Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
157s -
platform
android_x64 -
resource
android-x64-arm64-20240624-en -
resource tags
-
submitted
10/02/2025, 09:30
General
-
Target
dad4c29ccc4f7eedb446ee2d3e207d5f193be9b1cee8115953a46464a8309336.apk
-
Size
8.1MB
-
MD5
2bfe02b621d71ccba6abac8e4b39b8c0
-
SHA1
3b10c8c6eb15e9dc63e74464aa98c143bc4820e8
-
SHA256
dad4c29ccc4f7eedb446ee2d3e207d5f193be9b1cee8115953a46464a8309336
-
SHA512
0c5895bde662f42cc1257f18d3a6e0ace3e98c0dfae53465a15b441992a9dee562ab2eae36fc14af7b454b002f580b43b3cac3cbb4a0fd7f7366c5b32c9393fb
-
SSDEEP
98304:5XbA+c5iSRGx7Rs13J+KZ1VKkKQ0j7Fsub4dc5uIPBIpbuf:RA+creRQB1Ujzj7qGD
Malware Config
Extracted
octo
https://2a88253511735028fea71e75917fb77d.shop
Signatures
-
Octo
Octo is a banking malware with remote access capabilities first seen in April 2022.
-
Octo family
-
Octo payload 1 IoCs
-
Loads dropped Dex/Jar 1 TTPs 2 IoCs
Runs executable file dropped to the device during analysis.
-
Makes use of the framework's Accessibility service 4 TTPs 2 IoCs
Retrieves information displayed on the phone screen using AccessibilityService.
-
Obtains sensitive information copied to the device clipboard 2 TTPs 1 IoCs
Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.
-
Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
-
Queries the phone number (MSISDN for GSM devices) 1 TTPs
-
Acquires the wake lock 1 IoCs
-
Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs
Application may abuse the framework's foreground service to continue running in the foreground.
-
Queries the mobile country code (MCC) 1 TTPs 1 IoCs
-
Reads information about phone network operator. 1 TTPs
-
Requests disabling of battery optimizations (often used to enable hiding in the background). 1 TTPs 1 IoCs
-
Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs
-
Checks CPU information 2 TTPs 1 IoCs
-
Checks memory information 2 TTPs 1 IoCs
Processes
-
com.dyhearing09cloud1⤵
- Loads dropped Dex/Jar
- Makes use of the framework's Accessibility service
- Obtains sensitive information copied to the device clipboard
- Acquires the wake lock
- Makes use of the framework's foreground persistence service
- Queries the mobile country code (MCC)
- Requests disabling of battery optimizations (often used to enable hiding in the background).
- Uses Crypto APIs (Might try to encrypt user data)
- Checks CPU information
- Checks memory information
Network
MITRE ATT&CK Mobile v15
Defense Evasion
Download New Code at Runtime
1Foreground Persistence
1Hide Artifacts
1User Evasion
1Input Injection
1Virtualization/Sandbox Evasion
2System Checks
2Credential Access
Clipboard Data
1Input Capture
2GUI Input Capture
1Keylogging
1Discovery
Software Discovery
1Security Software Discovery
1System Information Discovery
2System Network Configuration Discovery
3Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
48B
MD5046a414913add6f5bb60072c7db819b6
SHA1451ee4f6809260aec622d772fd329c7d0297a842
SHA256b66c1320cb063a1d391c94273572ea6edae76c8c8b0a07f8d75c88686f0df72a
SHA5124e6355f3051ed5e811ab030abde1f5be7f5e1cf33be99cd08477e9b6c015deb1d8bd75a09fb9c7176b8511c5ad0a67abc0902a3531e97564ccb6afc57496a47c
-
Filesize
1016B
MD5ea5e9e3e3d45f5ed85711078337aeaa0
SHA1f6021d8cfae46cd6190e9755e631fa336f995565
SHA25689e1116fe106e350a93064c30658bcfc4274d6787a7c26289615c352493d8684
SHA5124bbdd22a373d82dad6b08dbab4459df5ccde6e121a6a983291fef994ae576c7c7de4bf0b39bf71db3e7d9b1bb8677e8399630c9362a390ac7588366cc223ef1d
-
Filesize
1016B
MD5afd5bfb8277f7a81b9a69d077f323898
SHA1a84362b0fd2e80c1d7455563faaa614ad672cbf9
SHA256ab13c3a67c16d6bc9a318ccb0f955be63bff70716927daafc6a3f0fe0bb8738f
SHA512b4bfaaddb88e6525999bcba8bf0c6703439f507e253992c129a9ed513cbbe3ad785cde497e8654f26d86c073645571d3d44bcc82cb2f1a3d4f707f96b66f8ad5
-
Filesize
322KB
MD577dc50489b9323274732d27dc8a4e803
SHA10e02a3595b62489d0739d771881da8604d117c65
SHA256c5684e792d1ebefea6aac09fed45911703fd58c899f8a08133d49dd91429a820
SHA5120684a92f3e9c525384cfa53f531afba61e5930e1c27032a7e27e3315f72761b62e122dc34768d8162ba08f9bed53d148aa8dc034b46456bdd211f230637eba58
-
Filesize
472B
MD5a1e6404b2e7a51f176ad3bfeb21246a3
SHA1796576a9d7f063cb2796943252953c815956cb8e
SHA256b573ddd2d53675cbdd042d82436faadc4bf1f3b753df72920f8c59ccef40dd4a
SHA5120d8ec7a8dc97f2be5740e626d34b3dd558f5cec17b7890d0617990dce2e85da3d1ad2277474246d86c1ea50caf6ab7b29852cf7b37d00b4de8ea3b2928e4a640
-
Filesize
525KB
MD55a0a98ebf20d157abccd3c697ae1b744
SHA18162a232fd459579860f2bd3f2fed27de3ce6a7b
SHA256c2aaca2ff697f955400e6905996e65a4f84b94ccf7f35b4ac58a5ab8e759c155
SHA512b227724212e8fe03d3f0b450bf622af6c24b901cfa23600870f52cfef09ce6fa42e8e41bc6fa44e534bfd7d443551a85fefe8ff6fb102b7ff0b2363707cd0a09
-
Filesize
1KB
MD5bf352db5d49984806a5e99199f2ff5f4
SHA130b3e619ddd6aea2a3eb018747eacb57f00ce09a
SHA25612d478cf7045af69224d4e59c744649d65bb049c54f408541a16056b89411c5b
SHA512c9eafd0e8ee13f27848869bb869272516c260a70087466b2528716a0d948cf58d093c1b64f8cff5a9f3634e0f0875c15c8e64ef8650d34f1f254f8f77f031f96