Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Resubmissions
11/12/2023, 11:24 UTC
231211-nhpltsdcam 711/12/2023, 10:18 UTC
231211-mb7ndsbhfp 708/12/2023, 21:22 UTC
231208-z76r7aedd2 7Analysis
-
max time kernel
1487526s -
max time network
1333s -
platform
android_x64 -
resource
android-x64-arm64-20231023-en -
resource tags
androidarch:armarch:arm64arch:x64arch:x86image:android-x64-arm64-20231023-enlocale:en-usos:android-11-x64system -
submitted
11/12/2023, 11:24 UTC
Static task
static1
Behavioral task
behavioral1
Sample
you-tube.apk
Resource
android-x86-arm-20231023-en
Behavioral task
behavioral2
Sample
you-tube.apk
Resource
android-x64-arm64-20231023-en
General
-
Target
you-tube.apk
-
Size
19.0MB
-
MD5
51b9845b4f63d3b70a67580017720ec7
-
SHA1
6d93642bcbd4f29e915dca06ca52124a084ea61b
-
SHA256
c50bcd4191a62a7dc7502c8ba07d9d55df49c14e37d1c599192552469c471433
-
SHA512
4789abcea248d0993f016300b0626d0aded12b9a5449feae30ddb66b3cf711978d75954bb3e4fc4a3f80abbdde4826befa6f37e99faba02ea0f65a1501901d41
-
SSDEEP
393216:oXNNdcrT8FMpWCU99Etf+gP5LDrqkriU0S57HQRc1l:6NNarT8FMpC99ENDP5LDrqkriUL57HQo
Malware Config
Signatures
-
Checks Android system properties for emulator presence. 1 IoCs
description ioc Process Accessed system property key: ro.product.model com.drama.tvbox.documentary.amovie.ymusi -
Loads dropped Dex/Jar 3 IoCs
Runs executable file dropped to the device during analysis.
ioc pid Process /system_ext/framework/androidx.window.sidecar.jar 4552 com.drama.tvbox.documentary.amovie.ymusi /system_ext/framework/androidx.window.sidecar.jar 4552 com.drama.tvbox.documentary.amovie.ymusi /data/user/0/com.drama.tvbox.documentary.amovie.ymusi/cache/1689111357674.jar 4552 com.drama.tvbox.documentary.amovie.ymusi -
Reads information about phone network operator.
-
Uses Crypto APIs (Might try to encrypt user data) 1 IoCs
description ioc Process Framework API call javax.crypto.Cipher.doFinal com.drama.tvbox.documentary.amovie.ymusi
Processes
Network
-
Remote address:1.1.1.1:53Requestwww.google.comIN AResponsewww.google.comIN A100.89.51.55
-
Remote address:100.108.79.183:80RequestGET /generate_204 HTTP/1.1
Connection: close
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.32 Safari/537.36
Host: play.googleapis.com
Accept-Encoding: gzip
ResponseHTTP/1.0 404 Not Found
-
Remote address:1.1.1.1:53Requestssl.google-analytics.comIN AResponsessl.google-analytics.comIN A100.122.62.186
-
Remote address:1.1.1.1:53Requestpipedapi.kavin.rocksIN AResponsepipedapi.kavin.rocksIN A100.75.84.132
-
Remote address:1.1.1.1:53Requestkupeer.comIN AResponsekupeer.comIN A100.102.152.138
-
Remote address:100.102.152.138:80RequestGET /advnew/http.json HTTP/1.1
Host: kupeer.com
Connection: keep-alive
User-Agent: com.drama.tvbox.documentary.amovie.ymusi/43 (Linux; U; Android 11; en_US; Pixel 2; Build/RSR1.210722.013; Cronet/113.0.5672.61)
