Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
2984879s -
max time network
156s -
platform
android_x86 -
resource
android-x86-arm-20231215-en -
resource tags
androidarch:armarch:x86image:android-x86-arm-20231215-enlocale:en-usos:android-9-x86system -
submitted
24/12/2023, 03:55
Static task
static1
Behavioral task
behavioral1
Sample
cc33191a0f4b6adb50409455e0245d48436d6e11f2c3500e5b0faf20a4ff5cb5.apk
Resource
android-x86-arm-20231215-en
Behavioral task
behavioral2
Sample
cc33191a0f4b6adb50409455e0245d48436d6e11f2c3500e5b0faf20a4ff5cb5.apk
Resource
android-33-x64-arm64-20231215-en
General
-
Target
cc33191a0f4b6adb50409455e0245d48436d6e11f2c3500e5b0faf20a4ff5cb5.apk
-
Size
22.9MB
-
MD5
c38a1b8521e43c0cf060491bcdc9e666
-
SHA1
ec38a133d814628241335a4c5827cc66f469f03b
-
SHA256
cc33191a0f4b6adb50409455e0245d48436d6e11f2c3500e5b0faf20a4ff5cb5
-
SHA512
2e749c08a42c84d66aabbc036e20c7e2fcbcfcef3421320663e67130072b4250ff3fea95b87eeb7d9341157fd50d3df04f41ab0bac6d4e6f58b165f06a6f0868
-
SSDEEP
393216:MXTIrckuhH1Y7D5KTk6/kvnT+ibrnyGjeicRq1ufdWmkhc1582llzB9ihvk:MEIDRaAMTDHnRj2Rq1+4rt2llzehvk
Malware Config
Signatures
-
Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 IoCs
description ioc Process Framework service call android.content.pm.IPackageManager.getInstalledApplications com.du91.mobilegameforum:channel -
Checks Android system properties for emulator presence. 6 IoCs
description ioc Process Accessed system property key: ro.hardware com.du91.mobilegameforum Accessed system property key: ro.product.name com.du91.mobilegameforum Accessed system property key: ro.hardware com.du91.mobilegameforum:channel Accessed system property key: ro.product.name com.du91.mobilegameforum:channel Accessed system property key: ro.product.model com.du91.mobilegameforum:channel Accessed system property key: ro.serialno com.du91.mobilegameforum:channel -
Checks Qemu related system properties. 4 IoCs
Checks for Android system properties related to Qemu for Emulator detection.
description ioc Process Accessed system property key: qemu.sf.fake_camera com.du91.mobilegameforum Accessed system property key: ro.kernel.qemu com.du91.mobilegameforum:channel Accessed system property key: qemu.sf.fake_camera com.du91.mobilegameforum:channel Accessed system property key: ro.kernel.qemu com.du91.mobilegameforum -
Loads dropped Dex/Jar 5 IoCs
Runs executable file dropped to the device during analysis.
ioc pid Process /data/user/0/com.du91.mobilegameforum/.cache/classes.dex 4476 com.du91.mobilegameforum /data/user/0/com.du91.mobilegameforum/.cache/classes.dex 4476 com.du91.mobilegameforum /data/user/0/com.du91.mobilegameforum/.cache/classes.dex 4788 com.du91.mobilegameforum:channel /data/user/0/com.du91.mobilegameforum/.cache/classes.dex 4788 com.du91.mobilegameforum:channel /data/user/0/com.du91.mobilegameforum/app_libs/ymdex.jar 4788 com.du91.mobilegameforum:channel -
Unexpected DNS network traffic destination 1 IoCs
Network traffic to other servers than the configured DNS servers was detected on the DNS port.
description ioc Destination IP 223.5.5.5 -
Reads information about phone network operator.
-
Listens for changes in the sensor environment (might be used to detect emulation) 1 IoCs
description ioc Process Framework API call android.hardware.SensorManager.registerListener com.du91.mobilegameforum -
Uses Crypto APIs (Might try to encrypt user data) 2 IoCs
description ioc Process Framework API call javax.crypto.Cipher.doFinal com.du91.mobilegameforum:channel Framework API call javax.crypto.Cipher.doFinal com.du91.mobilegameforum
Processes
-
com.du91.mobilegameforum1⤵
- Checks Android system properties for emulator presence.
- Checks Qemu related system properties.
- Loads dropped Dex/Jar
- Listens for changes in the sensor environment (might be used to detect emulation)
- Uses Crypto APIs (Might try to encrypt user data)
PID:4476
-
com.du91.mobilegameforum:channel1⤵
- Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps)
- Checks Android system properties for emulator presence.
- Checks Qemu related system properties.
