Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    5s
  • max time network
    153s
  • platform
    android_x64
  • resource
    android-33-x64-arm64-20240624-en
  • resource tags

    androidarch:arm64arch:x64image:android-33-x64-arm64-20240624-enlocale:en-usos:android-13-x64system
  • submitted
    07/02/2025, 22:03

General

  • Target

    7acfbc2fffd7d395aed93b41aae87a89104139a38ce25b5bb7e1cb5d52e23aea.apk

  • Size

    2.6MB

  • MD5

    6d7a5aa85283a8917a1f078a251e49be

  • SHA1

    d06c76725b27b1620ccf9593385f2becf7bd1b9a

  • SHA256

    7acfbc2fffd7d395aed93b41aae87a89104139a38ce25b5bb7e1cb5d52e23aea

  • SHA512

    203daab8c47fe60b6027b0a0844ec43c14e11f877cbacaa63c73e75086d69e481f91a792ea6c77197d870df2d3072a7dcdf5224be50d3fddd5a5fc699947f786

  • SSDEEP

    49152:UYSVe+T/k7p3lMETzZN/3rZz3MsQh4MrFr7ZEqzf/1MdAVbrXp5LWHO9+gPZXbB2:C1Tk7sEPZtdzOeuF3CqzVrrXp56u9tP6

Malware Config

Extracted

Family

octo

C2

https://kendimarkam.com/MWRlOTUyYjExM2Ew/

https://sporakademi4734/MWRlOTUyYjExM2Ew/

https://spormalzemeleri3414.com/MWRlOTUyYjExM2Ew/

https://malzemealmalisn552.com/MWRlOTUyYjExM2Ew/

https://designweb3413.com/MWRlOTUyYjExM2Ew/

rc4.plain

Signatures

  • Octo

    Octo is a banking malware with remote access capabilities first seen in April 2022.

  • Octo family
  • Octo payload 1 IoCs
  • Loads dropped Dex/Jar 1 TTPs 1 IoCs

    Runs executable file dropped to the device during analysis.

Processes

  • com.mountainforceiqiu
    1⤵
    • Loads dropped Dex/Jar
    PID:4301

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • /data/data/com.mountainforceiqiu/cache/mpuphxihtzff

    Filesize

    2.5MB

    MD5

    ba9ac1183aa80dafc28b47bea6f40966

    SHA1

    a9d03182a7fabd1c58df581b67bcfac05aff5081

    SHA256

    39a805f6d31a426aeeb64891b5408cc5792e345cddb0057b6e9a2edc41d701f1

    SHA512

    0afb8e145bc6ec7e60dd46ddfc28bf7bec345e9eddb28c1db239bf47915dcba85f3d4ab6317797b87b2eba3a91d48c7c6dfd3c8ac13c5cb13b1c5b1b481282b6