Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Resubmissions

20/05/2024, 06:03

240520-gsgkmseg38 10

27/12/2023, 08:11

231227-j3db3sedek 10

Analysis

  • max time kernel
    8s
  • max time network
    151s
  • platform
    android_x86
  • resource
    android-x86-arm-20240514-en
  • resource tags

    androidarch:armarch:x86image:android-x86-arm-20240514-enlocale:en-usos:android-9-x86system
  • submitted
    20/05/2024, 06:03

General

  • Target

    FlyGram.apk

  • Size

    50.6MB

  • MD5

    207591f089116460eecac93556cc4ee6

  • SHA1

    c6e26eafbf6703dc19446944af5ded65f86c9571

  • SHA256

    daf3d2cb6f1bbb7c8d1cfb5fc0db23afc304a622ebb24aa940228be691bcda2d

  • SHA512

    4fc1f05e6113680d2439541f9a66dca0284c3a56030ba4ad8b89f70b896df3b171ed99dc22ed09000429b325b1d8cc14194dff7c6209955cef40ac87eccc87c3

  • SSDEEP

    786432:PQhaCgW+rjQgsjp0i2bq5TXQOtj2pG4dG5NzarvqHwl0DdaAlmE:Iha7WA2lKbgTXTtjsGN3aLqHBaAlmE

Malware Config

Signatures

  • BadBazaar

    BadBazaar is an Android spyware used by GREF APT group.

  • Checks CPU information 2 TTPs 1 IoCs

    Checks CPU information which indicate if the system is an emulator.

  • Checks known Qemu pipes. 1 TTPs 2 IoCs

    Checks for known pipes used by the Android emulator to communicate with the host.

  • Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs
  • Acquires the wake lock 1 IoCs
  • Checks if the internet connection is available 1 TTPs 1 IoCs

Processes

  • org.telegram.FlyGram
    1⤵
    • Checks CPU information
    • Checks known Qemu pipes.
    • Registers a broadcast receiver at runtime (usually for listening for system events)
    • Acquires the wake lock
    • Checks if the internet connection is available
    PID:4291

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • /data/data/org.telegram.FlyGram/databases/com.google.android.datatransport.events

    Filesize

    4KB

    MD5

    f2b4b0190b9f384ca885f0c8c9b14700

    SHA1

    934ff2646757b5b6e7f20f6a0aa76c7f995d9361

    SHA256

    0a8ffb6b327963558716e87db8946016d143e39f895fa1b43e95ba7032ce2514

    SHA512

    ec12685fc0d60526eed4d38820aad95611f3e93ae372be5a57142d8e8a1ba17e6e5dfe381a4e1365dddc0b363c9c40daaffdc1245bd515fddac69bf1abacd7f1

  • /data/data/org.telegram.FlyGram/databases/com.google.android.datatransport.events-journal

    Filesize

    512B

    MD5

    3ded1c5f9393aa4d95f4dc89d7faf792

    SHA1

    5206773e175ddec5c4fe8c506ea88e745e2b64c9

    SHA256

    21e601586385559891db8b8a72922217e099cbe72b4b4b25d6b22f66c1dcf8f0

    SHA512

    da70f5ddfbcad92310038a6aedeedc209ee105c4ecd41d1885e0e76d0bfc1915e22d46d145cb743a3574ea0cf38f7c7581061ec708c11a4c529ac5a31658209f

  • /data/data/org.telegram.FlyGram/databases/com.google.android.datatransport.events-shm

    Filesize

    32KB

    MD5

    bb7df04e1b0a2570657527a7e108ae23

    SHA1

    5188431849b4613152fd7bdba6a3ff0a4fd6424b

    SHA256

    c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479

    SHA512

    768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012

  • /data/data/org.telegram.FlyGram/databases/com.google.android.datatransport.events-wal

    Filesize

    68KB

    MD5

    337c66d824ffb7aff2a19ea3c6d5b77d

    SHA1

    7a316c468fa87f7d2ea92ad17f2bae996ca15c88

    SHA256

    e954db4382179ad1fc1ff4f6c5cb33a44cdff6c064605e86bb07e03e4c10699f

    SHA512

    657dc7740759040060334e96f537343d5ddab3b0638ab9fbb49d147bfd44b7f42931dfc968db65227847f7353a95ae844a89c47fbb7130e1b7c605880c82b2fd

