Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
General
-
Target
52435cd21f3d725029038fd4c24e22f819dee4ea035107bb30ee2895d9d02b29.bin
-
Size
994KB
-
Sample
240416-1xl6gadg79
-
MD5
b5ee66fe34fab727ce1541e054bbd8a5
-
SHA1
8f4836b5604816f398eee8d42073eca89bfeb145
-
SHA256
52435cd21f3d725029038fd4c24e22f819dee4ea035107bb30ee2895d9d02b29
-
SHA512
9e699052d0fb9c4b1fe06e0b24d160a861da18ce4c2f754d92c005a3ad112385744d0e8ad4d2b29ad173c1b1f7265fdfdba5f26b9790abf9a47dfcdfe4f81900
-
SSDEEP
24576:zTww2poKQAdjHLE3z48qKCfCVCwCICHCCCnCICrCXgSDUW:z8w5XYasge0V5WHWpiKgSn
Behavioral task
behavioral1
Sample
52435cd21f3d725029038fd4c24e22f819dee4ea035107bb30ee2895d9d02b29.apk
Resource
android-x86-arm-20240221-en
Behavioral task
behavioral2
Sample
52435cd21f3d725029038fd4c24e22f819dee4ea035107bb30ee2895d9d02b29.apk
Resource
android-x64-20240221-en
Behavioral task
behavioral3
Sample
52435cd21f3d725029038fd4c24e22f819dee4ea035107bb30ee2895d9d02b29.apk
Resource
android-x64-arm64-20240221-en
Malware Config
Extracted
ermac
http://87.120.84.22:3434
Targets
-
-
Target
52435cd21f3d725029038fd4c24e22f819dee4ea035107bb30ee2895d9d02b29.bin
-
Size
994KB
-
MD5
b5ee66fe34fab727ce1541e054bbd8a5
-
SHA1
8f4836b5604816f398eee8d42073eca89bfeb145
-
SHA256
52435cd21f3d725029038fd4c24e22f819dee4ea035107bb30ee2895d9d02b29
-
SHA512
9e699052d0fb9c4b1fe06e0b24d160a861da18ce4c2f754d92c005a3ad112385744d0e8ad4d2b29ad173c1b1f7265fdfdba5f26b9790abf9a47dfcdfe4f81900
-
SSDEEP
24576:zTww2poKQAdjHLE3z48qKCfCVCwCICHCCCnCICrCXgSDUW:z8w5XYasge0V5WHWpiKgSn
-
Makes use of the framework's Accessibility service
Retrieves information displayed on the phone screen using AccessibilityService.
-
Makes use of the framework's foreground persistence service
Application may abuse the framework's foreground service to continue running in the foreground.
-
Queries the phone number (MSISDN for GSM devices)
-
Acquires the wake lock
-
Queries the unique device ID (IMEI, MEID, IMSI)
-
Reads information about phone network operator.
-
Requests disabling of battery optimizations (often used to enable hiding in the background).
-
MITRE ATT&CK Mobile v15
Defense Evasion
Foreground Persistence
1Hide Artifacts
2Suppress Application Icon
1User Evasion
1Input Injection
1Virtualization/Sandbox Evasion
2System Checks
2