Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
2746510s -
max time network
159s -
platform
android_x86 -
resource
android-x86-arm-20231215-en -
resource tags
androidarch:armarch:x86image:android-x86-arm-20231215-enlocale:en-usos:android-9-x86system -
submitted
23/12/2023, 20:08
Static task
static1
Behavioral task
behavioral1
Sample
85d218721cb31ebe4b2f7e30e48fd72f2fdfe9dd325a71866428e2ab71671afb.apk
Resource
android-x86-arm-20231215-en
General
-
Target
85d218721cb31ebe4b2f7e30e48fd72f2fdfe9dd325a71866428e2ab71671afb.apk
-
Size
6.1MB
-
MD5
e0e14235309f8e43f2a82d81950f3b8b
-
SHA1
63ff065ed280282bc9bbf94a3bc0707ccb553793
-
SHA256
85d218721cb31ebe4b2f7e30e48fd72f2fdfe9dd325a71866428e2ab71671afb
-
SHA512
3e887572d3823d47eb72d31b876c706e353d6c651bccc5e219406945fcbb601cda4ea804468f2c981150d3d689c120c6006c3fa4261905c09ad2a1e3c57766a3
-
SSDEEP
196608:S9XE+Dd0gOrfB6YMBDeTEKMpFSlSJHOLHyZybL:SXDOhz9MByWpFSuHFIbL
Malware Config
Signatures
-
Requests cell location 3 IoCs
Uses Android APIs to to get current cell location.
description ioc Process Framework service call com.android.internal.telephony.ITelephony.getCellLocation com.youyuan.yyhl Framework service call com.android.internal.telephony.ITelephony.getAllCellInfo com.youyuan.yyhl:remote Framework service call com.android.internal.telephony.ITelephony.getAllCellInfo com.youyuan.yyhl -
Queries the unique device ID (IMEI, MEID, IMSI)
-
Listens for changes in the sensor environment (might be used to detect emulation) 1 IoCs
description ioc Process Framework API call android.hardware.SensorManager.registerListener com.youyuan.yyhl:remote -
Uses Crypto APIs (Might try to encrypt user data) 2 IoCs
description ioc Process Framework API call javax.crypto.Cipher.doFinal com.youyuan.yyhl Framework API call javax.crypto.Cipher.doFinal com.youyuan.yyhl:remote
Processes
-
com.youyuan.yyhl1⤵
- Requests cell location
- Uses Crypto APIs (Might try to encrypt user data)
PID:4261 -
sh -c service call iphonesubinfo 12⤵PID:4314
-
-
service call iphonesubinfo 12⤵PID:4314
-
-
sh -c cd /proc/net/ && cat arp2⤵PID:4380
-
cat arp3⤵PID:4402
-
-
-
sh -c ls /dev/socket2⤵PID:4423
-
-
ls /dev/socket2⤵PID:4423
-
-
sh -c which su2⤵PID:4458
-
-
which su2⤵PID:4458
-
-
sh -c cat /proc/sys/kernel/random/boot_id2⤵PID:4488
-
-
cat /proc/sys/kernel/random/boot_id2⤵PID:4488
-
-
sh -c cat /proc/sys/kernel/random/uuid2⤵PID:4517
-
-
cat /proc/sys/kernel/random/uuid2⤵PID:4517
-
-
sh -c cat /proc/sys/kernel/osrelease2⤵PID:4547
-
-
