Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

10

Static

static

6

4358edc598...13.apk

android-9-x86

10

4358edc598...13.apk

android-10-x64

10

Analysis

  • max time kernel
    140s
  • max time network
    178s
  • platform
    android-9_x86
  • resource
    android-x86-arm-20240910-en
  • resource tags

    arch:armarch:x86image:android-x86-arm-20240910-enlocale:en-usos:android-9-x86system
  • submitted
    08/02/2025, 22:00

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    4358edc598f1ddb4c7edacd6b178a3119815632add843296da11613bc6e61513.apk

  • Size

    2.6MB

  • MD5

    e564311338b61624ccfdcdd29f08d735

  • SHA1

    09a1ca65bd31de4278fa5f0b7f6d6cd22b1aeca4

  • SHA256

    4358edc598f1ddb4c7edacd6b178a3119815632add843296da11613bc6e61513

  • SHA512

    8e78309013cb6f27f6144814f98cc77e9bdb73355a52218d19e4c8da352e7585f6ce2aad1f0c780acd998a00cc08bfa3e466efef341d79c856e712719cbafbf1

  • SSDEEP

    49152:EiUNm79lPgnF0GalO119G1XsmGftDTTe/xC7NhV8L6O7jx3RWYR/H9ZmnkvqJiuu:EiUNIaF0jggODft/TKxmT8vjxx63Jftk

Score
10/10
octobankercollectioncredential_accessdefense_evasiondiscoveryevasionimpactinfostealerpersistenceratstealthtrojan

