Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
17s -
max time network
151s -
platform
android_x86 -
resource
android-x86-arm-20240611.1-en -
resource tags
-
submitted
12/06/2024, 17:34 UTC
General
-
Target
a74506146b9c968783d314e60524997abcb1c76e347c58915017e866174a5dc3.apk
-
Size
313KB
-
MD5
e7cde44adda03033355e643e49c96a4e
-
SHA1
cdefd6f93ba066b9502f2e9da93df2920a591d98
-
SHA256
a74506146b9c968783d314e60524997abcb1c76e347c58915017e866174a5dc3
-
SHA512
2b342fe971cb6a3993442d75c228690ec94fb1d5d21e43f15d1485c70469e3ed1092b57f6740ea1590989d1041fe3aac8f93fa9bafd3b694500f10da3bb8e414
-
SSDEEP
6144:UK9Od3h9BmKM+g59kAVScHIQN6bvpnpIWWC+222Jbm+DMkG7Q7qqdylVW5sFGc1D:UKsB2+i95MnJpRzbmIG7QX2H/x8B2
Malware Config
Signatures
-
Loads dropped Dex/Jar 1 TTPs 24 IoCs
Runs executable file dropped to the device during analysis.
-
Queries the phone number (MSISDN for GSM devices) 1 TTPs
-
Requests disabling of battery optimizations (often used to enable hiding in the background). 1 TTPs 1 IoCs
Processes
-
com.dsbchhtzgejfuiw21hjcgnv.security1⤵
- Loads dropped Dex/Jar
- Requests disabling of battery optimizations (often used to enable hiding in the background).
-
/system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.dsbchhtzgejfuiw21hjcgnv.security/app_n8df.jug.e50x.ohy/obfs/0.obfedex --output-vdex-fd=42 --oat-fd=43 --oat-location=/data/user/0/com.dsbchhtzgejfuiw21hjcgnv.security/app_n8df.jug.e50x.ohy/obfs/oat/x86/0.odex --compiler-filter=quicken --class-loader-context=&2⤵
- Loads dropped Dex/Jar
-
-
/system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.dsbchhtzgejfuiw21hjcgnv.security/app_n8df.jug.e50x.ohy/obfs/1.obfedex --output-vdex-fd=42 --oat-fd=43 --oat-location=/data/user/0/com.dsbchhtzgejfuiw21hjcgnv.security/app_n8df.jug.e50x.ohy/obfs/oat/x86/1.odex --compiler-filter=quicken --class-loader-context=&2⤵
- Loads dropped Dex/Jar
-
-
/system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.dsbchhtzgejfuiw21hjcgnv.security/app_n8df.jug.e50x.ohy/obfs/2.obfedex --output-vdex-fd=42 --oat-fd=43 --oat-location=/data/user/0/com.dsbchhtzgejfuiw21hjcgnv.security/app_n8df.jug.e50x.ohy/obfs/oat/x86/2.odex --compiler-filter=quicken --class-loader-context=&2⤵
- Loads dropped Dex/Jar
-
-
/system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.dsbchhtzgejfuiw21hjcgnv.security/app_n8df.jug.e50x.ohy/obfs/3.obfedex --output-vdex-fd=43 --oat-fd=45 --oat-location=/data/user/0/com.dsbchhtzgejfuiw21hjcgnv.security/app_n8df.jug.e50x.ohy/obfs/oat/x86/3.odex --compiler-filter=quicken --class-loader-context=&2⤵
- Loads dropped Dex/Jar
-
-
/system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.dsbchhtzgejfuiw21hjcgnv.security/app_n8df.jug.e50x.ohy/obfs/4.obfedex --output-vdex-fd=43 --oat-fd=44 --oat-location=/data/user/0/com.dsbchhtzgejfuiw21hjcgnv.security/app_n8df.jug.e50x.ohy/obfs/oat/x86/4.odex --compiler-filter=quicken --class-loader-context=&2⤵
- Loads dropped Dex/Jar
-
-
/system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.dsbchhtzgejfuiw21hjcgnv.security/app_n8df.jug.e50x.ohy/obfs/5.obfedex --output-vdex-fd=43 --oat-fd=44 --oat-location=/data/user/0/com.dsbchhtzgejfuiw21hjcgnv.security/app_n8df.jug.e50x.ohy/obfs/oat/x86/5.odex --compiler-filter=quicken --class-loader-context=&2⤵