Accept-Encoding: gzip, deflate
ResponseHTTP/1.0 404 Not Found
-
Remote address:100.102.152.138:80RequestGET /advnew/http1.json HTTP/1.1
Host: kupeer.com
Connection: keep-alive
User-Agent: com.drama.tvbox.documentary.amovie.ymusi/43 (Linux; U; Android 11; en_US; Pixel 2; Build/RSR1.210722.013; Cronet/113.0.5672.61)
Accept-Encoding: gzip, deflate
ResponseHTTP/1.0 404 Not Found
-
Remote address:1.1.1.1:53Requestandroid.apis.google.comIN AResponseandroid.apis.google.comIN A100.90.66.194
-
Remote address:100.108.79.183:80RequestGET /generate_204 HTTP/1.1
Connection: close
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.32 Safari/537.36
Host: play.googleapis.com
Accept-Encoding: gzip
ResponseHTTP/1.0 404 Not Found
-
Remote address:1.1.1.1:53Requestwww.google.comIN AResponsewww.google.comIN A100.123.252.208
-
Remote address:1.1.1.1:53Requestpipedapi.smnz.deIN AResponsepipedapi.smnz.deIN A100.67.61.127
-
Remote address:1.1.1.1:53Requestgoogleads.g.doubleclick.netIN AResponsegoogleads.g.doubleclick.netIN A100.84.1.195
-
Remote address:100.102.152.138:80RequestGET /mugame5/ HTTP/1.1
Host: kupeer.com
Connection: keep-alive
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Linux; Android 11; Pixel 2 Build/RSR1.210722.013; wv) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/83.0.4103.106 Mobile Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
X-Requested-With: com.drama.tvbox.documentary.amovie.ymusi
Accept-Encoding: gzip, deflate
Accept-Language: en-US,en;q=0.9
ResponseHTTP/1.0 404 Not Found
-
Remote address:100.102.152.138:80RequestGET /favicon.ico HTTP/1.1
Host: kupeer.com
Connection: keep-alive
User-Agent: Mozilla/5.0 (Linux; Android 11; Pixel 2 Build/RSR1.210722.013; wv) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/83.0.4103.106 Mobile Safari/537.36
Accept: image/webp,image/apng,image/*,*/*;q=0.8
X-Requested-With: com.drama.tvbox.documentary.amovie.ymusi
Referer: http://kupeer.com/mugame5/
Accept-Encoding: gzip, deflate
Accept-Language: en-US,en;q=0.9
ResponseHTTP/1.0 404 Not Found
-
Remote address:100.108.79.183:80RequestGET /generate_204 HTTP/1.1
Connection: close
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.32 Safari/537.36
Host: play.googleapis.com
Accept-Encoding: gzip
ResponseHTTP/1.0 404 Not Found
-
Remote address:1.1.1.1:53Requestrcs-acs-tmobile-us.jibe.google.comIN AResponsercs-acs-tmobile-us.jibe.google.comIN A100.108.15.88
-
Remote address:100.102.152.138:80RequestGET /mugame5/ HTTP/1.1
Host: kupeer.com
Connection: keep-alive
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Linux; Android 11; sdk_gphone_x86_64_arm64 Build/RSR1.210722.013; wv) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/83.0.4103.106 Mobile Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