cat /proc/sys/kernel/osrelease2⤵PID:4547
-
-
sh -c id2⤵PID:4572
-
-
id2⤵PID:4572
-
-
sh -c cat2⤵PID:4596
-
-
cat2⤵PID:4596
-
-
sh -c cd /proc/self/;cat status2⤵PID:4622
-
cat status3⤵PID:4640
-
-
-
sh -c cat /proc/uptime2⤵PID:4663
-
-
cat /proc/uptime2⤵PID:4663
-
-
sh -c cat /proc/uptime2⤵PID:4688
-
-
cat /proc/uptime2⤵PID:4688
-
-
sh -c date2⤵PID:4719
-
-
date2⤵PID:4719
-
-
sh -c cat /sys/class/net/eth0/address2⤵PID:4746
-
-
cat /sys/class/net/eth0/address2⤵PID:4746
-
-
sh -c cat /sys/class/net/eth1/address2⤵PID:4770
-
-
cat /sys/class/net/eth1/address2⤵PID:4770
-
-
sh -c cat /sys/class/net/eth2/address2⤵PID:4794
-
-
cat /sys/class/net/eth2/address2⤵PID:4794
-
-
sh -c ps2⤵PID:4818
-
-
ps2⤵PID:4818
-
-
sh -c df2⤵PID:4843
-
-
df2⤵PID:4843
-
-
sh -c ls /system/fonts2⤵PID:4867
-
-
ls /system/fonts2⤵PID:4867
-
-
sh -c cat /proc/meminfo2⤵PID:4892
-
-
cat /proc/meminfo2⤵PID:4892
-
-
sh -c cat /sys/block/mmcblk0/device/cid2⤵PID:4916
-
-
cat /sys/block/mmcblk0/device/cid2⤵PID:4916
-
-
sh -c cat /sdcard/../../../../../../sdcard/._driver.dat2⤵PID:4940
-
-
cat /sdcard/../../../../../../sdcard/._driver.dat2⤵PID:4940
-
-
sh -c cat /sdcard/../../../../../../sdcard/Android/Data/System/local/_driver.dat2⤵PID:4964
-
-
cat /sdcard/../../../../../../sdcard/Android/Data/System/local/_driver.dat2⤵PID:4964
-
-
sh -c cat /sdcard/../../../../../../sdcard/._system.dat2⤵PID:4989
-
-
cat /sdcard/../../../../../../sdcard/._system.dat2⤵PID:4989
-
-
sh -c cat /sdcard/../../../../../../sdcard/Android/Data/System/local/_system.dat2⤵PID:5013
-
-
cat /sdcard/../../../../../../sdcard/Android/Data/System/local/_system.dat2⤵PID:5013
-
-
sh -c cat /sdcard/../../../../../../sdcard/._android.dat2⤵PID:5038
-
-
cat /sdcard/../../../../../../sdcard/._android.dat2⤵PID:5038
-
-
sh -c cat /sdcard/../../../../../../sdcard/Android/Data/System/local/_android.dat2⤵PID:5062
-
-
cat /sdcard/../../../../../../sdcard/Android/Data/System/local/_android.dat2⤵PID:5062
-
-
sh -c cd /sys/class/net/wlan0/ && cat address2⤵PID:5087
-
-
sh -c cd /sys/class/net/eth0/ && cat address2⤵PID:5105
-
-
sh -c ip link2⤵PID:5123
-
-
ip link2⤵PID:5123
-
-
sh -c cd /sys/class/net/wlan0/ && cat address2⤵PID:5147
-
-
sh -c cd /sys/class/net/eth0/ && cat address2⤵PID:5165
-
-
sh -c ip link2⤵PID:5183
-
-
ip link2⤵PID:5183
-
-
sh -c mkdir -p /sdcard/../../../../../../sdcard/Android/Data/System/local/2⤵PID:5208
-
-
mkdir -p /sdcard/../../../../../../sdcard/Android/Data/System/local/2⤵PID:5208
-
-