  • /data/data/org.telegram.FlyGram/files/PersistedInstallation4072722964326691999tmp

    Filesize

    114B

    MD5

    fc47a0845af64327365d61c272844d56

    SHA1

    59bacdf33c3394f0644f7dd32c7809247a6123e0

    SHA256

    d26ce1dd35697de058c4ff3b405dbfa0db638bf1e744bec774e23a5eec7162e5

    SHA512

    b8b5551f49a2f1a09a30967d230c457c1d6171ea9e130eae3b2029e42414a307a63669471e99c39643732246196e138f2fe6e9183257ffa7073aaefc6231a0bd

  • /data/data/org.telegram.FlyGram/files/PersistedInstallation4454913002119487403tmp

    Filesize

    90B

    MD5

    cf6e90aba74ddc269368941c517a0ccd

    SHA1

    eebcab09f13e12320547c0dbb41e3e707c180f64

    SHA256

    6adcadf06ea7b6a2b35bc0db57c2904562d553835e47082e3e3ae58a00c563f6

    SHA512

    6a3198124f7a8ec8741f44b63a2a4e8e21b5a1d58d45ed6498a9977526cbaa481da3a7c10679418ac3d0e830424f954f43e7c9ea16446f71c75c1657d6daf71b

  • /data/data/org.telegram.FlyGram/files/account1/cache4.db-journal

    Filesize

    512B

    MD5

    5be470d84139685cb458b4ad5f88ae94

    SHA1

    366b492f66efcf6a47743db8dcd05ff4960f3cca

    SHA256

    7632c412b01d3f6a5a58689e950170cff8513b8f55f298112aee82046ab3ebb7

    SHA512

    28e638d93be0a02dfef953a48d7a465bc2d6f0541f75363198e3d31cdda8642874ddfe34df83016df5be67f6696d8bd64093de597dd9c7d7d68289dc33600733

  • /data/data/org.telegram.FlyGram/files/account1/cache4.db-wal

    Filesize

    293KB

    MD5

    b7e3302a232e99fb6360f01c91337657

    SHA1

    d3132f33c8ba15bbac82189bf97a98c43f9a3f56

    SHA256

    c8ae977e14814e7dbd760a7fdaf4eb9d0682cd92d1407a88ebd65c6490fc5c5f

    SHA512

    84d588cec228542ad866ad2a04c3f0ac05fcc4c2c0965b4c08428157263972dec589ae2d8a38c26c6e26a75996089e864bbaf715f644f575e31d9cd92ff28cb0

  • /data/data/org.telegram.FlyGram/files/account1/file_to_path.db-journal

    Filesize

    512B

    MD5

    88880e8093c591cef9d6697e92a5cb59

    SHA1

    dbfb4b93a13ebbc6af720d03dc77d0fab306fee2

    SHA256

    1cc91ae5756810abc135b1c3cb9031a4fd92ba677ff959d12e4c87830c381d82

    SHA512

    b2ed83e04b00cc26d7499d1e59e152b89da5fc25fcc7d61a455d3a8e4af619a50f5493bef3f0be936ee1a7069977b14c5d9ddded52130788599ebd296c35f881

  • /data/data/org.telegram.FlyGram/files/account1/file_to_path.db-journal

    Filesize

    4KB

    MD5

    a618189346c4873ec35babfa4739156e

    SHA1

    b4fc2eec7d5bd6d992ae7164cde2d7ebc5bdc9a2

    SHA256

    1a81d8f46a19d055f2f1e99e7767eed21761499a0a129e1024986e58170da2ba

    SHA512

    a007501a9b0d9a8a6bb749d922c3739b7a63f75af7aee2fafc5972298f675109cac2210ac7a4e75f2741f4879b05e87c7db946267ea31401b5be5e069785543d

