Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
175s -
max time network
131s -
platform
android_x86 -
resource
android-x86-arm-20240514-en -
resource tags
-
submitted
17/05/2024, 18:25
General
-
Target
6947ff1be3734aadceb5f294d1f187a5.apk
-
Size
610KB
-
MD5
6947ff1be3734aadceb5f294d1f187a5
-
SHA1
321682c8395216b6f71ac1f4a1188040bbddfeb4
-
SHA256
0a399c83c1dcefe7901642e1e316f963eb2e0950ac3b0125ed1dd7c4d69d0f1a
-
SHA512
5e13e697ac55b7c7151b6c1ad54f0dc9e0d1c15906deca54c1d0c30f21fab26e607a77a0b1e02d7ef86137c560b238374baa13a0a9d4b0ab17f0bcc1adb85be6
-
SSDEEP
12288:TH7aga+gYU3BKfPbKdla+OAnycLhuDoQkvbUN:D7Y+gYU3BK3wN9nTOoQk4N
Malware Config
Signatures
-
Spynote
Spynote is a Remote Access Trojan first seen in 2017.
-
Spynote payload 2 IoCs
-
Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
-
Loads dropped Dex/Jar 1 TTPs 3 IoCs
Runs executable file dropped to the device during analysis.
-
Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs
Application may abuse the framework's foreground service to continue running in the foreground.
-
Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs
Processes
-
GOOD.BYE.GOOGLE1⤵
- Loads dropped Dex/Jar
- Makes use of the framework's foreground persistence service
- Registers a broadcast receiver at runtime (usually for listening for system events)
-
/system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/GOOD.BYE.GOOGLE/app_mph_dex/classes.dex --output-vdex-fd=41 --oat-fd=42 --oat-location=/data/user/0/GOOD.BYE.GOOGLE/app_mph_dex/oat/x86/classes.odex --compiler-filter=quicken --class-loader-context=&2⤵
- Loads dropped Dex/Jar
-
Network
MITRE ATT&CK Mobile v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
572KB
MD54565def4512efe74e999abf013c91b2d
SHA1e5cfc824020ce194e3c5e323cfeaf24caaf30ad6
SHA256bcab89c43b0252d44a028c4fa46702c401663d70cf445d0b46c5e68ae3980b27
SHA5127bea9f690e00b8bcecded81a8e48e869328ffb9f04796a99f4aa689f7e45433399d5ba3b748ba69f3303745a028ff78f42359bb475345240496af99e7f552425
-
Filesize
572KB
MD59016471b31bc084f452d0ef71a6d239f
SHA12bfdd23a29b923f31f20f5f9af4315a6b071af99
SHA25690ce52f7fe0678205338ce69adebd0ad5a78e085c20c0d18f5792b6158b38f47
SHA512762e1c5d9773e56997632906328ab4c14d8984a270009986f1cbb1ee6997fcfeefe451a4aaca11ed5dfa2a1e4f5d5f9446af305ea19df4c4f23d458d545c5a89
-
Filesize
1KB
MD5bd8b9e1a0b2ddd4d69cf7feb24335805
SHA130bb3cedb48f6c87cd07beda3ea0e0b6f12199f5
SHA2569852dfce6aeb8947eeed3a8ecc65bc98725b0a288c2ebb5fa0ff92c214c64358
SHA512592f5318de40e477434ce88f1be52e60781702716aef358920112328d221c518ef0ba2ca7e18076f5dd50e6dd73027071d9a105cb3ad68aae891c8bd3eca0501