Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    149s
  • max time network
    165s
  • platform
    android-10_x64
  • resource
    android-x64-20240910-en
  • resource tags

    arch:x64arch:x86image:android-x64-20240910-enlocale:en-usos:android-10-x64system
  • submitted
    08/02/2025, 22:00

General

  • Target

    98e4539f1f0278f4430ed4799af842b287b9adb557ca8dcc6d64f5bb7f1b8b2d.apk

  • Size

    2.0MB

  • MD5

    ec7c0e08f62c016fdc4bda1e470b3469

  • SHA1

    3b88d6dff02cb6817bc272657b0f7d2bdbe2610b

  • SHA256

    98e4539f1f0278f4430ed4799af842b287b9adb557ca8dcc6d64f5bb7f1b8b2d

  • SHA512

    4ab2e008fd073fd55c9c9030d8d8ddf0cc96718c89304be391e1f65ee689e7d93a2443067ecfc43fe95aa525245952d1e838eba00a1590244d4aa77ad536631a

  • SSDEEP

    49152:vVhN0c+BMxb0GyaV9lLqdeGyOL2wNsahq2pKAYmMYygNgM16wk5vsuKVi1ll4d:9EcQMxb0/GPGpL2ksaw2pxOogok5qSs

Malware Config

Extracted

Family

octo

C2

https://kuscanbilgipaylasimi.xyz/MzhiMTg0NTAwOTY5S/

https://kuscanyasamrehberi.xyz/MzhiMTg0NTAwOTY5S/

https://kuscangozlemnotlari.xyz/MzhiMTg0NTAwOTY5S/

https://kuscanvetabiatdostlugu.xyz/MzhiMTg0NTAwOTY5S/

https://kuscanfotografsanati.xyz/MzhiMTg0NTAwOTY5S/

https://kuscanhikayelerkulubu.xyz/MzhiMTg0NTAwOTY5S/

https://kuscanbakimvesaglik.xyz/MzhiMTg0NTAwOTY5S/

https://kuscanhobiaktiviteleri.xyz/MzhiMTg0NTAwOTY5S/

https://kuscanvedogalhabitat.xyz/MzhiMTg0NTAwOTY5S/

https://kuscanbeslenmebilgisi.xyz/MzhiMTg0NTAwOTY5S/

https://kuscancografikeziler.xyz/MzhiMTg0NTAwOTY5S/

https://kuscanlarveozelbakim.xyz/MzhiMTg0NTAwOTY5S/

https://kuscansevenlerplatformu.xyz/MzhiMTg0NTAwOTY5S/

https://kuscanegitimvedanisman.xyz/MzhiMTg0NTAwOTY5S/

https://kuscanturleriarastirma.xyz/MzhiMTg0NTAwOTY5S/

https://kuscanlarincennetbahcesi.xyz/MzhiMTg0NTAwOTY5S/

https://kuscanvedogayakasayolu.xyz/MzhiMTg0NTAwOTY5S/

https://kuscanlarinhikayeleridunyasi.xyz/MzhiMTg0NTAwOTY5S/

https://kuscanlarvesanatbaglantisi.xyz/MzhiMTg0NTAwOTY5S/

https://kuscanvedogaldenge.xyz/MzhiMTg0NTAwOTY5S/

rc4.plain

Extracted

Family

octo

C2

https://kuscanbilgipaylasimi.xyz/MzhiMTg0NTAwOTY5S/

https://kuscanyasamrehberi.xyz/MzhiMTg0NTAwOTY5S/

https://kuscangozlemnotlari.xyz/MzhiMTg0NTAwOTY5S/

https://kuscanvetabiatdostlugu.xyz/MzhiMTg0NTAwOTY5S/

https://kuscanfotografsanati.xyz/MzhiMTg0NTAwOTY5S/

https://kuscanhikayelerkulubu.xyz/MzhiMTg0NTAwOTY5S/

https://kuscanbakimvesaglik.xyz/MzhiMTg0NTAwOTY5S/

https://kuscanhobiaktiviteleri.xyz/MzhiMTg0NTAwOTY5S/

https://kuscanvedogalhabitat.xyz/MzhiMTg0NTAwOTY5S/

https://kuscanbeslenmebilgisi.xyz/MzhiMTg0NTAwOTY5S/

https://kuscancografikeziler.xyz/MzhiMTg0NTAwOTY5S/

https://kuscanlarveozelbakim.xyz/MzhiMTg0NTAwOTY5S/

https://kuscansevenlerplatformu.xyz/MzhiMTg0NTAwOTY5S/

https://kuscanegitimvedanisman.xyz/MzhiMTg0NTAwOTY5S/

https://kuscanturleriarastirma.xyz/MzhiMTg0NTAwOTY5S/

https://kuscanlarincennetbahcesi.xyz/MzhiMTg0NTAwOTY5S/

https://kuscanvedogayakasayolu.xyz/MzhiMTg0NTAwOTY5S/

https://kuscanlarinhikayeleridunyasi.xyz/MzhiMTg0NTAwOTY5S/

https://kuscanlarvesanatbaglantisi.xyz/MzhiMTg0NTAwOTY5S/

https://kuscanvedogaldenge.xyz/MzhiMTg0NTAwOTY5S/

Attributes
  • target_apps

    at.spardat.bcrmobile

    at.spardat.netbanking