  • /data/data/org.telegram.FlyGram/files/account1/file_to_path.db-journal

    Filesize

    4KB

    MD5

    2ba0c59619eb0dab5ea7aca665d59949

    SHA1

    3f9125db81cf9f709b95f2a3e7eef684b481ecd8

    SHA256

    95a0b7cb7fd4751f4702c9009087520f99fa928a38fe22e928216d2bcc3f2a2d

    SHA512

    0f4600385b13e0009098259d4c2f17bf3e1f27acde9845ba26f0aa9e5f0a44fc7e2ccd6ba855d3fdc8002ae3bf7022a79ccbf7ad005af114e7fa099595100a42

  • /data/data/org.telegram.FlyGram/files/account1/file_to_path.db-journal

    Filesize

    4KB

    MD5

    2a313ca8ad48060065e1a19d01f1d269

    SHA1

    a531f493b3132d667124ddd9d36e951d781bd2c4

    SHA256

    4fd26a11893640307eef48693c6ba97035a5426cc168ebf6688a4fecc3614588

    SHA512

    db54f98ca26cfbff4447a57aaaa73b6a5ddc4956ba019ed0f13f78116cfcab7dc8814685895bd5dde8c1ad3a8d1146a2144ba8432767e4d95f477249e4d3189e

  • /data/data/org.telegram.FlyGram/files/account1/tgnet.dat

    Filesize

    908B

    MD5

    f85b7527f09df80322f1e45251b1b7b4

    SHA1

    ffc4f0c8e134db2cbaf11a48c3b95be9cc2d5aab

    SHA256

    cef14733bf62224a7e1e18811f2d424e3c8e9fbd99edde16cef096499954c65b

    SHA512

    3233d753bef1e784d8662d10706123440e873f978d7868ec2d5fa08098529593c3b08e790a1b989f6733d35514ad810ece7f13290c1696cf463f1474645ceab8

  • /data/data/org.telegram.FlyGram/files/account1/tgnet.dat

    Filesize

    912B

    MD5

    265f1a73622f9f951e0e9008e3777a83

    SHA1

    b01e6de309b48a827f317cb2561774b8a47f2c67

    SHA256

    28c8ac81406a965febdd40fe73b923f289e522b2622d86d83d57819ca24ce9ff

    SHA512

    61ddb6607adb2e5273732a5b94d1e6c67108d917fdba655f14fa9dcd0efcd42e609324b14e8e2af0c08a23f09a1d99a8898461d6fac5ed2badef7a0a3df9415e

  • /data/data/org.telegram.FlyGram/files/account2/file_to_path.db-journal

    Filesize

    512B

    MD5

    a4b74e43e3c61ef0e8fc1ae2c1c9bf2a

    SHA1

    a33228df03b35c678ea3f9cfe9b52e4c6668780d

    SHA256

    402b874ec830bd55354bec92f8bf361167e78920c1c3060e9d2018d5562dd6ae

    SHA512

    15396bcac29d0a21728d7312439e43a9a008cb3ed14b01c446ceb29057807c487dd0982989cbaab9cb001cdc633bdc0b9e3065daf6f53abb73b1699d508c44db

  • /data/data/org.telegram.FlyGram/files/account2/file_to_path.db-journal

    Filesize

    4KB

    MD5

    8a1516ba57d8a2d57acd5230737160ce

    SHA1

    808f0528701ef5241ded85de4804397ef8c4148c

    SHA256

    0f528bb3b64163a8f784538ee65ee39db7329c47f5e53989fde025c1ddd1f52a

    SHA512

    bac90a4d654652a277c2fcb72c2585c2e67199bc046ab08de12569cacd4244ab75ae647b22cbf4897a1bc97ef0cad32652636d1ccfbeedbb4d80cfe68470325d

  • /data/data/org.telegram.FlyGram/files/account2/file_to_path.db-journal

    Filesize

    4KB

    MD5

    06ab75c08eb003c521f9a76761390c2f

    SHA1

    26815c33d861f96f974da4211cf331daf60294a8

    SHA256

    a1c75e160370b9367675871595cb2ed9b39673d2d344ba0364d008057cf47dff

    SHA512

    b0beda7a6904102e611bf608c8d248047aea22e5cda50a1e93113e6c42206d86b144dd856873e877767779d2fda6a3fdfa63ea44062b82b51088e5c4f540b7ff

