Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
67s -
max time network
154s -
platform
android_x64 -
resource
android-x64-arm64-20240221-en -
resource tags
androidarch:armarch:arm64arch:x64arch:x86image:android-x64-arm64-20240221-enlocale:en-usos:android-11-x64system -
submitted
20/04/2024, 20:10
Behavioral task
behavioral1
Sample
Shad-app-3.5.5(www.farsroid.com).apk
Resource
android-x86-arm-20240221-en
Behavioral task
behavioral2
Sample
Shad-app-3.5.5(www.farsroid.com).apk
Resource
android-x64-arm64-20240221-en
General
-
Target
Shad-app-3.5.5(www.farsroid.com).apk
-
Size
77.4MB
-
MD5
116d717823c9cd6a8ed989ee5d0c5be8
-
SHA1
7c944b80159e78116578d57acdca2000309171f0
-
SHA256
ade8d0d4511caa63f0d62075e99e39126b5a907a01986ee5575c82dc5748a384
-
SHA512
ea9621106c0daa87f3d0c77624374b5a3ac4411fa94d455e5146170cd3f57374dbde99faf4c4f983332dfaa1145e1177a618083df1a24aa4eb1084bfa9ac6f21
-
SSDEEP
1572864:jX0e8kxPDkMFD4iJC4SVB+lhspXvgJRAPGpw8GSTimL:jukJRuivihYCPdpSBL
Malware Config
Signatures
-
BadBazaar
BadBazaar is an Android spyware used by GREF APT group.
-
Checks memory information 2 TTPs 1 IoCs
Checks memory information which indicate if the system is an emulator.
description ioc Process File opened for read /proc/meminfo ir.medu.shad -
Reads the contacts stored on the device. 1 TTPs 1 IoCs
description ioc Process URI accessed for read content://com.android.contacts/contacts ir.medu.shad -
Reads the content of photos stored on the user's device. 1 TTPs 1 IoCs
description ioc Process URI accessed for read content://media/external/images/media ir.medu.shad -
Acquires the wake lock 1 IoCs
description ioc Process Framework service call android.os.IPowerManager.acquireWakeLock ir.medu.shad -
Checks if the internet connection is available 1 TTPs 1 IoCs
description ioc Process Framework service call android.net.IConnectivityManager.getActiveNetworkInfo ir.medu.shad -
Checks the presence of a debugger
Processes
Network
MITRE ATT&CK Mobile v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
56KB
MD5cd0a5c6aad81e4ddcf6224a81f3574d0
SHA14d1b6460798a8578eca617751ad2a59ed16aa81b
SHA2562819a8cda86a883e128330a4f32b8151210ee4e735c8470be65740c3bf8a9be3
SHA512a4a51128e57da0a6303128b8e44fedb40d615dae1f6e21d946cd9299900d90927a764c27f26ebd496150f47573258ed22faf567e18be6dc555a4167fe5f7bd11
-
Filesize
512B
MD52cd984726faadf77fa32b3b089b822ec
SHA1994a542b1c36ae1f003dae0c542ab66b87576d9b
SHA256ddde154c40bd6d327e785c19bee9e9a6360b6382bd7ef426f0149a57f8925964
SHA5121f668e665979103fe4f520f8a7a7f5f280b11e49ed92db2dc37ff26816536c7df275b59da42c95115c033dda8120ecf1ef0cf49cbd0399c54108189fedaa5506
-
Filesize
8KB
MD501c2fa16d2729866c5178fb8d731111d
SHA1b91436452c538d8011f8accf6b962362fbb7f1cf
SHA2563a6396addf4c39659f99fc35def7a7843bc0e38b3908bff8dae4b013a8328d9e
