Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
2452244s -
max time network
163s -
platform
android_x64 -
resource
android-x64-arm64-20231215-en -
resource tags
androidarch:armarch:arm64arch:x64arch:x86image:android-x64-arm64-20231215-enlocale:en-usos:android-11-x64system -
submitted
20/12/2023, 09:15
Static task
static1
Behavioral task
behavioral1
Sample
9ae9b5531217a80d8927266a650462ada38e17553d467a4fc288f726a2e2eaba.apk
Behavioral task
behavioral2
Sample
9ae9b5531217a80d8927266a650462ada38e17553d467a4fc288f726a2e2eaba.apk
Resource
android-x64-arm64-20231215-en
Behavioral task
behavioral3
Sample
dmss_v2.apk
Behavioral task
behavioral4
Sample
dmss_v2.apk
Resource
android-x64-20231215-en
Behavioral task
behavioral5
Sample
dmss_v2.apk
Resource
android-x64-arm64-20231215-en
Behavioral task
behavioral6
Sample
dump.apk
Behavioral task
behavioral7
Sample
dump.apk
Resource
android-x64-20231215-en
Behavioral task
behavioral8
Sample
dump.apk
Resource
android-x64-arm64-20231215-en
Behavioral task
behavioral9
Sample
dynamic.apk
Behavioral task
behavioral10
Sample
dynamic.apk
Resource
android-x64-20231215-en
Behavioral task
behavioral11
Sample
dynamic.apk
Resource
android-x64-arm64-20231215-en
General
-
Target
9ae9b5531217a80d8927266a650462ada38e17553d467a4fc288f726a2e2eaba.apk
-
Size
7.5MB
-
MD5
6df90c1e64b8b732103c413563e79226
-
SHA1
cb1c1bbb1856bd1d15c631bb1a2f58a171831d82
-
SHA256
9ae9b5531217a80d8927266a650462ada38e17553d467a4fc288f726a2e2eaba
-
SHA512
7426d36db9dc9bac7ec906082abdf37577f9be4a40a10898a224cd247e2368b7e40f9cd15be5a04c18db7c5d3508a59565eb28157af30e7ca22eaeef18f0dd86
-
SSDEEP
196608:K5mVDLU+Blcp1/wUkqws1RgtJARprFWfiUG:K5mVDAaIZwSNokjMat
Malware Config
Signatures
-
Requests cell location 2 IoCs
Uses Android APIs to to get current cell location.
description ioc Process Framework service call com.android.internal.telephony.ITelephony.getCellLocation com.qihoo.appstore Framework service call com.android.internal.telephony.ITelephony.getAllCellInfo com.qihoo.appstore -
Checks known Qemu files. 3 IoCs
Checks for known Qemu files that exist on Android virtual device images.
ioc Process /system/bin/qemu-props com.qihoo.daemon /system/lib/libc_malloc_debug_qemu.so com.qihoo.daemon /sys/qemu_trace com.qihoo.daemon -
Loads dropped Dex/Jar 1 IoCs
Runs executable file dropped to the device during analysis.
ioc pid Process /data/user/0/com.qihoo.appstore/files/sllak/opt/4479/finalcore.jar 4479 com.qihoo.appstore -
Acquires the wake lock 1 IoCs
description ioc Process Framework service call android.os.IPowerManager.acquireWakeLock com.qihoo.daemon -
Reads information about phone network operator.
-
Uses Crypto APIs (Might try to encrypt user data) 2 IoCs
description ioc Process Framework API call javax.crypto.Cipher.doFinal com.qihoo.appstore Framework API call javax.crypto.Cipher.doFinal com.qihoo.daemon
Processes
-
com.qihoo.appstore1⤵
- Requests cell location
- Loads dropped Dex/Jar
- Uses Crypto APIs (Might try to encrypt user data)
PID:4479
-
com.qihoo.daemon1⤵
- Checks known Qemu files.
