Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    17s
  • max time network
    151s
  • platform
    android_x86
  • resource
    android-x86-arm-20240611.1-en
  • resource tags

    androidarch:armarch:x86image:android-x86-arm-20240611.1-enlocale:en-usos:android-9-x86system
  • submitted
    12/06/2024, 17:34

General

  • Target

    a74506146b9c968783d314e60524997abcb1c76e347c58915017e866174a5dc3.apk

  • Size

    313KB

  • MD5

    e7cde44adda03033355e643e49c96a4e

  • SHA1

    cdefd6f93ba066b9502f2e9da93df2920a591d98

  • SHA256

    a74506146b9c968783d314e60524997abcb1c76e347c58915017e866174a5dc3

  • SHA512

    2b342fe971cb6a3993442d75c228690ec94fb1d5d21e43f15d1485c70469e3ed1092b57f6740ea1590989d1041fe3aac8f93fa9bafd3b694500f10da3bb8e414

  • SSDEEP

    6144:UK9Od3h9BmKM+g59kAVScHIQN6bvpnpIWWC+222Jbm+DMkG7Q7qqdylVW5sFGc1D:UKsB2+i95MnJpRzbmIG7QX2H/x8B2

Score
7/10

Malware Config

Signatures

  • Loads dropped Dex/Jar 1 TTPs 24 IoCs

    Runs executable file dropped to the device during analysis.

  • Queries the phone number (MSISDN for GSM devices) 1 TTPs
  • Requests disabling of battery optimizations (often used to enable hiding in the background). 1 TTPs 1 IoCs

Processes

  • com.dsbchhtzgejfuiw21hjcgnv.security
    1⤵
    • Loads dropped Dex/Jar
    • Requests disabling of battery optimizations (often used to enable hiding in the background).
    PID:4277
    • /system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.dsbchhtzgejfuiw21hjcgnv.security/app_n8df.jug.e50x.ohy/obfs/0.obfedex --output-vdex-fd=42 --oat-fd=43 --oat-location=/data/user/0/com.dsbchhtzgejfuiw21hjcgnv.security/app_n8df.jug.e50x.ohy/obfs/oat/x86/0.odex --compiler-filter=quicken --class-loader-context=&
      2⤵
      • Loads dropped Dex/Jar
      PID:4302
    • /system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.dsbchhtzgejfuiw21hjcgnv.security/app_n8df.jug.e50x.ohy/obfs/1.obfedex --output-vdex-fd=42 --oat-fd=43 --oat-location=/data/user/0/com.dsbchhtzgejfuiw21hjcgnv.security/app_n8df.jug.e50x.ohy/obfs/oat/x86/1.odex --compiler-filter=quicken --class-loader-context=&
      2⤵
      • Loads dropped Dex/Jar
      PID:4326
    • /system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.dsbchhtzgejfuiw21hjcgnv.security/app_n8df.jug.e50x.ohy/obfs/2.obfedex --output-vdex-fd=42 --oat-fd=43 --oat-location=/data/user/0/com.dsbchhtzgejfuiw21hjcgnv.security/app_n8df.jug.e50x.ohy/obfs/oat/x86/2.odex --compiler-filter=quicken --class-loader-context=&
      2⤵
      • Loads dropped Dex/Jar
      PID:4352
    • /system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.dsbchhtzgejfuiw21hjcgnv.security/app_n8df.jug.e50x.ohy/obfs/3.obfedex --output-vdex-fd=43 --oat-fd=45 --oat-location=/data/user/0/com.dsbchhtzgejfuiw21hjcgnv.security/app_n8df.jug.e50x.ohy/obfs/oat/x86/3.odex --compiler-filter=quicken --class-loader-context=&
      2⤵
      • Loads dropped Dex/Jar
      PID:4376
    • /system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.dsbchhtzgejfuiw21hjcgnv.security/app_n8df.jug.e50x.ohy/obfs/4.obfedex --output-vdex-fd=43 --oat-fd=44 --oat-location=/data/user/0/com.dsbchhtzgejfuiw21hjcgnv.security/app_n8df.jug.e50x.ohy/obfs/oat/x86/4.odex --compiler-filter=quicken --class-loader-context=&
      2⤵
      • Loads dropped Dex/Jar
      PID:4401
    • /system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.dsbchhtzgejfuiw21hjcgnv.security/app_n8df.jug.e50x.ohy/obfs/5.obfedex --output-vdex-fd=43 --oat-fd=44 --oat-location=/data/user/0/com.dsbchhtzgejfuiw21hjcgnv.security/app_n8df.jug.e50x.ohy/obfs/oat/x86/5.odex --compiler-filter=quicken --class-loader-context=&
      2⤵
      • Loads dropped Dex/Jar
      PID:4424
    • /system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.dsbchhtzgejfuiw21hjcgnv.security/app_n8df.jug.e50x.ohy/obfs/6.obfedex --output-vdex-fd=43 --oat-fd=44 --oat-location=/data/user/0/com.dsbchhtzgejfuiw21hjcgnv.security/app_n8df.jug.e50x.ohy/obfs/oat/x86/6.odex --compiler-filter=quicken --class-loader-context=&
      2⤵
      • Loads dropped Dex/Jar
      PID:4448
    • /system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.dsbchhtzgejfuiw21hjcgnv.security/app_n8df.jug.e50x.ohy/obfs/7.obfedex --output-vdex-fd=43 --oat-fd=44 --oat-location=/data/user/0/com.dsbchhtzgejfuiw21hjcgnv.security/app_n8df.jug.e50x.ohy/obfs/oat/x86/7.odex --compiler-filter=quicken --class-loader-context=&
      2⤵
      • Loads dropped Dex/Jar
      PID:4478

