Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
1853076s -
max time network
158s -
platform
android_x64 -
resource
android-x64 -
submitted
11/10/2021, 08:21
Static task
static1
Behavioral task
behavioral1
Sample
seven ransomware.apk
Resource
android-x86-arm
android_x86
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
seven ransomware.apk
Resource
android-x64
android_x64
0 signatures
0 seconds
General
-
Target
seven ransomware.apk
-
Size
6.8MB
-
MD5
73d0f5db820e8b491365e3faa9b55498
-
SHA1
d5ef600aa1c01fa200ed46140c8308637f09dfcd
-
SHA256
61f73bf90c3234faeb8aa7c90f24fa3f7a3a1d38b2e94d40ce96a21e7320fd28
-
SHA512
796c47b244bf7d871eb0c0e43dd1b8eed86d15c00a5128ae7740bf87c0b5fcbe9787ee133f739ee0dd5986bee49075208bb768718db12590b2c7073ebe1ed89b
Score
10/10
Malware Config
Signatures
-
Filecoder.C
A ransomware family that spreads to other victims via SMS.
-
Loads dropped Dex/Jar 2 IoCs
Runs executable file dropped to the device during analysis.
ioc pid Process /product/app/webview/webview.apk 3621 net.south.seven /product/app/webview/webview.apk 3621 net.south.seven -
Legitimate hosting services abused for malware hosting/C2 1 TTPs
-
Uses Crypto APIs (Might try to encrypt user data). 1 IoCs
description ioc Process Framework API call javax.crypto.Cipher.doFinal net.south.seven -
Changes the wallpaper (common with ransomware activity). 1 IoCs
description ioc Process Framework API call android.app.WallpaperManager.setBitmap net.south.seven -
Uses reflection 34 IoCs
description pid Process Invokes method android.content.Context.bindServiceAsUser 3621 net.south.seven Invokes method android.content.Context.bindServiceAsUser 3621 net.south.seven Acesses field com.android.okhttp.internal.tls.OkHostnameVerifier.INSTANCE 3621 net.south.seven Invokes method android.content.Context.bindServiceAsUser 3621 net.south.seven Acesses field javax.security.auth.x500.X500Principal.thisX500Name 3621 net.south.seven Acesses field javax.security.auth.x500.X500Principal.thisX500Name 3621 net.south.seven Acesses field javax.security.auth.x500.X500Principal.thisX500Name 3621 net.south.seven Acesses field javax.security.auth.x500.X500Principal.thisX500Name 3621 net.south.seven Acesses field javax.security.auth.x500.X500Principal.thisX500Name 3621 net.south.seven Acesses field javax.security.auth.x500.X500Principal.thisX500Name 3621 net.south.seven Acesses field javax.security.auth.x500.X500Principal.thisX500Name 3621 net.south.seven Acesses field javax.security.auth.x500.X500Principal.thisX500Name 3621 net.south.seven Acesses field javax.security.auth.x500.X500Principal.thisX500Name 3621 net.south.seven Acesses field javax.security.auth.x500.X500Principal.thisX500Name 3621 net.south.seven Acesses field javax.security.auth.x500.X500Principal.thisX500Name 3621 net.south.seven Acesses field javax.security.auth.x500.X500Principal.thisX500Name 3621 net.south.seven Acesses field javax.security.auth.x500.X500Principal.thisX500Name 3621 net.south.seven Acesses field javax.security.auth.x500.X500Principal.thisX500Name 3621 net.south.seven Acesses field javax.security.auth.x500.X500Principal.thisX500Name 3621 net.south.seven Acesses field javax.security.auth.x500.X500Principal.thisX500Name 3621 net.south.seven Acesses field javax.security.auth.x500.X500Principal.thisX500Name 3621 net.south.seven Acesses field javax.security.auth.x500.X500Principal.thisX500Name 3621 net.south.seven Acesses field javax.security.auth.x500.X500Principal.thisX500Name 3621 net.south.seven Acesses field javax.security.auth.x500.X500Principal.thisX500Name 3621 net.south.seven Acesses field javax.security.auth.x500.X500Principal.thisX500Name 3621 net.south.seven Acesses field javax.security.auth.x500.X500Principal.thisX500Name 3621 net.south.seven Acesses field javax.security.auth.x500.X500Principal.thisX500Name 3621 net.south.seven Acesses field javax.security.auth.x500.X500Principal.thisX500Name 3621 net.south.seven Acesses field javax.security.auth.x500.X500Principal.thisX500Name 3621 net.south.seven Acesses field javax.security.auth.x500.X500Principal.thisX500Name 3621 net.south.seven Acesses field javax.security.auth.x500.X500Principal.thisX500Name 3621 net.south.seven Acesses field javax.security.auth.x500.X500Principal.thisX500Name 3621 net.south.seven Acesses field javax.security.auth.x500.X500Principal.thisX500Name 3621 net.south.seven Acesses field javax.security.auth.x500.X500Principal.thisX500Name 3621 net.south.seven