Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
2382912s -
max time network
130s -
platform
android_x86 -
resource
android-x86-arm-20231215-en -
resource tags
androidarch:armarch:x86image:android-x86-arm-20231215-enlocale:en-usos:android-9-x86system -
submitted
20/12/2023, 03:46
Static task
static1
Behavioral task
behavioral1
Sample
81f437dcb6e3a68ad3badd2cc79ca95361f57bc690ddf4592a50596f4fa44b0e.apk
Resource
android-x86-arm-20231215-en
Behavioral task
behavioral2
Sample
81f437dcb6e3a68ad3badd2cc79ca95361f57bc690ddf4592a50596f4fa44b0e.apk
Resource
android-x64-20231215-en
Behavioral task
behavioral3
Sample
81f437dcb6e3a68ad3badd2cc79ca95361f57bc690ddf4592a50596f4fa44b0e.apk
Resource
android-x64-arm64-20231215-en
General
-
Target
81f437dcb6e3a68ad3badd2cc79ca95361f57bc690ddf4592a50596f4fa44b0e.apk
-
Size
1.6MB
-
MD5
0346504bc015c70d3ef8a3b5274f1295
-
SHA1
5a226ffe700292cc9877e345ba5c544df502c05e
-
SHA256
81f437dcb6e3a68ad3badd2cc79ca95361f57bc690ddf4592a50596f4fa44b0e
-
SHA512
2d09f2fa751ef28385d30a6b6d380a2ec94272ada8f91f72c028377ba74ffaa7bdc8673bb6654a73920e11c5d7ff7c2abcdc63ad82de64f5eaedcc8c994e3ccb
-
SSDEEP
49152:yzVLm0XZUM3OZakjZSDZIfkoB5hkmiLCLtm8S:yo0XmlgNIf1jiktrS
Malware Config
Signatures
-
Loads dropped Dex/Jar 2 IoCs
Runs executable file dropped to the device during analysis.
ioc pid Process /data/user/0/com.level9.oiltrain.transporter.eurotrain.driving.sim.subway/files/93b3fe6d.dex 4439 /system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.level9.oiltrain.transporter.eurotrain.driving.sim.subway/files/93b3fe6d.dex --output-vdex-fd=41 --oat-fd=42 --oat-location=/data/user/0/com.level9.oiltrain.transporter.eurotrain.driving.sim.subway/files/oat/x86/93b3fe6d.odex --compiler-filter=quicken --class-loader-context=& /data/user/0/com.level9.oiltrain.transporter.eurotrain.driving.sim.subway/files/93b3fe6d.dex 4411 com.level9.oiltrain.transporter.eurotrain.driving.sim.subway -
Acquires the wake lock 1 IoCs
description ioc Process Framework service call android.os.IPowerManager.acquireWakeLock com.level9.oiltrain.transporter.eurotrain.driving.sim.subway
Processes
-
com.level9.oiltrain.transporter.eurotrain.driving.sim.subway1⤵
- Loads dropped Dex/Jar
- Acquires the wake lock
PID:4411 -
/system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.level9.oiltrain.transporter.eurotrain.driving.sim.subway/files/93b3fe6d.dex --output-vdex-fd=41 --oat-fd=42 --oat-location=/data/user/0/com.level9.oiltrain.transporter.eurotrain.driving.sim.subway/files/oat/x86/93b3fe6d.odex --compiler-filter=quicken --class-loader-context=&2⤵
- Loads dropped Dex/Jar
PID:4439
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
261KB
MD55448fade2fc7aa579b2f32cea470d4a5
SHA111150277806996f22733209a79b54d5bcca80665
SHA2567816dc7d3f88748d5f0ab9219f0b10f3a30f534e66a2b2aa8f58753d9aa2b7e9
