Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    147s
  • max time network
    153s
  • platform
    android_x64
  • resource
    android-33-x64-arm64-20240624-en
  • resource tags

    androidarch:arm64arch:x64image:android-33-x64-arm64-20240624-enlocale:en-usos:android-13-x64system
  • submitted
    08/02/2025, 01:41

General

  • Target

    6316ca685bcf327e12bd0494395315c2a30d12c3031ba0cabe6f75bdb1a4ac0b.apk

  • Size

    2.2MB

  • MD5

    c09ad917969dec1e0802853dfbb36de8

  • SHA1

    40b1ccf8d0b145a5a59083013090009913cca1fe

  • SHA256

    6316ca685bcf327e12bd0494395315c2a30d12c3031ba0cabe6f75bdb1a4ac0b

  • SHA512

    2036a85a09447f2a7279a7b38a20f62997137b615cd8476dee0cba0bd54ef76dc468ffe865735e6c204d85b1ee6458fd58785721e33a3894447de3fdd05f8248

  • SSDEEP

    49152:Hj5pLCSxexaUIr8GVL0XvtZJSPHH+3HuyZVBBK9HNTnsDBInAVmBUGWHIf88veNF:Hj5txexPIr10XFZ8HKuIPBINTns9LeFm

Malware Config

Extracted

Family

octo

C2

https://otomatikbahcesulamasistemi.xyz/fHTKmZhmwRmq/

https://tarimsalverimsulamayontemi.xyz/fHTKmZhmwRmq/

https://damlamasulamateknolojileri.xyz/fHTKmZhmwRmq/

https://akillitarimsulamasistemleri.xyz/fHTKmZhmwRmq/

https://modernciftliksulamayontemi.xyz/fHTKmZhmwRmq/

https://verimlisulamataktikveyontem.xyz/fHTKmZhmwRmq/

https://tarlaotomatiksulamasistemleri.xyz/fHTKmZhmwRmq/

https://bahceveseraotomasyonsulama.xyz/fHTKmZhmwRmq/

https://sudepolamaveverimsulama.xyz/fHTKmZhmwRmq/

https://bitkisulamastratejiler.xyz/fHTKmZhmwRmq/

https://sebzesulamasistemcozumleri.xyz/fHTKmZhmwRmq/

https://akillibahcesulamauretimi.xyz/fHTKmZhmwRmq/

https://gelenekseltarimsulamamodeli.xyz/fHTKmZhmwRmq/

https://sulamaekipmanlariurunleri.xyz/fHTKmZhmwRmq/

https://akillidamlamaotomasyonsistemi.xyz/fHTKmZhmwRmq/

https://pratikverimlibitkisulama.xyz/fHTKmZhmwRmq/

https://topraksizserasulamasistemi.xyz/fHTKmZhmwRmq/

https://otomatiksektorelbitkisulama.xyz/fHTKmZhmwRmq/

https://verimlitarlavemodernsulama.xyz/fHTKmZhmwRmq/

https://bitkisagliginagoresulama.xyz/fHTKmZhmwRmq/

rc4.plain

Extracted

Family

octo

C2

https://otomatikbahcesulamasistemi.xyz/fHTKmZhmwRmq/

https://tarimsalverimsulamayontemi.xyz/fHTKmZhmwRmq/

https://damlamasulamateknolojileri.xyz/fHTKmZhmwRmq/

https://akillitarimsulamasistemleri.xyz/fHTKmZhmwRmq/

https://modernciftliksulamayontemi.xyz/fHTKmZhmwRmq/

https://verimlisulamataktikveyontem.xyz/fHTKmZhmwRmq/

https://tarlaotomatiksulamasistemleri.xyz/fHTKmZhmwRmq/

https://bahceveseraotomasyonsulama.xyz/fHTKmZhmwRmq/

https://sudepolamaveverimsulama.xyz/fHTKmZhmwRmq/

https://bitkisulamastratejiler.xyz/fHTKmZhmwRmq/

https://sebzesulamasistemcozumleri.xyz/fHTKmZhmwRmq/

https://akillibahcesulamauretimi.xyz/fHTKmZhmwRmq/

https://gelenekseltarimsulamamodeli.xyz/fHTKmZhmwRmq/

https://sulamaekipmanlariurunleri.xyz/fHTKmZhmwRmq/

https://akillidamlamaotomasyonsistemi.xyz/fHTKmZhmwRmq/

https://pratikverimlibitkisulama.xyz/fHTKmZhmwRmq/

https://topraksizserasulamasistemi.xyz/fHTKmZhmwRmq/

https://otomatiksektorelbitkisulama.xyz/fHTKmZhmwRmq/