Malware Config

Extracted

Family

octo

C2

https://kuscanbilgipaylasimi.xyz/MzhiMTg0NTAwOTY5S/

https://kuscanyasamrehberi.xyz/MzhiMTg0NTAwOTY5S/

https://kuscangozlemnotlari.xyz/MzhiMTg0NTAwOTY5S/

https://kuscanvetabiatdostlugu.xyz/MzhiMTg0NTAwOTY5S/

https://kuscanfotografsanati.xyz/MzhiMTg0NTAwOTY5S/

https://kuscanhikayelerkulubu.xyz/MzhiMTg0NTAwOTY5S/

https://kuscanbakimvesaglik.xyz/MzhiMTg0NTAwOTY5S/

https://kuscanhobiaktiviteleri.xyz/MzhiMTg0NTAwOTY5S/

https://kuscanvedogalhabitat.xyz/MzhiMTg0NTAwOTY5S/

https://kuscanbeslenmebilgisi.xyz/MzhiMTg0NTAwOTY5S/

https://kuscancografikeziler.xyz/MzhiMTg0NTAwOTY5S/

https://kuscanlarveozelbakim.xyz/MzhiMTg0NTAwOTY5S/

https://kuscansevenlerplatformu.xyz/MzhiMTg0NTAwOTY5S/

https://kuscanegitimvedanisman.xyz/MzhiMTg0NTAwOTY5S/

https://kuscanturleriarastirma.xyz/MzhiMTg0NTAwOTY5S/

https://kuscanlarincennetbahcesi.xyz/MzhiMTg0NTAwOTY5S/

https://kuscanvedogayakasayolu.xyz/MzhiMTg0NTAwOTY5S/

https://kuscanlarinhikayeleridunyasi.xyz/MzhiMTg0NTAwOTY5S/

https://kuscanlarvesanatbaglantisi.xyz/MzhiMTg0NTAwOTY5S/

https://kuscanvedogaldenge.xyz/MzhiMTg0NTAwOTY5S/
rc4.plain

Extracted

Family

octo

C2

https://kuscanbilgipaylasimi.xyz/MzhiMTg0NTAwOTY5S/

https://kuscanyasamrehberi.xyz/MzhiMTg0NTAwOTY5S/

https://kuscangozlemnotlari.xyz/MzhiMTg0NTAwOTY5S/

https://kuscanvetabiatdostlugu.xyz/MzhiMTg0NTAwOTY5S/

https://kuscanfotografsanati.xyz/MzhiMTg0NTAwOTY5S/

https://kuscanhikayelerkulubu.xyz/MzhiMTg0NTAwOTY5S/

https://kuscanbakimvesaglik.xyz/MzhiMTg0NTAwOTY5S/

https://kuscanhobiaktiviteleri.xyz/MzhiMTg0NTAwOTY5S/

https://kuscanvedogalhabitat.xyz/MzhiMTg0NTAwOTY5S/

https://kuscanbeslenmebilgisi.xyz/MzhiMTg0NTAwOTY5S/

https://kuscancografikeziler.xyz/MzhiMTg0NTAwOTY5S/

https://kuscanlarveozelbakim.xyz/MzhiMTg0NTAwOTY5S/

https://kuscansevenlerplatformu.xyz/MzhiMTg0NTAwOTY5S/

https://kuscanegitimvedanisman.xyz/MzhiMTg0NTAwOTY5S/

https://kuscanturleriarastirma.xyz/MzhiMTg0NTAwOTY5S/

https://kuscanlarincennetbahcesi.xyz/MzhiMTg0NTAwOTY5S/

https://kuscanvedogayakasayolu.xyz/MzhiMTg0NTAwOTY5S/

https://kuscanlarinhikayeleridunyasi.xyz/MzhiMTg0NTAwOTY5S/

https://kuscanlarvesanatbaglantisi.xyz/MzhiMTg0NTAwOTY5S/

https://kuscanvedogaldenge.xyz/MzhiMTg0NTAwOTY5S/
Attributes
  • target_apps

    at.spardat.bcrmobile

    at.spardat.netbanking

    com.bankaustria.android.olb

    com.bmo.mobile

    com.cibc.android.mobi

    com.rbc.mobile.android

    com.scotiabank.mobile

    com.td

    cz.airbank.android

    eu.inmite.prj.kb.mobilbank

    com.bankinter.launcher

    com.kutxabank.android

    com.rsi

    com.tecnocom.cajalaboral

    es.bancopopular.nbmpopular

    es.evobanco.bancamovil

    es.lacaixa.mobile.android.newwapicon

    com.dbs.hk.dbsmbanking

    com.FubonMobileClient

    com.hangseng.rbmobile

    com.MobileTreeApp

    com.mtel.androidbea

    com.scb.breezebanking.hk

    hk.com.hsbc.hsbchkmobilebanking

    com.aff.otpdirekt

    com.ideomobile.hapoalim

    com.infrasofttech.indianBank

    com.mobikwik_new

    com.oxigen.oxigenwallet

    jp.co.aeonbank.android.passbook

AES_key

Signatures

  • Octo

    Octo is a banking malware with remote access capabilities first seen in April 2022.

    bankertrojaninfostealerratocto
  • Octo family
    octo
  • Octo payload 2 IoCs
  • Removes its main activity from the application launcher 1 TTPs 1 IoCs
    stealthtrojanevasion
  • Loads dropped Dex/Jar 1 TTPs 2 IoCs

    Runs executable file dropped to the device during analysis.

    evasion
  • Makes use of the framework's Accessibility service 4 TTPs 2 IoCs

    Retrieves information displayed on the phone screen using AccessibilityService.

    collectiondefense_evasioncredential_access
  • Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
    bankerdiscovery
  • Queries the phone number (MSISDN for GSM devices) 1 TTPs
    discovery
  • Acquires the wake lock 1 IoCs
  • Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs

    Application may abuse the framework's foreground service to continue running in the foreground.

    defense_evasionpersistence
  • Performs UI accessibility actions on behalf of the user 1 TTPs 4 IoCs

    Application may abuse the accessibility service to prevent their removal.

    evasion
  • Queries the mobile country code (MCC) 1 TTPs 1 IoCs
    discovery
  • Queries the unique device ID (IMEI, MEID, IMSI) 1 TTPs
    discovery
  • Reads information about phone network operator. 1 TTPs
    discovery
  • Requests accessing notifications (often used to intercept notifications before users become aware). 1 TTPs 1 IoCs
    collectioncredential_access
  • Requests disabling of battery optimizations (often used to enable hiding in the background). 1 TTPs 1 IoCs
    defense_evasion
  • Requests modifying system settings. 1 IoCs
    defense_evasion
  • Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs
    persistence
  • Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs
    impact

