Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
115s -
max time network
130s -
platform
android_x86 -
resource
android-x86-arm-20240221-en -
resource tags
androidarch:armarch:x86image:android-x86-arm-20240221-enlocale:en-usos:android-9-x86system -
submitted
13/03/2024, 14:48
Static task
static1
Behavioral task
behavioral1
Sample
7e4c1ddfa772ca27691eaf3b78df63cd8a0b83952502275ce774346eb3ada191.apk
Resource
android-x86-arm-20240221-en
General
-
Target
7e4c1ddfa772ca27691eaf3b78df63cd8a0b83952502275ce774346eb3ada191.apk
-
Size
12.5MB
-
MD5
e5bb1615d7cb12810ce07816b3d269fb
-
SHA1
25d1365514d4e756e10dc55fdac301f1790b64f3
-
SHA256
7e4c1ddfa772ca27691eaf3b78df63cd8a0b83952502275ce774346eb3ada191
-
SHA512
39d8fa3edef592148f9d9d58d17476f4dedccb8cae9ee8d2fc8f5cdf11e131472eeae285a7b42f32b71ec33495b29d6643932a4aaf1eaf994fed1759cbbf5367
-
SSDEEP
393216:BMuLplR6OZPkvSGkAjLrWKg1C9NNKJsC4xlK1/9vDin:TLplOvSw2bkVFTCAn
Malware Config
Signatures
-
Loads dropped Dex/Jar 1 TTPs 8 IoCs
Runs executable file dropped to the device during analysis.
ioc pid Process /data/user/0/com.limolabs.edmonton/app_di1wplviho2fcvoyldi/edmonton.ext.jar 4503 /system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.limolabs.edmonton/app_di1wplviho2fcvoyldi/edmonton.ext.jar --output-vdex-fd=47 --oat-fd=55 --oat-location=/data/user/0/com.limolabs.edmonton/app_di1wplviho2fcvoyldi/oat/x86/edmonton.ext.odex --compiler-filter=quicken --class-loader-context=& /data/user/0/com.limolabs.edmonton/app_di1wplviho2fcvoyldi/edmonton.ext.jar 4461 com.limolabs.edmonton /data/user/0/com.limolabs.edmonton/app_di1wplviho2fcvoyldi/edmonton.dat.jar 4532 /system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.limolabs.edmonton/app_di1wplviho2fcvoyldi/edmonton.dat.jar --output-vdex-fd=47 --oat-fd=48 --oat-location=/data/user/0/com.limolabs.edmonton/app_di1wplviho2fcvoyldi/oat/x86/edmonton.dat.odex --compiler-filter=quicken --class-loader-context=& /data/user/0/com.limolabs.edmonton/app_di1wplviho2fcvoyldi/edmonton.dat.jar 4461 com.limolabs.edmonton /data/user/0/com.limolabs.edmonton/app_di1wplviho2fcvoyldi/xrrzCpXsT.dex 4555 /system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.limolabs.edmonton/app_di1wplviho2fcvoyldi/xrrzCpXsT.dex --output-vdex-fd=47 --oat-fd=48 --oat-location=/data/user/0/com.limolabs.edmonton/app_di1wplviho2fcvoyldi/oat/x86/xrrzCpXsT.odex --compiler-filter=quicken --class-loader-context=& /data/user/0/com.limolabs.edmonton/app_di1wplviho2fcvoyldi/xrrzCpXsT.dex 4461 com.limolabs.edmonton /data/user/0/com.limolabs.edmonton/app_di1wplviho2fcvoyldi/edmonton.ext.jar 4461 com.limolabs.edmonton /data/user/0/com.limolabs.edmonton/app_di1wplviho2fcvoyldi/edmonton.dat.jar 4461 com.limolabs.edmonton -
Uses Crypto APIs (Might try to encrypt user data) 1 IoCs
description ioc Process Framework API call javax.crypto.Cipher.doFinal com.limolabs.edmonton
Processes
-
com.limolabs.edmonton1⤵
- Loads dropped Dex/Jar
- Uses Crypto APIs (Might try to encrypt user data)