- Loads dropped Dex/Jar
- Uses Crypto APIs (Might try to encrypt user data)
PID:4788 -
cat /sys/class/net/wlan0/address2⤵PID:4891
-
-
cat /sys/class/net/wlan0/address2⤵PID:4912
-
-
/system/bin/cat /sys/devices/system/cpu/kernel_max2⤵PID:4931
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
4KB
MD5f2b4b0190b9f384ca885f0c8c9b14700
SHA1934ff2646757b5b6e7f20f6a0aa76c7f995d9361
SHA2560a8ffb6b327963558716e87db8946016d143e39f895fa1b43e95ba7032ce2514
SHA512ec12685fc0d60526eed4d38820aad95611f3e93ae372be5a57142d8e8a1ba17e6e5dfe381a4e1365dddc0b363c9c40daaffdc1245bd515fddac69bf1abacd7f1
-
Filesize
512B
MD5aeccdf5661ac40caada8d9850527bc88
SHA1c064a546dafb0e02d88152e7fdce532876d8da0a
SHA256852a5f2125b06952e82725e3198d3770bd9302c9a5453b5e996c3ed4ca79598c
SHA512fe8fcb81d534b8d6b7f4b9ce6987718e4b0ebf2f28f1e17590ae539644d2cfd13922ba284060d6029586f44098f5ac3b01f29f5942eea52a1be3667f69ef6e65
-
Filesize
28KB
MD5cf845a781c107ec1346e849c9dd1b7e8
SHA1b44ccc7f7d519352422e59ee8b0bdbac881768a7
SHA25618619b678a5c207a971a0aa931604f48162e307c57ecdec450d5f095fe9f32c7
SHA5124802861ea06dc7fb85229a3c8f04e707a084f1ba516510c6f269821b33c8ee4ebf495258fe5bee4850668a5aac1a45f0edf51580da13b7ee160a29d067c67612
-
Filesize
48KB
MD5f87227b462704a8aaca1ff15ee2da449
SHA153df7ceb19f048115dfd36a47bbb0411e87848dc
SHA25623fd0627cdf32410c63d7fd282de91dcda94adfa141a9ce5f5076aea73e80ca4
SHA512b3db38d13e40ef22071fd50bc1410692496a63aeedd11816d3dea772264d2bcfaab77cded82d886bf6c84e241af71d41b8da0ced7c4eba9727ad82ed993c8cfc
-
Filesize
512B
MD58c2975a47c13aa4f3242d2b169a33a86
SHA132b9c042797dc618c41dc0cc3ac7199de96e533d
SHA2566a0047bfe7c1a1871e1e704d9861b0097e08ddbca1170b2b7789c5130ae05521
SHA512ac51534c4427df3e7e483401466aaeeeba6e6535444d3e863061b71462b35e58a9ebaadacb9260c7bebd55099f5afab642339483c909f74ab8eba32907de81f2
-
Filesize
68KB
MD5af56a1e0043bbdf5a3a9e247bdd554fa
SHA16f80d5b0b454854e9095c15507dc3451add9a6a2
SHA256124d2c93ce42cfb0419c8f48ce589af3af0dcdf32f62eb6faa359ba9650b8c13
SHA512a0b74b047c1d35a958ee49cfae6349b8150a691dc9bf95412fb85f610bab08dac5458b7dd5a8950833a8efff548e48c08a4f21d515ce9024c5f8eea93440edef
-
Filesize
512B
MD559e361716fbc9bfd498ecda990dfaa40
SHA10ee7a6862c59cf882c642fb1470caa4cfbee3456
SHA256ec05c9d9c3b8cc904c91aee3fb9f0d5ab64d24143a9a3823155f1a68d22f32dc
SHA51227e1d4afb840f3581f79e0bc812cb1ff81fc3477582a35f3cb61a001afae4f9192da5b90c473c7d7011e6169969dce0732e01d90cd7b4de5a936a576133041d9
-
Filesize
512B
MD5c7eee6ea7607586c40f5e17470416f1e
SHA118c888d776463241e6627a8171f339b4247afd77
SHA25635b03bee2974e7d82252e7a25d3abe3333a976b40cabf07eaf0890fa7eb39a3c
SHA512bd9669b2ec324f90dd3ef99cf1bb0f5dad7b765f18a6c99d896e7e9befc54f10f4ac3f1eea9d1a99b637310590ff091dda19562da4daed9a67a32d0f5af35b55
-
Filesize
48KB
MD5d2603708756dbc703313d2cc6adbf6e7
SHA15a4e3acdf7254d8c5b5374379b6db1408a7b6fb8
SHA256ea7bd8dbe1222ea8abfac1a3ae63c7b47a99a145a204da0a468873e056dff068
