Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

7

Static

static

1

URLScan

urlscan

http://buxforblox.com

windows7-x64

1

http://buxforblox.com

android-10-x64

7

http://buxforblox.com

android-11-x64

1

http://buxforblox.com

android-13-x64

1

http://buxforblox.com

android-9-x86

1

Analysis

  • max time kernel
    26s
  • max time network
    36s
  • platform
    android_x64
  • resource
    android-x64-20240221-en
  • resource tags

    androidarch:x64arch:x86image:android-x64-20240221-enlocale:en-usos:android-10-x64system
  • submitted
    19/03/2024, 08:56 UTC

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    http://buxforblox.com

Score
7/10
collection

Malware Config

Signatures

  • Reads the content of photos stored on the user's device. 1 TTPs 1 IoCs
    collection

Processes

  • com.android.chrome
    1⤵
    • Reads the content of photos stored on the user's device.
    PID:5078

Network

  • flag-us
    DNS
    accounts.google.com
    Remote address:
    1.1.1.1:53
    Request
    accounts.google.com
    IN A
    Response
    accounts.google.com
    IN A
    64.233.166.84
  • flag-us
    DNS
    buxforblox.com
    Remote address:
    1.1.1.1:53
    Request
    buxforblox.com
    IN A
    Response
  • flag-us
    DNS
    buxforblox.com
    Remote address:
    1.1.1.1:53
    Request
    buxforblox.com
    IN A
    Response
  • flag-us
    DNS
    buxforblox.com
    Remote address:
    1.1.1.1:53
    Request
    buxforblox.com
    IN A
  • flag-us
    DNS
    ssl.google-analytics.com
    Remote address:
    1.1.1.1:53
    Request
    ssl.google-analytics.com
    IN A
    Response
    ssl.google-analytics.com
    IN A
    216.58.201.104
  • flag-us
    DNS
    safebrowsing.googleapis.com
    Remote address:
    1.1.1.1:53
    Request
    safebrowsing.googleapis.com
    IN A
    Response
    safebrowsing.googleapis.com
    IN A
    216.58.201.106
  • flag-us
    DNS
    www.google.com
    Remote address:
    1.1.1.1:53
    Request
    www.google.com
    IN A
  • flag-us
    DNS
    www.google.com
    Remote address:
    1.1.1.1:53
    Request
    www.google.com
    IN A
    Response
    www.google.com
    IN A
    142.250.200.36
  • flag-us
    DNS
    google.com
    Remote address:
    1.1.1.1:53
    Request
    google.com
    IN A
    Response
    google.com
    IN A
    172.217.16.238
  • flag-us
    DNS
    google.com
    Remote address:
    8.8.8.8:53
    Request
    google.com
    IN A
  • flag-us
    DNS
    update.googleapis.com
    Remote address:
    1.1.1.1:53
    Request
    update.googleapis.com
    IN A
    Response
    update.googleapis.com
    IN A
    142.250.200.3
  • flag-us
    DNS
    update.googleapis.com
    Remote address:
    1.1.1.1:53
    Request
    update.googleapis.com
    IN A
  • flag-us
    DNS
    buxforblox.com
    Remote address:
    1.1.1.1:53
    Request
    buxforblox.com
    IN A
    Response
  • flag-us
    DNS
    qaevgtqnhib
    Remote address:
    1.1.1.1:53
    Request
    qaevgtqnhib
    IN A
    Response
  • flag-us
    DNS
    kwgelqcuqalob
    Remote address:
    1.1.1.1:53
    Request
    kwgelqcuqalob
    IN A
    Response
  • flag-us
    DNS
    cvkodkalepbno
    Remote address:
    1.1.1.1:53
    Request
    cvkodkalepbno
    IN A
    Response
  • flag-us
    DNS
    google.com
    Remote address:
    8.8.4.4:53
    Request
    google.com
    IN A
    Response
    google.com
    IN A
    172.217.23.206
  • flag-us
    DNS
    buxforblox.com
    Remote address:
    1.1.1.1:53
    Request
    buxforblox.com
    IN A
  • flag-us
    DNS
    buxforblox.com
    Remote address:
    1.1.1.1:53
    Request
    buxforblox.com
    IN A
    Response
  • flag-gb
    POST
    https://update.googleapis.com/service/update2
    Remote address:
    142.250.200.3:443
    Request
    POST /service/update2 HTTP/1.1
    Content-Length: 661
    Content-Type: application/x-www-form-urlencoded
    User-Agent: Dalvik/2.1.0 (Linux; U; Android 10; Pixel 2 Build/QSR1.210802.001)
    Host: update.googleapis.com
    Connection: Keep-Alive
    Accept-Encoding: gzip
    Response
    HTTP/1.1 200 OK