X-Requested-With: com.drama.tvbox.documentary.amovie.ymusi
Accept-Encoding: gzip, deflate
Accept-Language: en-US,en;q=0.9
ResponseHTTP/1.0 404 Not Found
-
Remote address:100.102.152.138:80RequestGET /favicon.ico HTTP/1.1
Host: kupeer.com
Connection: keep-alive
User-Agent: Mozilla/5.0 (Linux; Android 11; sdk_gphone_x86_64_arm64 Build/RSR1.210722.013; wv) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/83.0.4103.106 Mobile Safari/537.36
Accept: image/webp,image/apng,image/*,*/*;q=0.8
X-Requested-With: com.drama.tvbox.documentary.amovie.ymusi
Referer: http://kupeer.com/mugame5/
Accept-Encoding: gzip, deflate
Accept-Language: en-US,en;q=0.9
ResponseHTTP/1.0 404 Not Found
-
Remote address:100.108.79.183:80RequestGET /generate_204 HTTP/1.1
Connection: close
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.32 Safari/537.36
Host: play.googleapis.com
Accept-Encoding: gzip
ResponseHTTP/1.0 404 Not Found
-
Remote address:100.108.79.183:80RequestGET /generate_204 HTTP/1.1
Connection: close
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.32 Safari/537.36
Host: play.googleapis.com
Accept-Encoding: gzip
ResponseHTTP/1.0 404 Not Found
-
969 B 1.6kB 7 6
-
919 B 1.6kB 7 6
-
641 B 408 B 8 7
HTTP Request
GET http://play.googleapis.com/generate_204HTTP Response
404 -
919 B 1.6kB 7 6
-
517 B 1.4kB 6 5
-
867 B 1.6kB 6 6
-
673 B 460 B 8 8
HTTP Request
GET http://kupeer.com/advnew/http.jsonHTTP Response
404 -
674 B 460 B 8 8
HTTP Request
GET http://kupeer.com/advnew/http1.jsonHTTP Response
404 -
695 B 40 B 1 1
-
867 B 1.6kB 6 5
-
919 B 1.6kB 7 6
-
919 B 1.6kB 7 6
-
641 B 460 B 8 8
HTTP Request
GET http://play.googleapis.com/generate_204HTTP Response
404 -
243 B 80 B 2 2
-
919 B 1.6kB 7 5
-
919 B 1.6kB 7 5
-
867 B 1.6kB 6 6
-
919 B 1.6kB 7 6
-
907 B 1.5kB 7 4
-
919 B 1.6kB 7 5
-
867 B 1.6kB 6 6
-
867 B 1.6kB 6 6
-
867 B 1.6kB 6 6
-
867 B 1.6kB 6 6
-
867 B 1.6kB 6 6
-
954 B 460 B 8 8
HTTP Request
GET http://kupeer.com/mugame5/HTTP Response
404 -
879 B 460 B 8 8
HTTP Request
GET http://kupeer.com/favicon.icoHTTP Response
404 -
867 B 1.6kB 6 6
-
919 B 1.6kB 7 5
-
641 B 460 B 8 8
HTTP Request
GET http://play.googleapis.com/generate_204HTTP Response
404 -
517 B 1.4kB 6 5
-
867 B 1.6kB 6 6
-
867 B 1.6kB 6 5
-
919 B 1.6kB 7 6
-
919 B 1.6kB 7 6
-
867 B 1.6kB 6 6
-
919 B 1.6kB 7 6
-
919 B 1.6kB 7 5
-
867 B 1.6kB 6 6
-
970 B 460 B 8 8
HTTP Request
GET http://kupeer.com/mugame5/HTTP Response
404 -
867 B 1.6kB 6 6
-
867 B 1.6kB 6 6
-
895 B 460 B 8 8
HTTP Request
GET http://kupeer.com/favicon.icoHTTP Response
404 -
867 B 1.6kB 6 6
-
517 B 1.4kB 6 5
-
919 B 1.6kB 7 5
-
128 B 40 B 2 1
-
565 B 40 B 1 1
-
867 B 1.6kB 6 5
-
597 B 1.4kB 8 5
-
517 B 1.4kB 6 5
-
919 B 1.6kB 7 6
-
641 B 460 B 8 8
HTTP Request
GET http://play.googleapis.com/generate_204HTTP Response
404 -
867 B 1.6kB 6 5
-