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • /data/data/com.dsbchhtzgejfuiw21hjcgnv.security/app_n8df.jug.e50x.ohy/obfs/0.obfedex

    Filesize

    51KB

    MD5

    37ed8fe121d758c8bfa03117e39070c1

    SHA1

    147555d7ec636aa64db62f06a85073250ad15e38

    SHA256

    30824ef717f1164a1efaff728b78ddc9d762248431f2a416b5279cd1926c83a3

    SHA512

    00d71b482c9fc18790e721d82343f6f3b4be6ba1747370cf1792de1fca3e480326dca8a34fa08071753bc2bc773c3aa024905913bdbdc297e3eceed9ab9a8832

  • /data/data/com.dsbchhtzgejfuiw21hjcgnv.security/app_n8df.jug.e50x.ohy/obfs/1.obfedex

    Filesize

    59KB

    MD5

    489286850c87593aad4ef891ec96c6f3

    SHA1

    8fa2b34018eb015fb5dd7ae34b26d00d74dc0eba

    SHA256

    b75c668bf5453d3c3ea5944672e9a24ae4634a04c0a3a2dcbc16c77ab36bc1b6

    SHA512

    25f22eff4ba1aa4e64d7fc0d94f1e9d456ec78c8f52cd286d9fa080f291db44563abcf09f5eadf2f32cb844ec462f2afff63b2708dc61b9c90eeb6a44f410273

  • /data/data/com.dsbchhtzgejfuiw21hjcgnv.security/app_n8df.jug.e50x.ohy/obfs/2.obfedex

    Filesize

    19KB

    MD5

    e635a738ebd639cede5c0412078ad117

    SHA1

    1fe6b8ea06c7db6797127d9b65dd80548dc436b2

    SHA256

    2b31e9ba14ac9b8eb87c99ae2a55820df6c3a73e9986fd18cdec1208a5144c20

    SHA512

    a4dbdfe338bfc759861837d0fc09728ce71feb8050e7e5c7416d7585f5195099547056750bed465b07c724b34201d3572f76e7c6c57cb4c3f79c78f38fb00f15

  • /data/data/com.dsbchhtzgejfuiw21hjcgnv.security/app_n8df.jug.e50x.ohy/obfs/3.obfedex

    Filesize

    16KB

    MD5

    75efbdea154bff2b6d11b9c9a93f6b5a

    SHA1

    2d01f780b859d91d6507e567aa03bec599e33bef

    SHA256

    5f6bf9aa513ef12fa7e96a98a5a2591b16c57559e61f3ad98c52d1647f842287

    SHA512

    28596ef946c873072b1ab8d0836b7c6cc81d952e8fe5aa94cd543d95d8c966649cfff5f58181a97c727269bdebf722311e8202cdaca5861305cc4d7736063461

  • /data/data/com.dsbchhtzgejfuiw21hjcgnv.security/app_n8df.jug.e50x.ohy/obfs/4.obfedex

