Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    151s
  • max time network
    146s
  • platform
    android_x64
  • resource
    android-33-x64-arm64-20240221-en
  • resource tags

    androidarch:arm64arch:x64image:android-33-x64-arm64-20240221-enlocale:en-usos:android-13-x64system
  • submitted
    23/02/2024, 14:15

General

  • Target

    61f73bf90c3234faeb8aa7c90f24fa3f7a3a1d38b2e94d40ce96a21e7320fd28.apk

  • Size

    6.8MB

  • MD5

    73d0f5db820e8b491365e3faa9b55498

  • SHA1

    d5ef600aa1c01fa200ed46140c8308637f09dfcd

  • SHA256

    61f73bf90c3234faeb8aa7c90f24fa3f7a3a1d38b2e94d40ce96a21e7320fd28

  • SHA512

    796c47b244bf7d871eb0c0e43dd1b8eed86d15c00a5128ae7740bf87c0b5fcbe9787ee133f739ee0dd5986bee49075208bb768718db12590b2c7073ebe1ed89b

  • SSDEEP

    196608:HSwZWQeHQZzcTK77FMQ+V+Y4Bz/JdLdJ3Uh3IwNde:H5ZwH80EJEv4h/9Shz7e

Score
10/10

Malware Config

Signatures

  • Filecoder.C

    A ransomware family that spreads to other victims via SMS.

  • Legitimate hosting services abused for malware hosting/C2 1 TTPs 3 IoCs
  • Changes the wallpaper (common with ransomware activity). 1 IoCs
  • Uses Crypto APIs (Might try to encrypt user data) 1 IoCs

Processes

  • net.south.seven
    1⤵
    • Changes the wallpaper (common with ransomware activity).
    • Uses Crypto APIs (Might try to encrypt user data)
    PID:4512

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • /data/system/users/0/wallpaper_orig

    Filesize

    428KB

    MD5

    c8d5a040d3d9607dc1c2c91df99304fa

    SHA1

    c2a567eb76d6ecaee6ae5c424e247027cdbca05e

    SHA256

    9be71f646a44b37a5a444afce74a94bdf5861cc5d15e39b62d1cb7f06c4d9549

    SHA512

    f4f3fd814a01fc8de337d50b6893c318bffef23cdf5595a32ccd372be8e6e262d63682de33b5a7c6020fc47784af8f781e08d4573f6e6387d7dad062bb0c0b3e

  • /data/system/users/0/wallpaper_orig

    Filesize

    1.3MB

    MD5

    1a6c1ce744da4d3a6219bed162294aac

    SHA1

    c890f7771e88d2639c9a3b463b48af6ff1b921f7

    SHA256

    6c3a28bf18115b233967bf477f3d767f184858ad0c6dece7a4f286f30a599ef8

    SHA512

    72f4ae4b9f9e27e161856bd50ccaa2bc9f77a0aba789de881316a823ea2f8460a966b12f1f6e564c6fd5c2bc9c9d0b8f683cf8775c90c323268f2731fa1fa48b