Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

10

Static

static

10

5bf740d33b...fd.apk

android-9-x86

6

5bf740d33b...fd.apk

android-13-x64

7

Analysis

  • max time kernel
    19s
  • max time network
    139s
  • platform
    android_x86
  • resource
    android-x86-arm-20240221-en
  • resource tags

    androidarch:armarch:x86image:android-x86-arm-20240221-enlocale:en-usos:android-9-x86system
  • submitted
    02/04/2024, 10:18 UTC

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    5bf740d33b8654c1888b6ff6f2f2d32895cdfd9b205be5acb550e3d15cd705fd.apk

  • Size

    3.4MB

  • MD5

    185103d45cb5c8d59319e8488035e3b4

  • SHA1

    dfbe249d9af8289ebe83f6c6436054498e9759d5

  • SHA256

    5bf740d33b8654c1888b6ff6f2f2d32895cdfd9b205be5acb550e3d15cd705fd

  • SHA512

    eb104556ef2cb685a0a8bca9b71d8bba9ecb857b34c29307a1b37834ae5cb029742e5576315ef0ce57421b698d90b2630e233247edd7d5b23b21184bef4a742a

  • SSDEEP

    98304:css9Dft3aCrCMr1GoTwr5qUa8Eeu0XVvetu85W:DWDFrDRevmW

Score
6/10
discovery

Malware Config

Signatures

  • Acquires the wake lock 1 IoCs
  • Reads information about phone network operator. 1 TTPs
    discovery
  • Uses Crypto APIs (Might try to encrypt user data) 1 IoCs

Processes

  • com.drnull.v5
    1⤵
    • Acquires the wake lock
    • Uses Crypto APIs (Might try to encrypt user data)
    PID:4266

Network

  • flag-us
    DNS
    semanticlocation-pa.googleapis.com
    Remote address:
    1.1.1.1:53
    Request
    semanticlocation-pa.googleapis.com
    IN A
    Response
    semanticlocation-pa.googleapis.com
    IN A
    142.250.180.10
    semanticlocation-pa.googleapis.com
    IN A
    142.250.178.10
    semanticlocation-pa.googleapis.com
    IN A
    216.58.213.10
    semanticlocation-pa.googleapis.com
    IN A
    142.250.187.202
    semanticlocation-pa.googleapis.com
    IN A
    142.250.179.234
    semanticlocation-pa.googleapis.com
    IN A
    142.250.200.10
    semanticlocation-pa.googleapis.com
    IN A
    142.250.200.42
    semanticlocation-pa.googleapis.com
    IN A
    216.58.201.106
    semanticlocation-pa.googleapis.com
    IN A
    172.217.169.10
    semanticlocation-pa.googleapis.com
    IN A
    216.58.204.74
    semanticlocation-pa.googleapis.com
    IN A
    172.217.16.234
    semanticlocation-pa.googleapis.com
    IN A
    172.217.169.42
    semanticlocation-pa.googleapis.com
    IN A
    142.250.187.234
    semanticlocation-pa.googleapis.com
    IN A
    216.58.212.202
  • flag-us
    DNS
    android.apis.google.com
    Remote address:
    1.1.1.1:53
    Request
    android.apis.google.com
    IN A
    Response
    android.apis.google.com
    IN CNAME
    clients.l.google.com
    clients.l.google.com
    IN A
    142.250.179.238
  • flag-us
    DNS
    green.whatsyourfavoritecolor.xyz
    Remote address:
    1.1.1.1:53
    Request
    green.whatsyourfavoritecolor.xyz
    IN A
    Response
  • 142.250.180.10:443
    semanticlocation-pa.googleapis.com
    tls
    1.7kB
     6.3kB
     11
    13
  • 142.250.187.206:443
    tls, https
    1.2kB
     40 B
     1
    1
  • 142.250.179.238:443
    android.apis.google.com
    tls
    8.2kB
     10.6kB
     29
    30
  • 224.0.0.251:5353
    3.7kB
     11
  • 1.1.1.1:53
    semanticlocation-pa.googleapis.com
    dns
    80 B
     304 B
     1
    1