  • /data/data/org.telegram.FlyGram/files/account2/file_to_path.db-journal

    Filesize

    4KB

    MD5

    fe3edf13241bee90ca399c7b5df52405

    SHA1

    4ebaab08d8c6d6d9d96716f7b17e0df98d5d54d9

    SHA256

    dde0a529f518804a04addd3cd5070fc839fd00150739ff09bc157c3cea8f4b1a

    SHA512

    cb27d31ed960df9cca03f1c5dc784228a660c36476fc639b8ebcd9861f4193cda16cea63f2c89ae41b3746b3b45269dd25ea3465c5bed6571f7f4ec628fa81f0

  • /data/data/org.telegram.FlyGram/files/account3/file_to_path.db

    Filesize

    24KB

    MD5

    0896f8facda443d1f4857d3f8f9987fc

    SHA1

    d3e80821bf57491c8a7f9a28ec2fd51f1654ca2c

    SHA256

    3119a312492090d16a81ddafadff2f238bcbecd6036518e9276831588dc80583

    SHA512

    851bfb8c15732ee4c11573e411382d8aaa5c97b188ef2b0eefa6fa085643cd0e0246641c79e1d05bb3adf75f460c01edc62fff8e7d5129236fddd0b5ea854dda

  • /data/data/org.telegram.FlyGram/files/account3/file_to_path.db-journal

    Filesize

    512B

    MD5

    a3801a74bca0f75c88d499da906ea9b5

    SHA1

    82d58e9228d5cfc72740816be4f78bfe3b1633bf

    SHA256

    fd75bf1d6707f9a2143ffaabadc231e28b802b0e6b05e25cdcc1a56a791cc0f4

    SHA512

    301584df152cc833bac55459e159d2783ad3a1612d4131df5cdc1efdcb8bfa021edc543edcbbd7907edc5e358f0502ab7c50c9927dc3df9cc8868b15714a87b9

  • /data/data/org.telegram.FlyGram/files/account3/file_to_path.db-journal

    Filesize

    4KB

    MD5

    c2fc8fa71aeccf2e823f9abe698e26d2

    SHA1

    73ee9d800fe1aab22b35cb893e8a808fb2edd3f5

    SHA256

    b4b8c852154fe79339ada3c0a91453f60b239ac5b87bce8a25d48c1c20e1d9b2

    SHA512

    8eae11580571108d9b8527e2275c1ad60d37370e647a17989a4e727a5190cddc8427e79040924efbd0b941517c051df1b43090e3c92ce6525a63a77b49319873

  • /data/data/org.telegram.FlyGram/files/account3/file_to_path.db-journal

    Filesize

    4KB

    MD5

    afeb8eadd3c3bbc901b7e73716c571bf

    SHA1

    3d448545d8cae70ecbdd89a6a85b0b77529bbcbf

    SHA256

    beda70359c79001ec2a7398c75274e8468c1985fe44e4c1e59f0a07270b060c4

    SHA512

    239a57ee89b78d6ce0d8f00954ca5939c3578e9ca70295c2dfafdfc7e6b576c7f1ced7ebd4d1eefee9f5fcf192bfe71d3634793d7be7306c33803951f4fc19d4

  • /data/data/org.telegram.FlyGram/files/account3/file_to_path.db-journal

    Filesize

    4KB

    MD5

    44a6556386b33b345dd9ef19d1061f5f

    SHA1

    9e9507286b8a90e591d9bffcc94abe9816e200a6

    SHA256

    14086deb6abf2dc982876548944eaee543a3aea2d7a0b2f16e89fe7d35f72b5e

    SHA512

    7f6cc56d1c369f27e0e3e130b5e229312264f7700c9e1eef94009ad2f621e861c867de1df360a10109e7c36f3513a91dbb4e4e05f4776d39baa52e60e37ed2b4

  • /data/data/org.telegram.FlyGram/files/bluebubbles.attheme

    Filesize

    5KB

    MD5

    c9827272d5202d5046c71eb711bb428e

    SHA1

    25b024a867914f64aba225f5f6c176730b28e26b

    SHA256

    e591f45fca803cc1b68d83cfd8fe9013984f496fb011e2160cb0e29d27f46d0d

    SHA512

    f1cc86fae9720b972fbffcbfe5f344dbd70f46870737ee16539a1740b0333b35a7c62275ec622e2d13669a1a512840243845e863e7af4af9eb9497f6ea193a69

