Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

10

Static

static

6

fe3bd3410a...fc.apk

android-9-x86

10

fe3bd3410a...fc.apk

android-10-x64

7

fe3bd3410a...fc.apk

android-11-x64

10

Analysis

  • max time kernel
    179s
  • max time network
    187s
  • platform
    android_x86
  • resource
    android-x86-arm-20240624-en
  • resource tags

    androidarch:armarch:x86image:android-x86-arm-20240624-enlocale:en-usos:android-9-x86system
  • submitted
    28/07/2024, 22:00 UTC

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    fe3bd3410a14aabdda61db0e8e41ae4fbbc87f2299ce0fae66b6cb6bfc8947fc.apk

  • Size

    2.9MB

  • MD5

    073c66d18320a3fcfa115a0a24ec700d

  • SHA1

    d1e829e1ecbb95ee4c2fa1b1274759d13b76eab4

  • SHA256

    fe3bd3410a14aabdda61db0e8e41ae4fbbc87f2299ce0fae66b6cb6bfc8947fc

  • SHA512

    02dfd34aef6e592b2d7311c89fb8f63c97b4754e9d0c48bc65bf7c95e5c1504242d0fa981f91d5514da91ad528af9a8058bc6d59dbc35eee08ed244ff50bb2d5

  • SSDEEP

    49152:xhkj3wPACt+cyg7biCdeWg4TmT/yUi/yfQg/AS9cXJYVJhRBn:jkLoACJykeroI/ylA25JYV9V

Score
10/10
hookbankercollectioncredential_accessdiscoveryevasionexecutionimpactinfostealerpersistencerattrojan

Malware Config

Extracted

Family

hook

C2

http://45.66.231.11:3434

AES_key
1
3141317a5031655035514765666932444d505466544c35534c6d763744697666

Signatures

Processes

  • com.kakao.talk
    1⤵
    • Makes use of the framework's Accessibility service
    • Queries information about running processes on the device
    • Acquires the wake lock
    • Makes use of the framework's foreground persistence service
    • Queries information about the current Wi-Fi connection
    • Queries the mobile country code (MCC)
    • Registers a broadcast receiver at runtime (usually for listening for system events)
    • Schedules tasks to execute at a specified time
    • Uses Crypto APIs (Might try to encrypt user data)
    • Checks CPU information
    • Checks memory information
    PID:4237

