Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Resubmissions
23/04/2024, 22:06 UTC
240423-1z3agacd59 623/04/2024, 19:46 UTC
240423-yg1yksbc92 1023/04/2024, 19:42 UTC
240423-yetrgsbc62 623/04/2024, 19:38 UTC
240423-ycq8ksbc46 623/04/2024, 17:41 UTC
240423-v9ez2aac97 723/04/2024, 17:35 UTC
240423-v6awxaac93 1023/04/2024, 17:34 UTC
240423-v5ll1sac88 6Analysis
-
max time kernel
116s -
max time network
131s -
platform
android_x86 -
resource
android-x86-arm-20240221-en -
resource tags
androidarch:armarch:x86image:android-x86-arm-20240221-enlocale:en-usos:android-9-x86system -
submitted
23/04/2024, 17:41 UTC
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
https://github.com/ytisf/theZoo
Resource
android-x86-arm-20240221-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
https://github.com/ytisf/theZoo
Resource
android-x64-20240221-en
4 signatures
150 seconds
Malware Config
Signatures
-
Checks CPU information 2 TTPs 1 IoCs
Checks CPU information which indicate if the system is an emulator.
description ioc Process File opened for read /proc/cpuinfo com.android.chrome -
Checks memory information 2 TTPs 1 IoCs
Checks memory information which indicate if the system is an emulator.
description ioc Process File opened for read /proc/meminfo com.android.chrome -
Legitimate hosting services abused for malware hosting/C2 1 TTPs 5 IoCs
flow ioc 63 camo.githubusercontent.com 69 camo.githubusercontent.com 70 camo.githubusercontent.com 72 camo.githubusercontent.com 73 raw.githubusercontent.com
Network
-
Remote address:1.1.1.1:53Requeststatic.xx.fbcdn.netIN AResponsestatic.xx.fbcdn.netIN CNAMEscontent.xx.fbcdn.netscontent.xx.fbcdn.netIN A163.70.147.23
-
Remote address:1.1.1.1:53Requestm.youtube.comIN AResponsem.youtube.comIN A142.250.180.14
-
Remote address:1.1.1.1:53Requestimages-na.ssl-images-amazon.comIN AResponseimages-na.ssl-images-amazon.comIN CNAMEm.media-amazon.comm.media-amazon.comIN CNAMEtp.c47710ee9-frontier.media-amazon.comtp.c47710ee9-frontier.media-amazon.comIN CNAMEf.media-amazon.comf.media-amazon.comIN CNAMEmedia.amazon.map.fastly.netmedia.amazon.map.fastly.netIN A151.101.193.16media.amazon.map.fastly.netIN A151.101.1.16media.amazon.map.fastly.netIN A151.101.65.16media.amazon.map.fastly.netIN A151.101.129.16
-
Remote address:1.1.1.1:53Requesten.m.wikipedia.orgIN AResponseen.m.wikipedia.orgIN CNAMEdyna.wikimedia.orgdyna.wikimedia.orgIN A185.15.59.224
-
Remote address:1.1.1.1:53Requesta.espncdn.comIN AResponsea.espncdn.comIN CNAMEa.espncdn.com.stls.edgesuite.neta.espncdn.com.stls.edgesuite.netIN CNAMEa1793.dscg1.akamai.neta1793.dscg1.akamai.netIN A173.222.211.56a1793.dscg1.akamai.netIN A173.222.211.11
-
Remote address:1.1.1.1:53Requests.yimg.comIN AResponses.yimg.comIN CNAMEedge.gycpi.b.yahoodns.netedge.gycpi.b.yahoodns.netIN A87.248.114.12edge.gycpi.b.yahoodns.netIN A87.248.114.11
-