PID:4461 -
/system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.limolabs.edmonton/app_di1wplviho2fcvoyldi/edmonton.ext.jar --output-vdex-fd=47 --oat-fd=55 --oat-location=/data/user/0/com.limolabs.edmonton/app_di1wplviho2fcvoyldi/oat/x86/edmonton.ext.odex --compiler-filter=quicken --class-loader-context=&2⤵
- Loads dropped Dex/Jar
PID:4503
-
-
/system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.limolabs.edmonton/app_di1wplviho2fcvoyldi/edmonton.dat.jar --output-vdex-fd=47 --oat-fd=48 --oat-location=/data/user/0/com.limolabs.edmonton/app_di1wplviho2fcvoyldi/oat/x86/edmonton.dat.odex --compiler-filter=quicken --class-loader-context=&2⤵
- Loads dropped Dex/Jar
PID:4532
-
-
/system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.limolabs.edmonton/app_di1wplviho2fcvoyldi/xrrzCpXsT.dex --output-vdex-fd=47 --oat-fd=48 --oat-location=/data/user/0/com.limolabs.edmonton/app_di1wplviho2fcvoyldi/oat/x86/xrrzCpXsT.odex --compiler-filter=quicken --class-loader-context=&2⤵
- Loads dropped Dex/Jar
PID:4555
-
Network
MITRE ATT&CK Mobile v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2KB
MD5049ae8efc43fa3a3504c650c3da1dbeb
SHA11ce2447302b1b03172a0290bd262d29654fb1c46
SHA25616c4848b097233af59deb3a4ddab7fad7030d8b4d10a2b1dddfedc8e004f5590
SHA51282560592e6acd6ad44911e5f00b3a231ae59b59fadaf627ed4ec76cf0a91cdf86649d867aaa90e38a03c894838c92a082f8fb0d0fd5309ceb3c6734f34d42e41
-
Filesize
2KB
MD50fcbd489d2d61e996f7c561ac6ac1ba8
SHA1b2afd13fca0a814e4d1804cbf7da1414e1013478
SHA2560aa3756d1ef53181fc12e7381488a079506c55ce038b6e75abfcd46cb808c457
SHA51238f138d24f343d2334c553c9e669dbf362cd03b6828ddc43a0772a1b44f2f8564ddacab494c6068c32416e5e44c0796895d8621fb5aaa3330945e40faaa936db
-
/data/data/com.limolabs.edmonton/code_cache/flutter_engine/9d5b21729ff53dbf8eadd8bc97e0e30d77abec95/skia/b4d60f807dbd034edf9fae1233aa1784f6c36d5c/CAZAAAACBAAAAAAAAAAGKAAAAAJQAAIA777777Y4AAIQAEYAAEAP777777777777AAAAAABAABMAAAAAAAAAAAAAAABAAAAAGQAFKAA.temp
Filesize1KB
MD5dd1c9903a02b3ea7f12db5bac1704d88
SHA141d09698b73b590ecb01ac7783b3dbe434168a61
SHA25666aee2b6574473bd2fcbe43b8e2937cec4da239f75b5acbf7371aeb8c090c74b
SHA51284ee0cba0ebe661065acd6b889d955de2aa4d23f3d5b6f8a617ffa36b9489e5f72bdb256d588cb496fff03c76148f2adffe79509f0c9c73dea29166acab8aa3c
-
/data/data/com.limolabs.edmonton/code_cache/flutter_engine/9d5b21729ff53dbf8eadd8bc97e0e30d77abec95/skia/b4d60f807dbd034edf9fae1233aa1784f6c36d5c/CAZAAAECA4AAAAAAAAAEOAAAAAJQAAIA777777Y4AAIQB7777777777777777777EAAFQAAAAAAAAAAAAAAAEAAAAAYAAVIA.temp
Filesize792B
MD540096fa02086acf7b52dcc2d5a1c2a4f
SHA135edc727ffc8043781e1c49d86899126cb45cd0b
SHA256a05d4bd49b0b68818d9576d7fc258b40608340dcfb6fea93bfc73737050144e6
SHA512e90995305d70f4567dddffe99407d794a49cedc46089e9e19a8947a707e75aaa492ee26f509bb1b0f0ae5d338917dc83a01b22c821cad42b67ea7dd6b374f400
-
