Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
3s -
max time network
186s -
platform
android_x64 -
resource
android-x64-20240514-en -
resource tags
androidarch:x64arch:x86image:android-x64-20240514-enlocale:en-usos:android-10-x64system -
submitted
17/05/2024, 18:24
Static task
static1
Behavioral task
behavioral1
Sample
66c4513025128719dda018820cc0987e_1.apk
Resource
android-x86-arm-20240514-en
Behavioral task
behavioral2
Sample
66c4513025128719dda018820cc0987e_1.apk
Resource
android-x64-20240514-en
Behavioral task
behavioral3
Sample
66c4513025128719dda018820cc0987e_1.apk
Resource
android-x64-arm64-20240514-en
General
-
Target
66c4513025128719dda018820cc0987e_1.apk
-
Size
3.0MB
-
MD5
66c4513025128719dda018820cc0987e
-
SHA1
4dcc2d9ef4921b3eb4e4dc72dd3716520d558102
-
SHA256
c19cf001efb893cfb4f3aedb1c4c3771ce8419d3838e1bc399e88a12b583b28c
-
SHA512
dd5ed77e8f110ceafe036adcf673dfb77b46e78d23815abcf25cbe08ad6631bf6c348bdab49ca497ed44c77c1ad0b19425fd8ed44063cb1da8dbe9b84fab49bd
-
SSDEEP
49152:HYvtHWc3kQdaWWce2fFeeC6K6iZHyqDmLJTsY2424rTOoQE2jvKuAz:Hodz3kQAW3ft9CH79dD2JNvS+
Malware Config
Signatures
-
Spynote
Spynote is a Remote Access Trojan first seen in 2017.
-
Spynote payload 1 IoCs
resource yara_rule behavioral2/files/fstream-1.dat family_spynote -
Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
-
Loads dropped Dex/Jar 1 TTPs 2 IoCs
Runs executable file dropped to the device during analysis.
ioc pid Process /data/user/0/GOOD.BYE.GOOGLE/app_mph_dex/classes.dex 5100 GOOD.BYE.GOOGLE /data/user/0/GOOD.BYE.GOOGLE/app_mph_dex/classes.dex 5100 GOOD.BYE.GOOGLE -
Requests dangerous framework permissions 2 IoCs
description ioc Required to be able to access the camera device. android.permission.CAMERA Allows an application to write to external storage. android.permission.WRITE_EXTERNAL_STORAGE
Network
MITRE ATT&CK Mobile v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
572KB
MD54565def4512efe74e999abf013c91b2d
SHA1e5cfc824020ce194e3c5e323cfeaf24caaf30ad6
SHA256bcab89c43b0252d44a028c4fa46702c401663d70cf445d0b46c5e68ae3980b27
SHA5127bea9f690e00b8bcecded81a8e48e869328ffb9f04796a99f4aa689f7e45433399d5ba3b748ba69f3303745a028ff78f42359bb475345240496af99e7f552425
-
Filesize
2.6MB
MD59f9098cd949fc90785c3fe1afccdca3e
SHA1c28083fd26c3067f1c29755f450dcba077212533
SHA256e441af83f445a1af90e738e4ad2ba5285304a3e9a2031013b887948dab4ffafd
SHA51226ed74d1f0089133c082ccee2ce02c799b0342aaceadfd5223bb4135cb980eb743797bf5e64b4ec97f7a68cbac58c192027dcb05a029b064dbb5aaf26654432d