SHA512feb90c8281c0bcb78e21e2b03b960c6c2965cacb32dc174cc306a0adfd4dbb838220bdc6cd8c41ea78908e4fb7c341730fb2e6f4da763a701ebb5a50b739c54b
-
Filesize
8KB
MD59ccc52527db4819529ccb42e50ec5e7b
SHA13891d638eb566bafd0f112069bc58650c9098240
SHA256d64e21a27dbcb3b763595538b831168a3b9226c90e5d984a8ebfdcff85f7d7a1
SHA5128ebbc85c8cfeab3a4984894c952c891286da69215407c987935d8fd683b59d048bbebcb1c6ef7dfe6ecf29a0f32a29f38ccdbc8ef74f0edb19a92499c724b5d6
-
Filesize
16KB
MD5a575630919b8ec6b7540ed777ed31aab
SHA10cf9d83e7134a771dd255a1ee1309908a84a5a3c
SHA256f823a43f718675a2eb822244b192a38e10923863258ecc543d9dd800ef688748
SHA5125544efbfe3a63eca77b5763a134c268a25bb405f844a0033d87aedd05c4aa0a90bde89ebca568baacda5eaae22a18cae18c5fd912bbca6284eb592e095138858
-
Filesize
16KB
MD5c067a2cc79eea2e4ae27e164e6fa337d
SHA1014fd264654c33e9da38ef3bb3bbc56c0086e004
SHA256ed8ce48dc0f7fa3e30c959bc761c5ae6a796f2c2ccfe8aaab0dd4403d94ce636
SHA512ed94da39ed7bee8cc5f4b993952d59ba56c8d01a59bb512028f3cb6e5960fb5e940e88fb25d7c1d22cd2e1efa5b93f0c26a5a43ac3e631490ab30634da53e1e1
-
Filesize
16KB
MD5834fb332b5920c0bdaf1a2f42fcc9f9d
SHA1512e16e0bf159b5c259ef5ec85c555eb64dce87e
SHA256542ff792e23709209fca144c1f37e2c5e51c4bff53919afc4423719a2352ce94
SHA51221b0b02d92a1a2b2e1ef9d9c5f3af18b9a05dcf4ab9fbb9e984a20460b4b5ebb6c66bb20177a3095d06d22b6fb381a8e19d0ae9a972cacde4d78306a6be5ca82
-
Filesize
16KB
MD59bfbf347f79a9b0f15674a613053a59a
SHA1744ab04ee19e690a86eadeb8ae74f6010bb06401
SHA256e07f8e0236898b1e6ae0e4bd50e4fe0520c5bcadec3e0060aedf531305db1973
SHA5124544ee2b11d3f43cf08e03d1482689b782c8aae2294ad4308464f1544a6808c2f38913c587fd47cef610b869fc73ba9c3d225c86a84f747b77a4450ba968e353
-
Filesize
16KB
MD59111c2d8110efffe0ac8dc218e3f3ffd
SHA144e704023b37de2dd417c614cbf22f13b31089cc
SHA2565c1016d5134a1c0a1ae6546372b58bc2e037b2f559aa03792850397401054175
SHA512ac23499637f0951512987a570a59e8ecb90169c8d1446f41073c090a52c69a71e131c5ee838e4497c7ce3cd36a38e77e4d8d6b8efa8762ffe06d6904964922ac
-
Filesize
16KB
MD5818548be1885386cc995f564f36a8e8e
SHA1008b0c602ed55b1122dadfb3a20db517d55c10b3
SHA256b4765a86f69c122307448d0c6e81cebd52ffbc59b0d19da42971e2857f773e6d
SHA51247840561a1eded73600b656576a7a9195bd1beddb79b08090b9e6bd9ab610de6cfb0a334310bfefe0b33ef157d420aaa17c6315fa2e689398da3328c4460a02f
-
Filesize
512B
MD57cdaca876478bc5f3cbab8b85347879c
SHA1f3bd21c0cc8cf1bc9be4e3fab836e3e87608776f
SHA2569e605bc66b6283074b9d7df4c0831efefc0a48c5cdd666ec1c1bebfb1877bfe6
SHA51278812a839e02973d50efd6648a16d3ccc1ccf55d3cea02bec8d26d2d94733879269c3dd781ff6b7966afbae1ab954f6f3c0e90164e425bd4b6e60223b428bc9a
-
Filesize
8KB
MD58ea9bd7313c016699a1f6701e03f3d66
SHA185a96c8ea7802a2a74fc38126c1e6f1a4aac3fbe
SHA25680a8afc8222b4bc0510d4c698549a0aa2ac36865f8f70d2062b71baa1996c2f7
