Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
1596818s -
max time network
276s -
platform
android_x64 -
resource
android-x64 -
submitted
19/08/2021, 16:05
Static task
static1
Behavioral task
behavioral1
Sample
86924_Video_Oynatıcı.apk
Resource
android-x86-arm
Behavioral task
behavioral2
Sample
86924_Video_Oynatıcı.apk
Resource
android-x64-arm64
Behavioral task
behavioral3
Sample
86924_Video_Oynatıcı.apk
Resource
android-x64
General
-
Target
86924_Video_Oynatıcı.apk
-
Size
3.3MB
-
MD5
8a06d18ad2a1e43450c4506cd397b3e5
-
SHA1
0161de8ceee842efb5a7396f806fcfc91a5e8e30
-
SHA256
e9109889d12f015832c3155da91f13dbe08784d553e5df41687af5bed789a9dd
-
SHA512
85c83b43634a13c8ee48df4a8261502d581dadaac06b5fd169277b00ec0ff025d90d06c75b4b3823cae1d3c5d37c7dea517120e873681d2481025f3794e7bc5d
Malware Config
Extracted
hydra
http://jannatedge58.xyz
Signatures
-
Hydra
Android banker and info stealer.
-
Loads dropped Dex/Jar 1 IoCs
Runs executable file dropped to the device during analysis.
ioc pid Process /data/user/0/com.vhrbutsu.roowdte/code_cache/secondary-dexes/base.apk.classes1.zip 3647 com.vhrbutsu.roowdte -
Requests enabling of the accessibility settings. 1 IoCs
description ioc Process Intent action android.settings.ACCESSIBILITY_SETTINGS com.vhrbutsu.roowdte -
Uses reflection 3 IoCs
description pid Process Acesses field com.android.okhttp.internal.tls.OkHostnameVerifier.INSTANCE 3647 com.vhrbutsu.roowdte Acesses field javax.security.auth.x500.X500Principal.thisX500Name 3647 com.vhrbutsu.roowdte Acesses field javax.security.auth.x500.X500Principal.thisX500Name 3647 com.vhrbutsu.roowdte