Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Overview
overview
10Static
static
7Lol.apk
android-9-x86
10Lol.apk
android-10-x64
10Lol.apk
android-11-x64
10amap_resou..._0.apk
android-9-x86
amap_resou..._0.apk
android-10-x64
amap_resou..._0.apk
android-11-x64
consentform.html
windows7-x64
1consentform.html
windows10-2004-x64
1libByteAINN.so
debian-9-armhf
1libbuffer.so
debian-9-armhf
1libfile_lock.so
debian-9-armhf
1libgifimage.so
debian-9-armhf
1libheif.so
debian-9-armhf
1libnative-filters.so
debian-9-armhf
1libnpth_dl.so
debian-9-armhf
1libttmverify.so
debian-9-armhf
1libttmverifylite.so
debian-9-armhf
1libvcnverify.so
debian-9-armhf
1libvcnverifylite.so
debian-9-armhf
1webvideo.html
windows7-x64
1webvideo.html
windows10-2004-x64
1zepto.min.js
windows7-x64
1zepto.min.js
windows10-2004-x64
1Resubmissions
08/09/2023, 03:26
230908-dzpm2sgc54 1001/08/2023, 11:42
230801-nvdp4agf6v 1001/08/2023, 11:24
230801-nhn1asge81 10Analysis
-
max time kernel
1926668s -
max time network
162s -
platform
android_x64 -
resource
android-x64-arm64-20230831-en -
resource tags
androidarch:armarch:arm64arch:x64arch:x86image:android-x64-arm64-20230831-enlocale:en-usos:android-11-x64system -
submitted
08/09/2023, 03:26
Static task
static1
Behavioral task
behavioral1
Sample
Lol.apk
Resource
android-x86-arm-20230831-en
Behavioral task
behavioral2
Sample
Lol.apk
Resource
android-x64-20230831-en
Behavioral task
behavioral3
Sample
Lol.apk
Resource
android-x64-arm64-20230831-en
Behavioral task
behavioral4
Sample
amap_resource1_0_0.apk
Resource
android-x86-arm-20230831-en
Behavioral task
behavioral5
Sample
amap_resource1_0_0.apk
Resource
android-x64-20230831-en
Behavioral task
behavioral6
Sample
amap_resource1_0_0.apk
Resource
android-x64-arm64-20230831-en
Behavioral task
behavioral7
Sample
consentform.html
Resource
win7-20230831-en
Behavioral task
behavioral8
Sample
consentform.html
Resource
win10v2004-20230831-en
Behavioral task
behavioral9
Sample
libByteAINN.so
Resource
debian9-armhf-20230831-en
Behavioral task
behavioral10
Sample
libbuffer.so
Resource
debian9-armhf-en-20211208
Behavioral task
behavioral11
Sample
libfile_lock.so
Resource
debian9-armhf-20230831-en
Behavioral task
behavioral12
Sample
libgifimage.so
Resource
debian9-armhf-20230831-en
Behavioral task
behavioral13
Sample
libheif.so
Resource
debian9-armhf-en-20211208
Behavioral task
behavioral14
Sample
libnative-filters.so
Resource
debian9-armhf-20230831-en
Behavioral task
behavioral15
Sample
libnpth_dl.so
Resource
debian9-armhf-20230831-en
Behavioral task
behavioral16
Sample
libttmverify.so
Resource
debian9-armhf-20230831-en
Behavioral task
behavioral17
Sample
libttmverifylite.so
Resource
debian9-armhf-20230831-en
Behavioral task
behavioral18
Sample
libvcnverify.so
Resource
debian9-armhf-20230831-en
Behavioral task
behavioral19
Sample
libvcnverifylite.so
Resource
debian9-armhf-en-20211208
Behavioral task
behavioral20
Sample
webvideo.html
Resource
win7-20230831-en
Behavioral task
behavioral21
Sample
webvideo.html
Resource
win10v2004-20230831-en
Behavioral task
behavioral22
Sample
zepto.min.js
Resource
win7-20230831-en
Behavioral task
behavioral23
Sample
zepto.min.js
Resource
win10v2004-20230831-en
General
-
Target
Lol.apk
-
Size
3.7MB
-
MD5
10f5a518febd8b0b08b7f69982bc0a7d
-
SHA1
77137ca4881b82a9baf3dea99e03ce92c89cc742
-
SHA256
238cdfbab88cbcb6b1a2379b2a18c993640c1f498c4cb0e9faef408331f41c0b
-
SHA512
52c557425b2eff4f244c2c34280118e913574c0b3a51bff966c4fb4538afdc1220ad6f94956098aeb53cee4984aeff30142f148f6e19c1a978af6d0e7801f918
-
SSDEEP
98304:z/Se3GAtk9/CYItyoKmFTwgzOOH2qWS9Rr:+e33tcPItTvFcg5W6b
Malware Config
Extracted
hook
http://193.233.196.2:3434
Extracted
hook
http://193.233.196.2:3434
Signatures
-
Hook
Hook is an Android malware that is based on Ermac with RAT capabilities.
-
Makes use of the framework's Accessibility service. 3 IoCs
description ioc Process Framework service call android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId com.dogilowopuna.zico Framework service call android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByViewId com.dogilowopuna.zico Framework service call android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByText com.dogilowopuna.zico -
Acquires the wake lock. 1 IoCs
description ioc Process Framework service call android.os.IPowerManager.acquireWakeLock com.dogilowopuna.zico -
Loads dropped Dex/Jar 1 IoCs
Runs executable file dropped to the device during analysis.
ioc pid Process /data/user/0/com.dogilowopuna.zico/app_DynamicOptDex/pskPXGY.json 4465 com.dogilowopuna.zico -
Reads information about phone network operator.