  • /data/data/org.telegram.FlyGram/files/cache4.db

    Filesize

    4KB

    MD5

    689eb9d3d2a866648f68f76e6a8c3d46

    SHA1

    ba65af36973bb4cb831868ec4882ce204bffb597

    SHA256

    2a8c5af4b19e1144088ff271ec893e963a454107facb5f7155c2ec33cfa17b6a

    SHA512

    98392c13983b1dea2b080c383bd26cae10b411360df2fe4192bef6c0958b5f6bbff98ad876d2edbd8bd771f0e8519ad9c3cc50ceff56afec569bdae864b14d83

  • /data/data/org.telegram.FlyGram/files/cache4.db-journal

    Filesize

    512B

    MD5

    c6e6ae1561cb0ba0800137f7ec119b7e

    SHA1

    3402038d7121a0ca15108b1d55c4f05eb0f7f241

    SHA256

    06d7067973865411a5013e8725dc50d5a550bc6e092142503e5c1d29aef2b46a

    SHA512

    caf047c7ecf7fa1a3d858b31bc10b6e90372aafb4aa39c8e1872168fceaf15d195cd174e0e9de2452e54d7ef5861bb191f81c0d7d0ced4215d478a6397136451

  • /data/data/org.telegram.FlyGram/files/cache4.db-shm

    Filesize

    28KB

    MD5

    cf845a781c107ec1346e849c9dd1b7e8

    SHA1

    b44ccc7f7d519352422e59ee8b0bdbac881768a7

    SHA256

    18619b678a5c207a971a0aa931604f48162e307c57ecdec450d5f095fe9f32c7

    SHA512

    4802861ea06dc7fb85229a3c8f04e707a084f1ba516510c6f269821b33c8ee4ebf495258fe5bee4850668a5aac1a45f0edf51580da13b7ee160a29d067c67612

  • /data/data/org.telegram.FlyGram/files/cache4.db-wal

    Filesize

    1.3MB

    MD5

    a9becf7849f616985151406577670f15

    SHA1

    5a03a42a268be3fe168997d316c801fa3ac89de8

    SHA256

    27e92bc802fa3281c68600a169d7053eb9f7f0f592973444d81fa2c5c6850b2e

    SHA512

    34810b67dd0d31cc28dfee38e7fa2370d0f6012ef580aa5844da79a9dc4145f38f0c5f9dee13010113931b5d23ac2b6f5554124f86a11c2b0eb9c1cc8e6f61d6

  • /data/data/org.telegram.FlyGram/files/dc2conf.dat

    Filesize

    40B

    MD5

    098b011c59a80daf15c048dfee00ff1f

    SHA1

    47963ffe950f64e4ab0d329f111f1ea61e1f72c6

    SHA256

    87152114f80cd6a1b36e7649f2e54e18e347d15b45ca4245e1b2f20922a8f037

    SHA512

    2caea2577cd87ab62be62621d976c650f14f063b6ef815d23f218b35b17354c95f2a56d595fce876750fcbb47ddbdfa844812e1218d77aa5249d85dd349e16c4

  • /data/data/org.telegram.FlyGram/files/default.attheme

    Filesize

    23KB

    MD5

    3397fa24b8427807d27172746db086ea

    SHA1

    494b8aadb3066fdcd5f382f1ddebff1365b6eac7

    SHA256

    27c69fcc13b4dda67bff750cec16415fbc5c3d9f3c2f2a7868943f7ab6c7fa82

    SHA512

    092eea41e93760278da37c50fc150c4dff5875b92005a868e3fbfb9a07c441d2b3bf888bf51f5f764bb068869d9a4c8b361f70d26f52e9975c4bfca600aa859b

