Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    147s
  • max time network
    156s
  • platform
    android_x64
  • resource
    android-x64-arm64-20240624-en
  • resource tags

    androidarch:armarch:arm64arch:x64arch:x86image:android-x64-arm64-20240624-enlocale:en-usos:android-11-x64system
  • submitted
    30/08/2024, 22:02

General

  • Target

    bc4291e2f44ace94341c149435d094a42e958d79974f5c237f61a7a9029aec3e.apk

  • Size

    1.2MB

  • MD5

    c12215a656eca98e7c6e2ef04f65c0fd

  • SHA1

    2b3e33138c1b54adb00ad89ed943686d52dbf0c1

  • SHA256

    bc4291e2f44ace94341c149435d094a42e958d79974f5c237f61a7a9029aec3e

  • SHA512

    4f2372fd7ee96c52ca757f6413fd9cf6e389aaed054069ed039956d7891312ce31b6b74e5dd3af11417055a9de203c600ca2bad4d4f08088493918153361e845

  • SSDEEP

    24576:aJOi8uCMvTqYdsz9Rl/4F1rgfBol9lELD:sHnfIbR4F1rgIfY

Malware Config

Extracted

Family

hook

C2

http://154.216.17.159:3434

AES_key

Signatures

Processes

  • com.cicofudiwiheyi.pekoca
    1⤵
    • Makes use of the framework's Accessibility service
    • Obtains sensitive information copied to the device clipboard
    • Queries information about running processes on the device
    • Acquires the wake lock
    • Makes use of the framework's foreground persistence service
    • Queries information about the current Wi-Fi connection
    • Queries the mobile country code (MCC)
    • Schedules tasks to execute at a specified time
    • Uses Crypto APIs (Might try to encrypt user data)
    • Checks CPU information
    • Checks memory information
    PID:4477

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • /data/user/0/com.cicofudiwiheyi.pekoca/no_backup/androidx.work.workdb

    Filesize

    4KB

    MD5

    7e858c4054eb00fcddc653a04e5cd1c6

    SHA1

    2e056bf31a8d78df136f02a62afeeca77f4faccf

    SHA256

    9010186c5c083155a45673017d1e31c2a178e63cc15a57bbffde4d1956a23dad

    SHA512

    d0c7a120940c8e637d5566ef179d01eff88a2c2650afda69ad2a46aad76533eaace192028bba3d60407b4e34a950e7560f95d9f9b8eebe361ef62897d88b30cb

  • /data/user/0/com.cicofudiwiheyi.pekoca/no_backup/androidx.work.workdb-journal

    Filesize

    512B

    MD5

    ae30c97d3493ffef80174a2713a5240b

    SHA1

    60d642d489750148f17268168476903737dced4f

    SHA256

    87940c2684a198d79607731bb33246317c4fe262d67cfe2d17388d9e86546403

    SHA512

    ae48cbf2aa214b3780939db2cbdb982d2c6084d93f54e15f8d88f4b84c4c3ea0bcf8dc3c5a8de6c818561079ddab1d93f030e9f5e58a88020672e28df4a97e8c

  • /data/user/0/com.cicofudiwiheyi.pekoca/no_backup/androidx.work.workdb-shm

    Filesize

    32KB

    MD5

    bb7df04e1b0a2570657527a7e108ae23

    SHA1

    5188431849b4613152fd7bdba6a3ff0a4fd6424b

    SHA256

    c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479

    SHA512

    768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012

  • /data/user/0/com.cicofudiwiheyi.pekoca/no_backup/androidx.work.workdb-wal

    Filesize

    16KB

    MD5

    f5f3226d505f4dd18205e0a02c3656ab

    SHA1

    0846ac8b12836b02652ac243b4755e4e5a9dea87

    SHA256

    1aa6281a03e220a4674f69c4143e7ca3271ce931a4139750d2858988af1b5a5b

    SHA512

    9f669e1942b136d37e44e793d4233aa8aef6e8cd228f13e4a53cb9252344ddbf5cff8c14fc6d5e8f139202b19c34a9cfa6e5a6901b5fccb48e02a369cf6b2a7f

  • /data/user/0/com.cicofudiwiheyi.pekoca/no_backup/androidx.work.workdb-wal

    Filesize

    108KB

    MD5

    bd0b908f06b35bbab96113e7fb31d62b

    SHA1

    27e27d9bef3726b760ea18a6e80f02bf6eab9c46

    SHA256

    1f807d9bc42aff30718a649d5e9e2e5392187d5f2255308757e27eb2b16fb701

    SHA512

    91bc3f8c55217491709ae3ee86376a0c9b4d17100c9d858346cdc53c88e91c1d1369bb0a8388d654de0989c56faeeeeb5751d44fb67f0ee668eb8b0a96ef0c02

  • /data/user/0/com.cicofudiwiheyi.pekoca/no_backup/androidx.work.workdb-wal

    Filesize

    173KB

    MD5

    725cbe986635c78b05b28cf169edc49b

    SHA1

    974bf29f740e72b3882afd421b221f57511b54f0

    SHA256

    f9b7365f654d340fbeefac5c22cbce840b1c1a093f3e01b5ec0103bfdc6474a3

    SHA512

    d68648948925a7de9b5255a532637d0087fb6640aa954e479f7daff9a9ab30f12de38bb768e016abc36c686aa96d148dd23e447e944770cffa41124699fe4f93