Network

  • flag-us
    DNS
    semanticlocation-pa.googleapis.com
    Remote address:
    1.1.1.1:53
    Request
    semanticlocation-pa.googleapis.com
    IN A
    Response
    semanticlocation-pa.googleapis.com
    IN A
    172.217.16.234
    semanticlocation-pa.googleapis.com
    IN A
    216.58.213.10
    semanticlocation-pa.googleapis.com
    IN A
    172.217.169.74
    semanticlocation-pa.googleapis.com
    IN A
    142.250.200.10
    semanticlocation-pa.googleapis.com
    IN A
    216.58.212.202
    semanticlocation-pa.googleapis.com
    IN A
    216.58.204.74
    semanticlocation-pa.googleapis.com
    IN A
    142.250.180.10
    semanticlocation-pa.googleapis.com
    IN A
    142.250.187.234
    semanticlocation-pa.googleapis.com
    IN A
    142.250.179.234
    semanticlocation-pa.googleapis.com
    IN A
    142.250.187.202
    semanticlocation-pa.googleapis.com
    IN A
    216.58.201.106
    semanticlocation-pa.googleapis.com
    IN A
    172.217.169.10
    semanticlocation-pa.googleapis.com
    IN A
    142.250.178.10
    semanticlocation-pa.googleapis.com
    IN A
    142.250.200.42
    semanticlocation-pa.googleapis.com
    IN A
    172.217.169.42
  • flag-nl
    GET
    http://45.66.231.11:3434/socket.io/?EIO=3&transport=polling
    Remote address:
    45.66.231.11:3434
    Request
    GET /socket.io/?EIO=3&transport=polling HTTP/1.1
    Accept: */*
    Host: 45.66.231.11:3434
    Connection: Keep-Alive
    Accept-Encoding: gzip
    User-Agent: okhttp/3.8.1
    Response
    HTTP/1.1 200 OK
    Access-Control-Allow-Credentials: true
    Access-Control-Allow-Headers: Accept, Authorization, Content-Type, Content-Length, X-CSRF-Token, Token, session, Origin, Host, Connection, Accept-Encoding, Accept-Language, X-Requested-With
    Access-Control-Allow-Methods: POST, OPTIONS, GET, PUT, DELETE
    Access-Control-Allow-Origin: http://45.66.231.11
    Content-Type: application/octet-stream
    Date: Sun, 28 Jul 2024 22:00:25 GMT
    Content-Length: 85
  • flag-nl
    GET
    http://45.66.231.11:3434/socket.io/?EIO=3&transport=polling&sid=7l8
    Remote address:
    45.66.231.11:3434
    Request
    GET /socket.io/?EIO=3&transport=polling&sid=7l8 HTTP/1.1
    Accept: */*
    Host: 45.66.231.11:3434
    Connection: Keep-Alive
    Accept-Encoding: gzip
    User-Agent: okhttp/3.8.1
    Response
    HTTP/1.1 200 OK
    Access-Control-Allow-Credentials: true
    Access-Control-Allow-Headers: Accept, Authorization, Content-Type, Content-Length, X-CSRF-Token, Token, session, Origin, Host, Connection, Accept-Encoding, Accept-Language, X-Requested-With
    Access-Control-Allow-Methods: POST, OPTIONS, GET, PUT, DELETE
    Access-Control-Allow-Origin: http://45.66.231.11
    Content-Type: application/octet-stream
    Date: Sun, 28 Jul 2024 22:00:25 GMT
    Content-Length: 5
  • flag-nl
    POST
    http://45.66.231.11:3434/socket.io/?EIO=3&transport=polling&sid=7l8
    Remote address:
    45.66.231.11:3434
    Request
    POST /socket.io/?EIO=3&transport=polling&sid=7l8 HTTP/1.1
    Accept: */*
    Content-Type: text/plain;charset=UTF-8
    Content-Length: 64
    Host: 45.66.231.11:3434
    Connection: Keep-Alive
    Accept-Encoding: gzip
    User-Agent: okhttp/3.8.1
    Response
    HTTP/1.1 200 OK
    Access-Control-Allow-Credentials: true
    Access-Control-Allow-Headers: Accept, Authorization, Content-Type, Content-Length, X-CSRF-Token, Token, session, Origin, Host, Connection, Accept-Encoding, Accept-Language, X-Requested-With
    Access-Control-Allow-Methods: POST, OPTIONS, GET, PUT, DELETE
    Access-Control-Allow-Origin: http://45.66.231.11
    Date: Sun, 28 Jul 2024 22:00:25 GMT
    Content-Length: 2
    Content-Type: text/plain; charset=utf-8
  • flag-nl
    GET
    http://45.66.231.11:3434/socket.io/?EIO=3&transport=websocket&sid=7l8
    Remote address:
    45.66.231.11:3434
    Request
    GET /socket.io/?EIO=3&transport=websocket&sid=7l8 HTTP/1.1
    Upgrade: websocket
    Connection: Upgrade
    Sec-WebSocket-Key: RxiXu/68Sx1CrHHD6PhKUQ==
    Sec-WebSocket-Version: 13
    Host: 45.66.231.11:3434
    Accept-Encoding: gzip
    User-Agent: okhttp/3.8.1
    Response
    HTTP/1.1 101 Switching Protocols
    Upgrade: websocket
    Connection: Upgrade
    Sec-WebSocket-Accept: j5RB8QQm2tFY5HQdWgQrAcK7Imo=
    Access-Control-Allow-Origin: http://45.66.231.11
    Access-Control-Allow-Credentials: true
    Access-Control-Allow-Methods: POST, OPTIONS, GET, PUT, DELETE
    Access-Control-Allow-Headers: Accept, Authorization, Content-Type, Content-Length, X-CSRF-Token, Token, session, Origin, Host, Connection, Accept-Encoding, Accept-Language, X-Requested-With
  • flag-nl
    GET
    http://45.66.231.11:3434/socket.io/?EIO=3&transport=polling&sid=7l8
    Remote address:
    45.66.231.11:3434
    Request
    GET /socket.io/?EIO=3&transport=polling&sid=7l8 HTTP/1.1
    Accept: */*
    Host: 45.66.231.11:3434
    Connection: Keep-Alive
    Accept-Encoding: gzip
    User-Agent: okhttp/3.8.1
    Response
    HTTP/1.1 200 OK
    Access-Control-Allow-Credentials: true
    Access-Control-Allow-Headers: Accept, Authorization, Content-Type, Content-Length, X-CSRF-Token, Token, session, Origin, Host, Connection, Accept-Encoding, Accept-Language, X-Requested-With
