Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
148s -
max time network
152s -
platform
android_x86 -
resource
android-x86-arm-20240624-en -
resource tags
-
submitted
15/09/2024, 08:24 UTC
General
-
Target
7b3262b6c3ad52e50e2ec6faf1ffb12ca08f0d17ac4f90420f13a6053b7f9622.apk
-
Size
4.5MB
-
MD5
215eb7fd4c261e17a696e8ba6a4061ed
-
SHA1
a5cd2dd1be880362a2b376e80981aa5caf69aa7b
-
SHA256
7b3262b6c3ad52e50e2ec6faf1ffb12ca08f0d17ac4f90420f13a6053b7f9622
-
SHA512
25b932b824266e484efa1922462ff8b947967d910c676457619370b8ed482e06850b2b2bd221bacd02ff80bbcc832519ffbf67909e799b686b04805940ad0a6d
-
SSDEEP
98304:cY1IoOKgjPhcpRUgr1D0e8D0oD0tD0EeD0nAmD0qD0VD0yZ4:31IorW5ck2DuDBDIDYDCTDLDsDnZ4
Malware Config
Signatures
-
Makes use of the framework's Accessibility service 4 TTPs 2 IoCs
Retrieves information displayed on the phone screen using AccessibilityService.
-
Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
-
Acquires the wake lock 1 IoCs
-
Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs
Application may abuse the framework's foreground service to continue running in the foreground.
-
Performs UI accessibility actions on behalf of the user 1 TTPs 49 IoCs
Application may abuse the accessibility service to prevent their removal.
-
Queries information about the current Wi-Fi connection 1 TTPs 1 IoCs
Application may abuse the framework's APIs to collect information about the current Wi-Fi connection.
-
Queries the mobile country code (MCC) 1 TTPs 1 IoCs
-
Requests accessing notifications (often used to intercept notifications before users become aware). 1 TTPs 1 IoCs
-
Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs
-
Checks CPU information 2 TTPs 1 IoCs
-
Checks memory information 2 TTPs 1 IoCs
Processes
-
com.apkbnlmybnl.app1⤵
- Makes use of the framework's Accessibility service
- Acquires the wake lock
- Makes use of the framework's foreground persistence service
- Performs UI accessibility actions on behalf of the user
- Queries information about the current Wi-Fi connection
- Queries the mobile country code (MCC)
- Requests accessing notifications (often used to intercept notifications before users become aware).
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Checks CPU information
- Checks memory information
Network
-
DNSsemanticlocation-pa.googleapis.comRemote address:1.1.1.1:53Requestsemanticlocation-pa.googleapis.comIN AResponsesemanticlocation-pa.googleapis.comIN A172.217.169.10semanticlocation-pa.googleapis.comIN A216.58.204.74semanticlocation-pa.googleapis.comIN A142.250.187.234semanticlocation-pa.googleapis.comIN A172.217.16.234semanticlocation-pa.googleapis.comIN A142.250.178.10semanticlocation-pa.googleapis.comIN A142.250.180.10semanticlocation-pa.googleapis.comIN A142.250.200.10semanticlocation-pa.googleapis.comIN A172.217.169.74semanticlocation-pa.googleapis.comIN A216.58.201.106semanticlocation-pa.googleapis.comIN A142.250.179.234semanticlocation-pa.googleapis.comIN A142.250.187.202semanticlocation-pa.googleapis.comIN A216.58.213.10semanticlocation-pa.googleapis.comIN A172.217.169.42semanticlocation-pa.googleapis.comIN A142.250.200.42 -
DNSandroid.apis.google.comRemote address:1.1.1.1:53Requestandroid.apis.google.comIN AResponseandroid.apis.google.comIN CNAMEclients.l.google.comclients.l.google.comIN A142.250.200.46
-
DNSfreeipapi.comRemote address:1.1.1.1:53Requestfreeipapi.comIN AResponsefreeipapi.comIN A104.21.94.136freeipapi.comIN A172.67.168.79
-
GEThttps://freeipapi.com/api/jsonRemote address:104.21.94.136:443RequestGET /api/json HTTP/2.0
host: freeipapi.com
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
accept-encoding: gzip
ResponseHTTP/2.0 200
date: Sun, 15 Sep 2024 08:24:40 GMT
content-type: application/json
access-control-allow-origin: *
cache-control: no-cache, private
x-powered-by: PHP/8.3.11
x-ratelimit-limit: 60
x-ratelimit-remaining: 50
cf-cache-status: DYNAMIC
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=4YEunPNaOIQ2V%2FxUIleg%2BH2r47JAYjbkMB%2FO3ndKddQw0DMD5pBgA4CXssYYKam6H5ccPIi28WhjfFrvg79rGyjsRuASgLbPfjO680CKaZHjS0Psn1vn%2BSZXHlvFfrw%2B"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 8c3738c44acbcd5c-LHR