sh -c echo MkYyOUQwOEIxMURGN0Q2RDgyMjNCQzUwMDU5RDk5M0Y0RjE5RkE6NDU5Q0VCOjgyREI4OQ== > /sdcard/../../../../../../sdcard/Android/Data/System/local/_driver.dat2⤵PID:5232
-
-
sh -c echo MkYyOUQwOEIxMURGN0Q2RDgyMjNCQzUwMDU5RDk5M0Y0RjE5RkE6NDU5Q0VCOjgyREI4OQ== > /sdcard/../../../../../../sdcard/._driver.dat2⤵PID:5250
-
-
sh -c mkdir -p /sdcard/../../../../../../sdcard/Android/Data/System/local/2⤵PID:5268
-
-
mkdir -p /sdcard/../../../../../../sdcard/Android/Data/System/local/2⤵PID:5268
-
-
sh -c echo QUQ5QTQxQjQwNEIzMEYyQ0ZDRUUxNUFEQUFGNTIyMUIxNThDQkU6QjEzOERGOjkwNDRGMg== > /sdcard/../../../../../../sdcard/Android/Data/System/local/_system.dat2⤵PID:5294
-
-
sh -c echo QUQ5QTQxQjQwNEIzMEYyQ0ZDRUUxNUFEQUFGNTIyMUIxNThDQkU6QjEzOERGOjkwNDRGMg== > /sdcard/../../../../../../sdcard/._system.dat2⤵PID:5312
-
-
sh -c mkdir -p /sdcard/../../../../../../sdcard/Android/Data/System/local/2⤵PID:5332
-
-
mkdir -p /sdcard/../../../../../../sdcard/Android/Data/System/local/2⤵PID:5332
-
-
sh -c echo MzNERDk2QzE2MDU2NTAxNTc2RTNFNDUwQjcxQTM1QTg0QTFBQjM6ODNFMUFEOjk1QUFGMw== > /sdcard/../../../../../../sdcard/Android/Data/System/local/_android.dat2⤵PID:5364
-
-
sh -c echo MzNERDk2QzE2MDU2NTAxNTc2RTNFNDUwQjcxQTM1QTg0QTFBQjM6ODNFMUFEOjk1QUFGMw== > /sdcard/../../../../../../sdcard/._android.dat2⤵PID:5382
-
-
com.youyuan.yyhl:remote1⤵
- Requests cell location
- Listens for changes in the sensor environment (might be used to detect emulation)
- Uses Crypto APIs (Might try to encrypt user data)
PID:4341
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
12KB
MD5ac4cf7caff840bbf8fa5c344b2df7d30
SHA1f38f99d4e0533d58abac84c4fe151e4e647649ff
SHA256330f18f6eec4299787e422465f7d7c46c56c839a8d5a7e014fd0278037e93565
SHA51277493f325fe4f3d4d086be8cb517fdc2c587e854ae1c2c5c03a92de57f18afa2b3502575a8505a9ff13ad7abf65cc3aee71c75a8e86cf7aa9ed1febb2408686e
-
Filesize
512B
MD5bc8cc5da41f005eff7c56dfa5fbfe7ce
SHA199799c58564c21b1ae27affb73d90b3603082585
SHA25607aed23c27543a0801df14fdfaa77fb7cdee57bc8434bdc796aa9b9c728b8ca8
SHA512b9d1252906f1895a4fc50329c3f665a1d8306e33a2fd1a1836d4a6c9504d80d7e316730457e80fb19ab3229a31506010c8f0e29a16f47e2483a68b60dd132c60
-
Filesize
28KB
MD5cf845a781c107ec1346e849c9dd1b7e8
SHA1b44ccc7f7d519352422e59ee8b0bdbac881768a7
SHA25618619b678a5c207a971a0aa931604f48162e307c57ecdec450d5f095fe9f32c7
SHA5124802861ea06dc7fb85229a3c8f04e707a084f1ba516510c6f269821b33c8ee4ebf495258fe5bee4850668a5aac1a45f0edf51580da13b7ee160a29d067c67612
-
Filesize
20KB
MD5850576599fd33df60bbb2760382ad530
SHA14e141f51786786a4f11d8ddac93faf030d7a1327