    Access-Control-Allow-Methods: POST, OPTIONS, GET, PUT, DELETE
    Access-Control-Allow-Origin: http://45.66.231.11
    Content-Type: application/octet-stream
    Date: Sun, 28 Jul 2024 22:00:25 GMT
    Content-Length: 4
  • flag-nl
    POST
    http://45.66.231.11:3434/php/rfi2crras6.php/
    Remote address:
    45.66.231.11:3434
    Request
    POST /php/rfi2crras6.php/ HTTP/1.1
    User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/53.0.2785.116 Safari/537.36
    Content-Length: 973
    Content-Type: application/x-www-form-urlencoded
    Host: 45.66.231.11:3434
    Connection: Keep-Alive
    Accept-Encoding: gzip
    Response
    HTTP/1.1 200 OK
    Access-Control-Allow-Credentials: true
    Access-Control-Allow-Headers: Accept, Authorization, Content-Type, Content-Length, X-CSRF-Token, Token, session, Origin, Host, Connection, Accept-Encoding, Accept-Language, X-Requested-With
    Access-Control-Allow-Methods: POST, OPTIONS, GET, PUT, DELETE
    Access-Control-Allow-Origin: http://45.66.231.11
    Content-Type: text/plain; charset=utf-8
    Date: Sun, 28 Jul 2024 22:00:27 GMT
    Content-Length: 24
  • flag-nl
    POST
    http://45.66.231.11:3434/php/jfxw4.php/
    Remote address:
    45.66.231.11:3434
    Request
    POST /php/jfxw4.php/ HTTP/1.1
    User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/53.0.2785.116 Safari/537.36
    Content-Length: 933
    Content-Type: application/x-www-form-urlencoded
    Host: 45.66.231.11:3434
    Connection: Keep-Alive
    Accept-Encoding: gzip
    Response
    HTTP/1.1 200 OK
    Access-Control-Allow-Credentials: true
    Access-Control-Allow-Headers: Accept, Authorization, Content-Type, Content-Length, X-CSRF-Token, Token, session, Origin, Host, Connection, Accept-Encoding, Accept-Language, X-Requested-With
    Access-Control-Allow-Methods: POST, OPTIONS, GET, PUT, DELETE
    Access-Control-Allow-Origin: http://45.66.231.11
    Content-Type: text/plain; charset=utf-8
    Date: Sun, 28 Jul 2024 22:00:30 GMT
    Content-Length: 128
  • flag-nl
    POST
    http://45.66.231.11:3434/php/ei7kxu7e9vutb5i.php/
    Remote address:
    45.66.231.11:3434
    Request
    POST /php/ei7kxu7e9vutb5i.php/ HTTP/1.1
    User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/53.0.2785.116 Safari/537.36
    Content-Length: 175
    Content-Type: application/x-www-form-urlencoded
    Host: 45.66.231.11:3434
    Connection: Keep-Alive
    Accept-Encoding: gzip
    Response
    HTTP/1.1 200 OK
    Access-Control-Allow-Credentials: true
    Access-Control-Allow-Headers: Accept, Authorization, Content-Type, Content-Length, X-CSRF-Token, Token, session, Origin, Host, Connection, Accept-Encoding, Accept-Language, X-Requested-With
    Access-Control-Allow-Methods: POST, OPTIONS, GET, PUT, DELETE
    Access-Control-Allow-Origin: http://45.66.231.11
    Content-Type: text/plain; charset=utf-8
    Date: Sun, 28 Jul 2024 22:00:30 GMT
    Transfer-Encoding: chunked
  • flag-nl
    POST
    http://45.66.231.11:3434/php/vrujty0eozdvhhs.php/
    Remote address:
    45.66.231.11:3434
    Request
    POST /php/vrujty0eozdvhhs.php/ HTTP/1.1
    User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/53.0.2785.116 Safari/537.36
    Content-Length: 90
    Content-Type: application/x-www-form-urlencoded
    Host: 45.66.231.11:3434
    Connection: Keep-Alive
    Accept-Encoding: gzip
    Response
    HTTP/1.1 200 OK
    Access-Control-Allow-Credentials: true
    Access-Control-Allow-Headers: Accept, Authorization, Content-Type, Content-Length, X-CSRF-Token, Token, session, Origin, Host, Connection, Accept-Encoding, Accept-Language, X-Requested-With
    Access-Control-Allow-Methods: POST, OPTIONS, GET, PUT, DELETE
    Access-Control-Allow-Origin: http://45.66.231.11
    Content-Type: text/plain; charset=utf-8
    Date: Sun, 28 Jul 2024 22:00:44 GMT
    Content-Length: 236
  • flag-nl
    POST
    http://45.66.231.11:3434/php/k4few9qsa88xt.php/
    Remote address:
    45.66.231.11:3434
    Request
    POST /php/k4few9qsa88xt.php/ HTTP/1.1
    User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/53.0.2785.116 Safari/537.36
    Content-Length: 90
    Content-Type: application/x-www-form-urlencoded
    Host: 45.66.231.11:3434
    Connection: Keep-Alive
    Accept-Encoding: gzip
    Response
    HTTP/1.1 200 OK
    Access-Control-Allow-Credentials: true
    Access-Control-Allow-Headers: Accept, Authorization, Content-Type, Content-Length, X-CSRF-Token, Token, session, Origin, Host, Connection, Accept-Encoding, Accept-Language, X-Requested-With
    Access-Control-Allow-Methods: POST, OPTIONS, GET, PUT, DELETE
    Access-Control-Allow-Origin: http://45.66.231.11
    Content-Type: text/plain; charset=utf-8
    Date: Sun, 28 Jul 2024 22:00:54 GMT
    Content-Length: 88
  • flag-nl
    POST
    http://45.66.231.11:3434/php/dgo.php/
    Remote address:
    45.66.231.11:3434
    Request
    POST /php/dgo.php/ HTTP/1.1
    User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/53.0.2785.116 Safari/537.36
    Content-Length: 90
    Content-Type: application/x-www-form-urlencoded
    Host: 45.66.231.11:3434