    DNS Request

    semanticlocation-pa.googleapis.com

    DNS Response

    142.250.180.10
    142.250.178.10
    216.58.213.10
    142.250.187.202
    142.250.179.234
    142.250.200.10
    142.250.200.42
    216.58.201.106
    172.217.169.10
    216.58.204.74
    172.217.16.234
    172.217.169.42
    142.250.187.234
    216.58.212.202

  • 1.1.1.1:53
    android.apis.google.com
    dns
    69 B
     109 B
     1
    1

    DNS Request

    android.apis.google.com

    DNS Response

    142.250.179.238

  • 1.1.1.1:53
    green.whatsyourfavoritecolor.xyz
    dns
    78 B
     143 B
     1
    1

    DNS Request

    green.whatsyourfavoritecolor.xyz

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • /data/data/com.drnull.v5/databases/com.google.android.datatransport.events
    Filesize

    4KB

    MD5

    f2b4b0190b9f384ca885f0c8c9b14700

    SHA1

    934ff2646757b5b6e7f20f6a0aa76c7f995d9361

    SHA256

    0a8ffb6b327963558716e87db8946016d143e39f895fa1b43e95ba7032ce2514

    SHA512

    ec12685fc0d60526eed4d38820aad95611f3e93ae372be5a57142d8e8a1ba17e6e5dfe381a4e1365dddc0b363c9c40daaffdc1245bd515fddac69bf1abacd7f1

    Download Submit

  • /data/data/com.drnull.v5/databases/com.google.android.datatransport.events-journal
    Filesize

    512B

    MD5

    7da3bc644173eb8c94738b04c767e3d1

    SHA1

    45550f69e0a882562717ce854b9129531b8b0e36

    SHA256

    ad1c726467c01177ebe8ea6a0ea2e4437e5ae0e012f5cfc291b9a9b833778913

    SHA512

    50e594f121c8ce8213d0919b8244575b70cab3acb49cfbc21098d6e220afcf97caabc77e384e8ff29bb143f3df4727eebdb00ff34e8b6562ab233c6419fff51c

    Download Submit

  • /data/data/com.drnull.v5/databases/com.google.android.datatransport.events-shm
    Filesize

    32KB

    MD5

    bb7df04e1b0a2570657527a7e108ae23

    SHA1

    5188431849b4613152fd7bdba6a3ff0a4fd6424b

    SHA256

    c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479

    SHA512

    768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012

    Download Submit

  • /data/data/com.drnull.v5/databases/com.google.android.datatransport.events-wal
    Filesize

    68KB

    MD5

    d9b3444371192667075e0d5b426f760a

    SHA1

    88f987f0b03b30839777e1d8a9d961b8aca79b18

    SHA256

    a9b1a04e137b769d9acdb73f8a70a52946e046fc636ef206c83e86a4c2ed4e05

    SHA512

    9b4b2741ec27f2aaf0b38c224278ec4c18b3155a040b48dff96ab8bae8ea00c63845aa5615925312c7d37e4b85c06fc55a4db26b0e71db1e27c779c2a0caece3

    Download Submit

  • /data/data/com.drnull.v5/files/PersistedInstallation5636089357122676549tmp
    Filesize

    569B

    MD5

    fdd2c3c686714ebac1937b7d78d1d38b

    SHA1

    e9bc61fe31cdd59fa1a7fada11b0a31e39044d21

    SHA256

    46644ceebacdcf54cfd222707273441b98957fb0ec5e1bfbd66f4e67e11875a3

    SHA512

    83b95c6733dcc502e7365bc9252596e378139bb18a21a16a301e408477630eedb2eb2fb82eb00a260700d3980709d3f10009c458a2c4533e8c2410eba58cf1a2