    com.bankaustria.android.olb

    com.bmo.mobile

    com.cibc.android.mobi

    com.rbc.mobile.android

    com.scotiabank.mobile

    com.td

    cz.airbank.android

    eu.inmite.prj.kb.mobilbank

    com.bankinter.launcher

    com.kutxabank.android

    com.rsi

    com.tecnocom.cajalaboral

    es.bancopopular.nbmpopular

    es.evobanco.bancamovil

    es.lacaixa.mobile.android.newwapicon

    com.dbs.hk.dbsmbanking

    com.FubonMobileClient

    com.hangseng.rbmobile

    com.MobileTreeApp

    com.mtel.androidbea

    com.scb.breezebanking.hk

    hk.com.hsbc.hsbchkmobilebanking

    com.aff.otpdirekt

    com.ideomobile.hapoalim

    com.infrasofttech.indianBank

    com.mobikwik_new

    com.oxigen.oxigenwallet

    jp.co.aeonbank.android.passbook

AES_key

Signatures

  • Octo

    Octo is a banking malware with remote access capabilities first seen in April 2022.

  • Octo family
  • Octo payload 1 IoCs
  • Loads dropped Dex/Jar 1 TTPs 1 IoCs

    Runs executable file dropped to the device during analysis.

  • Makes use of the framework's Accessibility service 4 TTPs 2 IoCs

    Retrieves information displayed on the phone screen using AccessibilityService.

  • Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
  • Queries the phone number (MSISDN for GSM devices) 1 TTPs
  • Acquires the wake lock 1 IoCs
  • Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs

    Application may abuse the framework's foreground service to continue running in the foreground.

  • Performs UI accessibility actions on behalf of the user 1 TTPs 4 IoCs

    Application may abuse the accessibility service to prevent their removal.

  • Queries the mobile country code (MCC) 1 TTPs 1 IoCs
  • Reads information about phone network operator. 1 TTPs
  • Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs
  • Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs

Processes

  • com.call.nature
    1⤵
    • Loads dropped Dex/Jar
    • Makes use of the framework's Accessibility service
    • Acquires the wake lock
    • Makes use of the framework's foreground persistence service
    • Performs UI accessibility actions on behalf of the user
    • Queries the mobile country code (MCC)
    • Registers a broadcast receiver at runtime (usually for listening for system events)
    • Uses Crypto APIs (Might try to encrypt user data)
    PID:5089

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • /data/data/com.call.nature/.qcom.call.nature

    Filesize

    48B

    MD5

    046a414913add6f5bb60072c7db819b6

    SHA1

    451ee4f6809260aec622d772fd329c7d0297a842

    SHA256

    b66c1320cb063a1d391c94273572ea6edae76c8c8b0a07f8d75c88686f0df72a

    SHA512

    4e6355f3051ed5e811ab030abde1f5be7f5e1cf33be99cd08477e9b6c015deb1d8bd75a09fb9c7176b8511c5ad0a67abc0902a3531e97564ccb6afc57496a47c

  • /data/data/com.call.nature/app_impulse/EQM.json

    Filesize

    153KB

    MD5

    a1ba02c738320dabe2a18263ca36d61b

    SHA1

    f04818815202a8782136c999d2edc22ed5c44008

    SHA256

    49d51a1ff93fb43e59322313cf7d7bb2d0a0bbe7d79527ee9cba661c77a01971

    SHA512

    e6d8c5078da3180e6ca0c6cdd4f764555b2ba82faf3281f37efb36e33855fe576f0bd616585cf3ccf3fdcb2a2bf561781f4f58bd527e4da3b8e74db93376117d