    Connection: Keep-Alive
    Accept-Encoding: gzip
    Response
    HTTP/1.1 200 OK
    Access-Control-Allow-Credentials: true
    Access-Control-Allow-Headers: Accept, Authorization, Content-Type, Content-Length, X-CSRF-Token, Token, session, Origin, Host, Connection, Accept-Encoding, Accept-Language, X-Requested-With
    Access-Control-Allow-Methods: POST, OPTIONS, GET, PUT, DELETE
    Access-Control-Allow-Origin: http://45.66.231.11
    Content-Type: text/plain; charset=utf-8
    Date: Sun, 28 Jul 2024 22:01:05 GMT
    Content-Length: 236
  • flag-nl
    POST
    http://45.66.231.11:3434/php/ig7iqb0101uw3px7fy.php/
    Remote address:
    45.66.231.11:3434
    Request
    POST /php/ig7iqb0101uw3px7fy.php/ HTTP/1.1
    User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/53.0.2785.116 Safari/537.36
    Content-Length: 90
    Content-Type: application/x-www-form-urlencoded
    Host: 45.66.231.11:3434
    Connection: Keep-Alive
    Accept-Encoding: gzip
    Response
    HTTP/1.1 200 OK
    Access-Control-Allow-Credentials: true
    Access-Control-Allow-Headers: Accept, Authorization, Content-Type, Content-Length, X-CSRF-Token, Token, session, Origin, Host, Connection, Accept-Encoding, Accept-Language, X-Requested-With
    Access-Control-Allow-Methods: POST, OPTIONS, GET, PUT, DELETE
    Access-Control-Allow-Origin: http://45.66.231.11
    Content-Type: text/plain; charset=utf-8
    Date: Sun, 28 Jul 2024 22:01:15 GMT
    Content-Length: 88
  • flag-nl
    POST
    http://45.66.231.11:3434/php/ggwsdc8mc.php/
    Remote address:
    45.66.231.11:3434
    Request
    POST /php/ggwsdc8mc.php/ HTTP/1.1
    User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/53.0.2785.116 Safari/537.36
    Content-Length: 90
    Content-Type: application/x-www-form-urlencoded
    Host: 45.66.231.11:3434
    Connection: Keep-Alive
    Accept-Encoding: gzip
    Response
    HTTP/1.1 200 OK
    Access-Control-Allow-Credentials: true
    Access-Control-Allow-Headers: Accept, Authorization, Content-Type, Content-Length, X-CSRF-Token, Token, session, Origin, Host, Connection, Accept-Encoding, Accept-Language, X-Requested-With
    Access-Control-Allow-Methods: POST, OPTIONS, GET, PUT, DELETE
    Access-Control-Allow-Origin: http://45.66.231.11
    Content-Type: text/plain; charset=utf-8
    Date: Sun, 28 Jul 2024 22:01:25 GMT
    Content-Length: 88
  • flag-nl
    POST
    http://45.66.231.11:3434/php/as4w.php/
    Remote address:
    45.66.231.11:3434
    Request
    POST /php/as4w.php/ HTTP/1.1
    User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/53.0.2785.116 Safari/537.36
    Content-Length: 90
    Content-Type: application/x-www-form-urlencoded
    Host: 45.66.231.11:3434
    Connection: Keep-Alive
    Accept-Encoding: gzip
    Response
    HTTP/1.1 200 OK
    Access-Control-Allow-Credentials: true
    Access-Control-Allow-Headers: Accept, Authorization, Content-Type, Content-Length, X-CSRF-Token, Token, session, Origin, Host, Connection, Accept-Encoding, Accept-Language, X-Requested-With
    Access-Control-Allow-Methods: POST, OPTIONS, GET, PUT, DELETE
    Access-Control-Allow-Origin: http://45.66.231.11
    Content-Type: text/plain; charset=utf-8
    Date: Sun, 28 Jul 2024 22:01:35 GMT
    Content-Length: 88
  • flag-nl
    POST
    http://45.66.231.11:3434/php/u3.php/
    Remote address:
    45.66.231.11:3434
    Request
    POST /php/u3.php/ HTTP/1.1
    User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/53.0.2785.116 Safari/537.36
    Content-Length: 90
    Content-Type: application/x-www-form-urlencoded
    Host: 45.66.231.11:3434
    Connection: Keep-Alive
    Accept-Encoding: gzip
    Response
    HTTP/1.1 200 OK
    Access-Control-Allow-Credentials: true
    Access-Control-Allow-Headers: Accept, Authorization, Content-Type, Content-Length, X-CSRF-Token, Token, session, Origin, Host, Connection, Accept-Encoding, Accept-Language, X-Requested-With
    Access-Control-Allow-Methods: POST, OPTIONS, GET, PUT, DELETE
    Access-Control-Allow-Origin: http://45.66.231.11
    Content-Type: text/plain; charset=utf-8
    Date: Sun, 28 Jul 2024 22:01:45 GMT
    Content-Length: 88
  • flag-nl
    POST
    http://45.66.231.11:3434/php/gul29u3ppmzxg0i61bc.php/
    Remote address:
    45.66.231.11:3434
    Request
    POST /php/gul29u3ppmzxg0i61bc.php/ HTTP/1.1
    User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/53.0.2785.116 Safari/537.36
    Content-Length: 90
    Content-Type: application/x-www-form-urlencoded
    Host: 45.66.231.11:3434
    Connection: Keep-Alive
    Accept-Encoding: gzip
    Response
    HTTP/1.1 200 OK
    Access-Control-Allow-Credentials: true
    Access-Control-Allow-Headers: Accept, Authorization, Content-Type, Content-Length, X-CSRF-Token, Token, session, Origin, Host, Connection, Accept-Encoding, Accept-Language, X-Requested-With
    Access-Control-Allow-Methods: POST, OPTIONS, GET, PUT, DELETE
    Access-Control-Allow-Origin: http://45.66.231.11
    Content-Type: text/plain; charset=utf-8
    Date: Sun, 28 Jul 2024 22:01:56 GMT
    Content-Length: 88
  • flag-nl
    POST
    http://45.66.231.11:3434/php/hyvj7fun42v7zk92.php/
    Remote address:
    45.66.231.11:3434
