Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    67s
  • max time network
    154s
  • platform
    android_x64
  • resource
    android-x64-arm64-20240221-en
  • resource tags

    androidarch:armarch:arm64arch:x64arch:x86image:android-x64-arm64-20240221-enlocale:en-usos:android-11-x64system
  • submitted
    20/04/2024, 20:10

General

  • Target

    Shad-app-3.5.5(www.farsroid.com).apk

  • Size

    77.4MB

  • MD5

    116d717823c9cd6a8ed989ee5d0c5be8

  • SHA1

    7c944b80159e78116578d57acdca2000309171f0

  • SHA256

    ade8d0d4511caa63f0d62075e99e39126b5a907a01986ee5575c82dc5748a384

  • SHA512

    ea9621106c0daa87f3d0c77624374b5a3ac4411fa94d455e5146170cd3f57374dbde99faf4c4f983332dfaa1145e1177a618083df1a24aa4eb1084bfa9ac6f21

  • SSDEEP

    1572864:jX0e8kxPDkMFD4iJC4SVB+lhspXvgJRAPGpw8GSTimL:jukJRuivihYCPdpSBL

Malware Config

Signatures

Processes

  • ir.medu.shad
    1⤵
    • Checks memory information
    • Reads the contacts stored on the device.
    • Reads the content of photos stored on the user's device.
    • Acquires the wake lock
    • Checks if the internet connection is available
    PID:4431

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • /data/data/ir.medu.shad/databases/com.google.android.datatransport.events

    Filesize

    56KB

    MD5

    cd0a5c6aad81e4ddcf6224a81f3574d0

    SHA1

    4d1b6460798a8578eca617751ad2a59ed16aa81b

    SHA256

    2819a8cda86a883e128330a4f32b8151210ee4e735c8470be65740c3bf8a9be3

    SHA512

    a4a51128e57da0a6303128b8e44fedb40d615dae1f6e21d946cd9299900d90927a764c27f26ebd496150f47573258ed22faf567e18be6dc555a4167fe5f7bd11

  • /data/data/ir.medu.shad/databases/com.google.android.datatransport.events-journal

    Filesize

    512B

    MD5

    2cd984726faadf77fa32b3b089b822ec

    SHA1

    994a542b1c36ae1f003dae0c542ab66b87576d9b

    SHA256

    ddde154c40bd6d327e785c19bee9e9a6360b6382bd7ef426f0149a57f8925964

    SHA512

    1f668e665979103fe4f520f8a7a7f5f280b11e49ed92db2dc37ff26816536c7df275b59da42c95115c033dda8120ecf1ef0cf49cbd0399c54108189fedaa5506

  • /data/data/ir.medu.shad/databases/com.google.android.datatransport.events-journal

    Filesize

    8KB

    MD5

    01c2fa16d2729866c5178fb8d731111d

    SHA1

    b91436452c538d8011f8accf6b962362fbb7f1cf

    SHA256

    3a6396addf4c39659f99fc35def7a7843bc0e38b3908bff8dae4b013a8328d9e

    SHA512

    feb90c8281c0bcb78e21e2b03b960c6c2965cacb32dc174cc306a0adfd4dbb838220bdc6cd8c41ea78908e4fb7c341730fb2e6f4da763a701ebb5a50b739c54b

  • /data/data/ir.medu.shad/databases/com.google.android.datatransport.events-journal

    Filesize

    8KB

    MD5

    9ccc52527db4819529ccb42e50ec5e7b

    SHA1

    3891d638eb566bafd0f112069bc58650c9098240

    SHA256

    d64e21a27dbcb3b763595538b831168a3b9226c90e5d984a8ebfdcff85f7d7a1

    SHA512

    8ebbc85c8cfeab3a4984894c952c891286da69215407c987935d8fd683b59d048bbebcb1c6ef7dfe6ecf29a0f32a29f38ccdbc8ef74f0edb19a92499c724b5d6

