Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    147s
  • max time network
    128s
  • platform
    android-9_x86
  • resource
    android-x86-arm-20240910-en
  • resource tags

    arch:armarch:x86image:android-x86-arm-20240910-enlocale:en-usos:android-9-x86system
  • submitted
    10/09/2024, 09:41

General

  • Target

    81d22a908f7989dbafa747a6cc3ce42a1068d5bed9f34cc69fa86672b4d57e19.apk

  • Size

    4.9MB

  • MD5

    fc0f20db5f8098e42d845492fcf3fca4

  • SHA1

    380e9f9d17c1f13e66d367f4f8726200e2dee07c

  • SHA256

    81d22a908f7989dbafa747a6cc3ce42a1068d5bed9f34cc69fa86672b4d57e19

  • SHA512

    d4fee4bd9bdaa012b57346c407a5e46eeb8908727686bd7022faf704a3baba81b6b6380b260e2f672fd8967b39a4d6f2008b6bf5e629efd163f01a30663d14a1

  • SSDEEP

    98304:UxQ993O4ZwUzMnKTI5qkVe6/7Tr/njx/3lIM1bfzyck/IISqf+HW6sR:KQ993zwU6+I5DE07TrPV/3lImKj7g26y

Malware Config

Signatures

  • SMSFactory

    SMSFactory is an Android SMS trojan malware first seen in Jun 2022.

  • Checks if the Android device is rooted. 1 TTPs 3 IoCs
  • Acquires the wake lock 2 IoCs
  • Queries information about active data network 1 TTPs 2 IoCs
  • Queries information about the current Wi-Fi connection 1 TTPs 1 IoCs

    Application may abuse the framework's APIs to collect information about the current Wi-Fi connection.

  • Reads information about phone network operator. 1 TTPs
  • Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 2 IoCs
  • Schedules tasks to execute at a specified time 1 TTPs 2 IoCs

    Application may abuse the framework's APIs to perform task scheduling for initial or recurring execution of malicious code.

  • Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 2 IoCs
  • Checks memory information 2 TTPs 1 IoCs

Processes

  • com.kongregate.mobile.bitheroes.google.hack
    1⤵
    • Checks if the Android device is rooted.
    • Acquires the wake lock
    • Queries information about active data network
    • Registers a broadcast receiver at runtime (usually for listening for system events)
    • Schedules tasks to execute at a specified time
    • Uses Crypto APIs (Might try to encrypt user data)
    • Checks memory information
    PID:4373
  • com.kongregate.mobile.bitheroes.google.hack:Metrica
    1⤵
    • Checks if the Android device is rooted.
    • Acquires the wake lock
    • Queries information about active data network
    • Queries information about the current Wi-Fi connection
    • Registers a broadcast receiver at runtime (usually for listening for system events)
    • Schedules tasks to execute at a specified time
    • Uses Crypto APIs (Might try to encrypt user data)
    PID:4413

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • /data/data/com.kongregate.mobile.bitheroes.google.hack/databases/OneSignal.db

    Filesize

    4KB

    MD5

    f2b4b0190b9f384ca885f0c8c9b14700

    SHA1

    934ff2646757b5b6e7f20f6a0aa76c7f995d9361

    SHA256

    0a8ffb6b327963558716e87db8946016d143e39f895fa1b43e95ba7032ce2514

    SHA512

    ec12685fc0d60526eed4d38820aad95611f3e93ae372be5a57142d8e8a1ba17e6e5dfe381a4e1365dddc0b363c9c40daaffdc1245bd515fddac69bf1abacd7f1

  • /data/data/com.kongregate.mobile.bitheroes.google.hack/databases/OneSignal.db-journal

    Filesize

    512B

    MD5

    933e2d398f785a0bb66207132cf9480b

    SHA1

    fabdfad795f0edf8306bab6faa97e78bc5fe8918

    SHA256

    5344daa67ca3db3c3aa572552cc98c01aa421bed3b89bff765431f8d39c5604a

    SHA512

    5f0f94a5d334109e052af5817a2b7f1c8fa25f3efd3fd46eb8cb548d2d1f95e318e31861e305634dab92e8387f65f110f55824ab638399baaae732fe229fab86

  • /data/data/com.kongregate.mobile.bitheroes.google.hack/databases/OneSignal.db-shm

