Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    144s
  • max time network
    154s
  • platform
    android_x64
  • resource
    android-x64-20240624-en
  • resource tags

    androidarch:x64arch:x86image:android-x64-20240624-enlocale:en-usos:android-10-x64system
  • submitted
    08/02/2025, 22:00

General

  • Target

    4358edc598f1ddb4c7edacd6b178a3119815632add843296da11613bc6e61513.apk

  • Size

    2.6MB

  • MD5

    e564311338b61624ccfdcdd29f08d735

  • SHA1

    09a1ca65bd31de4278fa5f0b7f6d6cd22b1aeca4

  • SHA256

    4358edc598f1ddb4c7edacd6b178a3119815632add843296da11613bc6e61513

  • SHA512

    8e78309013cb6f27f6144814f98cc77e9bdb73355a52218d19e4c8da352e7585f6ce2aad1f0c780acd998a00cc08bfa3e466efef341d79c856e712719cbafbf1

  • SSDEEP

    49152:EiUNm79lPgnF0GalO119G1XsmGftDTTe/xC7NhV8L6O7jx3RWYR/H9ZmnkvqJiuu:EiUNIaF0jggODft/TKxmT8vjxx63Jftk

Malware Config

Extracted

Family

octo

C2

https://kuscanbilgipaylasimi.xyz/MzhiMTg0NTAwOTY5S/

https://kuscanyasamrehberi.xyz/MzhiMTg0NTAwOTY5S/

https://kuscangozlemnotlari.xyz/MzhiMTg0NTAwOTY5S/

https://kuscanvetabiatdostlugu.xyz/MzhiMTg0NTAwOTY5S/

https://kuscanfotografsanati.xyz/MzhiMTg0NTAwOTY5S/

https://kuscanhikayelerkulubu.xyz/MzhiMTg0NTAwOTY5S/

https://kuscanbakimvesaglik.xyz/MzhiMTg0NTAwOTY5S/

https://kuscanhobiaktiviteleri.xyz/MzhiMTg0NTAwOTY5S/

https://kuscanvedogalhabitat.xyz/MzhiMTg0NTAwOTY5S/

https://kuscanbeslenmebilgisi.xyz/MzhiMTg0NTAwOTY5S/

https://kuscancografikeziler.xyz/MzhiMTg0NTAwOTY5S/

https://kuscanlarveozelbakim.xyz/MzhiMTg0NTAwOTY5S/

https://kuscansevenlerplatformu.xyz/MzhiMTg0NTAwOTY5S/

https://kuscanegitimvedanisman.xyz/MzhiMTg0NTAwOTY5S/

https://kuscanturleriarastirma.xyz/MzhiMTg0NTAwOTY5S/

https://kuscanlarincennetbahcesi.xyz/MzhiMTg0NTAwOTY5S/

https://kuscanvedogayakasayolu.xyz/MzhiMTg0NTAwOTY5S/

https://kuscanlarinhikayeleridunyasi.xyz/MzhiMTg0NTAwOTY5S/

https://kuscanlarvesanatbaglantisi.xyz/MzhiMTg0NTAwOTY5S/

https://kuscanvedogaldenge.xyz/MzhiMTg0NTAwOTY5S/

rc4.plain

Extracted

Family

octo

C2

https://kuscanbilgipaylasimi.xyz/MzhiMTg0NTAwOTY5S/

https://kuscanyasamrehberi.xyz/MzhiMTg0NTAwOTY5S/

https://kuscangozlemnotlari.xyz/MzhiMTg0NTAwOTY5S/

https://kuscanvetabiatdostlugu.xyz/MzhiMTg0NTAwOTY5S/

https://kuscanfotografsanati.xyz/MzhiMTg0NTAwOTY5S/

https://kuscanhikayelerkulubu.xyz/MzhiMTg0NTAwOTY5S/

https://kuscanbakimvesaglik.xyz/MzhiMTg0NTAwOTY5S/

https://kuscanhobiaktiviteleri.xyz/MzhiMTg0NTAwOTY5S/

https://kuscanvedogalhabitat.xyz/MzhiMTg0NTAwOTY5S/

https://kuscanbeslenmebilgisi.xyz/MzhiMTg0NTAwOTY5S/

https://kuscancografikeziler.xyz/MzhiMTg0NTAwOTY5S/

https://kuscanlarveozelbakim.xyz/MzhiMTg0NTAwOTY5S/

https://kuscansevenlerplatformu.xyz/MzhiMTg0NTAwOTY5S/

https://kuscanegitimvedanisman.xyz/MzhiMTg0NTAwOTY5S/

https://kuscanturleriarastirma.xyz/MzhiMTg0NTAwOTY5S/

https://kuscanlarincennetbahcesi.xyz/MzhiMTg0NTAwOTY5S/

https://kuscanvedogayakasayolu.xyz/MzhiMTg0NTAwOTY5S/

https://kuscanlarinhikayeleridunyasi.xyz/MzhiMTg0NTAwOTY5S/

https://kuscanlarvesanatbaglantisi.xyz/MzhiMTg0NTAwOTY5S/

https://kuscanvedogaldenge.xyz/MzhiMTg0NTAwOTY5S/

Attributes
  • target_apps

    at.spardat.bcrmobile

    at.spardat.netbanking