520 B 10
-
520 B 10
-
517 B 1.4kB 6 5
-
517 B 1.4kB 6 5
-
517 B 1.4kB 6 5
-
517 B 1.4kB 6 5
-
919 B 1.6kB 7 5
-
641 B 408 B 8 7
HTTP Request
GET http://play.googleapis.com/generate_204HTTP Response
404 -
867 B 1.6kB 6 5
-
867 B 1.6kB 6 6
-
517 B 1.4kB 6 5
-
517 B 1.4kB 6 5
-
517 B 1.4kB 6 5
-
3.7kB 11
-
60 B 90 B 1 1
DNS Request
www.google.com
DNS Response
100.89.51.55
-
70 B 110 B 1 1
DNS Request
ssl.google-analytics.com
DNS Response
100.122.62.186
-
66 B 102 B 1 1
DNS Request
pipedapi.kavin.rocks
DNS Response
100.75.84.132
-
56 B 82 B 1 1
DNS Request
kupeer.com
DNS Response
100.102.152.138
-
69 B 108 B 1 1
DNS Request
android.apis.google.com
DNS Response
100.90.66.194
-
60 B 90 B 1 1
DNS Request
www.google.com
DNS Response
100.123.252.208
-
62 B 94 B 1 1
DNS Request
pipedapi.smnz.de
DNS Response
100.67.61.127
-
73 B 116 B 1 1
DNS Request
googleads.g.doubleclick.net
DNS Response
100.84.1.195
-
80 B 130 B 1 1
DNS Request
rcs-acs-tmobile-us.jibe.google.com
DNS Response
100.108.15.88
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
10KB
MD5189d24556179c74f72678b58e01308c1
SHA1d4ed4dc1b0fb6741c6c9434348b159dbea92e0b4
SHA256236eb17c5c14261b62630ebdc5830f4a97d3cf0dbc7bd1de98dfd17d55474353
SHA51227dc7bd75c982173c58d3a02e793616dd6364bbc3d593d1453c5c1cb5dc0ef560b5931a7736ae12c69486fb170ee723bf124747d1b2727a4026281dccbdae9e2
-
Filesize
512B
MD5674b23bf16ac808f920a53da4b32790e
SHA16d966299ed1823eddb50e99969aa84fe7688c340
SHA2569cce76b906070b0627409b358534c0d5dd6158496901f958c8b7187e7c15a7d2
SHA5120e7d2b2f9e718d175bb4257a148d75c90f06bd75909ecdf2179bb07250ebb692bc41af3eb4849e962c948e968a50bc49e05adac54ea8f45aa3bed0ed69a3262c
-
Filesize
16KB
MD56ebe9b0d366ade2a906398e9bda5324d
SHA172eb058a45ad239235cf0d46e69f7cbca5300f92
SHA2567b6b1938fb454c60af4916565cc0e9073e7e6ddcf987a550a68b609685fd3fcf
SHA51257f2028056adaf2f74b43423af4f9e6cd886a65802607fa009c7ef50853896fc8c39d8081c68e4f54f357680f9250f396180bc8d40a7d3431b98777c23951638
-
Filesize
112KB
MD59ced6377f2fd7d554b19af004416cb43
SHA1f52640fdc3dc37e2ff037c6e410ffb1c9da364ad
SHA25667858b3b91545f949e48c3a172c15b6ca100a30978010a1e6ab994afba7156b7
SHA5124cb647c8ccc522babb211fb82697a187bc81cf94e46ff247c4a6420e60a0e8eed21855053cd7ce2ecc9a4cdb6ff18f96691b639969273e24d03be38f60bb6b5d
-
/data/data/com.drama.tvbox.documentary.amovie.ymusi/files/profileinstaller_profileWrittenFor_lastUpdateTime.dat
Filesize8B
MD54942713c23de75df1e14763176257263
SHA137b151715848b6608accdc1e1b400d34134ecaf0
SHA256974932845067e237ca5b5f466c3e23f52671e11eb2ccd6105be03898079b9689
SHA5120ad22117b8931c1956588a713beef7a80241ce8ace8b7ebdf21e2952cb8dd1fb68ca1f0727cca7c8debda19741a00d83575c260ed64c9fc15f341c9078383250
-
Filesize
4KB
MD57e858c4054eb00fcddc653a04e5cd1c6
SHA12e056bf31a8d78df136f02a62afeeca77f4faccf
SHA2569010186c5c083155a45673017d1e31c2a178e63cc15a57bbffde4d1956a23dad