    Download Submit

  • /data/data/com.drnull.v5/files/PersistedInstallation8733788213177138127tmp
    Filesize

    90B

    MD5

    1472e73c7843a392d62fcf417f617d26

    SHA1

    38c89e5dc779d3ba72aa003dec814f3527317e8e

    SHA256

    c6fc088935cecce00424acaec3e4f2fec6805f71abee05114ebb9e0860406551

    SHA512

    e65ebd6c7fd3d7787517fd04959442d56b1202e2b1d66c1c55ba21a7fcfa9d688bcda75daef02f12e249475272319c65fb514625a5d1f3ee5da9a23f416e2cb4

    Download Submit

  • /data/data/com.drnull.v5/files/database.db
    Filesize

    102B

    MD5

    e9b728cb9252a6ac9198e4f3bb053180

    SHA1

    9b5867fc433b9258fc4a32f0f11c537741e73879

    SHA256

    f4e63bfe6fe1ca610d728b428d2a15707b0e1d314c03777425221ce5b371176d

    SHA512

    9dd1d46d619dc45ded01ee718ceaa2e950c210152661526233e8ed33a9afb8589a3e2f9ef4016edd1e38e2748e8839616099283b15a9a70e3dfdd94c0a3a935d

    Download Submit

  • /data/data/com.drnull.v5/files/database.db
    Filesize

    262B

    MD5

    a78ff3dca3cf6f37556dd3e2576db1d1

    SHA1

    dd0c86addb2630512bde277a5ea1a4b899b12cba

    SHA256

    24cfaf85623d1521caa7f3d2cd6dc2e9a004c7b8ae2e71c6cc04083b06221fd5

    SHA512

    3e619bfde1dc8523610dc3a54952fb0080f5bd06e04f4ef13d9a50c843f6269f93652a05b061619cc07b7e714cd646c76f61dc7dfe96fcec2685ff0081065065

    Download Submit

  • /data/data/com.drnull.v5/files/profileInstalled
    Filesize

    24B

    MD5

    4b04c283b25fb9f2d557852fc79f3ba0

    SHA1

    f92a56508850839243b6a870d7cd2e1643b4feb1

    SHA256

    bb50ffe4ceee49e06fd7e5d5a93414995aab7dd8ea313a58978fc5f1bce3b63b

    SHA512

    015a29bb3e519987e4c744a2a5769ab045cd01afbca756bb948df26985cb3d9b845af37a2488b37b1940bcd2d83ebfce48a4add1719a05bf11cfbf4304c4feef

    Download Submit

  • /data/data/com.drnull.v5/files/profileinstaller_profileWrittenFor_lastUpdateTime.dat
    Filesize

    8B

    MD5

    5c1275f21b69bf954d437038c8d1e66f

    SHA1

    1f29a47c4ddd256738607327e1091026068dddd7

    SHA256

    54baab9e3f28f8b17a37ecb0c139f90d5f5c33bdafd93b9612ff5385a0ed0a22

    SHA512

    e981284b531b67f2db13d06406b26a2963754135936964ad028f75611344357fba77c7679c59f8581039f342c92ec8722b634134e6c9f4126d7e54bbee2836dc

    Download Submit

  • /data/misc/profiles/cur/0/com.drnull.v5/primary.prof
    Filesize

    1KB

    MD5

    622cb5612f87a316f2a3bed0eafae54e

    SHA1

    44ae60d1b0ca6942d37d3bcb662e0c24db451100

    SHA256

    e1526d6960592512b30665a13f4368b5b58a56c410cb7436844d0de9927a5982

    SHA512

    30766946d3708ec5cbb9a7d0300ca636f9614fb2de7313d07a577c57e17de7a4ff80e00e7a627ddc030df5c189f58d7a08b64af3f54a56d7e644781e84716709

    Download Submit

We care about your privacy.

This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.