    com.bankaustria.android.olb

    com.bmo.mobile

    com.cibc.android.mobi

    com.rbc.mobile.android

    com.scotiabank.mobile

    com.td

    cz.airbank.android

    eu.inmite.prj.kb.mobilbank

    com.bankinter.launcher

    com.kutxabank.android

    com.rsi

    com.tecnocom.cajalaboral

    es.bancopopular.nbmpopular

    es.evobanco.bancamovil

    es.lacaixa.mobile.android.newwapicon

    com.dbs.hk.dbsmbanking

    com.FubonMobileClient

    com.hangseng.rbmobile

    com.MobileTreeApp

    com.mtel.androidbea

    com.scb.breezebanking.hk

    hk.com.hsbc.hsbchkmobilebanking

    com.aff.otpdirekt

    com.ideomobile.hapoalim

    com.infrasofttech.indianBank

    com.mobikwik_new

    com.oxigen.oxigenwallet

    jp.co.aeonbank.android.passbook

AES_key

Signatures

  • Octo

    Octo is a banking malware with remote access capabilities first seen in April 2022.

  • Octo family
  • Octo payload 1 IoCs
  • Loads dropped Dex/Jar 1 TTPs 1 IoCs

    Runs executable file dropped to the device during analysis.

  • Makes use of the framework's Accessibility service 4 TTPs 2 IoCs

    Retrieves information displayed on the phone screen using AccessibilityService.

  • Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
  • Queries the phone number (MSISDN for GSM devices) 1 TTPs
  • Acquires the wake lock 1 IoCs
  • Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs

    Application may abuse the framework's foreground service to continue running in the foreground.

  • Performs UI accessibility actions on behalf of the user 1 TTPs 4 IoCs

    Application may abuse the accessibility service to prevent their removal.

  • Queries the mobile country code (MCC) 1 TTPs 1 IoCs
  • Reads information about phone network operator. 1 TTPs
  • Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs
  • Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs

Processes

  • com.hair.promote
    1⤵
    • Loads dropped Dex/Jar
    • Makes use of the framework's Accessibility service
    • Acquires the wake lock
    • Makes use of the framework's foreground persistence service
    • Performs UI accessibility actions on behalf of the user
    • Queries the mobile country code (MCC)
    • Registers a broadcast receiver at runtime (usually for listening for system events)
    • Uses Crypto APIs (Might try to encrypt user data)
    PID:4948

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • /data/data/com.hair.promote/.qcom.hair.promote

    Filesize

    48B

    MD5

    046a414913add6f5bb60072c7db819b6

    SHA1

    451ee4f6809260aec622d772fd329c7d0297a842

    SHA256

    b66c1320cb063a1d391c94273572ea6edae76c8c8b0a07f8d75c88686f0df72a

    SHA512

    4e6355f3051ed5e811ab030abde1f5be7f5e1cf33be99cd08477e9b6c015deb1d8bd75a09fb9c7176b8511c5ad0a67abc0902a3531e97564ccb6afc57496a47c

  • /data/data/com.hair.promote/app_eyebrow/bGMQH.json

    Filesize

    153KB

    MD5

    ce851a54391eda2d31b205bdac6dbe7b

    SHA1

    34f333d4bddbc742fb1f0e88c534aa90f6b1de3c

    SHA256

    6ec7214eb1815cf78bdaed058e4965a5e07f22e064790ccf85b904eee1401a9c

    SHA512

    b4f9926bb587f59ff2fb5a2bc996d449ce2cf410ec6e37365ca0cddfd66129a32655aa8f6ab937f807b64eb8c3a9f5a015b86609527ab0e0a128dcd9369d77e3