    Filesize

    32KB

    MD5

    7d88c811f8ab0e73a4c394881f0d2a7b

    SHA1

    0bacdeb77e64ba114b793b2d02b8f59ff408550d

    SHA256

    af4192a42d9cf2e9fb6c655469540a1e8f9eec3a3dedfb7bc4e7e6b6cf93e892

    SHA512

    8f02705b31266c404559a58b7f20ad9cb468dbf2f6b6fb7fe51960463b1ead4c5d3057f394ece232421b2e7c3ec2d69394e754c2802c3763c5e11d3b6b3bad83

  • /data/data/com.kongregate.mobile.bitheroes.google.hack/databases/OneSignal.db-wal

    Filesize

    64KB

    MD5

    1709a1c2cfcca8ef046ed8323f658cf7

    SHA1

    b41c0b39b88b727a7bbb30ab8dd86a274bd45611

    SHA256

    6095cb3969febd5bbfa3e2e8b42b3478843418da1afca403525f05054fcc5697

    SHA512

    2b292d8c787e5f9b3079f3d73a381b425c913d5eb47ca76a780a31e8d7ef91d8173702f3400447ada6c1270052a7278e85e2a588ec0980a3a6e431a164eb5cca

  • /data/data/com.kongregate.mobile.bitheroes.google.hack/files/credentials.dat

    Filesize

    227B

    MD5

    d01dccad56760ea4027255d4b3e1c4e4

    SHA1

    35efce9e693fa03888416d416896b683c3f3589e

    SHA256

    e8f1e4bbc36c537267fad8165e349a8aae67e83191fd7c59fa85a398317835be

    SHA512

    a969bbaa9082b48bb07f668aa20a300547b1dcf2002d65ec17dbfa3c699bad6af5ea97590ca78507d51925d842af39992ba813152b3b043d28b031f134a3c316

  • /data/data/com.kongregate.mobile.bitheroes.google.hack/no_backup/androidx.work.workdb

    Filesize

    4KB

    MD5

    91b95dd896cd8cfbfa5036f29aeea06f

    SHA1

    9e0139d493f73c2b94e75db50b7335f486199c7d

    SHA256

    06c2529d90f8d5830865cd2755d2c97d4948cd079ae4f45947d265de2c33fa50

    SHA512

    efa50fc0d172c9fb45314390027946b5cc094d6dd78234d94826f9080f537d25e98537739f72bc1b4e642a1c1739ef358b6ca6b2d0e630a469ba7c4c14a53061

  • /data/data/com.kongregate.mobile.bitheroes.google.hack/no_backup/androidx.work.workdb-journal

    Filesize

    406KB

    MD5

    1321b10201701c745808bf4393150d81

    SHA1

    b12291f8b3853d257badc98d88f168dab6415725

    SHA256

    f8d6c1bceb7272e18dc79f43ba7ffd8aae3ed952af4ca318a6f4426333e5811d

    SHA512

    81e0140551a74cbf2567a17596ebe26bb86fbd98125bae529730d66cbc120d41e583b15819ed7adc493455686492f956f1eb8d50b025049c0cdf9a84b8f678f8

  • /data/data/com.kongregate.mobile.bitheroes.google.hack/no_backup/androidx.work.workdb-wal

    Filesize

    32KB

    MD5

    b583f753f1149b4ac09edb5a01f11601

    SHA1

    d575a69f8f7bd7e8e840dfa6b475c8aa83a60c34

    SHA256

    690bf4c197934e35fa9bfe543452735b003835b505934b97f66e1ba067991fb1

    SHA512

    a78ea2ddfc9f85711a029aa3d5d6d26211ac69c03a60edd4c43e4cc0b4da61829eac333c3dac99a0657b3997f5ce6fa43d95e102951e122e3aa1887b649da82e

  • /data/data/com.kongregate.mobile.bitheroes.google.hack/no_backup/androidx.work.workdb-wal

    Filesize

    108KB

    MD5

    22a108dddd1ea4b9ee015afa42fd5e7d

    SHA1

    9cbc71865846cc1efc91627e3283fc0bbc0277f0

    SHA256

    14f7a0a9c70f5a78640d5c9f3ca5077694c9469698a4fc94cca035c57fd4b532

    SHA512

    01fa23f88c5cf85e50a8f108e72ff5d1dac2bfeeaa00296eb79911cde85e74d0a32bb7ca58494b3cb617da8b63aac93be6a92d8ac8edfb61424ac48085fc697b

  • /data/data/com.kongregate.mobile.bitheroes.google.hack/no_backup/androidx.work.workdb-wal