  • /data/data/ir.medu.shad/databases/google_app_measurement_local.db

    Filesize

    16KB

    MD5

    a575630919b8ec6b7540ed777ed31aab

    SHA1

    0cf9d83e7134a771dd255a1ee1309908a84a5a3c

    SHA256

    f823a43f718675a2eb822244b192a38e10923863258ecc543d9dd800ef688748

    SHA512

    5544efbfe3a63eca77b5763a134c268a25bb405f844a0033d87aedd05c4aa0a90bde89ebca568baacda5eaae22a18cae18c5fd912bbca6284eb592e095138858

  • /data/data/ir.medu.shad/databases/google_app_measurement_local.db

    Filesize

    16KB

    MD5

    c067a2cc79eea2e4ae27e164e6fa337d

    SHA1

    014fd264654c33e9da38ef3bb3bbc56c0086e004

    SHA256

    ed8ce48dc0f7fa3e30c959bc761c5ae6a796f2c2ccfe8aaab0dd4403d94ce636

    SHA512

    ed94da39ed7bee8cc5f4b993952d59ba56c8d01a59bb512028f3cb6e5960fb5e940e88fb25d7c1d22cd2e1efa5b93f0c26a5a43ac3e631490ab30634da53e1e1

  • /data/data/ir.medu.shad/databases/google_app_measurement_local.db

    Filesize

    16KB

    MD5

    834fb332b5920c0bdaf1a2f42fcc9f9d

    SHA1

    512e16e0bf159b5c259ef5ec85c555eb64dce87e

    SHA256

    542ff792e23709209fca144c1f37e2c5e51c4bff53919afc4423719a2352ce94

    SHA512

    21b0b02d92a1a2b2e1ef9d9c5f3af18b9a05dcf4ab9fbb9e984a20460b4b5ebb6c66bb20177a3095d06d22b6fb381a8e19d0ae9a972cacde4d78306a6be5ca82

  • /data/data/ir.medu.shad/databases/google_app_measurement_local.db

    Filesize

    16KB

    MD5

    9bfbf347f79a9b0f15674a613053a59a

    SHA1

    744ab04ee19e690a86eadeb8ae74f6010bb06401

    SHA256

    e07f8e0236898b1e6ae0e4bd50e4fe0520c5bcadec3e0060aedf531305db1973

    SHA512

    4544ee2b11d3f43cf08e03d1482689b782c8aae2294ad4308464f1544a6808c2f38913c587fd47cef610b869fc73ba9c3d225c86a84f747b77a4450ba968e353

  • /data/data/ir.medu.shad/databases/google_app_measurement_local.db

    Filesize

    16KB

    MD5

    9111c2d8110efffe0ac8dc218e3f3ffd

    SHA1

    44e704023b37de2dd417c614cbf22f13b31089cc

    SHA256

    5c1016d5134a1c0a1ae6546372b58bc2e037b2f559aa03792850397401054175

    SHA512

    ac23499637f0951512987a570a59e8ecb90169c8d1446f41073c090a52c69a71e131c5ee838e4497c7ce3cd36a38e77e4d8d6b8efa8762ffe06d6904964922ac

  • /data/data/ir.medu.shad/databases/google_app_measurement_local.db

    Filesize

    16KB

    MD5

    818548be1885386cc995f564f36a8e8e

    SHA1

    008b0c602ed55b1122dadfb3a20db517d55c10b3

    SHA256

    b4765a86f69c122307448d0c6e81cebd52ffbc59b0d19da42971e2857f773e6d

    SHA512

    47840561a1eded73600b656576a7a9195bd1beddb79b08090b9e6bd9ab610de6cfb0a334310bfefe0b33ef157d420aaa17c6315fa2e689398da3328c4460a02f

  • /data/data/ir.medu.shad/databases/google_app_measurement_local.db-journal

    Filesize

    512B

    MD5

    7cdaca876478bc5f3cbab8b85347879c

    SHA1

    f3bd21c0cc8cf1bc9be4e3fab836e3e87608776f

    SHA256

    9e605bc66b6283074b9d7df4c0831efefc0a48c5cdd666ec1c1bebfb1877bfe6

    SHA512

    78812a839e02973d50efd6648a16d3ccc1ccf55d3cea02bec8d26d2d94733879269c3dd781ff6b7966afbae1ab954f6f3c0e90164e425bd4b6e60223b428bc9a