https://verimlitarlavemodernsulama.xyz/fHTKmZhmwRmq/

https://bitkisagliginagoresulama.xyz/fHTKmZhmwRmq/

Attributes
  • target_apps

    at.spardat.bcrmobile

    at.spardat.netbanking

    com.bankaustria.android.olb

    com.bmo.mobile

    com.cibc.android.mobi

    com.rbc.mobile.android

    com.scotiabank.mobile

    com.td

    cz.airbank.android

    eu.inmite.prj.kb.mobilbank

    com.bankinter.launcher

    com.kutxabank.android

    com.rsi

    com.tecnocom.cajalaboral

    es.bancopopular.nbmpopular

    es.evobanco.bancamovil

    es.lacaixa.mobile.android.newwapicon

    com.dbs.hk.dbsmbanking

    com.FubonMobileClient

    com.hangseng.rbmobile

    com.MobileTreeApp

    com.mtel.androidbea

    com.scb.breezebanking.hk

    hk.com.hsbc.hsbchkmobilebanking

    com.aff.otpdirekt

    com.ideomobile.hapoalim

    com.infrasofttech.indianBank

    com.mobikwik_new

    com.oxigen.oxigenwallet

    jp.co.aeonbank.android.passbook

AES_key

Signatures

  • Octo

    Octo is a banking malware with remote access capabilities first seen in April 2022.

  • Octo family
  • Octo payload 1 IoCs
  • Loads dropped Dex/Jar 1 TTPs 1 IoCs

    Runs executable file dropped to the device during analysis.

  • Makes use of the framework's Accessibility service 4 TTPs 2 IoCs

    Retrieves information displayed on the phone screen using AccessibilityService.

  • Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
  • Queries the phone number (MSISDN for GSM devices) 1 TTPs
  • Acquires the wake lock 1 IoCs
  • Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs

    Application may abuse the framework's foreground service to continue running in the foreground.

  • Performs UI accessibility actions on behalf of the user 1 TTPs 4 IoCs

    Application may abuse the accessibility service to prevent their removal.

  • Queries the mobile country code (MCC) 1 TTPs 1 IoCs
  • Reads information about phone network operator. 1 TTPs
  • Requests accessing notifications (often used to intercept notifications before users become aware). 1 TTPs 1 IoCs
  • Requests disabling of battery optimizations (often used to enable hiding in the background). 1 TTPs 1 IoCs
  • Requests modifying system settings. 1 IoCs
  • Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs

Processes

  • com.sense.cruel
    1⤵
    • Loads dropped Dex/Jar
    • Makes use of the framework's Accessibility service
    • Acquires the wake lock
    • Makes use of the framework's foreground persistence service
    • Performs UI accessibility actions on behalf of the user
    • Queries the mobile country code (MCC)
    • Requests accessing notifications (often used to intercept notifications before users become aware).
    • Requests disabling of battery optimizations (often used to enable hiding in the background).
    • Requests modifying system settings.
    • Uses Crypto APIs (Might try to encrypt user data)
    PID:4319

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • /data/user/0/com.sense.cruel/.qcom.sense.cruel

