Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    2552032s
  • max time network
    131s
  • platform
    android_x86
  • resource
    android-x86-arm-20231215-en
  • resource tags

    androidarch:armarch:x86image:android-x86-arm-20231215-enlocale:en-usos:android-9-x86system
  • submitted
    23/12/2023, 16:33

General

  • Target

    4b8cab75dbb96d03e1db0e0d76288fdae0084be360f27f1cc89c936711946fe4.apk

  • Size

    8.8MB

  • MD5

    9b1c12e584163ad450993ef291c8304c

  • SHA1

    a380cca6a6ce3f2bd02f118a19256ce09191b376

  • SHA256

    4b8cab75dbb96d03e1db0e0d76288fdae0084be360f27f1cc89c936711946fe4

  • SHA512

    88b18f761df6912d28af380113fca4d2c64471a8a7f519f47a167275ec8baec4171acf98b8d92e795dc94a7fd7582a2e177262c0b5ac363e00358942ecf655af

  • SSDEEP

    196608:FyQj0kGjXZgg3+JH585ULq8VK90m8i2MD0LSrgDZwcd+W:Fvm+v85qq80n2KCy+wcdR

Score
8/10

Malware Config

Signatures

  • Requests cell location 1 IoCs

    Uses Android APIs to to get current cell location.

  • Reads information about phone network operator.
  • Uses Crypto APIs (Might try to encrypt user data) 1 IoCs

Processes

  • com.here.business:main
    1⤵
    • Requests cell location
    • Uses Crypto APIs (Might try to encrypt user data)
    PID:4250

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • /data/data/com.here.business/app_config/config

    Filesize

    73B

    MD5

    885cbccfba6181eaff7498ba078bec62

    SHA1

    a4189ef8c0cd47fefb85211eb5063dc5b7f37b14

    SHA256

    2fce1fb3df59e916d4dee43fd0da326a37ee80736a6c401ba53a8b8922f6c5ea

    SHA512

    c9ed609e9bdf7c38fa4759aec5e89f27f5b62fb85c05ad4c64acb89e39cbf098d4359375e508a29722b41abe508e190e771c8f4784322c3ed3ab8145c8b9f98b

  • /data/data/com.here.business/databases/demaiOne.db

    Filesize

    4KB

    MD5

    f2b4b0190b9f384ca885f0c8c9b14700

    SHA1

    934ff2646757b5b6e7f20f6a0aa76c7f995d9361

    SHA256

    0a8ffb6b327963558716e87db8946016d143e39f895fa1b43e95ba7032ce2514

    SHA512

    ec12685fc0d60526eed4d38820aad95611f3e93ae372be5a57142d8e8a1ba17e6e5dfe381a4e1365dddc0b363c9c40daaffdc1245bd515fddac69bf1abacd7f1

  • /data/data/com.here.business/databases/demaiOne.db-journal

    Filesize

    512B

    MD5

    8431c5c1a820b382e1a4aaa637a8abf3

    SHA1

    5ce827c2ad79765122adabc425a617a0cd061ad7

    SHA256

    c0bfdca59674bde412642d139231ab7789c9a998b135ea93637bd29f1b710113

    SHA512

    1e8c50ad1f28feb7b8bd7b1b1610ffe389635074dc34a9d705265a53afab911bd057c52ac3f8701b7b33ef9e407703fc250cfdcdf8f656c06427ce93cab6d1a1

  • /data/data/com.here.business/databases/demaiOne.db-shm

    Filesize

    28KB

    MD5

    cf845a781c107ec1346e849c9dd1b7e8

    SHA1

    b44ccc7f7d519352422e59ee8b0bdbac881768a7

    SHA256

    18619b678a5c207a971a0aa931604f48162e307c57ecdec450d5f095fe9f32c7

    SHA512

    4802861ea06dc7fb85229a3c8f04e707a084f1ba516510c6f269821b33c8ee4ebf495258fe5bee4850668a5aac1a45f0edf51580da13b7ee160a29d067c67612

  • /data/data/com.here.business/databases/demaiOne.db-wal

    Filesize

    20KB

    MD5

    58ac87134779c048c3a08dfe93a9f9c1

    SHA1

    2ecfd8bca0fa060dc2e038364b3552a1ab47ee45

    SHA256

    388617b2ca535a46c8abbb3f3552900ba113318c6eb71755242d8f6d2b4d1060

    SHA512

    824b89d1628761ce3f13a412a0a50f553b9a6c8c966e21da4ad3b88a433b2912fba285b1b47e40f274e1b168494bd1dc941d6debc8e25db4f468cc8fcf5a42df

  • /data/data/com.here.business/databases/demaiThree.db-journal

    Filesize

    512B

    MD5

    4476a854f62efc5f222ef51aa71f472b

    SHA1

    f7fe4ffa4ec6da2f486e202351aa3ed3a9895baf

    SHA256

    8c954cb38260029cb598e88396c9ae7ebd65f0c7600c99f764599f7607d51587

    SHA512

    2fa7b249dc5804dfcf89f6fde19a32b41271a430ce3a0362df7528aeb34198259dc835175c2344262ca3a9c4d7f26b942e343729b014daa909b1f4200d7450d9