- Acquires the wake lock
- Uses Crypto APIs (Might try to encrypt user data)
PID:4518
-
com.qihoo.appstore:critical1⤵PID:4717
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
12KB
MD52e8d2b7e3b1a8758ee427d301314b7ef
SHA132bcf7c03fd4934e1224feaf2114df2ae56d0551
SHA25667b1e827a498e60301f0b57d15e0e342027c49266e8be14c7441dc7f774c299d
SHA5122a7acd5dff858b159ad5ddd05f8392dda9a0d2185dd5b2b4b20ab660d8946bd3686cdaaaeff7317d717a23a2da1d86e5e42e0221e20e55cc020a2d9a16b0869f
-
Filesize
512B
MD59faa62da704c303df3e6caa6b0561367
SHA1779cd651f4bfbaf5e2bf989839cd3ce2b4ce6b8e
SHA256c77e83a77f4fe0e1ac9e460df3f6b5e1f954c4f5a3f570b8d6b8a4d99361e746
SHA512f1e4f2e0044f00b0af26ab9a59bb49368cf403a6549a1b80ea99d82071f08266b9fe0dad985c0e755fa64df452a325231e7a7323c93c79973e698cd76c049ad5
-
Filesize
8KB
MD5e328d125d3109ba34642f5b845a70f85
SHA1ab164e5d34c22f6d677de7b24381e19dfc589643
SHA256d5fe8f3f4d36a680dd4024f529a2d7216ff2811bc37c1d52d09ae0a268f1d1b7
SHA512fe812492a3d5792c83efb11e8d09fd8367fbc82ca7bc8e8e6f58eaa1261ed269c1eeed400d68f88a50e2eccc8e65c6a52fa2e15bc6a4bd9b83599f0ac89787e0
-
Filesize
4KB
MD596443f830f014a2161ca961bfab360d8
SHA112669aa8ad6cedf5429c23df972bf0275e048de8
SHA256d447e56a3ec3aef4a79236d2c449054486db0d904264d799c604646d4a5b9838
SHA512b5d924747434e8803784c56a1e7e3b0cb59ff273347e026b57d6ea0999e8f78c1ecf75fb870af69aad58294c1a9e3b679ad04bf7813d0df8c2127b9ad845716d
-
Filesize
12KB
MD5171aedf968e17a2744d2585715606cb9
SHA1bbeddeb3b89fcf809619c35b4a318a80e7d5b029
SHA256d2ab452d9360848f46af866b870b5c6fc98230b09c72b89cb1a4b2778586678e
SHA51278a0f517ee3d21c153dda6dbfec4187ebaee9d520d7b1b63f358bcb125d08aea53f26943907a56fdeba40161d9fc7e4fd63f9ae3154dd2ad887ba0162738285b
-
Filesize
8KB
MD5e577bde8ca9d011cf744066e0334f526
SHA15af2102d7cf6df215e2dfe23df604eb325c64580
SHA25672dcf658e8d88be7484c2a5291c2cee6110b74bbe64921d32af238c24373f202
SHA5128156d321806bd3c99822b8527b87186d5059e5b46266af55da74f11e00e0744db54651d99f28e85e4b232c65e49357ced9dc3a16dbce80bc5c131a9c34b74399
-
Filesize
8KB
MD54ac510aff599db35410cdde3a3c1f3f0
SHA1996d011fd8ae5221bc3db901e75f3a4bab483560
SHA256e9da8b043f2f9e64e0bda3f97c214839920b95864af8ffb8af0f0db2cba91050
SHA512debab30a1078c6f1a286bd6bfb47a259291ee52b704af9448730fee52067d030cc601b81e5704ee799112464029c8be73faf7816604f5445b0b20600ed035eaa
-
Filesize
512B
MD52e4131803a7cd53ffb3d478a7bcda2c2
SHA1aec8fd395d91ea03d7035bf0b851a328c4c2cbad
SHA25651b57f05feb1a4ee3d0a869d792e514c1d2aee60290c21e95427a505b66f45c0