/data/data/com.limolabs.edmonton/code_cache/flutter_engine/9d5b21729ff53dbf8eadd8bc97e0e30d77abec95/skia/b4d60f807dbd034edf9fae1233aa1784f6c36d5c/CAZACAACB4AAAAAAAAAGOAAAAAJQAAIA777777Y4AAIQAEYAAEAP777777777777EAAFQAAAAAAAAKAAIYAAIAAAAAYAANAABAAAAABYAA4AABAAAAAAAAAAABCAAHQAAQAAAAAAAAAAAAB4AA6AAPAAHQAAAAAALQADYAAEAAAAAAAAAAAAEAAAABWAAVIA.temp
Filesize2KB
MD56dacfa16038be5bff5d1524d4b6bf7ac
SHA1bac6d11de946edf517141ca1a0460dcd6425ec42
SHA2569654bccd1fd5399b6b2bc710a748a7a3a811b96e64e11a1b6d7d64296a2c78d4
SHA51237165e0cc5033020cdc50c718f990cb4a10421d0e0f0fc48caf65d84425e87fa955709f714a804d5310efaff776a77dc670c6f4ac0488a2e0db1e1ba36fa9e66
-
Filesize
512B
MD5573c00440a78a92df2e97ffc78e21b84
SHA1a5bdede057f85f9df82693ee447edab11d68da8a
SHA2568eef2150f1e6a491cfd711ed902e3a092d9024d500f86a098b7d1e92bddada6d
SHA51291cf78d41b7400481213331108cc92f470680cd0cf424880882e562fdd772fa59c80abb27d38fff48b30b3d49fa5996a37754f1d226a2ca267f9423bcaf56eec
-
Filesize
64KB
MD5d29eabbe33e479bd0a6454cdf9955aca
SHA12d2c793397280b471af5464a81d435383a24d9b6
SHA256301b7768c428366059485e56c04d09bbffc9a4159954354d2fc4d4b74d95f184
SHA5120678e938cfd9d30c3d856ec3d4c401c1338601e39aa99e33726c1ffefed95134b33d62203335f2159a722de6ca1c035217e9421c7ccb8a4caf140ad4bcc1b5a6
-
Filesize
4KB
MD5f2b4b0190b9f384ca885f0c8c9b14700
SHA1934ff2646757b5b6e7f20f6a0aa76c7f995d9361
SHA2560a8ffb6b327963558716e87db8946016d143e39f895fa1b43e95ba7032ce2514
SHA512ec12685fc0d60526eed4d38820aad95611f3e93ae372be5a57142d8e8a1ba17e6e5dfe381a4e1365dddc0b363c9c40daaffdc1245bd515fddac69bf1abacd7f1
-
Filesize
512B
MD5b886290f34a034d4a40e95facb62351d
SHA1c02b4cd30512b1e2588728f35dc5f3b5139828b0
SHA2565d54201459f9716f96445df04a2a08c2ceaf60a2d2e748b45af69694c0286e09
SHA512c558d4e92611efa6366052d8472205787f6ea10ff840226ab2992ecf64a0f67ed743668f169bbcf624d79578dab4785305bf24167657aa6596d91d73cd62da13
-
Filesize
16KB
MD5cf2cd66e4736eeeab1f2ead16dc1b7ce
SHA1f62134d641d46597b207b870f1fa0c78fd52d100
SHA256b4feb169ce6eb338ff6fe5ec12919ca88dc83f93f7bdf83420a29b73057e4380
SHA512a2e3f51f42d1ed6ceb5dab0145ef25f9b89c2d81ece6808a94b52c9869f3925e3c2c5ae619651c0c54bc25ee283e29c83739a6ec2547829cd19950c856cc527c
-
Filesize
96KB
MD57c588fdc0ee3ab449183ada953c31394
SHA11b72b2feb5440214a63310172caf7e2e61b5c46c
SHA2563c50c77e242b9295c9f2aa749c2e955e8f6cf47d2ee775573e7718da91ec990e
SHA512ac7fdff821cad49ddb34a148674a0c1cb6695cc575f1a8bc46f381fd941f9d641d33ba3ceb607db99ba0bfa74f98c6b8dbefef049e6363bdeea91f37f3a93aeb
-
Filesize
16KB
MD56a1f91b682709efeccc1a27bb510f4ec
SHA118e94181d4f3113c0537e814785b3529feb03225
SHA25654af92c5a02e0da0b37fb073e8bab25e3965506894dfa153f3eb15565435e439
SHA51289cd55520dbefd7ec19fc466eec9a6db2bdc6afcfe06913f31720f0bcf01c2fe92526d81257df92eda25a871a3e0dd728a403bcb985096777ece6e05ac5daa30
-
Filesize
16KB
MD57e8389badd4bef9b753e664f554e7a0a
SHA126ac805e9260c933d4a47265a4df037561f055e1
SHA2565cef3bdd1efb97b2077dc560c9079de4b2acebdedcf83bf8b882d4c1d214e7ee
SHA5127f9eef603811a9adc8ac5ea8472da42ad344da3611a9feeb8b9f2c96f9b2a9186ec173736af43edc2a9b047aa81750f52c16ed68d7b4202bbd9f7a09200cb40d
-
Filesize
16KB
MD544693692da738db6eb133cf0e4cde91b