SHA512b8a44082fa288adea1dc79d2381f9d24f81c164bf036ae0d567d779ae413f77780a591d81ca073216f58f7803d11c256a71ebf1a9987d997ecb34f974ac26ca3
-
Filesize
4KB
MD57c05794835d9e6d511845d41c6a7bb39
SHA1f598559c5f18d94a9b086f825aab17fc923db2e7
SHA256537e35ea847c7e81d03c474b4c4cca4b2bcb33df097772461406d47d51ec6074
SHA5124998f64a3385fe9061999362b4c579c7a6ec9bae8732ff66c6503b1a2ba0eff5117bed126b38bb9119c26af59325ba98fdc779ea30cb23c44f67e7aa3a980c7b
-
Filesize
8KB
MD5a2f3cab1d082f12daa8e732a10ddd6cd
SHA1622e65054d512db043ebb7c57ef37a513e0df436
SHA25657efba11b40b0183d8e218f3e12d9dc95de1ef9265596226fa5ccc192a67a12e
SHA5121579302f82d8287efe2ad73ac370f7f92f4fd184a7f63bc086a758a08cc7805d9feb24be84b66170fd32f54c021d1d2effc7890c04c787018f24f2caca6a48f2
-
Filesize
8KB
MD53e49d22eebd4261288e09a7c74bb1c34
SHA1fc951a4f5be4361412e9271caac4405237662c1b
SHA2566257d3f5647d7b3e7f22b5f168848e9b54a26e496bb184fda3b2968d5638614f
SHA512c6d1c85acf6d7d408428c82d89eb30afb432762396da6c0b9622f67b6fe9586f2ca412e82f3e407aa5aa456aecc21fc84ee05ebd4d00787b63c8ddd0373055bc
-
Filesize
8KB
MD5b05687a17a9a27d24581346cbf0821e5
SHA1f89298ea0a3ccf7b7e3755451e424078ccf54456
SHA2566fa6a861c39477995fd6dd78a02164332986abc706426f9e3d60450bc6c03c21
SHA5126fdea919e38748034ac2dbd5a3b2385be2098c92e0d6a6d291ccfb488bad9c107d8563b808bfffcc9c668748022993745990b513f79544e856dfd9e5583cfecb
-
/data/data/ir.medu.shad/files/.com.google.firebase.crashlytics.files.v2:ir.medu.shad/com.crashlytics.settings.json
Filesize708B
MD51b9703ed5d12d6b91011208a7976a40d
SHA144d4ac4dfe15514719215d9f20fd2ddb2b4ee623
SHA256f45f5385ffae4f7886c95cb70e7cb85ba2d3004cd8f689f2d37be068f40fed43
SHA512993bcc32158dba5a308139941e829975b5ba73a0706bf4ab5b3fa2d3983c2280e1a7edf6f43e8cb6d677f35787d712fa8136e4013be946db2111dec183cc5b63
-
/data/data/ir.medu.shad/files/.com.google.firebase.crashlytics.files.v2:ir.medu.shad/open-sessions/6624219001640001114F8E7652F58748/keys
Filesize76B
MD55cb3b1a52ae2faa82d7b765c3130b04a
SHA1fa685df7ca4fbea3a6595b6f84d8e7d381f11926
SHA25617af450a0b56d2a4d31925178aded86b950e799e16ffc4e8380a7fed2cabc47c
SHA51203feb879998f97da55ca46c4768d7c38174c9ad0e75aa8db943cdf40164b249209d94831dc2889bb01daaa515b4ec7a2ec23c67cdb444b682e554a0dcea70671
-
/data/data/ir.medu.shad/files/.com.google.firebase.crashlytics.files.v2:ir.medu.shad/open-sessions/6624219001640001114F8E7652F58748/report
Filesize738B
MD5881d884c157ca3e7a6da23ec7dec244d
SHA1a765c3dad36dc4b055457440e0b2a687ba3db924
SHA2562a3848cd79123fadbb38040a0e571b30361fd6d0646ef0e8a006b72ec4b9ec93
SHA5124bab6b9caf4f0f59473f3817b6b02607bb49b364c3e439c581b89b445d976239a6cfcdde0b42a46590be86aa0240613a3c9f1133db0cf564f88ed3790ad18665
-
/data/data/ir.medu.shad/files/.com.google.firebase.crashlytics.files.v2:ir.medu.shad/open-sessions/6624219001640001114F8E7652F58748/userlog
