Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

10

Static

static

10

29e642ef6b...87.apk

android-9-x86

7

29e642ef6b...87.apk

android-10-x64

7

29e642ef6b...87.apk

android-11-x64

7

Analysis

  • max time kernel
    149s
  • max time network
    158s
  • platform
    android_x64
  • resource
    android-x64-arm64-20240624-en
  • resource tags

    androidarch:armarch:arm64arch:x64arch:x86image:android-x64-arm64-20240624-enlocale:en-usos:android-11-x64system
  • submitted
    20/09/2024, 07:11 UTC

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    29e642ef6bd41f343f66210e924724bb343432affd1ed25bf386d638ae79ee87.apk

  • Size

    4.6MB

  • MD5

    93d05bac003f669b8d0cb9d0ac23a705

  • SHA1

    1aa89ec5de22d8698bb299b5c44ad6255efa7dde

  • SHA256

    29e642ef6bd41f343f66210e924724bb343432affd1ed25bf386d638ae79ee87

  • SHA512

    6e9a1c8da820cf30382cb5a8fadfd6812faf19dc6314ee2956d64b69399d53fabe470049b965c8f8d203811c85f90f238af446d5482bdcf10fb42adbfcf6872f

  • SSDEEP

    98304:2FFspr24BaPyjUQCvxvNlvD0eGD0OD0DD0E8D0nAYD0wD0DD0NY1:IF+rEPaCv1NlvDoDnD+D2DCtD5DSDqY1

Score
7/10
collectioncredential_accessevasionimpactpersistence

Malware Config

Signatures

  • Makes use of the framework's Accessibility service 4 TTPs 2 IoCs

    Retrieves information displayed on the phone screen using AccessibilityService.

    collectionevasioncredential_access
  • Obtains sensitive information copied to the device clipboard 2 TTPs 1 IoCs

    Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.

    collectioncredential_accessimpact
  • Acquires the wake lock 1 IoCs
  • Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs

    Application may abuse the framework's foreground service to continue running in the foreground.

    evasionpersistence
  • Performs UI accessibility actions on behalf of the user 1 TTPs 52 IoCs

    Application may abuse the accessibility service to prevent their removal.

    evasion
  • Requests accessing notifications (often used to intercept notifications before users become aware). 1 TTPs 1 IoCs
    collectioncredential_access
  • Checks CPU information 2 TTPs 1 IoCs
  • Checks memory information 2 TTPs 1 IoCs

Processes

  • com.sepgimuiestq.newicon
    1⤵
    • Makes use of the framework's Accessibility service
    • Obtains sensitive information copied to the device clipboard
    • Acquires the wake lock
    • Makes use of the framework's foreground persistence service
    • Performs UI accessibility actions on behalf of the user
    • Requests accessing notifications (often used to intercept notifications before users become aware).
    • Checks CPU information
    • Checks memory information
    PID:4483

Network

  • flag-us
    DNS
    android.apis.google.com
    Remote address:
    1.1.1.1:53
    Request
    android.apis.google.com
    IN A
    Response
    android.apis.google.com
    IN CNAME
    clients.l.google.com
    clients.l.google.com
    IN A
    172.217.16.238
  • flag-us
    DNS
    ssl.google-analytics.com
    Remote address:
    1.1.1.1:53
    Request
    ssl.google-analytics.com
    IN A
    Response
    ssl.google-analytics.com
    IN A
    216.58.201.104
  • 142.250.179.238:443
    tls, https
    1.5kB
     40 B
     1
    1
  • 142.250.179.238:443
    tls, https
    1.5kB
     40 B
     1
    1
  • 172.217.16.238:443
    android.apis.google.com
    tls
    6.5kB
     9.5kB
     29
    27
  • 216.58.213.10:443
    tls, https
    1.3kB
     40 B
     1
    1
  • 216.58.213.10:443
    tls, https
    530 B
     40 B
     1
    1
  • 216.58.201.104:443
    ssl.google-analytics.com
    tls
    1.3kB
     5.8kB
     8
    8
  • 193.3.19.37:52997
    300 B
     5
  • 142.250.187.196:443
    tls, https
    436 B
     40 B
     2
    1
  • 142.250.187.196:443
    www.google.com
    tls
    11.1kB
     11.6kB
     31
    38
  • 193.3.19.37:52997
    300 B
     5
  • 193.3.19.37:52997
    300 B
     5
  • 193.3.19.37:52997
    300 B
     5
  • 193.3.19.37:52997
    240 B
     4
  • 224.0.0.251:5353
    3.8kB
     12
  • 1.1.1.1:53
    android.apis.google.com
    dns
    69 B
     109 B
     1
    1

    DNS Request

    android.apis.google.com

    DNS Response

    172.217.16.238

  • 1.1.1.1:53
    ssl.google-analytics.com
    dns
    70 B
     86 B
     1
    1

    DNS Request

    ssl.google-analytics.com

    DNS Response

    216.58.201.104

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • /data/data/com.sepgimuiestq.newicon/files/db.db
    Filesize

    44KB

    MD5

    d5d190e1180c5e6858c40a93f7526f12

    SHA1

    0d054f2e34776c8d5bcfd54d743831b9919618fe

    SHA256

    274fe3e82fc2630d99809afd6a1c64768a77ed69c04b33e0df6a292a5a042203

    SHA512

    0d58df37359d6e35f02ef95e4edcfb05fac6c3bc57d1c3e56e49fa7b6c66aef3f99b383cb14dc5a01b52bc6a0d4685f275fb30279aa26e8339a5e0b8416ba85e

    Download Submit

  • /data/data/com.sepgimuiestq.newicon/files/loading.gif
    Filesize

    121KB

    MD5

    7b38720a0352dffa26411726c72dd2b0

    SHA1

    b15e687f42abcdc12427f146a3115ef2259211f8

    SHA256

    2013f490d45638cada331b3474ed65b9a43cec60da773accc98332e58c06336d

    SHA512

    0df28f87da4f9beb3ca8c108f54021a2a1a1434771abbb5ba67a2736097f2287b05e5220a33e92c42ee13ecae1144714a422b986763712794f69e65bc44c83e3

    Download Submit

  • /data/data/com.sepgimuiestq.newicon/files/txtscreensize.txt
    Filesize

    11B

    MD5

    1b65c10c6215685f9d621d797f911373

    SHA1

    cc50aaed5cd521a62ec8cf9fe0413153ec90f265

    SHA256

    2230c2b2787663a054c47450ecd1718f0296853ad768b8e5d306ecb912685e89

    SHA512

    5a9139f295dbe384b1584eff5c11f3f86759232f7b661b75f27fe92b996b4cdc0552e315f79b26f5f2c1f91756d9ae04cf0c3675b6172e91a3d373b9b314496f

    Download Submit

We care about your privacy.

This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.