SHA512486f76101c962af221dd47dd2fa160776b6d4ec14ee2f38710cfbe8426bc837a2d978fb16f46e82181e92056dbc4dabbcd7b1c55f245ef1a947b2820a8e9d185
-
Filesize
503B
MD566e5432d419e60da96537ce9f4731df5
SHA1ac73bbea2fb246e44b51bcf6b4e8af30237efe34
SHA256d530ede9a06625c7a4da3ffa76d52a81de21e5e9c7b0445f0c0e45c07b1071d6
SHA512f5f3d4ccf5c500633e03ea81a8118b74cafdcdfab8d63119cdafd1c14d5cd5616af6b85ce7cab3764028164cd119b8519d361c3bff2a01b11d4914f543a80e5f
-
Filesize
739B
MD5501287b1be38d0ff6d035fba21462f9c
SHA117d6fa272401ec3d2e8b8cb1f41b66edeb642364
SHA256f43b861b2363ec6fc295978354386d8bc26ec443594866277a96ed0ad6796475
SHA512c08cddb0ea6abf80575fe55622cc5401ef15ab65a435d35f7df92aa57f4b5375d9f2ae01aff5486c07894b7f87daa794016cdecbdd1a60a130b175a05ed5eae3
-
/data/data/com.level9.oiltrain.transporter.eurotrain.driving.sim.subway/files/PersistedInstallation6327648014050646162tmp
Filesize90B
MD5df71428dacac3441e4b2400b4894376c
SHA198a45d4c7c8704f4db5f17c580bd08c484be36fe
SHA2560ec33dc54423e4ecaa38fc266db79ec290460f97ee44e73904b06a01397cc3d8
SHA5121e35bb78d5a82ce55cf51920ae2bb8a24a94549fe053bf19506f98df0273082b5d19bfe394f9e0cb3cb928ce0be3e781b5321c6522f3e1e4d15023f3a31ccf46
-
/data/data/com.level9.oiltrain.transporter.eurotrain.driving.sim.subway/files/PersistedInstallation8303153058671356688tmp
Filesize569B
MD51bfd7bc4d99af3dfc2fa2a09561bd011
SHA1419bf77fb43d407a6bdd12d2f3b795c83bb3ed44
SHA256107c0643c8a0b2f1c72eccf2592b0c0dece092b02be1347dda57918fb7693224
SHA512b81725e8e304e76cbe63b86a9e4752bf99e6a30e0da5d558376adabacb9b2a8633d538aca65d712d25a0a222b7e7443ea92c4070eb4834c812c82512eee18799
-
Filesize
336B
MD559f0bba04a362c2df97c95a0a366d937
SHA14c37989992d8b64d8aae5e86c6e958df9cd17ccc
SHA256a1794bab86884027c52c0b0610308e3bb337bb700dc534a9d7d5775c69e8aff8
SHA512e9700e45a36d15e355d5f17f64da9b609aeb19045bdd28e514b348cc2e98bdecbe0919fa4773e64d76d866fe8ad634f6c7a9df82806995f5879e14de5be72434
-
Filesize
336B
MD52b22bdd1348c57fb6712121606f9eab3
SHA17631a11d5314e7f452d532b31ab464231826934c
SHA25633d835669620c21bd9eaf35f32322e64d22092c4ced559e566ca7fb0b8013d9a
SHA512ca860d69d39ef267adc7fbec6ff0fe5a6d595ea813deba33bbccc041d117e9ce063fd457f4f92a49bbfe262f399cea3236f92e842abd7542d62a8d203561e4a6
-
Filesize
336B
MD5872fa7eee9d2c3a20f5c0af9e02dd775
SHA1cdd191662e4592152813d8f21ab2991aa2c15c34
SHA25679238bbb254b5bd52009056419d9c24c52fd00c1cb739743c18fe79127d48ece
SHA5123b713ae7c29b9585c87af7fd0fc42ce8f8ba121de2611a71add0e6e7fd4e578b2d45548b84b8a4ad5b1a0152f3038fa6b4f545d4c5e0bcfe02ca0510bd95b29e
-
Filesize
613KB
MD5829a78d6a6571604b7f7f49e577719e9
SHA16ef60487216abdeae20ba43c291ac93c7b1dd631
SHA2565d72c4d14c8b256e195c360e2262ada4032fa2d2c5ce4528404da408fe2dce98
SHA5125471b1b9b9714e3ceca5a30e26362416c17335fa0869caf7cebd0afb96125646727c6473bf91f48f46ed3e8fe95d72f602f3043a8c3a09365b442f822c73c531