Filesize192B
MD5d039a1af711560b0839f1caf9aa3403b
SHA10650e77febb5387e9bb6276f836df51c4fe77e4a
SHA2560426ed21a6d59d05e9ee23f42bc8d0b6356faedb6a96976ddeaa11b3164d603e
SHA512e12584308b57f75fed8646f8d430c0e5d2253846af3ad492b94fff8f64d8184ab26b8b198261081ff8b2671ca9b0614759ccd8b1baaa524714c6e7b92c774552
-
/data/data/ir.medu.shad/files/.com.google.firebase.crashlytics.files.v2:ir.medu.shad/open-sessions/6624219001640001114F8E7652F58748/userlog.tmp
Filesize16B
MD5c33583fae4e0b61cde1c5b9227963237
SHA1fe2ebe4d27469af1460f7e852031a04208ef629b
SHA25635c6d6e5b93657e4a741a1cec71c21813fe05aab219909ebbb0f62fb0ae648dc
SHA512fa09047004bec791b23f0dade0b64f8ab9bbd67555505e0d0818f6e89dfe56f474df80db0786d081d36adf23a5bacea40275ba043444a3a85d3d9612575bdd1e
-
Filesize
90B
MD59ede0454a6cd1df2a9cb715a59e8066f
SHA1d2913fd5626adc219628b02dc13062b20777b966
SHA256b63431e7d17b34130f104d738346ef79f7a0ab1d29633b07e8bede5ea31a85a2
SHA5121fd555620edfa30f786a654b432fb5caf0e827ce2434c8f571032e7dbcde9a296260552e9264a205f0d3f3e2ee2185f6ecacf6a8a241f4b4be8fbd2811111811
-
Filesize
569B
MD5d4aecc5f31bb99ab59fbe395fc75ec4d
SHA11edd2e3c52583f99a057b3090852f4d7cc577b86
SHA256ce78bc144f57d6cb3a6b3d9e4e0f722591a3f55b9968c77c6c8ac980a7318299
SHA5124c1420af4143ca90c01e88bf36af6bd3263336767eaf3ef49a9df146dee2896fbdbf8eb61ee7ab5742b1f747fa55289beaa7017d825fc96a672b57ad2dde029a
-
Filesize
512B
MD520b6f16e019443b869632a760a60dac0
SHA1794b7de06e629348b7239237765e435e0518ce36
SHA25623f929b479f1c5cb08335365522a9b1ab1123bba4e66477b0e81a4b6926f5000
SHA5123e08d8377a9b40d4f0c04803e8e9ce26ad1dbe7a9af2d2220d9d92983ade245a6f664e8e2081b7b361b0fb703db2c12ba0ac0c594a3c6de1b7a4eba7ac94eb8a
-
Filesize
1.1MB
MD545eb47a4c2b4c54139d7b9aff7f35ba4
SHA1927c534790f845e3e2dcf505048e83e66c753280
SHA256601beb2927322d3ee527e27ee82d46929ddfa96cbeac43269145f0269182ebee
SHA512d6c7f358d908b00837b969ed4acb20761c8f2c42ce156804e1d8337ff16b1c4296eccaba7e585060f1cabd311263e73bf3ed6e78fdc910ee76c591edf16f615f
-
Filesize
512B
MD5565934ecefb4d7d48cad2e573ab83f38
SHA183bb9703c2fa382bc54a74f4fcc6370e197046b7
SHA256b49eb660370052b5c37f0894418a17d9b730a035fd08eca26ccb2fb690aa6678
SHA512c8076a50563fabcdc678e860d69ece4dbcf23ee7c206ab0005a43b43b6010196d9737cde488fd0bb3c7738f9d2f9b02c76f68616cd23ca2f01d900ea17d183f2
-
Filesize
1.1MB
MD5a6e6f39537bd9a833dda871ed0d41fb7
SHA194b69a1b61de7e0016ed341ce3f631485e74d55b
SHA256d9aa5184e023426f5d0e26ee76472acb300bf10bfa527735b3807ab4754a129c
SHA512510a227ec9b4a70381eaca775d8603ee49ed5f42d67b93bf184051cfde5d14e573afedb1555b9ac55ca01152f051a67896fa7d40e60d69977deba03d675a18fa
-
Filesize
4KB
MD53ff674d0f9e82976113f39dca75b8f78
SHA1fb1bf8a36688935c194e63dd8f18107e7033f5c0
SHA256d4e1b9bdba21d5fd3b004eb02f191389d2b3e21f5a793af5d27a199f90c5493e