SHA256ff31fcde2a3cd35898fb38d77ce60094139e94d99d5d0387f1841b02fc3ac223
SHA5129f33a4b0508ce194d6aa15d0f31f3438379642564082a0840d535936d193bb886a20e7be821e4cfb06925249d1f9ca06af328268edca5fdb4f53c59bb4ae9231
-
Filesize
16KB
MD5bc933d99e1964cf709b2068478e0fbea
SHA16b15e07cc01f1091d1432643a3eaa3c8a93dbe72
SHA256c2494c167e82b392d4e3ab6f95ddf2b55b1405863b007da990994a5a852e134d
SHA51220ab658f1ea4b5042c787d43d2b3e6eceb95f1b5b0844bee39c6e558091b3923f316c2b04a7ff64fc52af4f9d353b501206d4688c7edee3c013d1da3c7fe7960
-
Filesize
129B
MD54bf6fa7f838aefbea2b4f74cceb4980d
SHA1045bc87447b279b6443676ab6717be00a31dc85b
SHA2563d94450a59104aec561401b785969661a283f36b01b88f75af01af146738e060
SHA5128606d9c7a8135be94c608e8c7f5bfb6eb2de3a162001b5dc1b948e727f3940e089208b2b989403a4978d8135cfffc526281bb8070a4040c8cf214346e13b5909
-
Filesize
76B
MD5dd8090e768fe396775f46497cdc1e103
SHA19609dae886cf204f4c641a2e293393dbabb04ee8
SHA256a01273cabf6bda39c74416f70412e89ff58335520610c8786e4442281f542799
SHA512a685a0acc265c59f9c37bf374f5e03fcea818db3d192d99f09a368eb126c92bcf75af1d09b88b2eb7cabfb2a31755828ec167974f3cc51052c4a97734ff2f03e
-
Filesize
235B
MD511607bf0e98a076088d9240982089d07
SHA1be003f9602e22dfa81cb561c44ef361c0e4ad3a8
SHA25641a88aee4d1c4ae8028e4d44ce0358ccba296c9fce878d7565bb21d51e20f697
SHA512d3b489762ec29d0fbda13927811808d0f4fb5a1cd0a2669d051191fa972fbf7a30db2c2ee47bec1b971e7d6936a2d0311aaa79256e90b8ad43c7026a85b2efc9
-
Filesize
4KB
MD5f2b4b0190b9f384ca885f0c8c9b14700
SHA1934ff2646757b5b6e7f20f6a0aa76c7f995d9361
SHA2560a8ffb6b327963558716e87db8946016d143e39f895fa1b43e95ba7032ce2514
SHA512ec12685fc0d60526eed4d38820aad95611f3e93ae372be5a57142d8e8a1ba17e6e5dfe381a4e1365dddc0b363c9c40daaffdc1245bd515fddac69bf1abacd7f1
-
Filesize
512B
MD531530c99beac16a4624718a3064fe497
SHA12dcbda08f6e85c688abcf4f261bb19cc6cd7e6d7
SHA2563534d191984b96c6dcbdae16e72cf71c4c260ce74fb4b66d398667bca940eda6
SHA5125f0070a2f16c9aa3cf685158099b2369a4f64912eca7530077dfd73f8932786f75e2957cd9129901ba71239ec71e2ef029f021d4b6d4913c827d05b79d78766d
-
Filesize
48KB
MD56ddd3517bc650066419207c8f5e2d614
SHA17ace84cafdaa99689cf2a1ece8f2fb9b7a8ec110
SHA256245dcfc284e7a9b6d92334863e4e94456e07cb22abe335a536ae2d43718e42bc
SHA512d35e80007a6267069283a9a703d9e6706db3dcc96fe1c4511a1ed93b622e56bdf56d4987689da27b4ab3f6c2d4ed4d29e6ecc54499ac88cb30730d4d88cd177e
-
Filesize
512B
MD59dbda2b6f0871b001bff7884df3df066
SHA19b930406e8e7b2285c73dadf825531f2a64b8e3e
SHA256d688575a2a91af41566d24044f694548395b584b726d4dec44b1ec484cabc854