    Filesize

    116KB

    MD5

    96d68c385df0168ac94d911e241ac71c

    SHA1

    14259bc56e8cdff97125b5705ac26a6c3d335c63

    SHA256

    8f329564831f2e3f76b272feef1331feda32d41cd8de8e09b08debed10429587

    SHA512

    3125552b1edafa577c31199c71d5c75b83b2fa6a130a13a56ef134592d83950a66777c2fc1fc6dfa2cd7be564ef8bd85f2b6424dd66eea0b3b63c774181e22e9

  • /data/data/com.kongregate.mobile.bitheroes.google.hack/no_backup/androidx.work.workdb-wal

    Filesize

    181KB

    MD5

    72ddae348171329d443febfe8123bb68

    SHA1

    37aa60fb7080282a21bc8a512ddf437e7b78e750

    SHA256

    b96f0cb5d9abf6c754cf1afe7e74185ff4033c23ef065111963ecd579af2a3c8

    SHA512

    153ec6fc91fa551d61c431773f307e9e0ddce26dc770c286afee59de3c24a0316fe7deefa5b92891920e6fce1d886710cde2e6b1948a851de7e2ca9731d0afec

  • /data/data/com.kongregate.mobile.bitheroes.google.hack/no_backup/com.google.InstanceId.properties

    Filesize

    2KB

    MD5

    8de8504ed99af154760375041c120bed

    SHA1

    06069c1e141f0886a13c22dd9f0eaccb6f06522f

    SHA256

    f85a7884b27e425e488a915ca24baf3b588fe3ee3cab59c56b131b8a8a5d7508

    SHA512

    60769f4db8ab0b7c2b74495eb808e12d2cef7afd363facf978f80470087493703b983486f105a4890fd1674f40f7af07d5de7dea1aecb2f6e2a09cbe18892847

  • /data/data/com.kongregate.mobile.bitheroes.google.hack/no_backup/credentials.dat

    Filesize

    20KB

    MD5

    62bffba4d3bec7276eafea801f27cbec

    SHA1

    ffa00bc2aa51edb27100eceed236a23407c85cad

    SHA256

    02001df69ca8bbb911433c84ea661929cafc01d5f76743835010c721895dbf06

    SHA512

    46e341750bc5c1517b7082be52b798d01fc97e9c7a65dfe93868304e3d3f3f66efad0d76460a5fe1b09b291336ca7c75b0eb5b5980d515674f5e111cce5a3dc3

  • /data/data/com.kongregate.mobile.bitheroes.google.hack/no_backup/db_metrica_com.kongregate.mobile.bitheroes.google.hack

    Filesize

    36KB

    MD5

    8b16865c5cfad92c330d1f7be32e27b4

    SHA1

    69152455612ca8aa88b824bba7d1a5f57d04262b

    SHA256

    dc814ba74fc75f7cd2840623ca03ca70fef6336515a3808ce5292832d0c26bb5

    SHA512

    cb488fc51f870156c4fcd89a171a4889e29a2d187aa66f62ba032c0c7dd1ea6279b1ac14e176f009d889db2ea7dd9683c48a21e21ed414f2e253042989521ab3

  • /data/data/com.kongregate.mobile.bitheroes.google.hack/no_backup/db_metrica_com.kongregate.mobile.bitheroes.google.hack-shm

    Filesize

    32KB

    MD5

    82dd8903d8b1692c76dc217ea8dbd757

    SHA1

    095e0c9f09bac72f74c5ac23af7e3596f9540f55

    SHA256

    721fa26679d52238f7572dd58ba01a6a14e56abbe45f6bb40e534d784d221383

    SHA512

    dca07fc0cdb75bb94d4cea3941e5841280455cce70f8b456ce95040e2eedc81390081af0cb65617b39b27d4a92488ebc23d348fdccfac947ea22e856b750d2e9

  • /data/data/com.kongregate.mobile.bitheroes.google.hack/no_backup/db_metrica_com.kongregate.mobile.bitheroes.google.hack-wal

    Filesize

    406KB

    MD5

    0e94cc3fbc2d951e8fa4d1dc4c9d9b27

    SHA1

    ce481f7db11b0a735ac373202d6ffcce821c4227

    SHA256

    9cd391fb1417b3018f281c2176350a3a66896bc7ea8938feea96fd3f7bd7e41e

    SHA512

    25cad2bbb658d6cd4ef75591b78ff81937840811f16cf54d946b1f225cd5b8c33609dd8ab5397e4886930adc800f643d3629a995d06f8d1474815fe611be164f

  • /data/data/com.kongregate.mobile.bitheroes.google.hack/no_backup/db_metrica_com.kongregate.mobile.bitheroes.google.hack_20799a27-fa80-4b36-b2db-0f8141f24180