SHA5129ae90257eb321a7ad98b7425f64a81eb068671094d3c67703698da94b740276bd28fa3a6f2745ae47e34524934d6c5ba927d11171c225c9d33d8def017e4f11f
-
Filesize
8KB
MD5f2958e8c8271b26312aa4e5a586c85a7
SHA1e1af69b161765ea9d62e3f5d1ad297141f9cbbd3
SHA25615dac43f7e31795cf6d610e8be09d92766488195187110f612c34fe705ac7589
SHA5129b7616ce037a1d9982e9bda1f31f91c220e401335df1e09257ecca4cf8335d37bb06ae3bebb9bde9967dbfcfa17d3985a25ecc8bd8c1173c13e38526210637f3
-
Filesize
8KB
MD585634284d310c8b112133a5bff319bf4
SHA1a202ee39c6bbca522fba7c9add485310cdac95e6
SHA2569bced705c9caefb98fe80171bc90eb1bfd99e6252e73282b4fa521f967ad5172
SHA512687086a18c1fd437d149c5a9ddf779fe08454cb183acfc45095b5e619d0af307d19220999a2664ae686aef38578dad2781332a4f94564e0e5f8c58964c42661f
-
Filesize
512B
MD5fd5f09da28996efec2ac6730a1692301
SHA15c141a34e52a31c9b1dd4e332e3a2496ca2703da
SHA25623eae69bf0dd691c74bbd94215a6664e7ffb51d9d65247354a6314e4d21e757d
SHA512602a462aef1c080e6c7019f3e9835110ad9bbfcf1f04b0498f17005f4edb33a7ca73a06d76639de0a528c740533c3600141de24431f8c70e5f86e477f92a244e
-
Filesize
20KB
MD55b8c1dcf057a68205287484c9396d28c
SHA13d9adce9ef4241685710cf40afb78b8c9ec89607
SHA256c7697eef33212f41e3bcffe8434f3fd01700db4717bf1ea60cc0826604e13589
SHA5122bf7977cc261b7385004e50c137222f73965ca19585a41525243f02f4eca7e6a571d73e7be670ceae7649ad0c6dc6a128664d010174a6b727125480602c31ff1
-
Filesize
16KB
MD50f2f4e066d2715d160223674a2f3e357
SHA1dbe4dd0ba15d056b5af61676eee51067d1aa4c43
SHA256f788fa93ee15080a627598c189caff36a90ddede8510bf2d3b5496c028d98773
SHA512b90bc2eb1c7ac330b12b2f8cc02e1d04f19bf86490a24d7d4be1a21fcfb7768a1a1e030355f3e78da8ac247d77f18a6bd3df065575aea990e27beb9a1d069abc
-
Filesize
512B
MD551db4e70328f6da3b63f2e59a6ac4d97
SHA1ad4b325123a235512c783d2c62adf71cfe12b493
SHA25642158faa697b3bb68d814d97fc2972cbe49f3c7385dae0bae556686a2853f072
SHA512c24cabceac4209e3e3c78b73a8b823f86999e4e78482ecd21718543d43415a293840581db1d5c3b59ef2db35f261d9ef0bb268b23e3e9b6c72769daeb55cd5ed
-
Filesize
8KB
MD512e6ada804ba1815ab3629319fe301cf
SHA1999200eb7f70b4a99ba26009c3279aafc23c516f
SHA256e9db3db0aca4e4e8377e4a904608c93f4dcbd5fb93fccae87beaf6b0cb781075
SHA5127b39095bf9dc5888ed78827a608cc2be63c8f0ed39150f8417e6b88bf62f44acdd9d568768aef361ba82d1b1d20272a5fcd1f63f36c2618ed0342c18c6ad1bbf
-
Filesize
8KB
MD52e0eb8a74776f3aaa3d68aeed75615ae
SHA14e2732a42764491813390ee8045497cc48d73b1f
SHA2563c98d56c8f3c7e815e647258eabfa7777ec114fabc4b24a94c13f38308db5ad4