    Filesize

    48B

    MD5

    046a414913add6f5bb60072c7db819b6

    SHA1

    451ee4f6809260aec622d772fd329c7d0297a842

    SHA256

    b66c1320cb063a1d391c94273572ea6edae76c8c8b0a07f8d75c88686f0df72a

    SHA512

    4e6355f3051ed5e811ab030abde1f5be7f5e1cf33be99cd08477e9b6c015deb1d8bd75a09fb9c7176b8511c5ad0a67abc0902a3531e97564ccb6afc57496a47c

  • /data/user/0/com.sense.cruel/app_beef/JRY.json

    Filesize

    153KB

    MD5

    6da2fde3e6b3a50a2436e16a4fb1486a

    SHA1

    1448a3e175088cc2ed1b7716753b5ab393024fc3

    SHA256

    cc9bf294be2079f89c7e2c087d1b53b60b8fb29247c79e8354193ecd1a66d1d7

    SHA512

    d060e7decb89c9993a5a0921d24cbf399f280d5573dafa2c1c08922bff3c2001534308b5ecf91def0f163aa5b48747f0da581f7bfdc8476411d5dac5ed5beec3

  • /data/user/0/com.sense.cruel/app_beef/JRY.json

    Filesize

    153KB

    MD5

    7771c8058a79ecc9587373970b07fab1

    SHA1

    665e5bf8732cb50e6fb54fb00cb106ff694a0842

    SHA256

    f5ecb6b9aa3a6b420e19d575658d5d2f360e90496856d9b632f2963b32d01e54

    SHA512

    7669ea70a31bb7ef22c4392b1a64bcea1de9808c0ebc5e8ba3eb615a217ac5e89db42d585b5a4c2faf0997d76e4b06f666c567ea2a005a3afc9c73442847a5eb

  • /data/user/0/com.sense.cruel/app_beef/JRY.json

    Filesize

    450KB

    MD5

    b102411d3c103e18266b72a6396b0e1b

    SHA1

    cd132286ab3d17ced1817a9ad4dc08bb5105b6fb

    SHA256

    cc6c9e7e41d2d3d6a2b822af368d8fd8f20133137a2062da34916adb0d4b300e

    SHA512

    25cacc0a3434025935759c86421309e5c76a36afb03026ce35eee78e4c6691878c5f232cc529f1e9c09f6ea3bd6f55c07dbad85ae872fbdf8400f545b352e65d

  • /data/user/0/com.sense.cruel/kl.txt

    Filesize

    55B

    MD5

    e21832be250d8dce61b2f8694ae465cc

    SHA1

    0d7964bf5b1249b63b95bab7dcf2f4a5d027b44f

    SHA256

    523255310864e4c1cd3c6bff7b201ceacd08f78344de0dbbb48a27843d569d04

    SHA512

    d36f5f16daf4c172c6cdca6e78d5de9a9a38c49f0989b86843c7ef2a57b9b66bc9fb2c8f6e8821262439871540243fce8b4fe03b099bb84638a295b21afee9ea

  • /data/user/0/com.sense.cruel/kl.txt

    Filesize

    45B

    MD5

    ccce4c816c9364ddf04524ee0f6e5011

    SHA1

    0708e04a13d5d53f2e9142816b55543afae45761

    SHA256

    62d988333095018d0d1a4c6e8d73ca54473d250bb7873c0915d263c3c1781d96

    SHA512

    0e6a1f8e09c7daf9b7bb34020c7f66ae6faaeff7ae280015aec145ced9d43438c7cb68764dc0c311d5ffbbfae9f0a879a24a6f8012d6679ffa2857603446af0e

  • /data/user/0/com.sense.cruel/kl.txt

    Filesize

    70B

    MD5

    7c89edc944f751c9bc553c5be06030a6

    SHA1

    1c42d5fe610752d5f265ec1721d2e0d4389183db

    SHA256

    b105912782b2688c96798e23bdbb354a7ebdcfbec8c6c4bd72975190568cfa09

    SHA512

    5f03d440ae615cbbd220fb31f83f33e2eed952206ada5597132862245d71467b1d2716c13679eaad5df3c57af5b7c4717167b537c3f236ca3931fb9a16500069