SHA512d0c7a120940c8e637d5566ef179d01eff88a2c2650afda69ad2a46aad76533eaace192028bba3d60407b4e34a950e7560f95d9f9b8eebe361ef62897d88b30cb
-
Filesize
512B
MD59155531aebe5053067cde4556545d2f9
SHA196e4b2fb06627d5e2f96fcfae28847ae9b661dbe
SHA25638f6e93703f3638eb9cb6b0b5a46871713b44293077637a228c0c869db1c6996
SHA51227229b9b7098ea25f0d5e2f847e42ca865ffb78e618b8c8061cbf82e6e455818146359e125612bf8fe6f4b5425e529ae8ed5c83032b7a4b24776f24c771c79da
-
Filesize
32KB
MD5bb7df04e1b0a2570657527a7e108ae23
SHA15188431849b4613152fd7bdba6a3ff0a4fd6424b
SHA256c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479
SHA512768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012
-
Filesize
16KB
MD559747dc44c4cc95c778b2bccdb2408f1
SHA187dd4db654825eebdac929b10d5e178a67dadd49
SHA25693916755e58d1167437663abb84c410c1ba218e2735f929371480784005dd152
SHA512d9bffb2e9e78a310350c306408410e89d0fd5888f8c52e791b9b73adb74ac85b9ffc457a26855c92dd87298286903ae5db5e2528913f771171fa51932edebf77
-
Filesize
112KB
MD507d77bf3ff1fe807cd9eeebfeafa4eed
SHA1e44ae7d5da78b76f640b88c392e173724a98cb97
SHA25675b05b8dbc549a1e6049c053b2bdcf6eec53d1a45832bde47d719c2bf0817c08
SHA512a28f7350ef1b82a37783b6483126b30df5f03a99c5b77854ac3fe754eb221ac0b5b84456436e3c9eef88b1ac1cfa7c71e29453f3db20d6de23c0fe6fc7b32c2f
-
Filesize
177KB
MD55bb29fbed887c4696f96767d9a8666b3
SHA1c11f9727f2d713e7b89cb2a0fb93d366fc0392a9
SHA256b2d76ff684caac7061665a4cd245f91f649149e5b92498b88c7b94a30fc45ace
SHA5120dab7570a7e8308b014ecbe5a77dfd3d0354354d778536379a829cda7c346bcbd5f55d3d4245af56ca618d160b5f714d4d1a7ff98a40f3991a5a5c566301eb50
-
Filesize
8KB
MD594bfbc35e120d006fd6bf0c8ee049a1f
SHA1d4421a6860b82879f26dcc4cab4e9da2eeab57eb
SHA256ec4d024c1c267173c93f6ecef14e0f17be4d0b20be262201acdf20e5058c8f07
SHA512831b345f3794ca5e41d9763b6ca2d282d0c434dfdd1b998e74cd0586345a8c6ca2f18ff2495f3f8e7ca70c656c06a508ddab8b74dfb2548ab772b2c52709b077
-
Filesize
2KB
MD5335d8a7569a611cf4e6fd8bf0e2ed755
SHA15aa25b6a0dc776d751d51b54f8c577d78dbe2cce
SHA256c397b5ffa87e347553324226c24ff03a93b5520384fed8ef771d82935fbce833
SHA512def9d3239acbe5f09c623755992bdd0622f0bcbe0f70e9a0065abcdb06d5948cea6b5e6ea31c38835f299c8633ef07a9ce03868f62a535e4e88439b67f4b3e51
-
Filesize
22KB
MD52800ad09ca14a7a986a6e8becbbbb158
SHA1cff8d824d09296149af1f7f7ad12ebb701f4b8c5
SHA2565b3ace2783fb2b21f30cd4e20a8645e6bd6d59347c44cbfd11141b0d9afcb33e
SHA512c315532db47e93c406308f997b1f81876dc4394838b64f93b3afce0748f1cd1c5b5e490856e5c7be0fc7aef063c0f4dcef73de0cc1a712eebc4f80a443cea7d3
-
Filesize
12KB
MD5bdf3529e80318eb14e53a5bf3720c10d
SHA125c9ace4b1af6e80ebb2572345972c56505969ba
SHA256bbc8300dd1e9cd08de8f66560c1ac2c928615b72b51cef9649f88974f586d64b
SHA51248b9c2d01171bb651b9b54826baa51f4add48431a3efd8ceb5f7cc3bcd6f8f37edf47fabb24349dd15b3a02329cd450f90a8d164bf4f8dfae554bf3b35a8a55b