Remote address:1.1.1.1:53Requestir.ebaystatic.comIN AResponseir.ebaystatic.comIN CNAMEir.ebaycdn.netir.ebaycdn.netIN CNAMEebaystatic.ebay.map.fastly.netebaystatic.ebay.map.fastly.netIN A151.101.66.206ebaystatic.ebay.map.fastly.netIN A151.101.194.206ebaystatic.ebay.map.fastly.netIN A151.101.130.206ebaystatic.ebay.map.fastly.netIN A151.101.2.206
-
Remote address:1.1.1.1:53Requestwww.instagram.comIN AResponsewww.instagram.comIN CNAMEz-p42-instagram.c10r.instagram.comz-p42-instagram.c10r.instagram.comIN A163.70.147.174
-
Remote address:173.222.211.56:80RequestGET /wireless/mw5/r1/images/bookmark-icons/espn_icon-152x152.min.png HTTP/1.1
Host: a.espncdn.com
Connection: keep-alive
User-Agent: Mozilla/5.0 (Linux; Android 9; AOSP on IA Emulator Build/PSR1.180720.122) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/69.0.3497.100 Mobile Safari/537.36
Accept-Encoding: gzip, deflate
Accept-Language: en-US,en;q=0.9
ResponseHTTP/1.1 200 OK
ETag: "9ac9e9363b76587769dda7c61107e9a9"
Server: AmazonS3
Content-Type: image/png
Content-Length: 2790
Accept-Ranges: bytes
Cache-Control: max-age=14225
Date: Tue, 23 Apr 2024 17:42:20 GMT
Connection: keep-alive
Access-Control-Allow-Origin: *
-
Remote address:1.1.1.1:53Requestwww.google.comIN AResponsewww.google.comIN A216.58.201.100
-
Remote address:1.1.1.1:53Requestwww.google.co.ukIN AResponsewww.google.co.ukIN A142.250.179.227
-
Remote address:1.1.1.1:53Requestupdate.googleapis.comIN AResponseupdate.googleapis.comIN A142.250.178.3
-
Remote address:142.250.178.3:443RequestPOST /service/update2 HTTP/1.1
Content-Length: 660
Content-Type: application/x-www-form-urlencoded
User-Agent: Dalvik/2.1.0 (Linux; U; Android 9; Pixel 2 Build/PSR1.180720.122)
Host: update.googleapis.com
Connection: Keep-Alive
Accept-Encoding: gzip
ResponseHTTP/1.1 200 OK
Cache-Control: no-cache, no-store, max-age=0, must-revalidate
Pragma: no-cache
Expires: Mon, 01 Jan 1990 00:00:00 GMT
Date: Tue, 23 Apr 2024 17:42:26 GMT
Content-Type: text/xml; charset=UTF-8
X-Daynum: 6322
X-Daystart: 38546
Content-Encoding: gzip
X-Content-Type-Options: nosniff
X-Frame-Options: SAMEORIGIN
X-XSS-Protection: 1; mode=block
Server: GSE
Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
Transfer-Encoding: chunked
-
Remote address:142.250.178.3:443RequestPOST /service/update2 HTTP/1.1
Content-Length: 654
Content-Type: application/x-www-form-urlencoded
User-Agent: Dalvik/2.1.0 (Linux; U; Android 9; Pixel 2 Build/PSR1.180720.122)
Host: update.googleapis.com
Connection: Keep-Alive
Accept-Encoding: gzip
ResponseHTTP/1.1 200 OK
Cache-Control: no-cache, no-store, max-age=0, must-revalidate
Pragma: no-cache
Expires: Mon, 01 Jan 1990 00:00:00 GMT
Date: Tue, 23 Apr 2024 17:42:26 GMT
Content-Type: text/xml; charset=UTF-8
X-Daynum: 6322
X-Daystart: 38546
Content-Encoding: gzip
X-Content-Type-Options: nosniff
X-Frame-Options: SAMEORIGIN
X-XSS-Protection: 1; mode=block
Server: GSE
Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
Transfer-Encoding: chunked
-
Remote address:1.1.1.1:53RequestzvqhzdtqvIN AResponse
-
Remote address:1.1.1.1:53RequestddxscckdncykmiIN AResponse