    Filesize

    4KB

    MD5

    ee698e68d9ea22effd06f5d511cda4c0

    SHA1

    feca2e561733fd2c8ec8d96f1bb641aa748b63ad

    SHA256

    beebb3ed8b1d72be5fc27b3eef7e04f28b37317ae6dc9ea1b90f361c041cb6a5

    SHA512

    0e36f523abb57cb78a8252f45cbe4d5ff30e1c91ae1938c35584c3e42a2b97d5acb6084c36082de12ef4f4ea8548c5fe96b3a317be5bebd68c77f1686f869db1

  • /data/data/com.kongregate.mobile.bitheroes.google.hack/no_backup/db_metrica_com.kongregate.mobile.bitheroes.google.hack_20799a27-fa80-4b36-b2db-0f8141f24180-journal

    Filesize

    512B

    MD5

    a4ea09059613e3e7cefc1ad04f841bbf

    SHA1

    9763193e4663e3597436468fe0e03b0467fa0373

    SHA256

    840829fc303ef385044cf6589f9034fb790ec75fb38b88c532be13c02617e950

    SHA512

    a8693ed2834fced424f3896cb45ccfb6bcf5850571650c5fa9064ae3289014d7e64ce58ee2445150554bd3455cdcb85c36212388bd569ae9043064263c41d29a

  • /data/data/com.kongregate.mobile.bitheroes.google.hack/no_backup/db_metrica_com.kongregate.mobile.bitheroes.google.hack_20799a27-fa80-4b36-b2db-0f8141f24180-shm

    Filesize

    32KB

    MD5

    5edc96e4a9ca248e996c7072441272ff

    SHA1

    48aed645b00799f04ffc2e2e5b3819abc0d74bd7

    SHA256

    270f5fe15418c990cbadc0b71733d5499dd0288732ad283abd4d0abf154f164d

    SHA512

    c02976aabadfc8d8a7bdcfb19ff88a127db020a273a2c59224204a9425d48a26587af36085a2c92aaa4062a72a431b737bbbdb8c0353b934cfbda0adf75132a1

  • /data/data/com.kongregate.mobile.bitheroes.google.hack/no_backup/db_metrica_com.kongregate.mobile.bitheroes.google.hack_20799a27-fa80-4b36-b2db-0f8141f24180-wal

    Filesize

    209KB

    MD5

    700a5f07143d1609e7dcf41eb352f6fb

    SHA1

    ae4f8a0d4a76dabd6281c3dfa2ad4dff939e6bf8

    SHA256

    155123962a912068d3d096c3dd486af2c92deaa87e34fca5e59027e3e74a25f0

    SHA512

    161e6d9de8d5573ef3460a48b942251573be2f85ce7e1f139e7801da9a229a76f533fc15f9eb32f8c136146186b7238bbfba9d8c5744935dc00a80f81a88f2b2

  • /data/data/com.kongregate.mobile.bitheroes.google.hack/no_backup/metrica_client_data.db

    Filesize

    20KB

    MD5

    5ae1dae9eb36649faeb07a94ca96e7f8

    SHA1

    9056cb35b999726d6576ef6ced55ca9228cb97c3

    SHA256

    62eafa0fe191047857cbfdbd6909930487f2216d260b4be27fd52e3cff6086d3

    SHA512

    e33d2cec8122673da3c8ffc788bf2984eac878f7dada265485d960a886ebfb00e17b12a30b546c959bc04c62a31d5646fda748df693e0bdafbb974abbbe77c1a

  • /data/data/com.kongregate.mobile.bitheroes.google.hack/no_backup/metrica_client_data.db

    Filesize

    44KB

    MD5

    13510ccf5b189653f7b093631b063323

    SHA1

    6ec1d9b9ff8dd9ca349c4104dba624e1a1915ae5

    SHA256

    eab7e04c2fa8e620bea20198fef783c4bc5768f1150861e392db93f85cea5469

    SHA512

    52716e4411f056145dc01f09ea6e1d04030d41c0175280560d1dfe66f4b27b23104173da0c3a1ed51a9e2299df9941dccae6738b49f2eb1522f6577dede5f34b

  • /data/data/com.kongregate.mobile.bitheroes.google.hack/no_backup/metrica_client_data.db

