Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    47s
  • max time network
    132s
  • platform
    android_x86
  • resource
    android-x86-arm-20240624-en
  • resource tags

    androidarch:armarch:x86image:android-x86-arm-20240624-enlocale:en-usos:android-9-x86system
  • submitted
    01/08/2024, 22:09

General

  • Target

    c3256b91234624addc8b6ffe089ebe1b45b839e1d772abcf62cace376f473ba7.apk

  • Size

    2.5MB

  • MD5

    5a3ed72e1ad54c1f38ea48812472b649

  • SHA1

    1fc3e73f876887dbc235d1564a8122023d55b386

  • SHA256

    c3256b91234624addc8b6ffe089ebe1b45b839e1d772abcf62cace376f473ba7

  • SHA512

    a4a293dd39b72d2f2c25a52df158da0549f6a1c2175f9b2850b7a54f24ddf7fc093cdde4a7b117f5b4c83ba5e0afa6f2c3515eaaed4bb9708c3fa93b5bf7fbf8

  • SSDEEP

    49152:Pvyj76X6+Glm+nJVxAfWgLs/H7naTgjucPq8lwrRTpT/heBDDg1OOzkI+Wjy3rZF:YP+G0+JLsLs/uUjuMwl5UlDKkI+Wu3v

Malware Config

Signatures

  • Removes its main activity from the application launcher 1 TTPs 1 IoCs
  • Makes use of the framework's Accessibility service 4 TTPs 3 IoCs

    Retrieves information displayed on the phone screen using AccessibilityService.

  • Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
  • Acquires the wake lock 1 IoCs
  • Queries information about active data network 1 TTPs 1 IoCs
  • Queries the mobile country code (MCC) 1 TTPs 1 IoCs
  • Requests enabling of the accessibility settings. 1 IoCs
  • Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs
  • Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs
  • Checks memory information 2 TTPs 1 IoCs

Processes

  • jnlqpxmc.vmvsdm.dakdnau
    1⤵
    • Removes its main activity from the application launcher
    • Makes use of the framework's Accessibility service
    • Acquires the wake lock
    • Queries information about active data network
    • Queries the mobile country code (MCC)
    • Requests enabling of the accessibility settings.
    • Registers a broadcast receiver at runtime (usually for listening for system events)
    • Uses Crypto APIs (Might try to encrypt user data)
    • Checks memory information
    PID:4244
  • .tt
    1⤵
      PID:4350

    Network

    MITRE ATT&CK Mobile v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • /data/data/jnlqpxmc.vmvsdm.dakdnau/databases/google_app_measurement.db

      Filesize

      4KB

      MD5

      f2b4b0190b9f384ca885f0c8c9b14700

      SHA1

      934ff2646757b5b6e7f20f6a0aa76c7f995d9361

      SHA256

      0a8ffb6b327963558716e87db8946016d143e39f895fa1b43e95ba7032ce2514

      SHA512

      ec12685fc0d60526eed4d38820aad95611f3e93ae372be5a57142d8e8a1ba17e6e5dfe381a4e1365dddc0b363c9c40daaffdc1245bd515fddac69bf1abacd7f1

    • /data/data/jnlqpxmc.vmvsdm.dakdnau/databases/google_app_measurement.db-journal

      Filesize

      512B

      MD5

      106d659b306d9c439f61f52ff0cc2801

      SHA1

      0f9d9b88e638b1b53c3f51ae4e334aaa62488026

      SHA256

      9d8ddf1fef23d065138b76046484b041cd9668bd94e39189fbab2f725bfd2ff2

      SHA512

      0d4e14e1ea608671bf4e485fdb4d38d6953df0c488cf72c3eb30b448dc1b3ebe26cc8a66d5d5b1ee5055a792ce977e0eb3b7add234ccd56cf73a25d7fecd437a

    • /data/data/jnlqpxmc.vmvsdm.dakdnau/databases/google_app_measurement.db-shm

      Filesize

      32KB

      MD5

      bb7df04e1b0a2570657527a7e108ae23

      SHA1

      5188431849b4613152fd7bdba6a3ff0a4fd6424b

      SHA256

      c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479

      SHA512

      768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012

    • /data/data/jnlqpxmc.vmvsdm.dakdnau/databases/google_app_measurement.db-wal

      Filesize

      342KB

      MD5

      0b679fe726aa360f3e0496689b0ae4da

      SHA1

      b4860c995ba970152389d69bb0a00a4f55e21846

      SHA256

      df606d3e315d6ed792952905705d0ed4117097072f621f780673066ad1209f35

      SHA512

      9f08b903e13bb2aff2826a5f9d71245c0d279833042f78e3bc402a072724d9a94d6af9b03a7e20afab3e4686f36d14f9892932afc249a83c67ff1c6f7804253c

    • /data/data/jnlqpxmc.vmvsdm.dakdnau/no_backup/com.google.InstanceId.properties

      Filesize

      2KB

      MD5

      31a9391e211ed32e1f3ee6c762480a2e

      SHA1

      303355046cef1e1c8197d94efac59a823164ad5c

      SHA256

      fa50dc3676eb60e629a3c8b536572052f70a720ccf41b79b518a9ba08fc70402

      SHA512

      66a27fe1b5221f6d9741e8651a0774786ae88a8a29de2ee0715649d44ab7edeca910fcd0f6422792d68e64b89454ab6a857e8f552a7d86f4bc5c93e3424ead42