Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    179s
  • max time network
    172s
  • platform
    android_x64
  • resource
    android-33-x64-arm64-20240514-en
  • resource tags

    androidarch:arm64arch:x64image:android-33-x64-arm64-20240514-enlocale:en-usos:android-13-x64system
  • submitted
    30/05/2024, 23:14

General

  • Target

    0d8c39f587f98a405c7dbb02f6a46dc856ad4b24ff385c478de89c39e4ea76ec.apk

  • Size

    278KB

  • MD5

    3c97d7099516a6f62179c0d775c1eefd

  • SHA1

    d26e69c50a68010d092c8d620bee184fbc183450

  • SHA256

    0d8c39f587f98a405c7dbb02f6a46dc856ad4b24ff385c478de89c39e4ea76ec

  • SHA512

    2985419f0d4377d90a4a71aec0fb3e03a944ddaca5dcb38ab7c121e32cab525e41dcb96ec352bcc349c5bd98782db46d6af4ef5b3361a60c839a7be728087cbf

  • SSDEEP

    6144:sQvSjB6WhOxaPtVfoVj2WqW5TKpC6y6DSent7gtpS85N5rNk6:xvSjJqkojJY4yDp7g7SQhNk6

Malware Config

Extracted

Family

xloader_apk

C2

http://91.204.227.39:28844

DES_key

Signatures

Processes

  • xf.aotog.mtrwm.irw
    1⤵
    • Checks if the Android device is rooted.
    • Loads dropped Dex/Jar
    • Makes use of the framework's foreground persistence service
    • Queries account information for other applications stored on the device
    • Reads the contacts stored on the device.
    • Reads the content of the MMS message.
    • Acquires the wake lock
    • Checks if the internet connection is available
    • Requests disabling of battery optimizations (often used to enable hiding in the background).
    • Uses Crypto APIs (Might try to encrypt user data)
    PID:4297

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • /data/user/0/xf.aotog.mtrwm.irw/files/b

    Filesize

    492KB

    MD5

    7e1b639338295aaf9149d4d5cc496ed6

    SHA1

    d89b93d56bf924551e6b421234179fd4fec859f9

    SHA256

    02fcb596708bde924cdf258495deeb6cdb5a8016d01eff81f1b3ae449c2465fa

    SHA512

    699ae0b027bce12865a1db5890ab38f79b22fa4b64e4739316e50e0f73e0c399ab2d4a2bc939b66b53796b821326e66822ef9102c3bce9b8e3854cabb1fa356f

  • /storage/emulated/0/.msg_device_id.txt

    Filesize

    36B

    MD5

    44f099f5f703ab2318b2da62a25ee933

    SHA1

    29749abf263de0f980e74fd94ed6a3e06f6f7530

    SHA256

    240b5f2a2fd14eadde1bc57523cc37c18361bdd382cd2edcac83be1923c9b0e2

    SHA512

    2f0b2ab2426fd65adb16855a51633db26d2545550e610e102d8aacd206023a67ea78128cefdad15133bcebe41781c9783662c61bc851cfa60bd12a634d58e594