  • /data/user/0/com.sense.cruel/kl.txt

    Filesize

    490B

    MD5

    8387def7845789d1d4c3a1ef9eb93476

    SHA1

    ab175c6e54b6d4c0d83e6a8d2630961437731923

    SHA256

    38f4798a7f7d37316d26009f4a56e697b03c544559f7f8b9778f0b85e733d1b3

    SHA512

    cdf0d3307788802519b218dc7048cb6092e9d95391fcfdfe7898c76b521f04816c9dedb9015027963346570f9a06719d634b534e751e430b079040c64c1330b2

  • /data/user/0/com.sense.cruel/kl.txt

    Filesize

    68B

    MD5

    352fc619ac062a3725dbcd33d7c48f98

    SHA1

    813f78fd231a138aee0015264d6477da4879686e

    SHA256

    555271b998aa2b889e8ff89d8e40cb8e8e53e2182168164fd535d6921014d13f

    SHA512

    a0f83e75f4232570a740e4c37a6028e0fc0471360fcad8dcc85fa427e77db9bf71dad8d39bb7d8673b0541fce265e9a17a5a507e728b56f076271f1f57d6603d

  • /data/user/0/com.sense.cruel/kl.txt

    Filesize

    60B

    MD5

    944c336a216ed6d3d1a5d2c9bb8c2ff0

    SHA1

    36887547e22d65e040120b7a884ae3a4e26998bb

    SHA256

    74e79087cd558e5ab4e97569a3c13eb5fce128ba0acad66fb4aa4d6e382171a3

    SHA512

    690514e889dbe29d48d9cdc61a33873eee81f9052f88415f0c7c589f9b9c0f2744b6db4cd2a6967d4e9a935a6f14f7bdde91b98b196ea26a163a510b0946bb62

  • /data/user/0/com.sense.cruel/kl.txt

    Filesize

    52B

    MD5

    4cbbb2c44cafeeb782a52cc423b2ec51

    SHA1

    ec0e6606d6f20b4438422723e1373bf030a89ac4

    SHA256

    e46066d507c9ef0e4e4ea87f3deed99ca071a312115bb2a884500db7a690157e

    SHA512

    ede3c67d0342ccd9e8c12e3ae7a2431694eb7941166119b9be3adfaf8b3e1ce172336b446bab9c802cf162459adfd7614f0835ff329339207f70780866ff156a

  • /data/user/0/com.sense.cruel/kl.txt

    Filesize

    66B

    MD5

    f03fcfdc2e4506d4720bc0396e363887

    SHA1

    1399f786bb87b4807dd64bc70b58729bac974596

    SHA256

    e2be783a4ae062f250774600f8cfe4f8e062148632cbda5dfe6eec9315d5f7e4

    SHA512

    fb20fbc04979094299f0577b84f9ca8a9684a83f9d3bc3a354d2a9c33b69967668685d6274a1bbfd19815c8143ae7d2acbd7c79a8c401506462f4467f839726b

  • /data/user/0/com.sense.cruel/kl.txt

    Filesize

    84B

    MD5

    a57d83d044acef8ba66af263c7190813

    SHA1

    db03d88cce0096bf3fb657c05ac84a28aeffc62e

    SHA256

    e1b84ed4f2f47e1e2bb05a4242cc8620f85d46ffd3ae343a6fa8dba230f2a701

    SHA512

    2b82408aba7d05310acb82cb6ffdc0f36c7fdfb06577b21f7b75d7544274293da1f45cc786ba39191bb90e071f55c0654bd0ed21004856135be30e7172c0c9cc