- Loads dropped Dex/Jar
-
-
/system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.dsbchhtzgejfuiw21hjcgnv.security/app_n8df.jug.e50x.ohy/obfs/6.obfedex --output-vdex-fd=43 --oat-fd=44 --oat-location=/data/user/0/com.dsbchhtzgejfuiw21hjcgnv.security/app_n8df.jug.e50x.ohy/obfs/oat/x86/6.odex --compiler-filter=quicken --class-loader-context=&2⤵
- Loads dropped Dex/Jar
-
-
/system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.dsbchhtzgejfuiw21hjcgnv.security/app_n8df.jug.e50x.ohy/obfs/7.obfedex --output-vdex-fd=43 --oat-fd=44 --oat-location=/data/user/0/com.dsbchhtzgejfuiw21hjcgnv.security/app_n8df.jug.e50x.ohy/obfs/oat/x86/7.odex --compiler-filter=quicken --class-loader-context=&2⤵
- Loads dropped Dex/Jar
-
Network
-
DNSandroid.apis.google.comRemote address:1.1.1.1:53Requestandroid.apis.google.comIN AResponseandroid.apis.google.comIN CNAMEclients.l.google.comclients.l.google.comIN A142.250.187.206
-
172.217.169.74:443 -
142.250.187.238:443tls, https
-
142.250.187.206:443android.apis.google.comtls
-
224.0.0.251:5353 -
1.1.1.1:53android.apis.google.comdns
DNS Request
android.apis.google.com
DNS Response
142.250.187.206
MITRE ATT&CK Mobile v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
51KB
MD537ed8fe121d758c8bfa03117e39070c1
SHA1147555d7ec636aa64db62f06a85073250ad15e38
SHA25630824ef717f1164a1efaff728b78ddc9d762248431f2a416b5279cd1926c83a3
SHA51200d71b482c9fc18790e721d82343f6f3b4be6ba1747370cf1792de1fca3e480326dca8a34fa08071753bc2bc773c3aa024905913bdbdc297e3eceed9ab9a8832
-
Filesize
59KB
MD5489286850c87593aad4ef891ec96c6f3
SHA18fa2b34018eb015fb5dd7ae34b26d00d74dc0eba
SHA256b75c668bf5453d3c3ea5944672e9a24ae4634a04c0a3a2dcbc16c77ab36bc1b6
SHA51225f22eff4ba1aa4e64d7fc0d94f1e9d456ec78c8f52cd286d9fa080f291db44563abcf09f5eadf2f32cb844ec462f2afff63b2708dc61b9c90eeb6a44f410273
-
Filesize
19KB
MD5e635a738ebd639cede5c0412078ad117
SHA11fe6b8ea06c7db6797127d9b65dd80548dc436b2
SHA2562b31e9ba14ac9b8eb87c99ae2a55820df6c3a73e9986fd18cdec1208a5144c20
SHA512a4dbdfe338bfc759861837d0fc09728ce71feb8050e7e5c7416d7585f5195099547056750bed465b07c724b34201d3572f76e7c6c57cb4c3f79c78f38fb00f15
-
Filesize
16KB
MD575efbdea154bff2b6d11b9c9a93f6b5a
SHA12d01f780b859d91d6507e567aa03bec599e33bef
SHA2565f6bf9aa513ef12fa7e96a98a5a2591b16c57559e61f3ad98c52d1647f842287
SHA51228596ef946c873072b1ab8d0836b7c6cc81d952e8fe5aa94cd543d95d8c966649cfff5f58181a97c727269bdebf722311e8202cdaca5861305cc4d7736063461
-
Filesize
5KB
MD5f5721f94e4e30971ced04f3f5f2cdeab
SHA107d927f59476eef2980b497476bc52b22af3afb7
SHA25600f87b8000da1eb61905ede7fc1fcedb93f35bd4d72779da2272fc98617d1e13
SHA512b283681f17088f7463f0255f394b2172ab08cfb25a6fbf492b9bd299523d4a0341b2d28a9b1d1495a2ee818bc1a3e26c30958400ca73447bc93c9b6014388a44
-
Filesize
9KB
MD53c265e17c023df16c250f75b0605fc01
SHA15ca200531673520d9e30c2bcd93d87720eaf12d0
SHA256377a022838e9b46b661d3caa7f39d105081be6d47605e976b0050a19460d4341
SHA512c38c411dd0f48055b8aadfc2db47792f6f29c854286169563019147c02723d19dc42f6b7bfbf41ab63179ce629198da1f956f2e78af95c980aaaab930812df0b
-
Filesize
4KB
MD5d942556b6c563a25a774f1e64f623803
SHA1fed3170dd5cbfef7317eb0492722629d0ff10c36