SHA512fd07ff3a6e4a01f3967f39f7bf446b430212543cf5d9dffe0b1a353d4275381b9b3d5655e04f7d9c927544a0efabcb84c41a6027faa4c064242fdb2d78b15b40
-
Filesize
4KB
MD57ff77327a7fb0a9ded7a05fb076a8cee
SHA1fcce9bb28137dfb01b3f0b625c25e69a9cde2585
SHA256c1b9e4091893c96a4f502fe3bf811cc40dbbb8989a1a88e92e1b1066a5eb48b4
SHA512a826c5a2bd10509c577b04df391c1f21eb0aa07764db12b010e59517a8fedf82e1bb8706f508ceeda63ecbd36e06bcb2f77a088d63ce3ae304f832969f84028e
-
Filesize
8KB
MD509861d728febb8c63f461cf7157a5796
SHA17b16d234acbe4da35896f29dc6e8b2be23aa5b27
SHA25689976df947ce5b2a6b7fc5d3d5f22ddb075ff41a6ea53dbba7198ddaba171319
SHA51278bd7c1e8c97a99ad537d18455803f0bbf30fa03147b4acf1c9685507f4cab351b91bfacf443f63b14bb8e167ca927b0b38b12eaffda768b9cc644e7e07cae6f
-
Filesize
512B
MD51f762665d5b122f8cd1692ba96582884
SHA17bc3eb99d7b61bdd0805523421a353540acf47bb
SHA25607313ec813045a2a90e950c0b316b475f75d1de8e9ee2e833dc4f2d08649c646
SHA512787ef6be1ea440500a1c7b71d2c6605dab6f547cb3b40a616b443f37e39eb50f2d2a881f0d93c162f306007b84703deb96f92dd82b5254f97cab61c51ab88d34
-
Filesize
8KB
MD532862b20749d5d23ea1b01d1892a7f9c
SHA15ff494b0ea5376d706c454f625f408a9117533cd
SHA2563d28789d84588cb76d2c56b5b84a434124ed55f2d27d66f6743648c171bbecd2
SHA5120315e1c90d608de120b971c092837030383dd91dab9503351f18f7ac2b212cd955c9fb1c7b9dea0c830ce0d39e6a3feba7cb1d66aef23fe21910032092142c67
-
Filesize
20KB
MD52252653e7b771e27d34816586139005f
SHA1b2a9bdee7ba880cbe52d0a41f4a03190d48c0f06
SHA256cedf5ce8e27874c3b635b7ecb3c9c404aa00f6924b45e8901e4c723f8b76b52f
SHA512697d53afaab836022a9a7842f7b4b3db08f0645273b6ae1948387ddfae3b2fa97a2b3cadd6727d3a50ba1873b9dc01b8f5b68d299cda1d2943e71735ec1e20d8
-
Filesize
512B
MD5f20e5d241239aafd0ad001f3f1c0dd3c
SHA13561a09b0ad1e21ad0e222246e9099955daa3287
SHA2568c795290d3603eae64f7f2d366222ca5f4bcb4f5cf1675ef106bab6eabc890bc
SHA5120971c02577db0d37d5fbcc748d3ff16691b6e14db633b70665cc3d4b7e97dd6f59f2f6f89b8eb3f7d477ed51f8647b9aeda10964b0eec77196f5a412d77159be
-
Filesize
8KB
MD5570093ac9baf66278eded49935068b4c
SHA1e1e90d4e626dce534affbf2654f1079d2932f0c9
SHA2560f12383bb00d3d2281b813dbfcc2d1bcb8117025bf20e6c69466055f3355ff81
SHA512d7701892f97888e2793705723cdc7670e6493c60563ee5f266c96bfab97de494e0a1ab62115444fdfa98e51f1de7fd60d1c83625cd0c3216306952549a9099a3
-
Filesize
8KB
MD5909787ffc1125735f649b2a33c0ece87
SHA16447a33728a5e78313eab2469542369930fd7a5f
SHA256bac785f379fef9d04619ec49720988d4f7cbff090bc69b17b592b2f142d8eb13
SHA5126a3af7d2cf2550865796df3bc7a747e63d787b501555ddc1304162b91511cb580465ef0652e2fa3a78dba222de7a17f1e7ffdc4dfbe18bf0be2c98f76ef6b973