  • /data/data/com.call.nature/app_impulse/EQM.json

    Filesize

    153KB

    MD5

    fbe7e99c9eb57e0bc1c97dd8dff46824

    SHA1

    eff5d5319558d01980d26e2ead6e4d3b5754d75f

    SHA256

    b58c33b1c19cad921c432e1b0fc10f8c317e5e8731ee295844757823264b5856

    SHA512

    273e75f5224a56cacb41a373fb04759977a9df58f22b954599abc76e5e32e99d62bebed4add23db1d862cade7699f3e91903e3777feaf0505cfe61d5627cbb66

  • /data/data/com.call.nature/kl.txt

    Filesize

    230B

    MD5

    026c137fd0cfa4aac6ec71b3087f266e

    SHA1

    28fc49c92a88acf3f2fa906ad6c61dec7e82b185

    SHA256

    c72f804a6e1b70a58a55f20de6d55e1fee8db083a7908a75d4f48d0a92515b53

    SHA512

    585b9c7ce3249f11f21b3b81e38dd1a3ad291e7f2e080e4c5ec6f10e47aaeb45f6931d24edd176b7de9b053de7b83a2064ddfb011335465e60c51f3dfe78120d

  • /data/data/com.call.nature/kl.txt

    Filesize

    45B

    MD5

    d92ba4a3b7835a6501df380645c82163

    SHA1

    fce5d38d70f40482e3a87e552675a5a55aa5ce8e

    SHA256

    f72123e42a9696f76dd448fb69914d835582c467a5d6b0ac7d300b5c169eca18

    SHA512

    7841f653161635cf06b2d92d823c6e7e82d5cd9b0e6ace5aab3effae9a64d2e56bf13fa21e8af127ee3c82034a8d987dbc6f884f655f9bd1b80d6e0991ff89a4

  • /data/data/com.call.nature/kl.txt

    Filesize

    63B

    MD5

    048c1428ccc379e6239b9d6dc5ddd993

    SHA1

    b3ca98274471f933b978cca80c12e568d9c3aba6

    SHA256

    1d57204067b5e545cdc082ff2c734603f6a18e2e090224ef34b5cb082a9a92b7

    SHA512

    7024794cefc2d87bfb10917d38b8e4b76ce813077096420fcd32def8051a20edb640ad2aa92b8429dda9f87588dfbbacb7ac1bd4288d85d0ccbbcccc95a9adfa

  • /data/data/com.call.nature/kl.txt

    Filesize

    45B

    MD5

    d209fee125ef3013638605dfa91df7cb

    SHA1

    60929c21b49bed2425d2b5b72ada6b5ce196b097

    SHA256

    6885ab1a68d4fc953937fe5bfde6519562ec13c40369742dcd75340eb4a235ca

    SHA512

    f140c4b6e970efc4f57e58d878720649d557a7e9adf063f467e4fe8bb3a6cb1d4b2693a7deaba33a457fc4442bcba21a29cee3d148f8fb97220c2b894b23b892

  • /data/data/com.call.nature/kl.txt

    Filesize

    423B

    MD5

    e14e64c3fdfca6e49deddf1e491222a1

    SHA1

    bad36047f3e513aac3dea1d03206195ee0c387b0

    SHA256

    f14b796d23e79100da0d15dbec41dd0bc01cbe375130920a103ce6f4f0320e53

    SHA512

    610972e0b366476a761d69743c9c68917c928c00bd16409c07370a43e8c72408397d35398ba027deff08723dceee509a3a11a488a0322e6efe011ff7a3d937b1

  • /data/user/0/com.call.nature/app_impulse/EQM.json

    Filesize

    450KB

    MD5

    df23da55879b8fb0123ae239c854e90b

    SHA1

    7cf98046a7849b986800764f1b48058d04ebb90d

    SHA256

    c7f251214dcf10eb813c1b6cb3b724b10e4d0245acfc5b7d2a6d338e46b2e249

    SHA512

    4c93e108921536fb34ce40444bcbf9e0cfe805b2fbd8f73e638d1b6720330afa12b61857875c304a792df9fca1abc028f33aabdb6ee6b7e55fe334e6dd5da18a