  • /data/data/ir.medu.shad/databases/google_app_measurement_local.db-journal

    Filesize

    8KB

    MD5

    8ea9bd7313c016699a1f6701e03f3d66

    SHA1

    85a96c8ea7802a2a74fc38126c1e6f1a4aac3fbe

    SHA256

    80a8afc8222b4bc0510d4c698549a0aa2ac36865f8f70d2062b71baa1996c2f7

    SHA512

    b8a44082fa288adea1dc79d2381f9d24f81c164bf036ae0d567d779ae413f77780a591d81ca073216f58f7803d11c256a71ebf1a9987d997ecb34f974ac26ca3

  • /data/data/ir.medu.shad/databases/google_app_measurement_local.db-journal

    Filesize

    4KB

    MD5

    7c05794835d9e6d511845d41c6a7bb39

    SHA1

    f598559c5f18d94a9b086f825aab17fc923db2e7

    SHA256

    537e35ea847c7e81d03c474b4c4cca4b2bcb33df097772461406d47d51ec6074

    SHA512

    4998f64a3385fe9061999362b4c579c7a6ec9bae8732ff66c6503b1a2ba0eff5117bed126b38bb9119c26af59325ba98fdc779ea30cb23c44f67e7aa3a980c7b

  • /data/data/ir.medu.shad/databases/google_app_measurement_local.db-journal

    Filesize

    8KB

    MD5

    a2f3cab1d082f12daa8e732a10ddd6cd

    SHA1

    622e65054d512db043ebb7c57ef37a513e0df436

    SHA256

    57efba11b40b0183d8e218f3e12d9dc95de1ef9265596226fa5ccc192a67a12e

    SHA512

    1579302f82d8287efe2ad73ac370f7f92f4fd184a7f63bc086a758a08cc7805d9feb24be84b66170fd32f54c021d1d2effc7890c04c787018f24f2caca6a48f2

  • /data/data/ir.medu.shad/databases/google_app_measurement_local.db-journal

    Filesize

    8KB

    MD5

    3e49d22eebd4261288e09a7c74bb1c34

    SHA1

    fc951a4f5be4361412e9271caac4405237662c1b

    SHA256

    6257d3f5647d7b3e7f22b5f168848e9b54a26e496bb184fda3b2968d5638614f

    SHA512

    c6d1c85acf6d7d408428c82d89eb30afb432762396da6c0b9622f67b6fe9586f2ca412e82f3e407aa5aa456aecc21fc84ee05ebd4d00787b63c8ddd0373055bc

  • /data/data/ir.medu.shad/databases/google_app_measurement_local.db-journal

    Filesize

    8KB

    MD5

    b05687a17a9a27d24581346cbf0821e5

    SHA1

    f89298ea0a3ccf7b7e3755451e424078ccf54456

    SHA256

    6fa6a861c39477995fd6dd78a02164332986abc706426f9e3d60450bc6c03c21

    SHA512

    6fdea919e38748034ac2dbd5a3b2385be2098c92e0d6a6d291ccfb488bad9c107d8563b808bfffcc9c668748022993745990b513f79544e856dfd9e5583cfecb

  • /data/data/ir.medu.shad/files/.com.google.firebase.crashlytics.files.v2:ir.medu.shad/com.crashlytics.settings.json

    Filesize

    708B

    MD5

    1b9703ed5d12d6b91011208a7976a40d

    SHA1

    44d4ac4dfe15514719215d9f20fd2ddb2b4ee623

    SHA256

    f45f5385ffae4f7886c95cb70e7cb85ba2d3004cd8f689f2d37be068f40fed43

    SHA512

    993bcc32158dba5a308139941e829975b5ba73a0706bf4ab5b3fa2d3983c2280e1a7edf6f43e8cb6d677f35787d712fa8136e4013be946db2111dec183cc5b63

  • /data/data/ir.medu.shad/files/.com.google.firebase.crashlytics.files.v2:ir.medu.shad/open-sessions/6624219001640001114F8E7652F58748/keys