  • /data/data/com.here.business/databases/demaiThree.db-wal

    Filesize

    16KB

    MD5

    07b259dbfc7eed322bad8f6d1723cfe7

    SHA1

    4beea1068e4d12afcce15bf9cd2b52353a1a5244

    SHA256

    a5161f5cf06efc342ee43d6537a81656181b2b72febf187a47fe64291c29ff7b

    SHA512

    ca0cdd4542760649a6d45034a2429daba439d7bf6e3a3b993648fdce82b1895294e840271ade92e057adcf022c728f308abec006886f2cf0fea191575d03ad25

  • /data/data/com.here.business/databases/demaiTwo.db-journal

    Filesize

    512B

    MD5

    0a7a5c99179c7664094d18cada9e5ecb

    SHA1

    c1760a0a68309bdf3929e140dab406f6e2c35dd0

    SHA256

    b0f4092d60637668a437854b7c89fbcd406bc2a69f3f0b6af2803d30763c7d04

    SHA512

    756bd713982a9a92d79a22a99e9891e20f50adc261adf20ffd054f6a37ac9e1bc8e8b994c3a0e70664be05078572f4ec787344bc0db4b70c716a6a6b628d4a51

  • /data/data/com.here.business/databases/demaiTwo.db-wal

    Filesize

    32KB

    MD5

    307cc8abd5154ef449ab5f4fa7cf2bd4

    SHA1

    e1265ada92e8baf8290483bf528df502f5917422

    SHA256

    831cb250d9c7e99523ae4255e8b890d68df8cd3b5de0f2776231e62fa3e607e0

    SHA512

    3f706da71aa1a1fcabf902872496a01dcee51322ba87afa1a9280f766332620a9900d97eba2ccd9863bad73782b67ae011c6c0e23838f5e7529d30d6b78ebebe

  • /storage/emulated/0/Android/data/com.here.business/cache/locationCache/journal.tmp

    Filesize

    31B

    MD5

    8c92de9ce46d41a22f3b20f77404cc1d

    SHA1

    8671a6dca00edb72be47363a7071be65cf270373

    SHA256

    68bb33ddeed9200be85a71f70b377985f9ee68e91578afbde8321463396f1274

    SHA512

    30f45fe9954215d6adafcc8f0a060a7ff41963a64f9b849a37f0d18fe045038d429ec13bf15226769c4ba78dad3c52f3d9e0dbbb4fcdea4828a1efe956e48f56

  • /storage/emulated/0/Android/data/com.here.business/files/carrierdata/1703358960

    Filesize

    403B

    MD5

    a9de4b517c0bc5a2ae98fcb661eb2b1d

    SHA1

    fd0e85569f05d1240d0a08f470270a7a93146559

    SHA256

    1d66deddf46bffbfbacb42f6213d0d380672c5adeea870ce2f9a1f5e2a3042b9

    SHA512

    072b63eb7bd37f7f0b7631f801930aaff50e0b63b98e3c4fcc11345c4ca2c459ed0049b74296d5fdc1aaf5375fd5681c4171ba5f4ed458dfe224787e28d37414

  • /storage/emulated/0/demai/DiskLruCache/journal

    Filesize

    24B

    MD5

    d28888dce12003a0101ad042d0a6ac8e

    SHA1

    536297c4eb6fdbff3ddf073794d37416bf5992aa

    SHA256

    9147a87bfd53db6ede0393d0fca6fab68f305c6d9d55568a97435611a439c581

    SHA512

    8b5a1b743f672377e172f355349a0d9ab0ca6a234027ea73a3429c17e6ca84369b10d5955c1867a4b0b4756551f5fcaeda894b0318d097ba4222e105820850b7

  • /storage/emulated/0/demai/DiskLruCache/journal.tmp

    Filesize

    33B

    MD5

    db57cec3040a80df462f78319e3350aa

    SHA1

    1dadb59525ff1c0832c5b041113864834d0c8c5c

    SHA256

    b1afaa915365b28c59afd4d21d1473f1b7f6918ed4981348e48999414282ce03

    SHA512

    fa6e39d79dd999662ac5704fd2aa7fc6bed731b0179e8b0c33264b7f9d07e90ba5125df7fb6f2e5ad413452bc4e44d57c0d91231dd5e554d15cdabef189ea0ed

  • /storage/emulated/0/demai/DiskLruCache/use_long_time_key.0.tmp

    Filesize

    48B

    MD5

    46c7376f02c2aedcf02aea5be3b0db6b

    SHA1

    fb1d420d62b77723592e2ed641508c58e2a082ef

    SHA256

    7c2e418f5305e79cffd47dc145e0e0c002114bfa3c5725cdc9da13dd5aeb6bd0

    SHA512

    d3b0c069d67207568c8d31fd20eb25772409a57753a9511ed9ae52de2041fdc2876e0b9fed4aabd7310b8f36360ed2b7848b68ace34a21348ecbe1a9f177b499