Processes

  • com.hair.promote
    1⤵
    • Removes its main activity from the application launcher
    • Loads dropped Dex/Jar
    • Makes use of the framework's Accessibility service
    • Acquires the wake lock
    • Makes use of the framework's foreground persistence service
    • Performs UI accessibility actions on behalf of the user
    • Queries the mobile country code (MCC)
    • Requests accessing notifications (often used to intercept notifications before users become aware).
    • Requests disabling of battery optimizations (often used to enable hiding in the background).
    • Requests modifying system settings.
    • Registers a broadcast receiver at runtime (usually for listening for system events)
    • Uses Crypto APIs (Might try to encrypt user data)
    PID:4337
    • /system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.hair.promote/app_eyebrow/bGMQH.json --output-vdex-fd=41 --oat-fd=42 --oat-location=/data/user/0/com.hair.promote/app_eyebrow/oat/x86/bGMQH.odex --compiler-filter=quicken --class-loader-context=&
      2⤵
      • Loads dropped Dex/Jar
      PID:4361

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Event Triggered Execution

1
T1624

Broadcast Receivers

1
T1624.001

Foreground Persistence

1
T1541

Privilege Escalation

Defense Evasion

Download New Code at Runtime

1
T1407

Foreground Persistence

1
T1541

Hide Artifacts

2
T1628

Suppress Application Icon

1
T1628.001

User Evasion

1
T1628.002

Impair Defenses

1
T1629

Prevent Application Removal

1
T1629.001

Input Injection

1
T1516

Credential Access

Access Notifications

1
T1517

Input Capture

2
T1417

GUI Input Capture

1
T1417.002

Keylogging

1
T1417.001

Discovery

Software Discovery

1
T1418

Security Software Discovery

1
T1418.001

System Network Configuration Discovery

4
T1422

Lateral Movement

Collection

Access Notifications

1
T1517

Input Capture

2
T1417

GUI Input Capture

1
T1417.002

Keylogging

1
T1417.001

Screen Capture

1
T1513

Command and Control

Exfiltration

Impact

Data Encrypted for Impact

1
T1471

Input Injection

1
T1516

Replay Monitor

Loading Replay Monitor...

Downloads

  • /data/data/com.hair.promote/.qcom.hair.promote
    Filesize

    48B

    MD5

    046a414913add6f5bb60072c7db819b6

    SHA1

    451ee4f6809260aec622d772fd329c7d0297a842

    SHA256

    b66c1320cb063a1d391c94273572ea6edae76c8c8b0a07f8d75c88686f0df72a

    SHA512

    4e6355f3051ed5e811ab030abde1f5be7f5e1cf33be99cd08477e9b6c015deb1d8bd75a09fb9c7176b8511c5ad0a67abc0902a3531e97564ccb6afc57496a47c

    Download Submit

  • /data/data/com.hair.promote/app_eyebrow/bGMQH.json
    Filesize

    153KB

    MD5

    ce851a54391eda2d31b205bdac6dbe7b

    SHA1

    34f333d4bddbc742fb1f0e88c534aa90f6b1de3c

    SHA256

    6ec7214eb1815cf78bdaed058e4965a5e07f22e064790ccf85b904eee1401a9c

    SHA512

    b4f9926bb587f59ff2fb5a2bc996d449ce2cf410ec6e37365ca0cddfd66129a32655aa8f6ab937f807b64eb8c3a9f5a015b86609527ab0e0a128dcd9369d77e3

    Download Submit

  • /data/data/com.hair.promote/app_eyebrow/bGMQH.json
    Filesize

    153KB

    MD5

    a23bedc9bf7e474beea2f7ced419a090

    SHA1

    9cdce6d7cefc9dbcda7e0485e231f28c5f542541

    SHA256

    2abaca9d8d0c8434d69b63c4465ffe268349ea47717d052c0f7b21d544701c56

    SHA512

    148c4b82a4a5121ba4caacdcb160435f851d9931a075ce717b31fd1839f12c5edf1933eb8debf55ceb8e5f2c43933ff6c2f6cfbfe183d9094396db916c4a7d70