    Filesize

    76B

    MD5

    5cb3b1a52ae2faa82d7b765c3130b04a

    SHA1

    fa685df7ca4fbea3a6595b6f84d8e7d381f11926

    SHA256

    17af450a0b56d2a4d31925178aded86b950e799e16ffc4e8380a7fed2cabc47c

    SHA512

    03feb879998f97da55ca46c4768d7c38174c9ad0e75aa8db943cdf40164b249209d94831dc2889bb01daaa515b4ec7a2ec23c67cdb444b682e554a0dcea70671

  • /data/data/ir.medu.shad/files/.com.google.firebase.crashlytics.files.v2:ir.medu.shad/open-sessions/6624219001640001114F8E7652F58748/report

    Filesize

    738B

    MD5

    881d884c157ca3e7a6da23ec7dec244d

    SHA1

    a765c3dad36dc4b055457440e0b2a687ba3db924

    SHA256

    2a3848cd79123fadbb38040a0e571b30361fd6d0646ef0e8a006b72ec4b9ec93

    SHA512

    4bab6b9caf4f0f59473f3817b6b02607bb49b364c3e439c581b89b445d976239a6cfcdde0b42a46590be86aa0240613a3c9f1133db0cf564f88ed3790ad18665

  • /data/data/ir.medu.shad/files/.com.google.firebase.crashlytics.files.v2:ir.medu.shad/open-sessions/6624219001640001114F8E7652F58748/userlog

    Filesize

    192B

    MD5

    d039a1af711560b0839f1caf9aa3403b

    SHA1

    0650e77febb5387e9bb6276f836df51c4fe77e4a

    SHA256

    0426ed21a6d59d05e9ee23f42bc8d0b6356faedb6a96976ddeaa11b3164d603e

    SHA512

    e12584308b57f75fed8646f8d430c0e5d2253846af3ad492b94fff8f64d8184ab26b8b198261081ff8b2671ca9b0614759ccd8b1baaa524714c6e7b92c774552

  • /data/data/ir.medu.shad/files/.com.google.firebase.crashlytics.files.v2:ir.medu.shad/open-sessions/6624219001640001114F8E7652F58748/userlog.tmp

    Filesize

    16B

    MD5

    c33583fae4e0b61cde1c5b9227963237

    SHA1

    fe2ebe4d27469af1460f7e852031a04208ef629b

    SHA256

    35c6d6e5b93657e4a741a1cec71c21813fe05aab219909ebbb0f62fb0ae648dc

    SHA512

    fa09047004bec791b23f0dade0b64f8ab9bbd67555505e0d0818f6e89dfe56f474df80db0786d081d36adf23a5bacea40275ba043444a3a85d3d9612575bdd1e

  • /data/data/ir.medu.shad/files/PersistedInstallation5177522830299530939tmp

    Filesize

    90B

    MD5

    9ede0454a6cd1df2a9cb715a59e8066f

    SHA1

    d2913fd5626adc219628b02dc13062b20777b966

    SHA256

    b63431e7d17b34130f104d738346ef79f7a0ab1d29633b07e8bede5ea31a85a2

    SHA512

    1fd555620edfa30f786a654b432fb5caf0e827ce2434c8f571032e7dbcde9a296260552e9264a205f0d3f3e2ee2185f6ecacf6a8a241f4b4be8fbd2811111811

  • /data/data/ir.medu.shad/files/PersistedInstallation7666818071387907729tmp

    Filesize

    569B

    MD5

    d4aecc5f31bb99ab59fbe395fc75ec4d

    SHA1

    1edd2e3c52583f99a057b3090852f4d7cc577b86

    SHA256

    ce78bc144f57d6cb3a6b3d9e4e0f722591a3f55b9968c77c6c8ac980a7318299

    SHA512

    4c1420af4143ca90c01e88bf36af6bd3263336767eaf3ef49a9df146dee2896fbdbf8eb61ee7ab5742b1f747fa55289beaa7017d825fc96a672b57ad2dde029a