-
Remote address:1.1.1.1:53RequestrbphxidsdbhbrIN AResponse
-
Remote address:1.1.1.1:53Requestconsent.google.co.ukIN AResponseconsent.google.co.ukIN A142.250.187.206
-
Remote address:1.1.1.1:53Requestsafebrowsing.googleapis.comIN AResponsesafebrowsing.googleapis.comIN A142.250.178.10
-
Remote address:1.1.1.1:53Requestandroid.apis.google.comIN AResponseandroid.apis.google.comIN CNAMEclients.l.google.comclients.l.google.comIN A172.217.169.46
-
Remote address:1.1.1.1:53Requestencrypted-tbn0.gstatic.comIN AResponseencrypted-tbn0.gstatic.comIN A142.250.179.238
-
Remote address:1.1.1.1:53Requestgithub.comIN AResponsegithub.comIN A20.26.156.215
-
Remote address:1.1.1.1:53Requestgithub.githubassets.comIN AResponsegithub.githubassets.comIN A185.199.109.154github.githubassets.comIN A185.199.110.154github.githubassets.comIN A185.199.108.154github.githubassets.comIN A185.199.111.154
-
Remote address:1.1.1.1:53Requestavatars.githubusercontent.comIN AResponseavatars.githubusercontent.comIN A185.199.108.133avatars.githubusercontent.comIN A185.199.110.133avatars.githubusercontent.comIN A185.199.109.133avatars.githubusercontent.comIN A185.199.111.133
-
Remote address:1.1.1.1:53Requestgithub-cloud.s3.amazonaws.comIN AResponsegithub-cloud.s3.amazonaws.comIN CNAMEs3-1-w.amazonaws.coms3-1-w.amazonaws.comIN CNAMEs3-w.us-east-1.amazonaws.coms3-w.us-east-1.amazonaws.comIN A3.5.2.123s3-w.us-east-1.amazonaws.comIN A52.217.64.132s3-w.us-east-1.amazonaws.comIN A3.5.25.119s3-w.us-east-1.amazonaws.comIN A3.5.25.44s3-w.us-east-1.amazonaws.comIN A52.216.44.201s3-w.us-east-1.amazonaws.comIN A52.217.232.169s3-w.us-east-1.amazonaws.comIN A16.182.97.81s3-w.us-east-1.amazonaws.comIN A52.216.136.244
-
Remote address:1.1.1.1:53Requestuser-images.githubusercontent.comIN AResponseuser-images.githubusercontent.comIN A185.199.111.133user-images.githubusercontent.comIN A185.199.108.133user-images.githubusercontent.comIN A185.199.110.133user-images.githubusercontent.comIN A185.199.109.133
-
Remote address:1.1.1.1:53Requestcamo.githubusercontent.comIN AResponsecamo.githubusercontent.comIN A185.199.108.133camo.githubusercontent.comIN A185.199.110.133camo.githubusercontent.comIN A185.199.111.133camo.githubusercontent.comIN A185.199.109.133
-
Remote address:1.1.1.1:53Requestraw.githubusercontent.comIN AResponseraw.githubusercontent.comIN A185.199.111.133raw.githubusercontent.comIN A185.199.109.133raw.githubusercontent.comIN A185.199.108.133raw.githubusercontent.comIN A185.199.110.133
-
1.8kB 15.8kB 20 26
-
3.9kB 111.8kB 61 86
-
1.3kB 9.5kB 11 15
-
1.4kB 7.2kB 15 13
-
1.7kB 13.7kB 19 22
-
173.222.211.56:80http://a.espncdn.com/wireless/mw5/r1/images/bookmark-icons/espn_icon-152x152.min.pnghttp627 B 3.4kB 5 5
HTTP Request
GET http://a.espncdn.com/wireless/mw5/r1/images/bookmark-icons/espn_icon-152x152.min.pngHTTP Response
200 -
2.6kB 41.3kB 35 43
-
1.6kB 15.0kB 16 19
-
3.3kB 72.9kB 41 65
-
1.4kB 6.6kB 13 15
-
2.7kB 8.0kB 10 14
HTTP Request