SHA51241eb558e3b75e601a0fdb733833c5504fc869ba664cb537b2e2c84353218a9dfb7f94b4f20957f38043bf336ffc7a201834e4c4a5217fd2761648ef7cbbdef7e
-
Filesize
512B
MD5876e406718bc5ef66f4347f22ce7e5c4
SHA1098016ec2349932f432e9b13b5cfb8187c01f33f
SHA2565e32afdd3453a32949d837b79e088cc9eefaec514cbfc42d5ce5e9a00b3645aa
SHA512d3b3c374b4ed7c1d0fa53040875ead06f7637dc4555aaa3268738e8f1474b9d4d45b6f4b0985cd2abba4b5a6dbe79b5f37a816889f610512e7602aae0a1440df
-
Filesize
1.1MB
MD55762a087a49cfb10cda82f622d1e17ab
SHA1811df9d21cdecbe8f909b1a8a1d07e2348f4bd14
SHA25698cc3e03e94985af802f078ca9c594e9c78412696a28c4f3083c6b009788b0d5
SHA5127f9fb1bb84b6e085a84536495bdafe2347660370c343bb33a30f7bfb6c2dc8d316d762af7d0f321412062d2dbc646eb7b7a7a776b2d54bfa6e516df93673a04d
-
Filesize
4KB
MD57e858c4054eb00fcddc653a04e5cd1c6
SHA12e056bf31a8d78df136f02a62afeeca77f4faccf
SHA2569010186c5c083155a45673017d1e31c2a178e63cc15a57bbffde4d1956a23dad
SHA512d0c7a120940c8e637d5566ef179d01eff88a2c2650afda69ad2a46aad76533eaace192028bba3d60407b4e34a950e7560f95d9f9b8eebe361ef62897d88b30cb
-
Filesize
512B
MD589cd7476b74973ae5688426116a60d9f
SHA1c1ab0113ddcf2d1302a92204315a51b226ae9eaf
SHA2565b6d399c64aff6e6412e110f980d9df53e396dfaa44ffc75aa85d731e19258e8
SHA5124599162fb53da0f0d0368379abd2c0202ca62b63f8548c9bfd14e48763460c8e7638cd7da47a07425e256f20cd22299dfaefa98d6c3ba8425b7a82233b9bcf71
-
Filesize
32KB
MD5bb7df04e1b0a2570657527a7e108ae23
SHA15188431849b4613152fd7bdba6a3ff0a4fd6424b
SHA256c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479
SHA512768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012
-
Filesize
16KB
MD5805d465e028e647ef617c68801b167c7
SHA187fd33218372b894d6daf612fa99a77a4fb0d490
SHA25630c54cb8ef73b1a12862804cbc788d89e58e4e411bd6c9b0282cd79b54b643f5
SHA51215715a0a0e510463dd51bfe10c8d4f768eeecced47ae0541591f8d939577e5a4c4e442e957d7ccf14e9d3cede3a6b1a389050328567b1bab563e71e879e04c0b
-
Filesize
108KB
MD526b8880d3fb2679c1586e30339166685
SHA1c3d63b5ad9eeef27bad9b964ea1e6428f7f6ebe3
SHA2562c58e35d01d3cec1cb6c03e2c40abe1bd22f82dd56621cfb0517c927474a7959
SHA512904b9a0d111e944e50f1a078d3cfdb2965308e18414edfd1af340cb7dd98cf1b8f9577df9ef245e57250610c8fe835aaf542fd780b91e54c46f1815b3d2c97f3
-
Filesize
249KB
MD5b285ca5ae00a15e5efd6c98f8899123b
SHA1a15322bc9bf4f057b3bcfb58ed2ab88842e1916d
SHA256f9aed5c3e28f829034002719a544c5bc52e929e1bed206d82dff667fc2b211df
SHA5128e842bbe3d4506dd0e0ac58ee8cf108300440b6994d99a1d6337a9481161527f439e0be7711746efa8bfac98938804a2906017d65662b15388a6d6343811e8dd
-
Filesize
1024B
MD50f343b0931126a20f133d67c2b018a3b
SHA160cacbf3d72e1e7834203da608037b1bf83b40e8
SHA2565f70bf18a086007016e948b04aed3b82103a36bea41755b6cddfaf10ace3c6ef
SHA5128efb4f73c5655351c444eb109230c556d39e2c7624e9c11abc9e3fb4b9b9254218cc5085b454a9698d085cfa92198491f07a723be4574adc70617b73eb0b6461