  • /data/user/0/com.sense.cruel/kl.txt

    Filesize

    68B

    MD5

    c94f8f36e050a62830b801224cf56b79

    SHA1

    b2d53fca54e56996802b7b9eea42537db5265f13

    SHA256

    fc555be2795617aad911fa4d5ac02fb73c5ed4dda9bce6a4f8724006a16ac56b

    SHA512

    b36e7d45bbd80e2205ba381f16ffb661575a313f16bad1e2aa5eff2163e4022a47beb1dc62fc1ad6b9d9a0c22270220fec6913d5202d25c1c0afd85b98425aa4

  • /data/user/0/com.sense.cruel/kl.txt

    Filesize

    214B

    MD5

    158bb4f76482b710ebfe46bf5de99199

    SHA1

    c3d32444ccd15ffba71a9737f9e4641b794cbf75

    SHA256

    792533db86dc37a8f8dc8ea2d30e5d1cf961e48614a1c71957db268cf8b2d2b3

    SHA512

    9baa408c435e1e909ab746b0617e2159c1340bd7fe41445373a2e521b96a8ae1e146414ded1a236b8455fae8d7198f7899812581f3fbe100bdde2fad7a645bb7

  • /data/user/0/com.sense.cruel/kl.txt

    Filesize

    54B

    MD5

    24ee6abe6df3658e1ac0f175388921f6

    SHA1

    a11f176aaac1ea87a8efc612189c437e1c650d1e

    SHA256

    43bc15ee5170b5dcd99d051bde6103a3d8aa9c0766fa845a2e432308a4639f14

    SHA512

    a29371d37be39e271db091e98a4cdd6e8c45ba0a74830ef12166bcc8424ecadfa67fa4bbe2034adcd305070883db909999ecdb113034b7f13df07d617136e6bc

  • /data/user/0/com.sense.cruel/kl.txt

    Filesize

    68B

    MD5

    c1e31e986013f199b29a3d14420412ce

    SHA1

    d68f6abf7503827fe8993ba799af473a996b59c9

    SHA256

    3cddd4ef5acac32cf7759d333c1e41afe970fc286bd42cc15bbf918c9baf1f27

    SHA512

    dece115fc72d0d583c009280cac76f4f117db83a6cc7033e650b72054afd5221577a48c451e3df51dd3a274344965b1f79f702358730a5ecada4782f137a6853

  • /data/user/0/com.sense.cruel/kl.txt

    Filesize

    60B

    MD5

    cb8a6df42c7e1687856142aa4b88844b

    SHA1

    fdba8908be24f242b3345cedcb13741c3177f2eb

    SHA256

    be23ad3c7a272a703c836e452ee66cad13a442476fce0936f0fc91b67eb5aa0f

    SHA512

    7f962bb765809d3e383f1bc9e3cee4283e12322a56acccb254ca9a5649e7803a4a393ee288a23de29c054a3849bdf5d829870f43df373670b750161b8a7f531d

  • /data/user/0/com.sense.cruel/kl.txt

    Filesize

    52B

    MD5

    25c425d6e5dc8d6aa6486546185c290e

    SHA1

    dc4afcb366267acea20e8380783530d106726a9e

    SHA256

    181863706f4364faee190d6fe7e599496c4f2617a94f97c8772079795b1e09e2

    SHA512

    140a43797bba0045c3f4c37dadf7a502c80a34c33019b6671d057ad13eccfe5ed42ff56e876db87161a3072ee0107deff433d7eeaed29bd326ae9bba0c9c5007

  • /data/user/0/com.sense.cruel/kl.txt

    Filesize

    70B

    MD5

    cd4246d7763c3faa09b3a5f4a636b3b3

    SHA1

    234ddba7f15220d853aefb727829e4bb2a2ee9a2

    SHA256

    08339f3d77021ebf8de30ccfdf0bdaa038b1b841f92fbf9388cfd58908ec1001

    SHA512

    7d75d527313a09defc1f4c3c200f34e32f1cd84f75f5b596899fdeaf427614d58f73d98b1906e29f2ba45b1a6c74d6f1891e0cedead07fff6919356ebbff43aa