content-encoding: gzip
alt-svc: h3=":443"; ma=86400
-
142.250.180.10:443tls, https -
80.251.153.96:52997 -
216.58.201.110:443tls, https
-
142.250.200.46:443android.apis.google.comtls
-
172.217.169.10:443semanticlocation-pa.googleapis.comtls
-
80.251.153.96:52997
-
142.250.178.10:443semanticlocation-pa.googleapis.comtls, https
-
104.21.94.136:443https://freeipapi.com/api/jsontls, http2
HTTP Request
GET https://freeipapi.com/api/jsonHTTP Response
200 -
80.251.153.96:52997
-
80.251.153.96:52997
-
80.251.153.96:52997
-
80.251.153.96:52997
-
80.251.153.96:52997
-
80.251.153.96:52997
-
80.251.153.96:52997
-
80.251.153.96:52997
-
80.251.153.96:52997
-
80.251.153.96:52997
-
1.1.1.1:53semanticlocation-pa.googleapis.comdns
DNS Request
semanticlocation-pa.googleapis.com
DNS Response
172.217.169.10216.58.204.74142.250.187.234172.217.16.234142.250.178.10142.250.180.10142.250.200.10172.217.169.74216.58.201.106142.250.179.234142.250.187.202216.58.213.10172.217.169.42142.250.200.42
-
1.1.1.1:53android.apis.google.comdns
DNS Request
android.apis.google.com
DNS Response
142.250.200.46
-
1.1.1.1:53freeipapi.comdns
DNS Request
freeipapi.com
DNS Response
104.21.94.136172.67.168.79
MITRE ATT&CK Mobile v15
Persistence
Event Triggered Execution
1Broadcast Receivers
1Foreground Persistence
1Defense Evasion
Foreground Persistence
1Impair Defenses
1Prevent Application Removal
1Input Injection
1Virtualization/Sandbox Evasion
2System Checks
2Credential Access
Access Notifications
1Input Capture
2GUI Input Capture
1Keylogging
1Discovery
Software Discovery
1Security Software Discovery
1System Information Discovery
2System Network Configuration Discovery
1System Network Connections Discovery
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
427B
MD5daadafd4adf7c2da3351beb9c3bfb9dd
SHA16673c20620fdc3dd31a1ec9d78392c3d46cb2f50
SHA256f1251b8332a1b29c67682c9e1f9975ab0f611395e24534cc6168b68e778192f1
SHA512faafe0145ee0fe888e0829123266dc65348270fdf51a494378d3195b6c86fee5c52a4ca2cfd3e162e0eee25c570d947b8270ff08636bc25339757cfc2f9ccdb7
-
Filesize
4B
MD5098f6bcd4621d373cade4e832627b4f6
SHA1a94a8fe5ccb19ba61c4c0873d391e987982fbbd3
SHA2569f86d081884c7d659a2feaa0c55ad015a3bf4f1b2b0b822cd15d6c15b0f00a08
SHA512ee26b0dd4af7e749aa1a8ee3c10ae9923f618980772e473f8819a5d4940e0db27ac185f8a0e1d5f84f88bc887fd67b143732c304cc5fa9ad8e6f57f50028a8ff
-
Filesize
44KB
MD5d5d190e1180c5e6858c40a93f7526f12
SHA10d054f2e34776c8d5bcfd54d743831b9919618fe
SHA256274fe3e82fc2630d99809afd6a1c64768a77ed69c04b33e0df6a292a5a042203
SHA5120d58df37359d6e35f02ef95e4edcfb05fac6c3bc57d1c3e56e49fa7b6c66aef3f99b383cb14dc5a01b52bc6a0d4685f275fb30279aa26e8339a5e0b8416ba85e
-
Filesize
4KB
MD52c6fe773f7cc42d162630d93a98fa91f
SHA1a0d76f9403df661aea3017a0d912de03c415e3a9
SHA2563855acc95e1e3648649a16c91abdcb1e2eb81826ae6171a0ab25c5b74452f186
SHA51220436ab982d11ec32d69267c93c378e4ad92d8f840f5b412984af5aa0240f0eb8df757fdfde5ab95a2649c6f9862d9b633cd8dfcab5c07c1a4533072600c39a6
-
Filesize
4KB
MD58ad1f4fd038fa130fa9c02bf75dfd72f
SHA12bb45ef26978079ada77f35846217468c066dcd4
SHA25677d4e2097843e8e7a82c89c2f7fed5cc32be4e6b0253907066c9dde74845a22f
SHA512965687b3e37c5bbb1c28f5546e8a080d8d5cc1a6fdad1b630f6d42e51adea3848aa289192e548a0c09cf72190e263c9f80070dc4a71b538e3963ce2947b58ed4
-
Filesize
32KB
MD5bb7df04e1b0a2570657527a7e108ae23
SHA15188431849b4613152fd7bdba6a3ff0a4fd6424b
SHA256c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479
SHA512768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012
-
Filesize
73KB
MD5b939bfddae63d6eeb43f71e60c5fe2e5
SHA1d20e224ddfac3efc818ca7ec35327b3a549f0e70
SHA2568b0f662fc6a3c42378b9abe0a47963997a054eba207dd5a1ce8b2c6dbbe71d6e
SHA5124987a75bf83e843607b7d8a76dcd0fb944298568103f7e9bdbec3b538582e2adaf514ca8d182f8be7dd381a2774fa40146124e58b1e755554c297fbdabb0bb4a
-
Filesize
11B
MD51b65c10c6215685f9d621d797f911373
SHA1cc50aaed5cd521a62ec8cf9fe0413153ec90f265
SHA2562230c2b2787663a054c47450ecd1718f0296853ad768b8e5d306ecb912685e89
SHA5125a9139f295dbe384b1584eff5c11f3f86759232f7b661b75f27fe92b996b4cdc0552e315f79b26f5f2c1f91756d9ae04cf0c3675b6172e91a3d373b9b314496f