  • /data/data/com.hair.promote/app_eyebrow/bGMQH.json

    Filesize

    153KB

    MD5

    a23bedc9bf7e474beea2f7ced419a090

    SHA1

    9cdce6d7cefc9dbcda7e0485e231f28c5f542541

    SHA256

    2abaca9d8d0c8434d69b63c4465ffe268349ea47717d052c0f7b21d544701c56

    SHA512

    148c4b82a4a5121ba4caacdcb160435f851d9931a075ce717b31fd1839f12c5edf1933eb8debf55ceb8e5f2c43933ff6c2f6cfbfe183d9094396db916c4a7d70

  • /data/data/com.hair.promote/kl.txt

    Filesize

    230B

    MD5

    3214d3db5aaf8e166d21cdb783c39b03

    SHA1

    c6b85225e403745dfb315810ef91312f151622db

    SHA256

    5938815f4101bc599646da77128bdc74351a6d6cfa82d1acfb8e742580641cc6

    SHA512

    e2f9f81791ad6a7bb5eeccb28b4a8f993f98c1fc7f3643a487486ec19e670a506074425985ec9959998bd7617d5508ae9f9b6f45281f3a4f91dd59fbf9370c5c

  • /data/data/com.hair.promote/kl.txt

    Filesize

    45B

    MD5

    4dd0cda6d9e05e49ee90fa90917289fc

    SHA1

    17fcec85698ddfae267b24b18e947f5ecd9ea3c5

    SHA256

    73f4ef02bb86eae4e61b43efaf74d593c5e5b8f0e2dc96fa9ba17a10c8d52f02

    SHA512

    3178da7128889094b86d6ba066193ff1acbe2a079b697580ed65986b6297439adf510347a9dfea3bfb9625ee93ddf222fcba382495be824ea802b36db3f73fdd

  • /data/data/com.hair.promote/kl.txt

    Filesize

    63B

    MD5

    fde93d1e64cb8b741ee4644256a46359

    SHA1

    a8f925db56553ba0ade09cf0f11661ea08f3ef83

    SHA256

    12cb6f7a602db6dce09f94f28495c6cb09c623db115afbcb843b84136a2ab801

    SHA512

    5bc380aaa94e182e2c876a20f74cae61ed0cd19e2d51093f4ad8c154541e74c168d8d3e0a214e7c84074c9be43a2d92f5296f70a9a7e666da4881102f54eefa4

  • /data/data/com.hair.promote/kl.txt

    Filesize

    45B

    MD5

    d9695e9568e5ad04e9f8da80bf887aae

    SHA1

    8c1259af00343931fcbd21ba68c1990ffd998e32

    SHA256

    609d0d758c2e31502c66b385802a1fcf8d1c0a891ceb4aed85c65d35c17bd5ae

    SHA512

    c346e6318f297f2b65110f1e1cde3c467d2b0346493aa3ee32dbb46f6d098f9bebca8d49b909032d24151559a3c4da4b2ddad86a883d6499752a6960ec219877

  • /data/data/com.hair.promote/kl.txt

    Filesize

    423B

    MD5

    6d2f1aac8285641cbbe30119878d2e58

    SHA1

    bb66a6cb9c700788b69ebed7dd0ea6eb928d4c23

    SHA256

    ccd7812bdf3dd7f55301561cead0af56fe6e225a4b7514b7e97341c57774405f

    SHA512

    d7a00068053ffdc237b384e751946b9b0bdcc3e557206f22f32e5ab5f4087f05aacf1bad0661e072c14f6178cee5caa9f875d871147759d2eb539b792192d7c8

  • /data/user/0/com.hair.promote/app_eyebrow/bGMQH.json

    Filesize

    451KB

    MD5

    2e6af80e0b6427818bc7f9f5899a0fcf

    SHA1

    23b5448383dafec308f07199fa0084f383fcd286

    SHA256

    46f11fcef1b5f70365345d583e0a89e1a2fd8071058f1a9c14f459f081cbdae4

    SHA512

    188a2b1a984cb3bfad4c64770adcdb772d749e07eb558995013dae2eefa5bc71d4ec8e3478eec4441c16668d7bd8083c84a974b14c7a0e282422e9490fb40a26