SHA5124212082becf6e27817d1b1dee6fd593091972ad16cb90f7a34350754c30884ce5195991a9963366ae48fa1cb77ab1020f6c0a25a816958b19476b537fec3e6a8
-
Filesize
156KB
MD5d85e655ab645717d08aa928cbcc92a2c
SHA1aa18383720cce425d88ba75e96a3e50e0b4c14d2
SHA25610cc009dc23e5cda9cf1a2e713ddd5e0770638016a81982172c8a54c8d495822
SHA5127af7ce72620a51778860468f7b9b6cabc464fc63c105cab8308c26b8029281660c2c49b2bbc549429699dd0bba0837cd0c9d493617855b2afb7f3eebf860539d
-
Filesize
181KB
MD5cfdf755172ff1c524ee2ac7ec16abc19
SHA1b3072d320e7bd8c17dd5af42f22fb268a809b015
SHA2560718c88c7e9d885fd790121e0de362d5fccd3ea85ba4e75a3d72f15946fd37a2
SHA512a933e6fe625da8002ea08d3a4fd0d402ebee5df6ba62a755359adb50c0984c7f1994cd0270d148a424b78b3901aaf12876e580b6221e4745e9ae830c1c3e23ae
-
Filesize
12B
MD58d80bc8ea90e9cac010d3ddf97bda5f5
SHA1f063bc0d356e6ba9ab1eb9a851131ffbefd8fa07
SHA256f52db31332534833414abd5e870f78c810b8ebbe5b134bbf599506beecfd1b93
SHA5129ea732dd572a9a4ba91b70891972230a09576687ca1bc19e62d5a98b5b84e0f2ae11985108008bc9fbccf357219b8bd3dbf146bb70752f618f70dc5d0c46a7c7
-
Filesize
153B
MD57d12bf7e1a6777458b4661cf836a37db
SHA1661234855394879077249b6e3e9987abb335a235
SHA25614c52766985d99d623e5bfe4e7c0d4831389eab066282578966a9e03b2d987cf
SHA51201d1983b3ee61a7ed1874dd070ab6c4a776500f4d63f9eddb7c62465fc8a4cf9a8e90c1c382a6a479ecb84634fe21557de2ea323411ccc8033aa0e854970f9c9
-
Filesize
24B
MD5161557b06b4a4d3ce095528dea370eb7
SHA18bfe9c4d916fe58d856b5a6ecaf8cd9ea4df2c9f
SHA256f054ef19481234ee5b2db1d1c681839dab235a857ed3a4bc02efa8f785f478d4
SHA51296ce8aedbdbb387438efc86aaabd13a6378628bfae203d2bc25ea1cd7daa6ddbd6dd2c81d631fbdc9b653a93011d3c80f0c085580275b683d5e0bce077e6e449
-
Filesize
494B
MD54bf20180e444851c409fb99659fdd3b1
SHA185e4ea31f7a0a19b4b404a6e9751b034899e2251
SHA25626ab11496fe2c8ad567020c9903dfa9f6289684f48ad5f3080026413111bf9f9
SHA5122e5aad68f549e48192b2d9c4db834f7334d45a7372be1e58a17b7a1b1817a1bda3b98b8720c3d3c41ca4c4c37161808e9c24f47e4f88f3aeec889f1c7c7c91d2
-
Filesize
24B
MD5a936690571e9104e1922dda4a0ba5bd1
SHA165f49c57edde2f96be2a1dbdfc3f7351f1e66554
SHA256f0f5049c51879dd7da0ce4a43349b5b34ce053d072a0ca704f62cf22ba4a8412
SHA5123be1c3693963aebdfc04e86b1c820ee0ec3cf0b200e6a4788ef1141f39fd6c2f77f4227247ae4affa66c0a6c027df8466cc0dcec1e67ebfb953e36bee97de394
-
Filesize
24B
MD51681ffc6e046c7af98c9e6c232a3fe0a
SHA1d3399b7262fb56cb9ed053d68db9291c410839c4
SHA2569d908ecfb6b256def8b49a7c504e6c889c4b0e41fe6ce3e01863dd7b61a20aa0