  • /data/data/ir.medu.shad/files/account1/cache4.db-journal

    Filesize

    512B

    MD5

    20b6f16e019443b869632a760a60dac0

    SHA1

    794b7de06e629348b7239237765e435e0518ce36

    SHA256

    23f929b479f1c5cb08335365522a9b1ab1123bba4e66477b0e81a4b6926f5000

    SHA512

    3e08d8377a9b40d4f0c04803e8e9ce26ad1dbe7a9af2d2220d9d92983ade245a6f664e8e2081b7b361b0fb703db2c12ba0ac0c594a3c6de1b7a4eba7ac94eb8a

  • /data/data/ir.medu.shad/files/account1/cache4.db-wal

    Filesize

    1.1MB

    MD5

    45eb47a4c2b4c54139d7b9aff7f35ba4

    SHA1

    927c534790f845e3e2dcf505048e83e66c753280

    SHA256

    601beb2927322d3ee527e27ee82d46929ddfa96cbeac43269145f0269182ebee

    SHA512

    d6c7f358d908b00837b969ed4acb20761c8f2c42ce156804e1d8337ff16b1c4296eccaba7e585060f1cabd311263e73bf3ed6e78fdc910ee76c591edf16f615f

  • /data/data/ir.medu.shad/files/account2/cache4.db-journal

    Filesize

    512B

    MD5

    565934ecefb4d7d48cad2e573ab83f38

    SHA1

    83bb9703c2fa382bc54a74f4fcc6370e197046b7

    SHA256

    b49eb660370052b5c37f0894418a17d9b730a035fd08eca26ccb2fb690aa6678

    SHA512

    c8076a50563fabcdc678e860d69ece4dbcf23ee7c206ab0005a43b43b6010196d9737cde488fd0bb3c7738f9d2f9b02c76f68616cd23ca2f01d900ea17d183f2

  • /data/data/ir.medu.shad/files/account2/cache4.db-wal

    Filesize

    1.1MB

    MD5

    a6e6f39537bd9a833dda871ed0d41fb7

    SHA1

    94b69a1b61de7e0016ed341ce3f631485e74d55b

    SHA256

    d9aa5184e023426f5d0e26ee76472acb300bf10bfa527735b3807ab4754a129c

    SHA512

    510a227ec9b4a70381eaca775d8603ee49ed5f42d67b93bf184051cfde5d14e573afedb1555b9ac55ca01152f051a67896fa7d40e60d69977deba03d675a18fa

  • /data/data/ir.medu.shad/files/cache4.db

    Filesize

    4KB

    MD5

    3ff674d0f9e82976113f39dca75b8f78

    SHA1

    fb1bf8a36688935c194e63dd8f18107e7033f5c0

    SHA256

    d4e1b9bdba21d5fd3b004eb02f191389d2b3e21f5a793af5d27a199f90c5493e

    SHA512

    41eb558e3b75e601a0fdb733833c5504fc869ba664cb537b2e2c84353218a9dfb7f94b4f20957f38043bf336ffc7a201834e4c4a5217fd2761648ef7cbbdef7e

  • /data/data/ir.medu.shad/files/cache4.db-journal

    Filesize

    512B

    MD5

    876e406718bc5ef66f4347f22ce7e5c4

    SHA1

    098016ec2349932f432e9b13b5cfb8187c01f33f

    SHA256

    5e32afdd3453a32949d837b79e088cc9eefaec514cbfc42d5ce5e9a00b3645aa

    SHA512

    d3b3c374b4ed7c1d0fa53040875ead06f7637dc4555aaa3268738e8f1474b9d4d45b6f4b0985cd2abba4b5a6dbe79b5f37a816889f610512e7602aae0a1440df

  • /data/data/ir.medu.shad/files/cache4.db-wal

    Filesize

    1.1MB

    MD5

    5762a087a49cfb10cda82f622d1e17ab

    SHA1

    811df9d21cdecbe8f909b1a8a1d07e2348f4bd14

    SHA256

    98cc3e03e94985af802f078ca9c594e9c78412696a28c4f3083c6b009788b0d5

    SHA512

    7f9fb1bb84b6e085a84536495bdafe2347660370c343bb33a30f7bfb6c2dc8d316d762af7d0f321412062d2dbc646eb7b7a7a776b2d54bfa6e516df93673a04d