SHA512e00a23f98fe430ed7fe20ad696031e5a84a39194a04c12ed2235ee3d2ee80b54973e18c29d9e5ac6435ad444a0a112a830d0f59a5edc57bb16879d7d95fcee78
-
Filesize
28KB
MD5b180f74524f6fb14c8a0d0dc0c8ec1e4
SHA1c702a04dd58a81dd0d4183dbd3d3e3b3a69d0c75
SHA256a83be5024c9646759247f0b9ed500fd916961d423041d72d195a3d50d9045647
SHA51229ccacb54c46f329ed692472822834ab6cfe19afa685fe78b9384836dae57c59e0e09370af60e663f2f545750ca85fc2b59162e5357a1d1e2b6ec898db4f4d3b
-
Filesize
8.4MB
MD515c45cf69b57d51a71edd0093cc87d3c
SHA14fc6a79a2113f8141cf975bcb3d88a1e70ce42a9
SHA2569dfa85058ed5b4862c30502eceac2b4113b11b03324949b248401c512b8e75fa
SHA512fea848d894bc0e75095fa283f58c63058b96580ce5aad855f7e4fe4c5aa0b7c4e69d656b7aacdc6df3882c1402e28f00d2ec45c69d87f2e180451c93da69df89
-
Filesize
3.1MB
MD5d4bb3c12a036f35c4d1b47c2ef329289
SHA1543f2603b28c700b52c9e8b26de42f44b4dcfc9a
SHA2563ea9e32e5930b6e6eb42e830868966ecf43cad73febb4ac30135bf1acdf618e8
SHA5123576e0a968abcaff560b00e31d5b7c014b285241d8b5f47c7538888a6ea0753bbf8c5aee0c57010f188cededeae447af7e4106bacef3e9c08165ccd0d0d6f759
-
Filesize
841KB
MD59084b14b2a21514122e9818dd73e60a5
SHA15c83ad3343799fbb2e055c409d5f3efa905d6c7f
SHA2562ba924119f2380d04d9d28ba07d6b2225be124a18d9b57610929cdd9ee3d1b6d
SHA512d8ca7514f0a1e943ee05c0dabf00e28cfda128381bffe896f951e0e81c4f84e5d69afcab649bd0af55f5f4f451193abd7dd3640ca6578a82a45ac61d6fab3886
-
Filesize
111B
MD59ab0cc38f3ecf66cac074dffd56cca2d
SHA14037343acfd385912f2ba9087c834765f2a02bbe
SHA2562b36c2bac339cc0af1a4dc29c5a3eefc45e885f043780b593468fa3de9c4b903
SHA512b09a53656380d3496ca0731cc21c768c1039c3d634daa4aa3e395ad47bc6d6a704e556e06241e484928e9b58177b421f8e31dbed864611c71166962047823468
-
Filesize
512B
MD57204a2bb285221e6a55bdc0d6493be62
SHA1f64ce34c2be2bce07dc9e73fd72b4c82dcd2dd47
SHA256a95a78fee42355c5f0e2bc978238d9c62f99e9871cda0e392a3e3f12f99831ae
SHA5123ab32fae57b8b8d03872150bd4771f2cf4ec21f5d0f32c46598dc2c444148753346af39ee1a528faec60b2e56002918ed26bafe4b012123284dd66d96659570f
-
Filesize
65B
MD59781ca003f10f8d0c9c1945b63fdca7f
SHA14156cf5dc8d71dbab734d25e5e1598b37a5456f4
SHA2563325d2a819fdd8062c2cdc48a09b995c9b012915bcdf88b1cf9742a7f057c793
SHA51225a9877e274e0e9df29811825bd4f680fa0bf0ae6219527e4f1dcd17d0995d28b2926192d961a06ee5bef2eed73b3f38ec4ffdd0a1cda7ff2a10dc5711ffdf03
-
Filesize
111B
MD57fe6a10007ceae6373df70f0a02082c4
SHA1c8af8c214516295c452de8b1d890a7e014ba98ac
SHA25654b84e9a2de8cf92679394adc5cf1b81686d6a596cbac7d4a0ba38ab3337f05d
SHA512f5e18b91d9af83dba64aa8dfb7288385c04566c73cfec1aabf33505c1319a28e0b4531afaef766a86902409d81cebede6b483b5af60a537f3a92f952455d3245
-
Filesize
4KB
MD535c00f708d60ef2db3cb07329248dded
SHA1beb3f0f7eab95600901b6bbf9a0d648f3fe10cc9
SHA256fee7016e688f177869d8f55cf49384affbdc9fb0402e0f67b78ab93a778fc437
SHA512419c9c893b51ce2ee6cc246ed66029df05d7f82e1179449cd619afc32246703c13c625f6bf06f3e504ab9cc5949423cf2b57475e0100959b8f232a41e1055ff9