    Request
    POST /php/hyvj7fun42v7zk92.php/ HTTP/1.1
    User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/53.0.2785.116 Safari/537.36
    Content-Length: 90
    Content-Type: application/x-www-form-urlencoded
    Host: 45.66.231.11:3434
    Connection: Keep-Alive
    Accept-Encoding: gzip
    Response
    HTTP/1.1 200 OK
    Access-Control-Allow-Credentials: true
    Access-Control-Allow-Headers: Accept, Authorization, Content-Type, Content-Length, X-CSRF-Token, Token, session, Origin, Host, Connection, Accept-Encoding, Accept-Language, X-Requested-With
    Access-Control-Allow-Methods: POST, OPTIONS, GET, PUT, DELETE
    Access-Control-Allow-Origin: http://45.66.231.11
    Content-Type: text/plain; charset=utf-8
    Date: Sun, 28 Jul 2024 22:02:06 GMT
    Content-Length: 88
  • flag-nl
    POST
    http://45.66.231.11:3434/php/4uvbaej27cp3id5.php/
    Remote address:
    45.66.231.11:3434
    Request
    POST /php/4uvbaej27cp3id5.php/ HTTP/1.1
    User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/53.0.2785.116 Safari/537.36
    Content-Length: 90
    Content-Type: application/x-www-form-urlencoded
    Host: 45.66.231.11:3434
    Connection: Keep-Alive
    Accept-Encoding: gzip
    Response
    HTTP/1.1 200 OK
    Access-Control-Allow-Credentials: true
    Access-Control-Allow-Headers: Accept, Authorization, Content-Type, Content-Length, X-CSRF-Token, Token, session, Origin, Host, Connection, Accept-Encoding, Accept-Language, X-Requested-With
    Access-Control-Allow-Methods: POST, OPTIONS, GET, PUT, DELETE
    Access-Control-Allow-Origin: http://45.66.231.11
    Content-Type: text/plain; charset=utf-8
    Date: Sun, 28 Jul 2024 22:02:16 GMT
    Content-Length: 88
  • flag-nl
    POST
    http://45.66.231.11:3434/php/4vsw7chtnuyjr9sf2e.php/
    Remote address:
    45.66.231.11:3434
    Request
    POST /php/4vsw7chtnuyjr9sf2e.php/ HTTP/1.1
    User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/53.0.2785.116 Safari/537.36
    Content-Length: 90
    Content-Type: application/x-www-form-urlencoded
    Host: 45.66.231.11:3434
    Connection: Keep-Alive
    Accept-Encoding: gzip
    Response
    HTTP/1.1 200 OK
    Access-Control-Allow-Credentials: true
    Access-Control-Allow-Headers: Accept, Authorization, Content-Type, Content-Length, X-CSRF-Token, Token, session, Origin, Host, Connection, Accept-Encoding, Accept-Language, X-Requested-With
    Access-Control-Allow-Methods: POST, OPTIONS, GET, PUT, DELETE
    Access-Control-Allow-Origin: http://45.66.231.11
    Content-Type: text/plain; charset=utf-8
    Date: Sun, 28 Jul 2024 22:02:26 GMT
    Content-Length: 88
  • flag-nl
    POST
    http://45.66.231.11:3434/php/eoxrgtlp4jjxgyw96y.php/
    Remote address:
    45.66.231.11:3434
    Request
    POST /php/eoxrgtlp4jjxgyw96y.php/ HTTP/1.1
    User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/53.0.2785.116 Safari/537.36
    Content-Length: 90
    Content-Type: application/x-www-form-urlencoded
    Host: 45.66.231.11:3434
    Connection: Keep-Alive
    Accept-Encoding: gzip
    Response
    HTTP/1.1 200 OK
    Access-Control-Allow-Credentials: true
    Access-Control-Allow-Headers: Accept, Authorization, Content-Type, Content-Length, X-CSRF-Token, Token, session, Origin, Host, Connection, Accept-Encoding, Accept-Language, X-Requested-With
    Access-Control-Allow-Methods: POST, OPTIONS, GET, PUT, DELETE
    Access-Control-Allow-Origin: http://45.66.231.11
    Content-Type: text/plain; charset=utf-8
    Date: Sun, 28 Jul 2024 22:02:37 GMT
    Content-Length: 88
  • flag-nl
    POST
    http://45.66.231.11:3434/php/w1kcy4bhzbb016fi.php/
    Remote address:
    45.66.231.11:3434
    Request
    POST /php/w1kcy4bhzbb016fi.php/ HTTP/1.1
    User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/53.0.2785.116 Safari/537.36
    Content-Length: 90
    Content-Type: application/x-www-form-urlencoded
    Host: 45.66.231.11:3434
    Connection: Keep-Alive
    Accept-Encoding: gzip
    Response
    HTTP/1.1 200 OK
    Access-Control-Allow-Credentials: true
    Access-Control-Allow-Headers: Accept, Authorization, Content-Type, Content-Length, X-CSRF-Token, Token, session, Origin, Host, Connection, Accept-Encoding, Accept-Language, X-Requested-With
    Access-Control-Allow-Methods: POST, OPTIONS, GET, PUT, DELETE
    Access-Control-Allow-Origin: http://45.66.231.11
    Content-Type: text/plain; charset=utf-8
    Date: Sun, 28 Jul 2024 22:02:47 GMT
    Content-Length: 88
  • flag-nl
    POST
    http://45.66.231.11:3434/php/cq8h1z2.php/
    Remote address:
    45.66.231.11:3434
    Request
    POST /php/cq8h1z2.php/ HTTP/1.1
    User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/53.0.2785.116 Safari/537.36
    Content-Length: 90
    Content-Type: application/x-www-form-urlencoded
    Host: 45.66.231.11:3434
    Connection: Keep-Alive
    Accept-Encoding: gzip
    Response
    HTTP/1.1 200 OK
    Access-Control-Allow-Credentials: true
    Access-Control-Allow-Headers: Accept, Authorization, Content-Type, Content-Length, X-CSRF-Token, Token, session, Origin, Host, Connection, Accept-Encoding, Accept-Language, X-Requested-With