    Filesize

    20KB

    MD5

    ac26a375d5d673c2a7b39bbe42efacaa

    SHA1

    a7384db83f153cce2cdd67a97a20df068f6ecd67

    SHA256

    001ea8b38280af72e70a8168524cfb2b07a711040948397d36fcace03b593716

    SHA512

    45e1842b55ebab067e53fb3c6ab880c0a652a951f26c1cae5363f429207db5f1aa56c821e89973612b73f9c0d186561221b6129db22e447ccd421b40342dd6bf

  • /data/data/com.kongregate.mobile.bitheroes.google.hack/no_backup/metrica_client_data.db

    Filesize

    20KB

    MD5

    18c0c0d2b2908de36d9cae1168503d66

    SHA1

    df099ef7091375697a878b03e39aa5fdeeaaa93e

    SHA256

    8770981e5a3ef7b7cf982a656876042b70516b0ddbd3c02c911b443d94a8161e

    SHA512

    704e9953d5e66f726654ae205b1be1ba51297c53094318b5593de3a5da8c2ba21d841e28d32c6eef11892035d792a9c026e21842ceb1e735aa1710396f04e93f

  • /data/data/com.kongregate.mobile.bitheroes.google.hack/no_backup/metrica_client_data.db-journal

    Filesize

    512B

    MD5

    0b307c1e3a73441e4717343c2719c7d9

    SHA1

    69d3792906a6504e859a35986d622347c7bef223

    SHA256

    bd954f299220a2959a7481cefa775e414a10aecdf6ba3e2506351034d7932d91

    SHA512

    e2584ea4f0c04de25d095c693bc071c7e3629281cae3c80b287b2290b861b12f036d73fcdd46a5ffdf50c4f769f51363274590c2a1877b73d05eda162d8094b0

  • /data/data/com.kongregate.mobile.bitheroes.google.hack/no_backup/metrica_client_data.db-shm

    Filesize

    32KB

    MD5

    bb7df04e1b0a2570657527a7e108ae23

    SHA1

    5188431849b4613152fd7bdba6a3ff0a4fd6424b

    SHA256

    c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479

    SHA512

    768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012

  • /data/data/com.kongregate.mobile.bitheroes.google.hack/no_backup/metrica_client_data.db-wal

    Filesize

    8KB

    MD5

    7463872fd13a345da30a5d92eb04fd31

    SHA1

    56622df3c52769dee63fe9448d7327e39eccf0b2

    SHA256

    8c9e85f30b0aa23d73cf62238ce330f9871116deeccaaf78ff4bb8d0796fa539

    SHA512

    9633ddec9a3c9cd11009ea1b9895e31694818e7207dbfeebae456d7943cf9d914ed4443339d0ff5c70856af553e3775d791a7e20aea698501a58ceff196189bb

  • /data/data/com.kongregate.mobile.bitheroes.google.hack/no_backup/metrica_client_data.db-wal

    Filesize

    8KB

    MD5

    cc75e4b6db3b6c805037ce3db65fd4f2

    SHA1

    ae3a066aae4554bb4a8a57b36d21b24145a71fbf

    SHA256

    0d446435f988cad3729f2e4eb63673eee7ff8894e40f88bf44450a4de6890ce3

    SHA512

    4bb51985c4f9e5a96edc982d47ba5e8b22478e02bc8c0ba84f5e336a752359341835ff568bf8c55cecb3ad4c91a573f43e9ad5980ebe48fb2185324ed3670f70

  • /data/data/com.kongregate.mobile.bitheroes.google.hack/no_backup/metrica_client_data.db-wal

    Filesize

    8KB

    MD5

    3ab39e371f3e6cddedd49e0d9cdd180d

    SHA1

    2005d3dd43e45c299445cf63c6370d9bae440a81

    SHA256

    e00ad6a90e134d7ef49ecc43ea4d01b1128d612d76e9063e2a0f57d33b1fe365

    SHA512

    f54a48e61f2455af67a2ba2e73a68c1d9540908d47713f308583e33d86d04a9bd3f677b4327056d1df0c588101e9dd1118e9ea351d57a8d9b9fa8172c8842bc9

  • /data/data/com.kongregate.mobile.bitheroes.google.hack/no_backup/metrica_client_data.db-wal

    Filesize

    32KB

    MD5

    c6301be5d08b543bbc27b60861b2d1d4

    SHA1

    d140073f1093b84709b4eda6b37cea968f9b448b

    SHA256

    bec5fffd6b38d40b9a936c8dfd8caff610ed7608d865cd07dbd806cad78da327

    SHA512

    3afcdb348059950bcac68fc62662f105277c3115f8d68988c7edba570d9256fc470453dffc77e8a5f401d8b979203c40d40bb00bb6789124d23f147eadba8b67