    Filesize

    5KB

    MD5

    f5721f94e4e30971ced04f3f5f2cdeab

    SHA1

    07d927f59476eef2980b497476bc52b22af3afb7

    SHA256

    00f87b8000da1eb61905ede7fc1fcedb93f35bd4d72779da2272fc98617d1e13

    SHA512

    b283681f17088f7463f0255f394b2172ab08cfb25a6fbf492b9bd299523d4a0341b2d28a9b1d1495a2ee818bc1a3e26c30958400ca73447bc93c9b6014388a44

  • /data/data/com.dsbchhtzgejfuiw21hjcgnv.security/app_n8df.jug.e50x.ohy/obfs/5.obfedex

    Filesize

    9KB

    MD5

    3c265e17c023df16c250f75b0605fc01

    SHA1

    5ca200531673520d9e30c2bcd93d87720eaf12d0

    SHA256

    377a022838e9b46b661d3caa7f39d105081be6d47605e976b0050a19460d4341

    SHA512

    c38c411dd0f48055b8aadfc2db47792f6f29c854286169563019147c02723d19dc42f6b7bfbf41ab63179ce629198da1f956f2e78af95c980aaaab930812df0b

  • /data/data/com.dsbchhtzgejfuiw21hjcgnv.security/app_n8df.jug.e50x.ohy/obfs/6.obfedex

    Filesize

    4KB

    MD5

    d942556b6c563a25a774f1e64f623803

    SHA1

    fed3170dd5cbfef7317eb0492722629d0ff10c36

    SHA256

    f156f98a12ed9784508afcb5cde2129caac3d0c57fca059e14d98aff4450eb9b

    SHA512

    549330d91a585328de10ab4e42a0a2260c59eb913bf2115e055aca3f8630c475b513dc9593d4bf0307b4a6742a18064fbd24fa7c928b8df7c07bb93ccd351644

  • /data/data/com.dsbchhtzgejfuiw21hjcgnv.security/app_n8df.jug.e50x.ohy/obfs/7.obfedex

    Filesize

    8KB

    MD5

    a6985bd8f9bee57d72449b59bd33e48b

    SHA1

    3fa892c358287c105f8a39e08498bc2b15ca2b0c

    SHA256

    1345d847c546fe0c257a2c6c3a964ef6dbd1d369be77ee91aeb1db1082e98d9a

    SHA512

    48fc1c08dadcd66abb43995a1c2b3ff808c833e18cc3c7706e58aac9552cfd9951331f5cb6c8b646ad6627291175530d887c04d5994dc4fcdc6199096a90ac6a

  • /data/user/0/com.dsbchhtzgejfuiw21hjcgnv.security/app_n8df.jug.e50x.ohy/obfs/0.obfedex

    Filesize

    51KB

    MD5

    d77ed4e7e39e9b8ca93fae36a4e10cc1

    SHA1

    98bb25dd677b1122a675baf6823013c8d320b51a

    SHA256

    77f7d5b0a4823d644f1627b69102a48aca0d91aebda5d557d7d7c180fed054ca

    SHA512

    0e926a6135049b16c43878584457c21e67b53961bf805ce26a3d37adbc180f659b07b757044b7b25c983f0b70511b04466173dc0b73e7d1d771afafc4def3555

  • /data/user/0/com.dsbchhtzgejfuiw21hjcgnv.security/app_n8df.jug.e50x.ohy/obfs/1.obfedex

    Filesize

    59KB

    MD5

    0179f132f7507c48cf929edffdceb01a

    SHA1

    3b3f58ba2423fc5156eb2a7b4fc332243dc08500

    SHA256

    b80962739594d603da550de080a1ecd2bf374b07eceb6270b1e4d4a840c49286

    SHA512

    49c9f29def5f194454ff44033aa5bd765865c71a1158ff1b0dc8434e7fa7a505d54f09efa635cbaa0e797f98efb1d044bf7604c16a79e1b9c7e98bec343d696e

  • /data/user/0/com.dsbchhtzgejfuiw21hjcgnv.security/app_n8df.jug.e50x.ohy/obfs/2.obfedex

    Filesize

    19KB

    MD5

    5a3c4ae4cdd3c2081a6c6b5a6b6b516b

    SHA1

    d6c234038b103663f348f397b42e4d27960ba962

    SHA256

    c1444392c64df9c83e14d48d3342abce966b830a2d250b2ace1b760cf14413ff

    SHA512

    d45b414ea90769eef8818a3b25e8abc0ba3d5dc452011624ab9bf35bfc271fc23b239101c36910fe0366bf5a8abdbe49cd52022eb8181645d3404a071ebd3af4