    Access-Control-Allow-Methods: POST, OPTIONS, GET, PUT, DELETE
    Access-Control-Allow-Origin: http://45.66.231.11
    Content-Type: text/plain; charset=utf-8
    Date: Sun, 28 Jul 2024 22:02:57 GMT
    Content-Length: 88
  • flag-nl
    POST
    http://45.66.231.11:3434/php/mxt12eyg.php/
    Remote address:
    45.66.231.11:3434
    Request
    POST /php/mxt12eyg.php/ HTTP/1.1
    User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/53.0.2785.116 Safari/537.36
    Content-Length: 90
    Content-Type: application/x-www-form-urlencoded
    Host: 45.66.231.11:3434
    Connection: Keep-Alive
    Accept-Encoding: gzip
    Response
    HTTP/1.1 200 OK
    Access-Control-Allow-Credentials: true
    Access-Control-Allow-Headers: Accept, Authorization, Content-Type, Content-Length, X-CSRF-Token, Token, session, Origin, Host, Connection, Accept-Encoding, Accept-Language, X-Requested-With
    Access-Control-Allow-Methods: POST, OPTIONS, GET, PUT, DELETE
    Access-Control-Allow-Origin: http://45.66.231.11
    Content-Type: text/plain; charset=utf-8
    Date: Sun, 28 Jul 2024 22:03:07 GMT
    Content-Length: 88
  • flag-nl
    POST
    http://45.66.231.11:3434/php/n83m8fkwb.php/
    Remote address:
    45.66.231.11:3434
    Request
    POST /php/n83m8fkwb.php/ HTTP/1.1
    User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/53.0.2785.116 Safari/537.36
    Content-Length: 90
    Content-Type: application/x-www-form-urlencoded
    Host: 45.66.231.11:3434
    Connection: Keep-Alive
    Accept-Encoding: gzip
    Response
    HTTP/1.1 200 OK
    Access-Control-Allow-Credentials: true
    Access-Control-Allow-Headers: Accept, Authorization, Content-Type, Content-Length, X-CSRF-Token, Token, session, Origin, Host, Connection, Accept-Encoding, Accept-Language, X-Requested-With
    Access-Control-Allow-Methods: POST, OPTIONS, GET, PUT, DELETE
    Access-Control-Allow-Origin: http://45.66.231.11
    Content-Type: text/plain; charset=utf-8
    Date: Sun, 28 Jul 2024 22:03:18 GMT
    Content-Length: 88
  • flag-nl
    POST
    http://45.66.231.11:3434/php/zg9qq6fgqmlw0x.php/
    Remote address:
    45.66.231.11:3434
    Request
    POST /php/zg9qq6fgqmlw0x.php/ HTTP/1.1
    User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/53.0.2785.116 Safari/537.36
    Content-Length: 325
    Content-Type: application/x-www-form-urlencoded
    Host: 45.66.231.11:3434
    Connection: Keep-Alive
    Accept-Encoding: gzip
    Response
    HTTP/1.1 200 OK
    Access-Control-Allow-Credentials: true
    Access-Control-Allow-Headers: Accept, Authorization, Content-Type, Content-Length, X-CSRF-Token, Token, session, Origin, Host, Connection, Accept-Encoding, Accept-Language, X-Requested-With
    Access-Control-Allow-Methods: POST, OPTIONS, GET, PUT, DELETE
    Access-Control-Allow-Origin: http://45.66.231.11
    Content-Type: text/plain; charset=utf-8
    Date: Sun, 28 Jul 2024 22:00:30 GMT
    Content-Length: 24
  • flag-nl
    POST
    http://45.66.231.11:3434/php/u1c37q2vgg28.php/
    Remote address:
    45.66.231.11:3434
    Request
    POST /php/u1c37q2vgg28.php/ HTTP/1.1
    User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/53.0.2785.116 Safari/537.36
    Content-Length: 758
    Content-Type: application/x-www-form-urlencoded
    Host: 45.66.231.11:3434
    Connection: Keep-Alive
    Accept-Encoding: gzip
    Response
    HTTP/1.1 200 OK
    Access-Control-Allow-Credentials: true
    Access-Control-Allow-Headers: Accept, Authorization, Content-Type, Content-Length, X-CSRF-Token, Token, session, Origin, Host, Connection, Accept-Encoding, Accept-Language, X-Requested-With
    Access-Control-Allow-Methods: POST, OPTIONS, GET, PUT, DELETE
    Access-Control-Allow-Origin: http://45.66.231.11
    Content-Type: text/plain; charset=utf-8
    Date: Sun, 28 Jul 2024 22:00:31 GMT
    Content-Length: 24
  • flag-nl
    POST
    http://45.66.231.11:3434/php/q0.php/
    Remote address:
    45.66.231.11:3434
    Request
    POST /php/q0.php/ HTTP/1.1
    User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/53.0.2785.116 Safari/537.36
    Content-Length: 349
    Content-Type: application/x-www-form-urlencoded
    Host: 45.66.231.11:3434
    Connection: Keep-Alive
    Accept-Encoding: gzip
    Response
    HTTP/1.1 200 OK
    Access-Control-Allow-Credentials: true
    Access-Control-Allow-Headers: Accept, Authorization, Content-Type, Content-Length, X-CSRF-Token, Token, session, Origin, Host, Connection, Accept-Encoding, Accept-Language, X-Requested-With
    Access-Control-Allow-Methods: POST, OPTIONS, GET, PUT, DELETE
    Access-Control-Allow-Origin: http://45.66.231.11
    Content-Type: text/plain; charset=utf-8
    Date: Sun, 28 Jul 2024 22:00:31 GMT
    Content-Length: 24
  • flag-us
    DNS
    android.apis.google.com
    Remote address:
    1.1.1.1:53
    Request
    android.apis.google.com
    IN A
    Response
    android.apis.google.com
    IN CNAME
    clients.l.google.com
    clients.l.google.com
    IN A
    172.217.169.78
  • 216.58.204.74:443
    tls, https
    202 B
     40 B
     1
    1
  • 45.66.231.11:3434
    http://45.66.231.11:3434/socket.io/?EIO=3&transport=polling&sid=7l8
    http
    1.6kB
     2.4kB
     18
    17