-
Filesize
668B
MD5c3073391c9ec348fe20ab07644ebc8e9
SHA14951930d883f4846a081cdf12c38ead798ee5226
SHA2569edf05589d20d2fc138c42f3d11c0367b70dcb5ffdaa82df8b5f726e428d3af0
SHA5125375423e4a50180e68c0760cbc837a4d843c9e126e099d06775de554dbce660b788a82b74a7f6369e641b114d28615ca43f60527b0a8d6ff9a34d926995a4aa9
-
Filesize
20KB
MD59c43e8893b199a364244569416e77c06
SHA13e6037b5e8bc0aabef9e622c4016885f0b1db762
SHA25606f6f2774ab63ce0b5a12bd4f4f739c24cfe8d69558a02ff9f754a18cf1a9f86
SHA512ccc75412401677686a3f43f2a7dca672bc1d3c4d9573785fc8712197c6b4550577348d4fa9319715260690f22a077730afb125e08949aafb04a72a85c4e7ca56
-
Filesize
20KB
MD5db4f21fc62cdeff724ccfce17af9733a
SHA11610aeed8de7769c43ac3b51312355b9c232f4bc
SHA256d4951c705c0be4ec3882c64cfad8a8a3e58fad25c0456bd035ebedc715f52677
SHA512e3d10b20606c4b6dc7e146b68889ab249130a78b4a01343d9a0307ff48c3af5aa95437647f40be42acff37503ce883232047bf9ffc04726020490db6dc5994aa
-
Filesize
676B
MD517de628946efeef0c25d81839774bdee
SHA105fec893921d78f7b9ff758c90802dc3e591e51f
SHA25675816abf2c6505faa9d85269e2c2d85dc86f72c8cdf2adb3804291c54ea628b9
SHA512c7cd57562fd5d29922c30e7c3ab096b5306b1750d3e02a4dab3c8c9aef667236ad88c93841a7e9b81095ad922b921aca08ace7b3e21d71a1482f5358a4d04c20
-
Filesize
520B
MD5b28976f630702cbd7fe88fcc96101dd7
SHA14855ad595be018b6ce283e699ca399fc596143eb
SHA256f718d0f30521b73802ff13370c1d0929aa456856b6a8e6fec34183f31970e592
SHA5128748323a90f8d430ad0fc95c4196642c4a3062282458781f9547a606a3b2ad37ed9626b236c2dc84537fc8d1fa51da1aef7307c52491f5f5bdae6b9714d08df4
-
Filesize
544B
MD584d3c739a82d2ecb4d19a2f0c4d210ac
SHA1ec3e0ede009333707d316f33daaeebcbbabccb0f
SHA25637723d445bba3e600c67b36e41f661e5aaaf82e443764476300056652330e7eb
SHA512e287330ccf9c2e2e1f467fa8804932da2af8c12031069db214e73e352cdfc4cce4d3891909153fd5f0fa2f4b514426013786bb0f0bfe08ca13e705b98407a359
-
Filesize
82KB
MD560eea93b9e0262e6384aa01db5ba5fe5
SHA1f2802c5a18684e9ab6619c32518cad9152044117
SHA256f9647497050367a8b106ed16bcd6bc55a862d080e6691fdec1b9d3f32faa29fd
SHA5129ae75cb641e50287fe196f6a084215c597034e007ec4f15e932134601f4ecde1377fe807ee1e50d9deb194c2447ccd945e5a3f33a66c3d37c9f2b0c0657e9b06
-
Filesize
1005B
MD5a2938341702d17bf670b785d6403e43c
SHA11a347aa3349d09f3c7a19382fdfecd8f18f782a1
SHA256f51a9b61166462bbb1f95c0d5627c4a13d7ef20cb7e19db61b6d1579c346aa20
SHA512e2c6f1d745077edfc004592864c1ce4a372e126187c633eee6300c66d98d218fb308455f5bdef55822b03dcd02bde008cb1719867f6d09da8c966cdbeb00002b
