Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    149s
  • max time network
    151s
  • platform
    android-11_x64
  • resource
    android-x64-arm64-20240910-en
  • resource tags

    arch:armarch:arm64arch:x64arch:x86image:android-x64-arm64-20240910-enlocale:en-usos:android-11-x64system
  • submitted
    09/09/2024, 22:01

General

  • Target

    d06cd0d42bc27c9b3935b9e0b5955d9b4f13f5f952762c8f19b9c018a31afc37.apk

  • Size

    302KB

  • MD5

    6b5dee813d7ec7f8098811f6c5523e11

  • SHA1

    a4299e94f6c9f2e3791eb012ea13c58fe43ead19

  • SHA256

    d06cd0d42bc27c9b3935b9e0b5955d9b4f13f5f952762c8f19b9c018a31afc37

  • SHA512

    a6b2f055a8bc21fcda5df3f7edea401b2b3a9c60ef6e3a1e8b265c447bdff8d023ab47891f1a484ba85e9bfbfc3053b24300fe950202cc2113e98a34e51546c0

  • SSDEEP

    6144:Gu+5QKfX62Ay/M0jOBBOrUbzVRIZWPezV0WDnKGE6Es2U5CEsmkj4eXwgR:GzZq2A1mDUbzVRIMP92KH6ES5CEsmknH

Malware Config

Extracted

Family

xloader_apk

C2

http://91.204.227.39:28844

DES_key

Signatures

Processes

  • xwfc.avacv.oevjs
    1⤵
    • Checks if the Android device is rooted.
    • Removes its main activity from the application launcher
    • Loads dropped Dex/Jar
    • Reads the content of the MMS message.
    • Acquires the wake lock
    • Makes use of the framework's foreground persistence service
    • Requests changing the default SMS application.
    • Uses Crypto APIs (Might try to encrypt user data)
    PID:4780

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • /data/user/0/xwfc.avacv.oevjs/files/dex

    Filesize

    580KB

    MD5

    ed9219be2761d62f01f05dee71f02df3

    SHA1

    c2b904961f519a66052c04d444b34ef4c3f00e67

    SHA256

    b8f6a3769331039a5f2dc29eba3adc431a7b086d47ec579cd143da11f137f13d

    SHA512

    420dc0fa4e231a66fa5c26fbd7952f574aa24aec62ecdf387dd376e98dac93cbea493785d67a030bd6d6745b00c7f3b14b693f906124ee6438b6a227d682f8bd

  • /data/user/0/xwfc.avacv.oevjs/files/oat/dex.cur.prof

    Filesize

    866B

    MD5

    b3aff47a60621de4f98a14bae67bbf75

    SHA1

    e122e0ad97b0e73141d038d859bcdcde24cd43cc

    SHA256

    0203f863ac216e0e4539fabb4d12857172fe754871ad073ba01bdb7f449cc0dc

    SHA512

    efeea840ca39e59050612af0a66065bac81c676becb63450743508fb5d903bd5a2fd0a6b5742318b42bb52a00f3aed781fc3b4d3f7c6ef67c7d066b836295de6