Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Resubmissions

29/05/2024, 07:44

240529-jk595sfd9x 10

20/05/2024, 06:02

240520-grv2msfc7v 10

27/10/2023, 07:30

231027-jb7fvaef28 10

General

  • Target

    signal.apk

  • Size

    79.1MB

  • Sample

    240529-jk595sfd9x

  • MD5

    76351b5e3b9487b0b39759dbfea5f0c9

  • SHA1

    19e5cf2e8eed73ee614b668bc1dbdda01e058c0c

  • SHA256

    549d726fe2b775cfdd1304c2d689dfd779731336a3143225dc3c095440f69ed0

  • SHA512

    0f858b36e47012737de9ca88399a4f95740f6ffc3639b5134aa418ccee441af905f1e503775fb741cd3def7931db18b517a8b2f07c4f0576f8f79ff9fb3f3fa7

  • SSDEEP

    1572864:U/u4rrAgdZh87ZlyFLSnI8LcejgNtwQYpxtIwTJSzslunYuTAO:UOIeZBI8LHUUxlT4YlSjTb

Malware Config

Extracted

Family

badbazaar

C2

https://signalplus.org:4332/api/

https://signalplus.org:4332/api/QRCode?imei=

Targets

    • Target

      signal.apk

    • Size

      79.1MB

    • MD5

      76351b5e3b9487b0b39759dbfea5f0c9

    • SHA1

      19e5cf2e8eed73ee614b668bc1dbdda01e058c0c

    • SHA256

      549d726fe2b775cfdd1304c2d689dfd779731336a3143225dc3c095440f69ed0

    • SHA512

      0f858b36e47012737de9ca88399a4f95740f6ffc3639b5134aa418ccee441af905f1e503775fb741cd3def7931db18b517a8b2f07c4f0576f8f79ff9fb3f3fa7

    • SSDEEP

      1572864:U/u4rrAgdZh87ZlyFLSnI8LcejgNtwQYpxtIwTJSzslunYuTAO:UOIeZBI8LHUUxlT4YlSjTb

    • Loads dropped Dex/Jar

      Runs executable file dropped to the device during analysis.

    • Makes use of the framework's foreground persistence service

      Application may abuse the framework's foreground service to continue running in the foreground.

    • Registers a broadcast receiver at runtime (usually for listening for system events)

    • Acquires the wake lock

    • Checks if the internet connection is available

    • Schedules tasks to execute at a specified time

      Application may abuse the framework's APIs to perform task scheduling for initial or recurring execution of malicious code.

MITRE ATT&CK Mobile v15

Tasks