data/data/com.amused.mail/.qcom.amused.mail

    Filesize

    48B

    MD5

    046a414913add6f5bb60072c7db819b6

    SHA1

    451ee4f6809260aec622d772fd329c7d0297a842

    SHA256

    b66c1320cb063a1d391c94273572ea6edae76c8c8b0a07f8d75c88686f0df72a

    SHA512

    4e6355f3051ed5e811ab030abde1f5be7f5e1cf33be99cd08477e9b6c015deb1d8bd75a09fb9c7176b8511c5ad0a67abc0902a3531e97564ccb6afc57496a47c

  • /data/data/com.amused.mail/app_ugly/fgQqsU.json

    Filesize

    153KB

    MD5

    b575c2ac7d48f6c71b1cd25689fd7b55

    SHA1

    f123d3f867d3c034ac42334298300d2724067bf2

    SHA256

    f04d27c40975c92acf3dc3fa4c59d5a7e1f8526606a6a13cfd0a9146cfe7cdca

    SHA512

    b710f52c43ccd22e28e666ad6631aab90d9479e5a0ab37dbf48cad702b0bd907aedd3b4efe233d3d40ef2a4319969fdf0accf8b12e3bd897ecc38c146bc49fb2

  • /data/data/com.amused.mail/app_ugly/fgQqsU.json

    Filesize

    153KB

    MD5

    e179f845497ed1d5c93d2d25eef164ab

    SHA1

    2f4f8056c4d824f7c1daa91df0ab24053823dea9

    SHA256

    815031a8b091bc4fbb9d708a589df9b951bfe53116a65c6ddbc09658613e1def

    SHA512

    8a0ad4aadf5096837bd868221440c61cd32522f5c22708f5deb09bd72124f13a8b0deae48eb1d4d8c22fb2494ba639b49468fe135e17dfcd4d241c8808e60592

  • /data/data/com.amused.mail/kl.txt

    Filesize

    230B

    MD5

    77dae2c9199cf44d61d4c144c05fe9ba

    SHA1

    e0eb549a12bb80547fd5f8207a127c447a37d1c0

    SHA256

    b7c86e4b539e60def1ad3cea40e1f891a37883cd67f7db3fcd834091bc43a284

    SHA512

    07c8cf3743e5cf7c3a1717e42c4b1a5bf5d155be338556600550215c132cbd1f61c5faaee44e1f911e55c5689482b0fe91f1e98b59736b87d70ba26d83b12b27

  • /data/data/com.amused.mail/kl.txt

    Filesize

    54B

    MD5

    f88dba520fe93049eb5331cd2515b54d

    SHA1

    7febd9852c6962d6f03745359afc9a40eefb0e57

    SHA256

    479ca2237a5e942564cde16dd3725e7fe510bec7f10010b45838bc3630449315

    SHA512

    8e07acfb0d4dc8c47ad03e763d461376f09cd1fe728fa665672b961ece79911dd6259c937a8d12db556eeb02a47534c0490b5a43c753a4a998d70acb921d3a2d

  • /data/data/com.amused.mail/kl.txt

    Filesize

    63B

    MD5

    4774cc089d56f3a4a77d6edf7cca04eb

    SHA1

    3ccc578486e88271c852d920c960c83f69ac91c9

    SHA256

    9b57c032ad384c85ac659d66a926ea55dfb1bab8172317aaaea600d6cc33a99f

    SHA512

    02875557d24b932a8d84b3922e951b5ab9b8812169ef8ab43907ad4131b33f20569296392ba99a30e2030252b94de2ecb47e54ebf5f55fb12df56faac25baccb

  • /data/data/com.amused.mail/kl.txt

    Filesize

    45B

    MD5

    e0f86a491b64f86e523b6abcea06ee81

    SHA1

    fca94657170674c86dbeef21b2e1fe6ecb99eea8

    SHA256

    45a918b4c1d6db134476bb2f579fdcfb52530523558d1a964bb84bedd6e16de9

    SHA512

    a815a573f3661d2dfa167eacd23c70ad2f9de3cd57bf544f1142aa79ba84c4b5c7b2df1d07d08af2a32477ccded3fd8d998024d086bde13ff08f0a147aef1c5d

  • /data/data/com.amused.mail/kl.txt

    Filesize

    423B

    MD5

    954f2c62ecb0cb2d026a9dc3c80cf6c2

    SHA1

    62d176e486ee6fbad24850090a974ff245d5a908

    SHA256

    02823043eaede33fcd86cb0b0c96bfaa2eb051e88b6db83434a34ae85b98e7af

    SHA512

    676f8d0eaa8a2f60dfbc471cbfc304b9718f03d1f715871307d883209623051ad30b40b3d5ad4804a9f8f5ffdf8d79e75e1e64db5fc12be5479d06d7d12365ea

  • /data/user/0/com.amused.mail/app_ugly/fgQqsU.json

    Filesize

    450KB

    MD5

    360395e822e221e403b451126b831b3a

    SHA1

    586fba5f8f3f354ebb536c0832dfa0aa259a688b

    SHA256

    e23fda9471302b84d9a07120f987a34a119eac9f8eb05eb7b3f3164dd1da468b

    SHA512

    6807df1c05c0d6faff63711484349be3f645a65de5bdef6ac47d92ffa489999687b2bfb91cfd0efc5efa2b5c990b19d127e797f00544f7faafd59b82de58c9c2