Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
2537921s -
max time network
139s -
platform
android_x86 -
resource
android-x86-arm-20231215-en -
resource tags
androidarch:armarch:x86image:android-x86-arm-20231215-enlocale:en-usos:android-9-x86system -
submitted
23/12/2023, 15:18
Static task
static1
Behavioral task
behavioral1
Sample
3bbbdfc6d338464af8d1ec131e263149600cf88878d95a7ca69af67fbc265fa4.apk
Resource
android-x86-arm-20231215-en
Behavioral task
behavioral2
Sample
3bbbdfc6d338464af8d1ec131e263149600cf88878d95a7ca69af67fbc265fa4.apk
Resource
android-x64-arm64-20231215-en
General
-
Target
3bbbdfc6d338464af8d1ec131e263149600cf88878d95a7ca69af67fbc265fa4.apk
-
Size
11.4MB
-
MD5
65100f37c5c9b5eaf82abdd0deb5ee4b
-
SHA1
eb4051f400e2ee6ecc33ad517222167a82c11bfe
-
SHA256
3bbbdfc6d338464af8d1ec131e263149600cf88878d95a7ca69af67fbc265fa4
-
SHA512
e78d60b721c3f28180b13150d00631da9b463c1a678d1056e1336793b75089f8901ec1d060937b38d2ee0cd09ff3d9b7caf8c914c6157a49ab45d17e0d035d1e
-
SSDEEP
196608:2zf4JkYLmln/IqNO54OkNmG+pcVLNNfJu/L4jEwPxc9PFoz:2T4JTmlhNg4VLNNBu/LwA98
Malware Config
Signatures
-
Uses Crypto APIs (Might try to encrypt user data) 1 IoCs
description ioc Process Framework API call javax.crypto.Cipher.doFinal com.xgbuy.xg
Processes
-
com.xgbuy.xg1⤵
- Uses Crypto APIs (Might try to encrypt user data)
PID:4219 -
chmod 755 /data/user/0/com.xgbuy.xg/.jiagu/libjiagu.so2⤵PID:4244
-
-
chmod 755 /data/user/0/com.xgbuy.xg/.jiagu/libjiagu.so2⤵PID:4303
-
-
/system/bin/dex2oat --instruction-set=x86 --dex-file=/data/data/com.xgbuy.xg/.jiagu/classes.dex --dex-file=/data/data/com.xgbuy.xg/.jiagu/classes.dex!classes2.dex --dex-file=/data/data/com.xgbuy.xg/.jiagu/classes.dex!classes3.dex --oat-file=/data/data/com.xgbuy.xg/.jiagu/oat/x86/classes.odex --inline-max-code-units=0 --compiler-filter=speed2⤵PID:4325
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
6.6MB
MD51f2b7921806844a3a335da824a2c51a6
SHA18055aeca17345916e6248f0a800b89de76bb739a
SHA256e9716135ec8aacc21246a8818d2b1985bd1972bcf99867117a0d8c5eff8c6404
SHA5124365eb7631c407115ba70ae9015119c123fdea8d8d173bf75f4a695bd031606564690700ca7c5e3b83abb702974e80eb658295e46eec2a4dd31f85e2eb4094b7
-
Filesize
359KB
MD53d5f6f33036d1d83a9db4a241897d3fa
SHA1846a39db4d511863354867ec2c83031a61c92f78
SHA256cdf3d9163dd27e237407295c2727c0a99c522719c4bd750f8ea19e31143341f0
SHA512d210723a528e0cfde902290f65123947ead0d36f5a4bf71b833eeb318aedeaa9b8b2a4d07c1371baddc4a849c40e29e1ce28a36991f88f495009ea45fd09ef8a