  • /data/data/ir.medu.shad/no_backup/androidx.work.workdb

    Filesize

    4KB

    MD5

    7e858c4054eb00fcddc653a04e5cd1c6

    SHA1

    2e056bf31a8d78df136f02a62afeeca77f4faccf

    SHA256

    9010186c5c083155a45673017d1e31c2a178e63cc15a57bbffde4d1956a23dad

    SHA512

    d0c7a120940c8e637d5566ef179d01eff88a2c2650afda69ad2a46aad76533eaace192028bba3d60407b4e34a950e7560f95d9f9b8eebe361ef62897d88b30cb

  • /data/data/ir.medu.shad/no_backup/androidx.work.workdb-journal

    Filesize

    512B

    MD5

    89cd7476b74973ae5688426116a60d9f

    SHA1

    c1ab0113ddcf2d1302a92204315a51b226ae9eaf

    SHA256

    5b6d399c64aff6e6412e110f980d9df53e396dfaa44ffc75aa85d731e19258e8

    SHA512

    4599162fb53da0f0d0368379abd2c0202ca62b63f8548c9bfd14e48763460c8e7638cd7da47a07425e256f20cd22299dfaefa98d6c3ba8425b7a82233b9bcf71

  • /data/data/ir.medu.shad/no_backup/androidx.work.workdb-shm

    Filesize

    32KB

    MD5

    bb7df04e1b0a2570657527a7e108ae23

    SHA1

    5188431849b4613152fd7bdba6a3ff0a4fd6424b

    SHA256

    c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479

    SHA512

    768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012

  • /data/data/ir.medu.shad/no_backup/androidx.work.workdb-wal

    Filesize

    16KB

    MD5

    805d465e028e647ef617c68801b167c7

    SHA1

    87fd33218372b894d6daf612fa99a77a4fb0d490

    SHA256

    30c54cb8ef73b1a12862804cbc788d89e58e4e411bd6c9b0282cd79b54b643f5

    SHA512

    15715a0a0e510463dd51bfe10c8d4f768eeecced47ae0541591f8d939577e5a4c4e442e957d7ccf14e9d3cede3a6b1a389050328567b1bab563e71e879e04c0b

  • /data/data/ir.medu.shad/no_backup/androidx.work.workdb-wal

    Filesize

    108KB

    MD5

    26b8880d3fb2679c1586e30339166685

    SHA1

    c3d63b5ad9eeef27bad9b964ea1e6428f7f6ebe3

    SHA256

    2c58e35d01d3cec1cb6c03e2c40abe1bd22f82dd56621cfb0517c927474a7959

    SHA512

    904b9a0d111e944e50f1a078d3cfdb2965308e18414edfd1af340cb7dd98cf1b8f9577df9ef245e57250610c8fe835aaf542fd780b91e54c46f1815b3d2c97f3

  • /data/data/ir.medu.shad/no_backup/androidx.work.workdb-wal

    Filesize

    249KB

    MD5

    b285ca5ae00a15e5efd6c98f8899123b

    SHA1

    a15322bc9bf4f057b3bcfb58ed2ab88842e1916d

    SHA256

    f9aed5c3e28f829034002719a544c5bc52e929e1bed206d82dff667fc2b211df

    SHA512

    8e842bbe3d4506dd0e0ac58ee8cf108300440b6994d99a1d6337a9481161527f439e0be7711746efa8bfac98938804a2906017d65662b15388a6d6343811e8dd

  • /storage/emulated/0/Android/data/ir.medu.shad/cache/000000000_999999_temp.f

    Filesize

    1024B

    MD5

    0f343b0931126a20f133d67c2b018a3b

    SHA1

    60cacbf3d72e1e7834203da608037b1bf83b40e8

    SHA256

    5f70bf18a086007016e948b04aed3b82103a36bea41755b6cddfaf10ace3c6ef

    SHA512

    8efb4f73c5655351c444eb109230c556d39e2c7624e9c11abc9e3fb4b9b9254218cc5085b454a9698d085cfa92198491f07a723be4574adc70617b73eb0b6461