SHA256f156f98a12ed9784508afcb5cde2129caac3d0c57fca059e14d98aff4450eb9b
SHA512549330d91a585328de10ab4e42a0a2260c59eb913bf2115e055aca3f8630c475b513dc9593d4bf0307b4a6742a18064fbd24fa7c928b8df7c07bb93ccd351644
-
Filesize
8KB
MD5a6985bd8f9bee57d72449b59bd33e48b
SHA13fa892c358287c105f8a39e08498bc2b15ca2b0c
SHA2561345d847c546fe0c257a2c6c3a964ef6dbd1d369be77ee91aeb1db1082e98d9a
SHA51248fc1c08dadcd66abb43995a1c2b3ff808c833e18cc3c7706e58aac9552cfd9951331f5cb6c8b646ad6627291175530d887c04d5994dc4fcdc6199096a90ac6a
-
Filesize
51KB
MD5d77ed4e7e39e9b8ca93fae36a4e10cc1
SHA198bb25dd677b1122a675baf6823013c8d320b51a
SHA25677f7d5b0a4823d644f1627b69102a48aca0d91aebda5d557d7d7c180fed054ca
SHA5120e926a6135049b16c43878584457c21e67b53961bf805ce26a3d37adbc180f659b07b757044b7b25c983f0b70511b04466173dc0b73e7d1d771afafc4def3555
-
Filesize
59KB
MD50179f132f7507c48cf929edffdceb01a
SHA13b3f58ba2423fc5156eb2a7b4fc332243dc08500
SHA256b80962739594d603da550de080a1ecd2bf374b07eceb6270b1e4d4a840c49286
SHA51249c9f29def5f194454ff44033aa5bd765865c71a1158ff1b0dc8434e7fa7a505d54f09efa635cbaa0e797f98efb1d044bf7604c16a79e1b9c7e98bec343d696e
-
Filesize
19KB
MD55a3c4ae4cdd3c2081a6c6b5a6b6b516b
SHA1d6c234038b103663f348f397b42e4d27960ba962
SHA256c1444392c64df9c83e14d48d3342abce966b830a2d250b2ace1b760cf14413ff
SHA512d45b414ea90769eef8818a3b25e8abc0ba3d5dc452011624ab9bf35bfc271fc23b239101c36910fe0366bf5a8abdbe49cd52022eb8181645d3404a071ebd3af4
-
Filesize
16KB
MD521dc206180fb70859e15eb7a0c1dc71b
SHA18c5097bf173d31f3647717eb7ab20b8f36225b4e
SHA25628ed7eb07423a8a0268538fa92cf0fff74f85bc0389a0cda8c66243d76620d3c
SHA5128778aaac2d6118ce118ef1e2512a356923ff5590ff5918bab87c49f6ed68f0c19ced66daa26d17063573a7988c69e0f0f8bd0117991b95a231d837b6c6979542
-
Filesize
5KB
MD505d28efabd7bdc8cee1e0d3888f82e21
SHA17bf7fe4da5ebb5c60101b91a03ec693f626b469a
SHA256f9de77ac796f9e29722849c79ed16fbba578981b73c3d5b573a83c66635e14e0
SHA5128921a578ae39ba1f2e4abe6a499da90e14eee10b135699852b6d10f02593247376d0c363fe5ade5c1d3d88f78e8d41dd66b52441c374ec2b808bf51f7edf5021
-
Filesize
9KB
MD56e16485cde191927bd5f95e7ff96227f
SHA1c7e0f17ebf30f5e14ebb21e4e9904829cacb6ee6
SHA2564fe43cbff90c1d32be2c62c5a75d0e167c8139dc9a03fd0be9f596e5e7659656
SHA512e3a3389a9b7ad3f66eefe39053cbac1d78c3ce3e517f5345e8986eb41ac9147487e6c66438e3e05c0e0b3bece018d2b8b22ac1cf59a4029d4b22e13eae7f1b0b
-
Filesize
4KB
MD5fb403e4a89138fef63fbf1145b257a8f
SHA1ac2684b11d384bf53bef0db16665e79a70cccb5f
SHA25621721048cf274b6b2e18ce2e01b2bdbde4c1dc49605da38b7f68c30ed6ce61ea
SHA51279951c80e69627b834232621933aa1e0d938313f9c8dc3b5e057f76fef69a0dd98f489fa5e94462cacac3a3092943aa511a6b4856a22216d53320b86b4ca6d0d
-
Filesize
8KB
MD51107ee119614e486019f0342ca9f3d34
SHA13afda737d5b3afbf44edeb395f0b0612b0872aec
SHA25601a03066f96ee6fad7b9468b6e4e03f2d13fd5c9aba90ee27ece1142fd4b1abd
SHA5124e4c258b371b686aac78d81463b9c0ee82d8b610b5640f924b5b77868e1814f310aa6df018dd296743908aa1779f051d6814e634367cc0925620b9fdc09f55a1
-
Filesize
2B
MD56512bd43d9caa6e02c990b0a82652dca
SHA117ba0791499db908433b80f37c5fbc89b870084b
SHA2564fc82b26aecb47d2868c4efbe3581732a3e7cbcc6c2efb32062c08170a05eeb8
SHA51274a49c698dbd3c12e36b0b287447d833f74f3937ff132ebff7054baa18623c35a705bb18b82e2ac0384b5127db97016e63609f712bc90e3506cfbea97599f46f