Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
3180602s -
max time network
12s -
platform
android_x86 -
resource
android-x86-arm-20220823-en -
resource tags
androidarch:armarch:x86image:android-x86-arm-20220823-enlocale:en-usos:android-9-x86system -
submitted
27/11/2022, 13:12
Static task
static1
Behavioral task
behavioral1
Sample
fe7bfc21c7912c162dae7a110e099afe16417cdd44a7a970076e90b0cc5e3f8d.apk
Resource
android-x86-arm-20220823-en
General
-
Target
fe7bfc21c7912c162dae7a110e099afe16417cdd44a7a970076e90b0cc5e3f8d.apk
-
Size
2.4MB
-
MD5
8807da2540dd197e75a86f88a3b20653
-
SHA1
55dff1445061219b4cd1e64b6e75e0c161f68356
-
SHA256
fe7bfc21c7912c162dae7a110e099afe16417cdd44a7a970076e90b0cc5e3f8d
-
SHA512
8f74970f0ec7c95028aaaa3eede510d87f6af2eb736e35dd565ee36889f37e231bb4c9808c60a831a87cc5899e9847bb31540a6cd92d1ec69c7b7d5e0f5df8a2
-
SSDEEP
49152:4OTkVwVYOjEkSpJqNqyulSzlzp20N5U+UhmZsye9:4OAwVDEkKJqkyulSzlzk0N5U5h4sye9
Malware Config
Signatures
-
Loads dropped Dex/Jar 4 IoCs
Runs executable file dropped to the device during analysis.
ioc pid Process /data/user/0/ad.brkiutzbqkot.jxkvfoszqelzobt.b80aaf4a24452c8.l1e/files/8f909d646bd2b999b5a214949d47c632.apk 4158 /system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/ad.brkiutzbqkot.jxkvfoszqelzobt.b80aaf4a24452c8.l1e/files/8f909d646bd2b999b5a214949d47c632.apk --output-vdex-fd=44 --oat-fd=45 --oat-location=/data/user/0/ad.brkiutzbqkot.jxkvfoszqelzobt.b80aaf4a24452c8.l1e/files/oat/x86/8f909d646bd2b999b5a214949d47c632.odex --compiler-filter=quicken --class-loader-context=& /data/user/0/ad.brkiutzbqkot.jxkvfoszqelzobt.b80aaf4a24452c8.l1e/files/8f909d646bd2b999b5a214949d47c632.apk 4086 ad.brkiutzbqkot.jxkvfoszqelzobt.b80aaf4a24452c8.l1e /data/user/0/ad.brkiutzbqkot.jxkvfoszqelzobt.b80aaf4a24452c8.l1e/realshell/c09360499a419972b20c305dca8d19d4.apk 4211 /system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/ad.brkiutzbqkot.jxkvfoszqelzobt.b80aaf4a24452c8.l1e/realshell/c09360499a419972b20c305dca8d19d4.apk --output-vdex-fd=45 --oat-fd=46 --oat-location=/data/user/0/ad.brkiutzbqkot.jxkvfoszqelzobt.b80aaf4a24452c8.l1e/realshell/oat/x86/c09360499a419972b20c305dca8d19d4.odex --compiler-filter=quicken --class-loader-context=& /data/user/0/ad.brkiutzbqkot.jxkvfoszqelzobt.b80aaf4a24452c8.l1e/realshell/c09360499a419972b20c305dca8d19d4.apk 4086 ad.brkiutzbqkot.jxkvfoszqelzobt.b80aaf4a24452c8.l1e
Processes
-
ad.brkiutzbqkot.jxkvfoszqelzobt.b80aaf4a24452c8.l1e1⤵
- Loads dropped Dex/Jar
PID:4086 -
/system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/ad.brkiutzbqkot.jxkvfoszqelzobt.b80aaf4a24452c8.l1e/files/8f909d646bd2b999b5a214949d47c632.apk --output-vdex-fd=44 --oat-fd=45 --oat-location=/data/user/0/ad.brkiutzbqkot.jxkvfoszqelzobt.b80aaf4a24452c8.l1e/files/oat/x86/8f909d646bd2b999b5a214949d47c632.odex --compiler-filter=quicken --class-loader-context=&2⤵
- Loads dropped Dex/Jar
PID:4158
-
-
/system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/ad.brkiutzbqkot.jxkvfoszqelzobt.b80aaf4a24452c8.l1e/realshell/c09360499a419972b20c305dca8d19d4.apk --output-vdex-fd=45 --oat-fd=46 --oat-location=/data/user/0/ad.brkiutzbqkot.jxkvfoszqelzobt.b80aaf4a24452c8.l1e/realshell/oat/x86/c09360499a419972b20c305dca8d19d4.odex --compiler-filter=quicken --class-loader-context=&2⤵