    HTTP Request

    GET http://45.66.231.11:3434/socket.io/?EIO=3&transport=polling

    HTTP Response

    200

    HTTP Request

    GET http://45.66.231.11:3434/socket.io/?EIO=3&transport=polling&sid=7l8

    HTTP Response

    200

    HTTP Request

    POST http://45.66.231.11:3434/socket.io/?EIO=3&transport=polling&sid=7l8

    HTTP Response

    200
  • 45.66.231.11:3434
    http://45.66.231.11:3434/socket.io/?EIO=3&transport=websocket&sid=7l8
    http
    2.0kB
     1.8kB
     32
    24

    HTTP Request

    GET http://45.66.231.11:3434/socket.io/?EIO=3&transport=websocket&sid=7l8

    HTTP Response

    101
  • 45.66.231.11:3434
    http://45.66.231.11:3434/socket.io/?EIO=3&transport=polling&sid=7l8
    http
    959 B
     1.2kB
     15
    14

    HTTP Request

    GET http://45.66.231.11:3434/socket.io/?EIO=3&transport=polling&sid=7l8

    HTTP Response

    200
  • 45.66.231.11:3434
    http://45.66.231.11:3434/php/n83m8fkwb.php/
    http
    27.7kB
     794.3kB
     344
    563

    HTTP Request

    POST http://45.66.231.11:3434/php/rfi2crras6.php/

    HTTP Response

    200

    HTTP Request

    POST http://45.66.231.11:3434/php/jfxw4.php/

    HTTP Response

    200

    HTTP Request

    POST http://45.66.231.11:3434/php/ei7kxu7e9vutb5i.php/

    HTTP Response

    200

    HTTP Request

    POST http://45.66.231.11:3434/php/vrujty0eozdvhhs.php/

    HTTP Response

    200

    HTTP Request

    POST http://45.66.231.11:3434/php/k4few9qsa88xt.php/

    HTTP Response

    200

    HTTP Request

    POST http://45.66.231.11:3434/php/dgo.php/

    HTTP Response

    200

    HTTP Request

    POST http://45.66.231.11:3434/php/ig7iqb0101uw3px7fy.php/

    HTTP Response

    200

    HTTP Request

    POST http://45.66.231.11:3434/php/ggwsdc8mc.php/

    HTTP Response

    200

    HTTP Request

    POST http://45.66.231.11:3434/php/as4w.php/

    HTTP Response

    200

    HTTP Request

    POST http://45.66.231.11:3434/php/u3.php/

    HTTP Response

    200

    HTTP Request

    POST http://45.66.231.11:3434/php/gul29u3ppmzxg0i61bc.php/

    HTTP Response

    200

    HTTP Request

    POST http://45.66.231.11:3434/php/hyvj7fun42v7zk92.php/

    HTTP Response

    200

    HTTP Request

    POST http://45.66.231.11:3434/php/4uvbaej27cp3id5.php/

    HTTP Response

    200

    HTTP Request

    POST http://45.66.231.11:3434/php/4vsw7chtnuyjr9sf2e.php/

    HTTP Response

    200

    HTTP Request

    POST http://45.66.231.11:3434/php/eoxrgtlp4jjxgyw96y.php/

    HTTP Response

    200

    HTTP Request

    POST http://45.66.231.11:3434/php/w1kcy4bhzbb016fi.php/

    HTTP Response

    200

    HTTP Request

    POST http://45.66.231.11:3434/php/cq8h1z2.php/

    HTTP Response

    200

    HTTP Request

    POST http://45.66.231.11:3434/php/mxt12eyg.php/

    HTTP Response

    200

    HTTP Request

    POST http://45.66.231.11:3434/php/n83m8fkwb.php/

    HTTP Response

    200
  • 45.66.231.11:3434
    http://45.66.231.11:3434/php/q0.php/
    http
    3.3kB
     2.4kB
     19
    18

    HTTP Request

    POST http://45.66.231.11:3434/php/zg9qq6fgqmlw0x.php/

    HTTP Response

    200

    HTTP Request

    POST http://45.66.231.11:3434/php/u1c37q2vgg28.php/

    HTTP Response

    200

    HTTP Request

    POST http://45.66.231.11:3434/php/q0.php/

    HTTP Response

    200
  • 142.250.187.206:443
    tls, https
    858 B
     40 B
     1
    1
  • 172.217.169.78:443
    android.apis.google.com
    tls
    4.7kB
     8.7kB
     14
    23
  • 224.0.0.251:5353
    3.7kB
     11
  • 1.1.1.1:53
    semanticlocation-pa.googleapis.com
    dns
    80 B
     320 B
     1
    1