  • /data/data/org.telegram.FlyGram/files/file_to_path.db-journal

    Filesize

    512B

    MD5

    58ccb79b03a1f07c54ca41fa9b77ef54

    SHA1

    c686148d44d52306c302e97633870d028ea2efea

    SHA256

    befaf0ab774f7227b570da6b02946ea8e20c489465565c2ccfadfd63fa5fccf4

    SHA512

    14486686a55f797a0946998f524eb95ddbba84866aae2f8f66256ef38e13edfbc15c668eacf588712c713c7cbc56bac4e8cf7effd5009009c2865a2fbe2ef9d1

  • /data/data/org.telegram.FlyGram/files/file_to_path.db-journal

    Filesize

    4KB

    MD5

    76e88b4214a780f836a76bf10c72ddc1

    SHA1

    d3779dc7b683263e9123f82f8dac7504f2f67cfb

    SHA256

    3b18b80c8899c1d2a7f509250eec45db9c974da18857bdc3bff8638dbf81c148

    SHA512

    38dae1542a1757271b5cae71cbbe10c2a795f521e01861c5765e10afd5e176c9b7ab0a523ca10e0907497078957ce935fb85936216edd459aa3f4bd96ba84a75

  • /data/data/org.telegram.FlyGram/files/file_to_path.db-journal

    Filesize

    4KB

    MD5

    8ac2f08df9d749ec8ceaa0068855391e

    SHA1

    fa6fb2c7cec5e6082ebb90ccc2d6cd50906c8c29

    SHA256

    b52e2ac68f9346ec175aee4acf7844d20e0ffa5734708be362e7262c9399e2fb

    SHA512

    e4ca45b6a10fde8e28c6a192001289252e2c3f77f758b601a3ad78079a793bc4892b8847156e22a64fa6e6109b746848e87d9029b2c5e4bbef322008337e52e3

  • /data/data/org.telegram.FlyGram/files/file_to_path.db-journal

    Filesize

    4KB

    MD5

    fbeb8e9d4102b6c858b1e4134981fa3e

    SHA1

    35e2b9bd46318522d4a759234e43812aa952ca61

    SHA256

    cf443b0d448c76d025bb8f84c2c61d782684afb71d1e37f14b5132a077b3f74e

    SHA512

    9ed496618794280df1833a2b68f9ac73401d5f0347fda52da34aaa9a51c2e708bd3f99755b4329ff52e22b17918e3702fd8b2b5ebe30eee9ead7fe19253ac328

  • /data/data/org.telegram.FlyGram/files/tgnet.dat

    Filesize

    908B

    MD5

    f40d0c37dac115149f9909d7cec1b0e8

    SHA1

    6fc7b14e75b7b0e5388c5d6d8d1ae950c0a279d7

    SHA256

    f61efe54fea640621815b76d23e2d1b562b9fb558532388d455a0bae8d31dd89

    SHA512

    b7054ede3f8cb5d57b141e23217f277b41510c3c0f35d64aebbcc6ecfd194525e13610a2f39c813fc542933e7f0d7262d80c452561a3666b91d86cb1c1b17308

  • /data/data/org.telegram.FlyGram/files/tgnet.dat

    Filesize

    912B

    MD5

    841021546368062600318b8a6a66ebc7

    SHA1

    a6edcec95bf5d1ed0eaf7befacad84c804af643a

    SHA256

    354051236839618a79b234b253b5aac13321b11810764141dcb673dd3fe13a8c

    SHA512

    0e0716d02cb6c1f36576d63552e0ed773a2fb7f810562fce3cefc1bc0f67c0db5948cce8ceb709419f2e03d6689d5dcb45f4902c7c24d0163ac0f17e24dad07d

  • /storage/emulated/0/Android/data/org.telegram.FlyGram/cache/000000000_999999_temp.f

    Filesize

    1024B

    MD5

    0f343b0931126a20f133d67c2b018a3b

    SHA1

    60cacbf3d72e1e7834203da608037b1bf83b40e8

    SHA256

    5f70bf18a086007016e948b04aed3b82103a36bea41755b6cddfaf10ace3c6ef

    SHA512

    8efb4f73c5655351c444eb109230c556d39e2c7624e9c11abc9e3fb4b9b9254218cc5085b454a9698d085cfa92198491f07a723be4574adc70617b73eb0b6461