Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Resubmissions
11/12/2023, 11:24
231211-nhpltsdcam 711/12/2023, 10:18
231211-mb7ndsbhfp 708/12/2023, 21:22
231208-z76r7aedd2 7Analysis
-
max time kernel
1487434s -
max time network
1335s -
platform
android_x86 -
resource
android-x86-arm-20231023-en -
resource tags
androidarch:armarch:x86image:android-x86-arm-20231023-enlocale:en-usos:android-9-x86system -
submitted
11/12/2023, 11:24
Static task
static1
Behavioral task
behavioral1
Sample
you-tube.apk
Resource
android-x86-arm-20231023-en
Behavioral task
behavioral2
Sample
you-tube.apk
Resource
android-x64-arm64-20231023-en
General
-
Target
you-tube.apk
-
Size
19.0MB
-
MD5
51b9845b4f63d3b70a67580017720ec7
-
SHA1
6d93642bcbd4f29e915dca06ca52124a084ea61b
-
SHA256
c50bcd4191a62a7dc7502c8ba07d9d55df49c14e37d1c599192552469c471433
-
SHA512
4789abcea248d0993f016300b0626d0aded12b9a5449feae30ddb66b3cf711978d75954bb3e4fc4a3f80abbdde4826befa6f37e99faba02ea0f65a1501901d41
-
SSDEEP
393216:oXNNdcrT8FMpWCU99Etf+gP5LDrqkriU0S57HQRc1l:6NNarT8FMpC99ENDP5LDrqkriUL57HQo
Malware Config
Signatures
-
Loads dropped Dex/Jar 2 IoCs
Runs executable file dropped to the device during analysis.
ioc pid Process /data/user/0/com.drama.tvbox.documentary.amovie.ymusi/cache/1689111357674.jar 4294 com.drama.tvbox.documentary.amovie.ymusi /data/user/0/com.drama.tvbox.documentary.amovie.ymusi/cache/1689111357674.jar 4486 /system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.drama.tvbox.documentary.amovie.ymusi/cache/1689111357674.jar --output-vdex-fd=161 --oat-fd=162 --oat-location=/data/user/0/com.drama.tvbox.documentary.amovie.ymusi/cache/oat/x86/1689111357674.odex --compiler-filter=quicken --class-loader-context=& -
Reads information about phone network operator.
-
Uses Crypto APIs (Might try to encrypt user data) 1 IoCs
description ioc Process Framework API call javax.crypto.Cipher.doFinal com.drama.tvbox.documentary.amovie.ymusi
Processes
-
com.drama.tvbox.documentary.amovie.ymusi1⤵
- Loads dropped Dex/Jar
- Uses Crypto APIs (Might try to encrypt user data)
PID:4294 -
/system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.drama.tvbox.documentary.amovie.ymusi/cache/1689111357674.jar --output-vdex-fd=161 --oat-fd=162 --oat-location=/data/user/0/com.drama.tvbox.documentary.amovie.ymusi/cache/oat/x86/1689111357674.odex --compiler-filter=quicken --class-loader-context=&2⤵
- Loads dropped Dex/Jar
PID:4486
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
10KB
MD5189d24556179c74f72678b58e01308c1
SHA1d4ed4dc1b0fb6741c6c9434348b159dbea92e0b4
SHA256236eb17c5c14261b62630ebdc5830f4a97d3cf0dbc7bd1de98dfd17d55474353
SHA51227dc7bd75c982173c58d3a02e793616dd6364bbc3d593d1453c5c1cb5dc0ef560b5931a7736ae12c69486fb170ee723bf124747d1b2727a4026281dccbdae9e2
-
Filesize
4KB
MD5f2b4b0190b9f384ca885f0c8c9b14700
SHA1934ff2646757b5b6e7f20f6a0aa76c7f995d9361
SHA2560a8ffb6b327963558716e87db8946016d143e39f895fa1b43e95ba7032ce2514
SHA512ec12685fc0d60526eed4d38820aad95611f3e93ae372be5a57142d8e8a1ba17e6e5dfe381a4e1365dddc0b363c9c40daaffdc1245bd515fddac69bf1abacd7f1
-
Filesize
512B
MD51c4e1e030623a598f487ff545c5e9384
SHA1f0cc72dd91b6e5f9dc09a643a283e8bb50adc089
SHA2560bfd60c54ebbecb66fb5526b1f0c6483fc2b55594d227f0328c5df1c86ac20c1
SHA512bebc51ba8a529d2678cad2c84ab93f6896e06514a5094070c8c2f115314be4561eda2d11fa94f2f06110758df8b78ff5c52c5545a04f43201692c4f3278290f6
-
Filesize
16KB
MD508e2113f08eb08b52d55b70daa1dd0f8
SHA152168b7163b51a828b40a946f57e6d06e91f0b2a
SHA256628d23629fa82561bff3072ddc4948315a6c9c5f0676fa3202d9595dddc5a24c
SHA512fd369a930e845459ebba6cf33052490d10f2994d03dedf1e317745b31d14118893f23de397c80b9e35096ec31ea0290e0affd695f7845bbf0cbcd9375141fb81
-
Filesize
112KB
MD5602be88e7a6bdd316d97aeb7dc20e535
SHA1f3e2388055c6f5a13ce037664d6fa06006d4c1e6
SHA256d1cb845512e9c7e54b6cc0008782eb30717eb17490a884cfda8973850450cb77
SHA5127d8ba40eff9de97082e8488f89326635bfe743d0bbce34303b0470da3baa725feefbc7c825d084c44d78a55b8d58d4b692c5518c75f12f6c613d4453e2bd240f
-
Filesize
120KB
MD5ee454a4b3e7c8ab63f46d5a27dc52a6f
SHA1ded411ddb8bbe95de035abc98a200a89d55b08ab
SHA25614bf9f7d3bcac643661dd684379a19fac59672cae20aa5e46f180bb78059194a
SHA5126318b09648cc433ea3d5931c1ae3ff191b9e15bcdb04326bf6e2faa0cce87685f6d03baaa242205a53e79388965eb954996adae99da7d9330a67792d97f36388
-
Filesize
22KB
MD51ae022c13ce3d4bd976b4e9021315118
SHA10c8817d14a05d9940402800a3384bd7f8cdff9e6
SHA256fdf2b35466c0b803f767da4cb62568688e846aad81a6bf3560197bd47f77a5f3
SHA512aa395e134d5337c7b1b589dcb371121ed4a7accb8c0a9bd732a882dddaabcc48c36e3a7d743e1e058c870476df467cd3c378a7380cea8667b4edeb8cfd8ec0bc
-
Filesize
22KB
MD52800ad09ca14a7a986a6e8becbbbb158
SHA1cff8d824d09296149af1f7f7ad12ebb701f4b8c5
SHA2565b3ace2783fb2b21f30cd4e20a8645e6bd6d59347c44cbfd11141b0d9afcb33e
SHA512c315532db47e93c406308f997b1f81876dc4394838b64f93b3afce0748f1cd1c5b5e490856e5c7be0fc7aef063c0f4dcef73de0cc1a712eebc4f80a443cea7d3