    DNS Request

    semanticlocation-pa.googleapis.com

    DNS Response

    172.217.16.234
    216.58.213.10
    172.217.169.74
    142.250.200.10
    216.58.212.202
    216.58.204.74
    142.250.180.10
    142.250.187.234
    142.250.179.234
    142.250.187.202
    216.58.201.106
    172.217.169.10
    142.250.178.10
    142.250.200.42
    172.217.169.42

  • 1.1.1.1:53
    android.apis.google.com
    dns
    69 B
     109 B
     1
    1

    DNS Request

    android.apis.google.com

    DNS Response

    172.217.169.78

MITRE ATT&CK Mobile v15

Initial Access

Execution

Scheduled Task/Job

1
T1603

Persistence

Event Triggered Execution

1
T1624

Broadcast Receivers

1
T1624.001

Foreground Persistence

1
T1541

Scheduled Task/Job

1
T1603

Privilege Escalation

Defense Evasion

Foreground Persistence

1
T1541

Input Injection

1
T1516

Virtualization/Sandbox Evasion

2
T1633

System Checks

2
T1633.001

Credential Access

Input Capture

2
T1417

GUI Input Capture

1
T1417.002

Keylogging

1
T1417.001

Discovery

Process Discovery

1
T1424

Software Discovery

1
T1418

Security Software Discovery

1
T1418.001

System Information Discovery

2
T1426

System Network Configuration Discovery

3
T1422

System Network Connections Discovery

1
T1421

Lateral Movement

Collection

Input Capture

2
T1417

GUI Input Capture

1
T1417.002

Keylogging

1
T1417.001

Screen Capture

1
T1513

Command and Control

Exfiltration

Impact

Data Encrypted for Impact

1
T1471

Input Injection

1
T1516

Replay Monitor

Loading Replay Monitor...

Downloads

  • /data/data/com.kakao.talk/no_backup/androidx.work.workdb
    Filesize

    4KB

    MD5

    f2b4b0190b9f384ca885f0c8c9b14700

    SHA1

    934ff2646757b5b6e7f20f6a0aa76c7f995d9361

    SHA256

    0a8ffb6b327963558716e87db8946016d143e39f895fa1b43e95ba7032ce2514

    SHA512

    ec12685fc0d60526eed4d38820aad95611f3e93ae372be5a57142d8e8a1ba17e6e5dfe381a4e1365dddc0b363c9c40daaffdc1245bd515fddac69bf1abacd7f1

    Download Submit

  • /data/data/com.kakao.talk/no_backup/androidx.work.workdb-journal
    Filesize

    512B

    MD5

    8a76ef7827b43ec3c2206b0625319f47

    SHA1

    9650e4b0510b8375a75e3830037b3290a198a60d

    SHA256

    2676bb3e796d05b09c3cd802eb6af5ba8206412c045211814bc0a05d8f35bc0c

    SHA512

    7e26f45a16965f1aac851e95a6f32e6a4846ee14b78e467b5b0d868205562a5c67ff3e1f250b0e3e6c6d00e3b331572fefc71b75416e235dcd20f62e8d8e2887

    Download Submit

  • /data/data/com.kakao.talk/no_backup/androidx.work.workdb-shm
    Filesize

    32KB

    MD5

    bb7df04e1b0a2570657527a7e108ae23

    SHA1

    5188431849b4613152fd7bdba6a3ff0a4fd6424b

    SHA256

    c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479

    SHA512

    768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012

    Download Submit

  • /data/data/com.kakao.talk/no_backup/androidx.work.workdb-wal
    Filesize

    16KB

    MD5

    081d80c69a8cb81cea56683492c0211d

    SHA1

    6136140ed436a9ea8bd4b9b383a2ce97a35419e1

    SHA256

    0113ad30faaccc255005c19dce30eaff2b413986d56cdebe04216bb57ac7fda7

    SHA512

    47e1f650071ea7b88caf62628d5fb30c0758bf0c4968d678081a2e325a7b4e085fc34e1584371147b911dc6a39262ac8aa82302b75936973237701b27e380ffb

    Download Submit

  • /data/data/com.kakao.talk/no_backup/androidx.work.workdb-wal
    Filesize

    108KB

    MD5

    2f7440b38b9a825b126be0f163d1088c

    SHA1

    a1fe45a5c9267d898c1cc852eb50405cce2d2aec

    SHA256

    ef42830aca64cadc85b6bcb0b0e003ec957d1a319a16b9cf996fb9524e3799b2

    SHA512

    fec1c602d2eac473f81d7782fe313251d13f387463bac617a4d781a2f462a7ea30ebfab41682b1d254daa07cce5621c5fdef9fbb05a554f7b36f1f5c1301579c

    Download Submit

  • /data/data/com.kakao.talk/no_backup/androidx.work.workdb-wal
    Filesize

    173KB

    MD5

    54924e3355d7313c5ea79890881ebf79

    SHA1

    f079fe2f9b771b4f469e28292bc91558dece0e45

    SHA256

    4b07b60530dac45f657d4d7f068676840fc21c30d8dff4c744a6ad3fd592a5ad

    SHA512

    003d68ad6f51573e7d26c8e544db439c368bbc74fd972dce15a0db84f21022a692458a6d18bae1c796b902e2d7e2ac4d7515ae51df8a218702717ffb7e7559ea

    Download Submit

We care about your privacy.

This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.