    Content-Security-Policy: script-src 'report-sample' 'nonce-sHC2ut8mfgiYdQm8VwJ-RQ' 'unsafe-inline' 'strict-dynamic' https: http:;object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/clientupdate-aus/1
    Cache-Control: no-cache, no-store, max-age=0, must-revalidate
    Pragma: no-cache
    Expires: Mon, 01 Jan 1990 00:00:00 GMT
    Date: Tue, 19 Mar 2024 08:57:17 GMT
    Content-Type: text/xml; charset=UTF-8
    X-Daynum: 6287
    X-Daystart: 7037
    Content-Encoding: gzip
    X-Content-Type-Options: nosniff
    X-Frame-Options: SAMEORIGIN
    X-XSS-Protection: 1; mode=block
    Server: GSE
    Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
    Transfer-Encoding: chunked
  • flag-gb
    POST
    https://update.googleapis.com/service/update2
    Remote address:
    142.250.200.3:443
    Request
    POST /service/update2 HTTP/1.1
    Content-Length: 655
    Content-Type: application/x-www-form-urlencoded
    User-Agent: Dalvik/2.1.0 (Linux; U; Android 10; Pixel 2 Build/QSR1.210802.001)
    Host: update.googleapis.com
    Connection: Keep-Alive
    Accept-Encoding: gzip
    Response
    HTTP/1.1 200 OK
    Content-Security-Policy: script-src 'report-sample' 'nonce-CIKq9dZYTjtw0LkYwYTPfw' 'unsafe-inline' 'strict-dynamic' https: http:;object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/clientupdate-aus/1
    Cache-Control: no-cache, no-store, max-age=0, must-revalidate
    Pragma: no-cache
    Expires: Mon, 01 Jan 1990 00:00:00 GMT
    Date: Tue, 19 Mar 2024 08:57:17 GMT
    Content-Type: text/xml; charset=UTF-8
    X-Daynum: 6287
    X-Daystart: 7037
    Content-Encoding: gzip
    X-Content-Type-Options: nosniff
    X-Frame-Options: SAMEORIGIN
    X-XSS-Protection: 1; mode=block
    Server: GSE
    Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
    Transfer-Encoding: chunked
  • flag-us
    DNS
    android.apis.google.com
    Remote address:
    1.1.1.1:53
    Request
    android.apis.google.com
    IN A
    Response
    android.apis.google.com
    IN CNAME
    clients.l.google.com
    clients.l.google.com
    IN A
    142.250.178.14
  • flag-us
    DNS
    buxforblox.com
    Remote address:
    1.1.1.1:53
    Request
    buxforblox.com
    IN A
    Response
  • flag-us
    DNS
    google.com
    Remote address:
    1.1.1.1:53
    Request
    google.com
    IN A
    Response
    google.com
    IN A
    172.217.16.238
  • flag-us
    DNS
    google.com
    Remote address:
    8.8.4.4:53
    Request
    google.com
    IN A
    Response
    google.com
    IN A
    172.217.23.206
  • flag-us
    DNS
    semanticlocation-pa.googleapis.com
    Remote address:
    1.1.1.1:53
    Request
    semanticlocation-pa.googleapis.com
    IN A
    Response
    semanticlocation-pa.googleapis.com
    IN A
    142.250.187.234
    semanticlocation-pa.googleapis.com
    IN A
    142.250.200.42
    semanticlocation-pa.googleapis.com
    IN A
    216.58.204.74
    semanticlocation-pa.googleapis.com
    IN A
    216.58.201.106
    semanticlocation-pa.googleapis.com
    IN A
    172.217.169.42
    semanticlocation-pa.googleapis.com
    IN A
    216.58.213.10
    semanticlocation-pa.googleapis.com
    IN A
    142.250.180.10
    semanticlocation-pa.googleapis.com
    IN A
    172.217.16.234
    semanticlocation-pa.googleapis.com
    IN A
    142.250.179.234
    semanticlocation-pa.googleapis.com
    IN A
    216.58.212.202
    semanticlocation-pa.googleapis.com
    IN A
    142.250.200.10
    semanticlocation-pa.googleapis.com
    IN A
    142.250.187.202
    semanticlocation-pa.googleapis.com
    IN A
    142.250.178.10
  • flag-us
    DNS
    semanticlocation-pa.googleapis.com
    Remote address:
    1.1.1.1:53
    Request
    semanticlocation-pa.googleapis.com
    IN A
  • 64.233.166.84:443
    accounts.google.com
    tls
    2.0kB
     7.6kB
     18
    16
  • 216.58.201.104:443
    ssl.google-analytics.com
    tls
    1.3kB
     6.1kB
     9
    9
  • 216.58.201.106:443
    safebrowsing.googleapis.com
    tls
    9.3kB
     379.7kB
     147
    265
  • 216.58.213.10:443
    tls, https
    128 B
     40 B
     2
    1
  • 142.250.200.36:443
    www.google.com
    tls
    2.8kB
     11.6kB
     26
    22
  • 142.250.200.3:443
    https://update.googleapis.com/service/update2
    tls, http
    3.0kB
     8.3kB
     10
    14