- Loads dropped Dex/Jar
PID:4211
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
/data/user/0/ad.brkiutzbqkot.jxkvfoszqelzobt.b80aaf4a24452c8.l1e/files/8f909d646bd2b999b5a214949d47c632.apk
Filesize104KB
MD5e7077772b3ff7d3ccea9fb738e1e6593
SHA15879ddc7b8be5baf4061e9c1f7a6caf9dad672b5
SHA256e3d45a82b4d2d1a9ad55a8a252d5929a144df97c0eb90d612d9dadf4f1ea815b
SHA512e4ac758e5f7142bb474bef03eea6d46ff82afcfea1e0f5af648975fc34a34cfe16b8d9d859c7a6348f8a4841e5ffebd44a541a4a1443729fffd62dcfb522a389
-
/data/user/0/ad.brkiutzbqkot.jxkvfoszqelzobt.b80aaf4a24452c8.l1e/files/8f909d646bd2b999b5a214949d47c632.apk
Filesize289KB
MD53b896d80f8fdfc0aa5458a3ea4baae54
SHA14a38c55dd9cd49a9d329f27262a0a307508748b7
SHA2560bfa64931aef7d997b418a3ef11a8c2d687945e566540a5b79af59e499e71b40
SHA51289e696e07f6518be4e271ee67e287ab507424220ca077d58ba3deb530b099f866cb0fbcc143640ddd0484970a09bd7e1b3363c348d0c5e171188667d0ab69b4c
-
/data/user/0/ad.brkiutzbqkot.jxkvfoszqelzobt.b80aaf4a24452c8.l1e/files/8f909d646bd2b999b5a214949d47c632.apk
Filesize289KB
MD5e81e911960239b085457e6c0b69c0378
SHA1514333da875a1f7c596764c4dbfb1e9b073f6f49
SHA2565cc95d45cdc93d7d8df48acc0fa4165466faa27c77b29889c77a12ce3b1d0629
SHA51271bae9761e2c6a2ed131c1f552e4fbd79bab02bb992d5fe0e70f6d4bc52eb6c50f765b9502c68d9217edfac5d5fcf6b3433dfa1464c21c2bf97e256c33bcbb7c
-
/data/user/0/ad.brkiutzbqkot.jxkvfoszqelzobt.b80aaf4a24452c8.l1e/realshell/c09360499a419972b20c305dca8d19d4.apk
Filesize1.2MB
MD5ee1222ea00e0eb1bb3e08d5a76069197
SHA1f04fca2b2c7c13e6ca9f98ee7d72ecd403de3877
SHA256905df9419cacd1890a49d79301a230bb242da40e1c6504e130932373a2f374e1
SHA512dc1f4f2063ea8280b65fb1707ed898cda0ad8417f389ec64f749f90242bbdf3b73391e2c2e835dd16319c2ecb38c303e0b827cb0030a2de008b11fbfaad8e3e2
-
/data/user/0/ad.brkiutzbqkot.jxkvfoszqelzobt.b80aaf4a24452c8.l1e/realshell/c09360499a419972b20c305dca8d19d4.apk
Filesize1.2MB
MD568fe3823e6f5bcf9b2ac0ea31b7916f6
SHA15a3f97d0e355ce58a77010cece31655c91cf8360
SHA256a370e0f95ff84d1a36924bde7f7685f329a69d4d1bbf4c7fdc06866b5fd30dd2
SHA5125f7b027ee6c704decda1cf1aeb03af9cef1a67579b586a0a423589892a343f589de449809ba3bf22f038cbc5b2df90b135d6bade12e0a855071b0f8e0a2476b4
-
/data/user/0/ad.brkiutzbqkot.jxkvfoszqelzobt.b80aaf4a24452c8.l1e/realshell/c09360499a419972b20c305dca8d19d4.apk
Filesize1.2MB
MD5b017442e7a5dc9b2c6caa0c78361d9b0
SHA1112fd5f2db8b46badf517f44b12b55207d8233cc
SHA25672839c2d4693cd9be56f3df40cfe423d34ff0ee5cb8937b260f78d489362ff99
SHA512a18bb3e8fb41a51787469054fcb3851ad20af6d223ef2fe4e7d65b84e1fb206b7427d45617bc1d7fd3af5f28da85a8b5cb94fa219e6d2ce7813c0686289f2c4b
-
/data/user/0/ad.brkiutzbqkot.jxkvfoszqelzobt.b80aaf4a24452c8.l1e/shared_prefs/APP_START_TIMER_INFO.xml
Filesize117B
MD5774ee0a3bc1c21c0ce14e4c0f09f4723
SHA1d7185406fe47eade4e32fc5ebed83ec88ef41b50
SHA256dcab3f63a355be6a2f0a781c6e8d9a17c0fb2aeb397fcb63a5da6250023ab06f
SHA5127200ff31e290ebfd697a459af65c46c556e1709b1f99dbefbfbfe9e6cac85013488fb2ffdb8c4e773c36296ed8f13231a74f685c58e7a041b511c799a66ae57a