SHA1e6bda56494c325d8d37ad89552263ae85d9b0550
SHA2568fe0ac9db76d4a2dcd3b3d54c0efedcd223e25aabf716506493d50e243a7a2d4
SHA512b34ddfe1ae343b1b12f7029ae476a0ba8e1b4043ccb520afb412b3f71335ef679bf29723c9a5c00af7e922e9982d5b3af54b2ed779da8cb601f378e5b9d26be5
-
Filesize
4KB
MD5413b912c596ff7aefc6dbfa5ce3e73d4
SHA1b0d9760c27ffd909b4fcef5b722c359e761e2c38
SHA256c702b4dee6dcfd0a5de0434e2dbb201b11911784b12250f06b4f42169d1bfffd
SHA5126aae89da04839aa41854f333bdc78ffee5c573c7f06043970094c1199708cd95e02bb6185dda1068cd9065e06289c05a6c254ef347f0be28b3003de10a8bc4ab
-
Filesize
4KB
MD5c4f20a3f0b772e1bc2fc7476372e4b23
SHA134d25352008ea087bf8d232387e5b2771c0cd53b
SHA2568a81efc5e1ae5842e96f104396f1bf401d190ff606fbc95d1283fc3498540382
SHA5123e39bcc984646a87b79a6c83097c00e27530babf6fc727a6771b7f2abc85c8c2eb56071430dd2e1ed6918deb70d2a5181ec724574c7389bd656559de529bce6e
-
Filesize
4KB
MD5506b321613f6be7c57fec0a76ad36ce4
SHA16c3416efe63a300370e01ddc5c490fc9952b6703
SHA2567a32c71b5ebb20cccd0a3443a94014a2490a50893a53d1273df44945b6a41ead
SHA512bdcb7d335f7107da3caa6e58024dc5768964174d77113f82378b8f0c5bf1cfb5822241e2b04040e3f197b4e2449af43f4817bee08ae52a233b2b5c0e6b9450a9
-
Filesize
6KB
MD521486c8b21745b02a88fde1b044514ee
SHA1bbfce6c338f367a9fcd50974e21094c1058f2aa9
SHA2566ca9c305f07daf382f93b7420340c28e5fc0d5ff4f026b90ca3f3561f43b887f
SHA51208a5d536d0fefbf56ef611094d768b2fbe3f3e8f3197e44473f09449cad451f4b69a2c940f334133519fe1eea231cc570720a75a844409bc958d5bd1f642bb76
-
Filesize
6KB
MD5c2975c1e845f99249f758912b6eee293
SHA17ba0ef346c28c2950d9bc42d7ee6f13bedb98175
SHA2563bb7f7250b9441edae1862f79095a9e1db4e5d75d9176df74fae8d862cc94645
SHA5128b57e0d13e5f86a66f0e3aaa15dd1c5952e0e783051719d1752c45ec6919a8ad30db9f999ecd0002ca4a5ec14709b44953ebe5e9f35e399b11648b58c8ab39b8
-
Filesize
6.3MB
MD5f85adddd54466fe9890d68d2338af9dd
SHA1e055a274650a4c1908ad93dbb0059a0b04a62fa5
SHA2569dd9654fe94ac0677b9444724bb7fe780ee08b1efa979af132eeb9e0f1f08f6e
SHA512617b92297e90f2984cbef9eb523d406bd1f86181da5227a1dd32a5c74bdb56b832ec53fe51702874a6288a140fbb042fac7c7b6b79deca30c5b366a274beb247
-
Filesize
6.3MB
MD547cd7bbf75e32c13f4bfb23915a3fd0e
SHA12869e7e4dd545fa11ef8c6bb6325f1a50231e60d
SHA25668ce8ab05f649fcdbd8d6f99a4ac879e45478fa131f7b4a7c70fdd06f59bb1d2
SHA5121072f9ff91a816fe38e0fd9cc7d8bfa9cf429ba7b5c3520a1e4d36c8938be4d6b2e6b9182850ad26230b089b911fa411bc02f312132d6f20701eee1b08e5d9d6
-
Filesize
4KB
MD50549cdd13e4782ca7c02dc4d3bbcb67a
SHA191b3dc0ef257c58fe9b2ef4ac73f78f611aab0d7
SHA256620adf9de0509c91943876be17934f5e34cfa03f31da7861c505867798e9ebb3
SHA5127268aa2de2f72c5f8bfefc4b42dbc9c66e62c52d91b76ae3a61b19497d1254f325141ddd5967f50bb0d2671eef063fc38b285ae26832eb35d9a88bae88bfecfc
-
Filesize
4KB
MD55725c01e3b9ad94add77186b155f31c2
SHA155c56d76e1f354199a22e5dfd1dea666496468e0
SHA256f55dbc2175954bbe9f9ae74c6802babffa0338a16e197eb8b836611ad1d6707b
SHA512e6e100ce0a866697ca91b186e4456ea0f67ed6d96864984e242fa8b33ee35cbcd4a441a3b95df18cb5ca249f09b0db485978bbbfd77c5a089dd8dc52dad982fa