SHA51211bb994b5d2eab48b18667c7d8943e82c9011cb1d974304b8f2b6247a7e6b7f55ca2f7c62893644c3728d17dafd74ae3ba46271cf6287bb9e751c779a26fefc5
-
Filesize
89B
MD5e8659f993b6fba488c8d97a3a86c55ec
SHA19f51c0ffdec4fc3f2ed45f7166b077b1ce201d6f
SHA256ff8de379f5601e63aef5118b2cfa591b18d8618320655e4f8df368bf4e6be116
SHA512f79b098ebd4814993b59a3a7742b8470abfb0b45ee05869c298e963d107452c4b1947d94742aa2bf3fd08eebb857ae16dda285422a54e0862641ba9e39f04cf7
-
Filesize
96B
MD52e81f73d888b18e6f1fcf21f1bb64f40
SHA1c1b5bc978bf726ee0a6e4b8c22c4753563ab944c
SHA2565d4864bfcffefea06b59ae5b905af1821587d4779f8a513cbb1378aa4a0b586a
SHA512c3b05c2d1e52de4cc7a1bb18c2d019adaa5499cd9193df413f3ff9ff8b552e9b85b2786f486b57791b78ec841d42b71861a8a26f88df88526a836e336c63e6d3
-
Filesize
96B
MD522eed40325381f858d4112105abc1a48
SHA15a473dbb488db57b0fad9cb2e9990d6f92589ac0
SHA2563f87044629db901fd99fbe1b3033e118e5726961601a64b3fd160751d43a2fb3
SHA51254e76ffd383120c50d7e1a4a6a427762069b587787e341734df9e986f168b6ee24c4b1655741a2c1e4204a8ce1fe509fffbd5d1f5ae281855188776ae098143a
-
Filesize
28KB
MD50d3e99204c6401ea499fe9e6d9855497
SHA109829f00ca458eab7374d5079393a2cd69a2348a
SHA25663ad014cb50908591939d6a1536f85eece807425af4f4e8a1f9b9eeab13cc5ca
SHA5128d9a50aa9abd17e508ed3ac35a3033e8f9e550d1088baa951f53e6c4697c5ac026d22b90e36e27341d64baa3f0202bd89ca97583e99feb25f8c26b5776c59c68
-
Filesize
12KB
MD56e4955f23868c2cbe8136c5750208698
SHA14af80c31a0eed99c00704cac327db9e7352510f4
SHA256db0d95d81567b67fb89d862fef154bb17e482f9b68873f020a8e0fb2baa3754c
SHA512c0cb1208d0a57c9d0b7944d7ee54c942c20617fe2f8a6fb7b62da3d4186e5a19f61df695b41d06090e9b49702284e1dab45e6b2dfda7c62f7ce1e5882199e170
-
Filesize
52KB
MD5dd765bac2f7a4fe33d8c49635e1c1a33
SHA124850a466f67e22c8a3c43ec592be36ce0818b25
SHA2568b32b956eea3441bf62f85c9ad85a115e98d386038287c5642732fa749fcd0b3
SHA512b501976ec5aa7f8adb07ee89cec348e3c6d0e48624a2e2c37f8476a15d69cbc833858032a200c032c95964526c0cdb25ea54b8ed169302fe2139b894473c8e79
-
Filesize
105B
MD5ce80805bcaab0b82ecf0bdf7169b026e
SHA153e0b8ffdfe071cf5315598159d79a1d76942f95
SHA25652d9fd1fdf3d0b67fcbc3f2be21b3ef0583bf852185fe01c235258f508365997
SHA51270f2ee5797316a779fe413ca8708dad1fe1326c8b611a45575151687146e7f94f691beed0d3b9f4b2a3efa959f9e9c41b1dd6417fb66cc9ce3b869f3267f4343
-
Filesize
105B
MD59b0a79646f7d4247593fca876008b456
SHA1dfac4ce256f8d59be88a98451b99643d29371fc9
SHA25646046a2200e4b4a64e4a88d77625a3b0c6fb8305e3b097c014a1691b3ac6dad7
SHA5123fd9cc3a1aa58408cf20f374bd6ad3e3ab1392965c19fcedd2aea1b54abf7f61d4c2490fced8a6505b29cf8e49a2bc9c56d06bb6170283b5833aa931d1fa5ac3