-
Requests disabling of battery optimizations (often used to enable hiding in the background). 1 IoCs
description ioc Process Intent action android.settings.REQUEST_IGNORE_BATTERY_OPTIMIZATIONS com.dogilowopuna.zico -
Removes a system notification. 1 IoCs
description ioc Process Framework service call android.app.INotificationManager.cancelNotificationWithTag com.dogilowopuna.zico
Processes
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
3KB
MD5ce9ab1e3e554bf9961b18e6cdb06a4f7
SHA132770227381320d116224f7bf924e60fc140464b
SHA2564ddea8401595b4f85daee925ff7876aad5c555df2de577843206d53e2cf39636
SHA5126d0fbd1f0195cd1da12b92108cf38675a7829fc56f129778213911db33d8e48e2cf86418405bbb544165fa530d8fa2d58e720fac50fee421df13a980e1e95a89
-
Filesize
704KB
MD59bfea1b2027ec1635c3590e0ea14e3cf
SHA19cc1ea7f49e361961be1f5d2ab43658d41f86d59
SHA256f2620b302348120f00c9bd7a3e0a6cbef991b484edcdcdd915fbbd13ac861eb4
SHA5124e17d67bcd5f5361a3d9b27f4fbc29969b25a2686edffa9872e7bca1a6528b4eaaf7f90541eda8d31583d8e515b1a20d4d1b20dd4a88c9e83e07d91d525de4a1
-
Filesize
704KB
MD54c5cc08fbf8fe10e34fc490fef580f3c
SHA192f11a0ec664e21d5546109af27ac481d4741b8f
SHA256604976f65004e5c54cd7ded095be2b42aae134c7e48c4bbef1faea342b8ed878
SHA512f69b6877c057b0907b60a429d20af46f48931b3e95ab429ec2f580e1c6fa61232b0177a3dac18292f7bb4cef82d3dfe9e9263d929ffa1a8ffc1fb0319d3ab214
-
Filesize
1.5MB
MD5cf80a0964d7adb2dc9ab389185abcff1
SHA1a630b6d63b9be79f2fe9f2fc38c91fcbc1d8d6ea
SHA256f90f95cb686db2f9ce0607038438527e3665ca8e33c38fd168834f6d96def4ed
SHA512ef1a6f7c47772fd49ae2fda552df4f54fea83e30c99980ae8e0863b4abcfe2d7cb9869449962129cb560760d49ee6349add36e6ca7417e6cf0e9f99d86a3ee53
-
Filesize
4KB
MD57e858c4054eb00fcddc653a04e5cd1c6
SHA12e056bf31a8d78df136f02a62afeeca77f4faccf
SHA2569010186c5c083155a45673017d1e31c2a178e63cc15a57bbffde4d1956a23dad
SHA512d0c7a120940c8e637d5566ef179d01eff88a2c2650afda69ad2a46aad76533eaace192028bba3d60407b4e34a950e7560f95d9f9b8eebe361ef62897d88b30cb
-
Filesize
512B
MD5982193774cb48e8d321a33f9c3b694e4
SHA1bd605f44183872f29e84028cd2418915bb81d4de
SHA256f005010ec69ade9a6c037d8c2f174aa1a16031b146bfc09d3d1c75280ae5f609
SHA512bc220503bd124069ee924dcc33f7a81b9ab7c114120d88e7e4f81194d2f5d15652e3063234e6d77a9574002da69a972b3ee94b37135078b7316571b9dd9a29f5
-
Filesize
32KB
MD5bb7df04e1b0a2570657527a7e108ae23
SHA15188431849b4613152fd7bdba6a3ff0a4fd6424b
SHA256c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479
SHA512768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012
-
Filesize
16KB
MD541ef082384bc494d2d9dad3916e1387b
SHA18614b17dd0b7ca0110bc80985d9f7daa9a6e9508
SHA256c04b0fe979a5f93679857c7dd7fcdddd612ca62c62b8fa57747a54c511ed1c07
SHA5121e58ba4edf99e00b6d11430663ed6934b5d9c8718f44b97d5244bd7b9ded2f9ead25d0a852cb795ea925a743b6443385f9c133c1ef3ed1919925b3cd9e345472
-
Filesize
108KB
MD5689cc31b08b3333b1401247a3bfa52bb
SHA1293388b41fc31506f696aaad11e55ae22c0840fc
SHA2561c1dd8678dc314e9eb98990a36ae28c0690ea109f7a6817107c8c9a80c482a75
SHA512a379a3df68b86c38e5c18af6a942a1cb78b70ca04844e5b654c64ca719d8ded0d443d3118d89f98387d4607c431407a38242cb431155680ebb23a9d4ca35aa42
-
Filesize
173KB
MD52c9541b28a5c7d6003a4689c346c99ff
SHA10729ddb0031ea37a4d4098eba66ebb7d97fa8613
SHA256000fd7e611565c6b4d49b466658e606d1c176384c8dbfcd381800f45b0ecdb4b
SHA512548e2ac969e6d378653f938c081e52ae230c3b9781e60b8c19cbbc8942dcd36a212477f3e71c6dacef455652085937a6c8ca73cf90fec0041b768e47b25e4864