-
Filesize
1KB
MD51850ccf737cd5e67b2c71d51e09f9402
SHA15601167a37e85015328acb9fd87c466dc472cda9
SHA25692295ea2a313847033eb779777a18b1a1ca1503e6c18b2b8ce2eb9d480738374
SHA512d78b63f7cbe2550a473c7a83d09c1c558fc31a2c5427939cb01697ac3476dc6b3955627b7b0ff2efca412860cf6f866dba24ecaafa35cb695b43ec0a94eb157e
-
Filesize
2KB
MD5723142ec74505addfae81f40a7da36f3
SHA17864d1fb94f6add96881c81455e65af731af3136
SHA256b0506eb8789ed64f57dd1169708ac26eb87437d9aeba09e04d9654445eb04da4
SHA512e9c732d192d684467ad3eef5697c49e01494124163b1a68390169f4deb381d43e2773d5538e7c382777e6b924a587d943153839b0b174f96d1b37cf33163cd53
-
Filesize
587B
MD5d8d6130d36096c68b0311efdfc648b96
SHA14ef5ca66a9b2362d6edd936a35f52011f601c143
SHA256f5ebe8c748322d44f1d7c3d6ac18dadf66a506cfbf2ce935f1f2e725049cf67a
SHA5125e0882792be2946fe3977e0dd6a51616ca172317cc195b880baad5e40661ef6bf82c99488f24dcdf1643314e123bc0064d4be62d40cdc10ae339b5d6b0543684
-
Filesize
82KB
MD5075fd8293ae3f0660d33ed6e4c18afa4
SHA190e53cb016655151c4c270b544040bb672bec580
SHA256b9e8fdafae37bb0b84025acdf9bf75d29186fe110882013db30cad329531f061
SHA512326da4e311281ff8c00c95ed6f0d226d14ddc12add70a2f006826f6ea94b3175295de35fb4d91cbc941e8e438aa07370f237564fba21ca3cd660451c89e43965
-
Filesize
190KB
MD523dc19e6fedc47a8ce0ab5030cbc91b5
SHA17731b8be52a78ce6d63186dd0a4fad6a1bdd5fea
SHA2563643ca6c07ec547366f77e5102cfc94ece1e8f9482580418de06320efb71b0fc
SHA512057c558818178a0a9387443b988b2cb0de3dcc65444784b266c744645c34d09222572cd9d9082784b56af7202eccb1c8c16704d8d1c487c52e042ecadeb19531
-
Filesize
509B
MD56702c0440052f2ac95f48c55386292d4
SHA1be68202facd288f07eed0319afe4c50549041ab9
SHA2569b3cd8f0a3663cf42cfb9b4038ec5077798fc56e0ff0a00d85d1ca89f8882807
SHA512845c65b452390e5d2130d0914b8d609f52e15925ee43d24e8c4de6834acad9438f50c333d68e5455ff30374087d8139d3e355b991c579373828901df4bff51a0
-
Filesize
109KB
MD57cb96d38ac8e8ded40d01f8c2d36e254
SHA1799e60ac6b54899f451502991dd43eafd7f84722
SHA256412cdaa8d1e6df3c5c68cd8ea62edbd92d57449dbc6587991c495b7c7d9f86e6
SHA5122a5aa10e59b75954a42d32968b57e5af7bcbaaf4d95224347693a1f6a9f7a76df94c19227c4c5a91eb4e4efec232d1f9de926bde8556c105ec202f9d9c9cb91a
-
Filesize
83B
MD52ead34749dac8f3b7e2462491dcbecf2
SHA1b32dd36bf9a275e7e35ae5052d0a562eca0481d3
SHA256307d3d966affd5db5fc63f9ee47a38bc9f2822ac7167585caff414bfcb458839
SHA512fab8c48d6169a662eb01ab922751fa1b99729cb04e1d05caff7d5a164b26f533bd20ef611bda51b719f7ac354146077d52db1210c3539fd548a0976f96e76386