    Download Submit

  • /data/data/com.hair.promote/kl.txt
    Filesize

    45B

    MD5

    0dbf576199037db051e1cea4ad07bc3c

    SHA1

    2970244a9eb168bbee2593aa957401f16b438eb0

    SHA256

    1f64152a2a893c55abce63839307b9c35f600ae6f74bbfe439bc040b79b3d734

    SHA512

    d6fd93b5c0e2334063a0f030c2700354f59bab5f6923a7db977a530f5de0ad464a4779aa2be816a1772c6661904b23f5c0c9c3f2f63d33ab82efdb8839b85589

    Download Submit

  • /data/data/com.hair.promote/kl.txt
    Filesize

    423B

    MD5

    97677fbbc9ef748173512d951d1aa0d4

    SHA1

    e940f16f7c7bce93fae76139dba5d25b57360ffc

    SHA256

    65d45671338cdf912679858b267615b699ff06af91cb2bc741addbd5ee411ec4

    SHA512

    76ceb780139b2b4bbb2bf407b7fbf59bfeb0a23159f264b00957cadec2690e94e5e8bf24ab84f136062204dd5bd4cf277709242ef6e1340deafddd0d3399fcf5

    Download Submit

  • /data/data/com.hair.promote/kl.txt
    Filesize

    230B

    MD5

    e778cb54d4474aac6b0fad1f04ed7036

    SHA1

    07642c868ff091f05a6ab5f2ea6f1dd14a488c71

    SHA256

    752b0db84322695b6279f56c004982c1e2ed11a1afd8f3ab5f2c22d775e801cc

    SHA512

    05f6e6ae5b3971f37ab3df3faf64a8e6245082ac3a8410f2bd797dc46baf0d3443234bad5a624e40f216d8b863289ab0fd5f665303f43b5b3a05781d3bc7a2f6

    Download Submit

  • /data/data/com.hair.promote/kl.txt
    Filesize

    54B

    MD5

    2c8d79573f8824c0dade167140fb5145

    SHA1

    069ea94fe6904e3af692040d3057b450b0f19e1d

    SHA256

    34ce17ceac05f13b0539e9a25b0d6e743467f780af9d1ed2ce44c4c385fa4332

    SHA512

    8888df29021cd6bb6279249e31df6943c9a822683d63a367484b036b3aa537a6a5ae57936a2ce34115c2f1861fa32c1850799f5f59aa5958ca77a4643aac1bcb

    Download Submit

  • /data/data/com.hair.promote/kl.txt
    Filesize

    63B

    MD5

    b1980ffe7e1370fa8b873be98d7e091a

    SHA1

    84c2c2b1ef8c6cdcd63ffe1a1a6ad7b5e388accb

    SHA256

    336fd6a528f5bec8bbb5b03b49fc7b26d9523b9d4a4fd739f58008a500809b17

    SHA512

    2f25c7a124ba59e248ced2f70beee0fdfd9edfbc2d808ab81dcb38ac1efc92012b2eee9373fae9a994503a53cbfe911a71ee9342739e7bc6725c273d1e7de6d4

    Download Submit

  • /data/user/0/com.hair.promote/app_eyebrow/bGMQH.json
    Filesize

    451KB

    MD5

    25c47dec02fb8231e4e58066e3c56829

    SHA1

    2f8ed9bfc18d95f21dd3e586760827ede136f7b6

    SHA256

    f0a52bc3982e3339d22284ceebc66ce90ca19dcbe5c009467d1c22edd1e2c02b

    SHA512

    f04e03875a2cccf8ca968ad4715ffc7f796da2b918175eee907e32d7a115b5227bb957488b382449b325344b0fa8d27fef097a90d974c8e241084c847d7a601d

    Download Submit

  • /data/user/0/com.hair.promote/app_eyebrow/bGMQH.json
    Filesize

    451KB

    MD5

    2e6af80e0b6427818bc7f9f5899a0fcf

    SHA1

    23b5448383dafec308f07199fa0084f383fcd286

    SHA256

    46f11fcef1b5f70365345d583e0a89e1a2fd8071058f1a9c14f459f081cbdae4

    SHA512

    188a2b1a984cb3bfad4c64770adcdb772d749e07eb558995013dae2eefa5bc71d4ec8e3478eec4441c16668d7bd8083c84a974b14c7a0e282422e9490fb40a26

    Download Submit