POST https://update.googleapis.com/service/update2HTTP Response
200HTTP Request
POST https://update.googleapis.com/service/update2HTTP Response
200 -
3.6kB 14.4kB 29 30
-
9.3kB 380.6kB 142 271
-
858 B 40 B 1 1
-
5.0kB 9.0kB 21 24
-
3.3kB 45.9kB 34 44
-
986 B 5.1kB 11 9
-
986 B 5.0kB 11 8
-
934 B 5.1kB 10 9
-
942 B 5.0kB 9 7
-
934 B 5.1kB 10 9
-
8.6kB 246.3kB 125 209
-
831 B 4.7kB 11 10
-
883 B 4.7kB 12 10
-
883 B 4.7kB 12 10
-
38.6kB 1.2MB 484 850
-
883 B 4.7kB 12 10
-
831 B 4.7kB 11 10
-
6.6kB 93.2kB 67 88
-
957 B 4.6kB 8 7
-
1.0kB 4.6kB 9 7
-
1.1kB 4.6kB 9 6
-
957 B 4.6kB 8 7
-
957 B 4.6kB 8 7
-
935 B 4.7kB 11 9
-
935 B 4.7kB 11 9
-
276 B 172 B 5 3
-
1.1kB 4.8kB 12 10
-
2.0kB 7.4kB 15 14
-
3.7kB 11
-
65 B 104 B 1 1
DNS Request
static.xx.fbcdn.net
DNS Response
163.70.147.23
-
59 B 75 B 1 1
DNS Request
m.youtube.com
DNS Response
142.250.180.14
-
77 B 263 B 1 1
DNS Request
images-na.ssl-images-amazon.com
DNS Response
151.101.193.16151.101.1.16151.101.65.16151.101.129.16
-
64 B 109 B 1 1
DNS Request
en.m.wikipedia.org
DNS Response
185.15.59.224
-
59 B 170 B 1 1
DNS Request
a.espncdn.com
DNS Response
173.222.211.56173.222.211.11
-
56 B 127 B 1 1
DNS Request
s.yimg.com
DNS Response
87.248.114.1287.248.114.11
-
63 B 196 B 1 1
DNS Request
ir.ebaystatic.com
DNS Response
151.101.66.206151.101.194.206151.101.130.206151.101.2.206
-
63 B 114 B 1 1
DNS Request
www.instagram.com
DNS Response
163.70.147.174
-
60 B 76 B 1 1
DNS Request
www.google.com
DNS Response
216.58.201.100
-
62 B 78 B 1 1
DNS Request
www.google.co.uk
DNS Response
142.250.179.227
-
67 B 83 B 1 1
DNS Request
update.googleapis.com
DNS Response
142.250.178.3
-
55 B 130 B 1 1
DNS Request
zvqhzdtqv
-
60 B 135 B 1 1
DNS Request
ddxscckdncykmi
-
59 B 134 B 1 1
DNS Request
rbphxidsdbhbr
-
66 B 82 B 1 1
DNS Request
consent.google.co.uk
DNS Response
142.250.187.206
-
73 B 89 B 1 1
DNS Request
safebrowsing.googleapis.com
DNS Response
142.250.178.10
-
69 B 109 B 1 1
DNS Request
android.apis.google.com
DNS Response
172.217.169.46
-
72 B 88 B 1 1
DNS Request
encrypted-tbn0.gstatic.com
DNS Response
142.250.179.238
-
56 B 72 B 1 1
DNS Request
github.com
DNS Response
20.26.156.215
-
69 B 133 B 1 1
DNS Request
github.githubassets.com
DNS Response
185.199.109.154185.199.110.154185.199.108.154185.199.111.154
-
75 B 139 B 1 1
DNS Request
avatars.githubusercontent.com
DNS Response
185.199.108.133185.199.110.133185.199.109.133185.199.111.133
-
75 B 253 B 1 1
DNS Request
github-cloud.s3.amazonaws.com
DNS Response
3.5.2.12352.217.64.1323.5.25.1193.5.25.4452.216.44.20152.217.232.16916.182.97.8152.216.136.244
-
79 B 143 B 1 1
DNS Request
user-images.githubusercontent.com
DNS Response
185.199.111.133185.199.108.133185.199.110.133185.199.109.133
-
72 B 136 B 1 1
DNS Request
camo.githubusercontent.com
DNS Response
185.199.108.133185.199.110.133185.199.111.133185.199.109.133
-
71 B 135 B 1 1
DNS Request
raw.githubusercontent.com
DNS Response
185.199.111.133185.199.109.133185.199.108.133185.199.110.133