    HTTP Request

    POST https://update.googleapis.com/service/update2

    HTTP Response

    200

    HTTP Request

    POST https://update.googleapis.com/service/update2

    HTTP Response

    200
  • 142.250.178.14:443
    tls, https
    857 B
     40 B
     1
    1
  • 142.250.178.14:443
    android.apis.google.com
    tls
    1.8kB
     6.2kB
     8
    10
  • 224.0.0.251:5353
    2.5kB
     8
  • 1.1.1.1:53
    accounts.google.com
    dns
    65 B
     81 B
     1
    1

    DNS Request

    accounts.google.com

    DNS Response

    64.233.166.84

  • 1.1.1.1:53
    buxforblox.com
    dns
    60 B
     133 B
     1
    1

    DNS Request

    buxforblox.com

  • 1.1.1.1:53
    buxforblox.com
    dns
    120 B
     133 B
     2
    1

    DNS Request

    buxforblox.com

    DNS Request

    buxforblox.com

  • 1.1.1.1:53
    ssl.google-analytics.com
    dns
    70 B
     86 B
     1
    1

    DNS Request

    ssl.google-analytics.com

    DNS Response

    216.58.201.104

  • 1.1.1.1:53
    safebrowsing.googleapis.com
    dns
    73 B
     89 B
     1
    1

    DNS Request

    safebrowsing.googleapis.com

    DNS Response

    216.58.201.106

  • 1.1.1.1:53
    www.google.com
    dns
    60 B
     1

    DNS Request

    www.google.com

  • 1.1.1.1:53
    www.google.com
    dns
    60 B
     76 B
     1
    1

    DNS Request

    www.google.com

    DNS Response

    142.250.200.36

  • 1.1.1.1:53
    google.com
    dns
    56 B
     72 B
     1
    1

    DNS Request

    google.com

    DNS Response

    172.217.16.238

  • 8.8.8.8:53
    google.com
    dns
    56 B
     1

    DNS Request

    google.com

  • 1.1.1.1:53
    update.googleapis.com
    dns
    134 B
     83 B
     2
    1

    DNS Request

    update.googleapis.com

    DNS Request

    update.googleapis.com

    DNS Response

    142.250.200.3

  • 1.1.1.1:53
    buxforblox.com
    dns
    60 B
     133 B
     1
    1

    DNS Request

    buxforblox.com

  • 1.1.1.1:53
    qaevgtqnhib
    dns
    57 B
     132 B
     1
    1

    DNS Request

    qaevgtqnhib

  • 1.1.1.1:53
    kwgelqcuqalob
    dns
    59 B
     134 B
     1
    1

    DNS Request

    kwgelqcuqalob

  • 1.1.1.1:53
    cvkodkalepbno
    dns
    59 B
     134 B
     1
    1

    DNS Request

    cvkodkalepbno

  • 8.8.4.4:53
    google.com
    dns
    56 B
     72 B
     1
    1

    DNS Request

    google.com

    DNS Response

    172.217.23.206

  • 1.1.1.1:53
    buxforblox.com
    dns
    60 B
     1

    DNS Request

    buxforblox.com

  • 1.1.1.1:53
    buxforblox.com
    dns
    60 B
     133 B
     1
    1

    DNS Request

    buxforblox.com

  • 1.1.1.1:53
    android.apis.google.com
    dns
    69 B
     109 B
     1
    1

    DNS Request

    android.apis.google.com

    DNS Response

    142.250.178.14

  • 1.1.1.1:53
    buxforblox.com
    dns
    60 B
     133 B
     1
    1

    DNS Request

    buxforblox.com

  • 1.1.1.1:53
    google.com
    dns
    56 B
     72 B
     1
    1

    DNS Request

    google.com

    DNS Response

    172.217.16.238

  • 8.8.4.4:53
    google.com
    dns
    56 B
     72 B
     1
    1

    DNS Request

    google.com

    DNS Response

    172.217.23.206

  • 1.1.1.1:53
    semanticlocation-pa.googleapis.com
    dns
    160 B
     288 B
     2
    1

    DNS Request

    semanticlocation-pa.googleapis.com

    DNS Request

    semanticlocation-pa.googleapis.com

    DNS Response

    142.250.187.234
    142.250.200.42
    216.58.204.74
    216.58.201.106
    172.217.169.42
    216.58.213.10
    142.250.180.10
    172.217.16.234
    142.250.179.234
    216.58.212.202
    142.250.200.10
    142.250.187.202
    142.250.178.10

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads

We care about your privacy.

This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.