  • /data/user/0/com.dsbchhtzgejfuiw21hjcgnv.security/app_n8df.jug.e50x.ohy/obfs/3.obfedex

    Filesize

    16KB

    MD5

    21dc206180fb70859e15eb7a0c1dc71b

    SHA1

    8c5097bf173d31f3647717eb7ab20b8f36225b4e

    SHA256

    28ed7eb07423a8a0268538fa92cf0fff74f85bc0389a0cda8c66243d76620d3c

    SHA512

    8778aaac2d6118ce118ef1e2512a356923ff5590ff5918bab87c49f6ed68f0c19ced66daa26d17063573a7988c69e0f0f8bd0117991b95a231d837b6c6979542

  • /data/user/0/com.dsbchhtzgejfuiw21hjcgnv.security/app_n8df.jug.e50x.ohy/obfs/4.obfedex

    Filesize

    5KB

    MD5

    05d28efabd7bdc8cee1e0d3888f82e21

    SHA1

    7bf7fe4da5ebb5c60101b91a03ec693f626b469a

    SHA256

    f9de77ac796f9e29722849c79ed16fbba578981b73c3d5b573a83c66635e14e0

    SHA512

    8921a578ae39ba1f2e4abe6a499da90e14eee10b135699852b6d10f02593247376d0c363fe5ade5c1d3d88f78e8d41dd66b52441c374ec2b808bf51f7edf5021

  • /data/user/0/com.dsbchhtzgejfuiw21hjcgnv.security/app_n8df.jug.e50x.ohy/obfs/5.obfedex

    Filesize

    9KB

    MD5

    6e16485cde191927bd5f95e7ff96227f

    SHA1

    c7e0f17ebf30f5e14ebb21e4e9904829cacb6ee6

    SHA256

    4fe43cbff90c1d32be2c62c5a75d0e167c8139dc9a03fd0be9f596e5e7659656

    SHA512

    e3a3389a9b7ad3f66eefe39053cbac1d78c3ce3e517f5345e8986eb41ac9147487e6c66438e3e05c0e0b3bece018d2b8b22ac1cf59a4029d4b22e13eae7f1b0b

  • /data/user/0/com.dsbchhtzgejfuiw21hjcgnv.security/app_n8df.jug.e50x.ohy/obfs/6.obfedex

    Filesize

    4KB

    MD5

    fb403e4a89138fef63fbf1145b257a8f

    SHA1

    ac2684b11d384bf53bef0db16665e79a70cccb5f

    SHA256

    21721048cf274b6b2e18ce2e01b2bdbde4c1dc49605da38b7f68c30ed6ce61ea

    SHA512

    79951c80e69627b834232621933aa1e0d938313f9c8dc3b5e057f76fef69a0dd98f489fa5e94462cacac3a3092943aa511a6b4856a22216d53320b86b4ca6d0d

  • /data/user/0/com.dsbchhtzgejfuiw21hjcgnv.security/app_n8df.jug.e50x.ohy/obfs/7.obfedex

    Filesize

    8KB

    MD5

    1107ee119614e486019f0342ca9f3d34

    SHA1

    3afda737d5b3afbf44edeb395f0b0612b0872aec

    SHA256

    01a03066f96ee6fad7b9468b6e4e03f2d13fd5c9aba90ee27ece1142fd4b1abd

    SHA512

    4e4c258b371b686aac78d81463b9c0ee82d8b610b5640f924b5b77868e1814f310aa6df018dd296743908aa1779f051d6814e634367cc0925620b9fdc09f55a1

  • /storage/emulated/0/dsbchhtzgejfuiw21hjcgnv.txt

    Filesize

    2B

    MD5

    6512bd43d9caa6e02c990b0a82652dca

    SHA1

    17ba0791499db908433b80f37c5fbc89b870084b

    SHA256

    4fc82b26aecb47d2868c4efbe3581732a3e7cbcc6c2efb32062c08170a05eeb8

    SHA512

    74a49c698dbd3c12e36b0b287447d833f74f3937ff132ebff7054baa18623c35a705bb18b82e2ac0384b5127db97016e63609f712bc90e3506cfbea97599f46f