Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    149s
  • max time network
    150s
  • platform
    android-9_x86
  • resource
    android-x86-arm-20240910-en
  • resource tags

    arch:armarch:x86image:android-x86-arm-20240910-enlocale:en-usos:android-9-x86system
  • submitted
    11/10/2024, 22:12

General

  • Target

    1ebce88fd9ed81307999d103ecfc34c2b496aaea197b6cb3be9d3f0c58923000.apk

  • Size

    4.3MB

  • MD5

    1382eb0d9cce4223566c43d6fd5d819f

  • SHA1

    a66e58e07af419cf02ea48b89be1fa94b9365747

  • SHA256

    1ebce88fd9ed81307999d103ecfc34c2b496aaea197b6cb3be9d3f0c58923000

  • SHA512

    9ff49d1952258fb1a01b6ac9cf22e5b3e7d986d5b226863dd4f80b3456b8034ee127e1d717dbb719930565408deea28e9ddc60d07e0769159ade30d8e3c7eb25

  • SSDEEP

    98304:GP9xxsnMx8UDAVJGXfgQ+oQVpcjRUoxrn6wQn7g0dTeEkC1/4bE2VWrcynAXJTdx:Nne8UCGoQ+oUqlUcf+7GEkCIEMWhAXx

Malware Config

Signatures

  • Android SoumniBot payload 2 IoCs
  • SoumniBot

    SoumniBot is an Android banking trojan first seen in April 2024.

  • Loads dropped Dex/Jar 1 TTPs 3 IoCs

    Runs executable file dropped to the device during analysis.

  • Acquires the wake lock 1 IoCs
  • Queries information about active data network 1 TTPs 1 IoCs
  • Requests disabling of battery optimizations (often used to enable hiding in the background). 1 TTPs 1 IoCs

Processes

  • gzroi.klwx.exv
    1⤵
    • Loads dropped Dex/Jar
    • Acquires the wake lock
    • Queries information about active data network
    • Requests disabling of battery optimizations (often used to enable hiding in the background).
    PID:4272
    • /system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/gzroi.klwx.exv/app_dex/classes.dex --output-vdex-fd=44 --oat-fd=45 --oat-location=/data/user/0/gzroi.klwx.exv/app_dex/oat/x86/classes.odex --compiler-filter=quicken --class-loader-context=&
      2⤵
      • Loads dropped Dex/Jar
      PID:4300

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • /data/data/gzroi.klwx.exv/app_dex/classes.dex

    Filesize

    7.0MB

    MD5

    0674b87591e30c90a15ed045d355f673

    SHA1

    fbddd5493bcd9929320e75acf9e437425980003e

    SHA256

    f3e1ee78f1fe42dc84be8634e66efad6e317d3eccc996f873ec97001151f78ae

    SHA512

    35e1ee4661ce56b9e6fbb902518bce756d4a2ba5f748d4524987d25748cf005ffee92d00e33e8c5b44477d47699871ac2842ba05131c113d618b89f7460e586d

  • /data/data/gzroi.klwx.exv/cache/image_manager_disk_cache/88bfcb6bce24319bc05d6aa5fe4b75a5e42802c10bdd3167fc1c87916054b13a.0.tmp

    Filesize

    166KB

    MD5

    f75aaa920b08fa0e17bc524bcddc3747

    SHA1

    08b960b03fc9c3373940da5ed8ba8955f367c8de

    SHA256

    00af88628626e15db3ddf56bfba14e390b40b299d714998594d26e0714fef657

    SHA512

    c1811b5eaddd24f114b9b37644006f4751adcfa7b859912fb013fdf44d4866f726d3375fd931781b5070bfb3d92c3dcb053f43b6216648dcfaa71592f273a371

  • /data/data/gzroi.klwx.exv/cache/image_manager_disk_cache/journal

    Filesize

    180B

    MD5

    16a32559ff60385966e73769320fc47a

    SHA1

    99dc629f36569817bcef80abdea8d21ff876d14b

    SHA256

    4e2f0a2e3b5baa917d879a17acc900ae1b17d325f2dbab11312daac6ba588e96

    SHA512

    1b7394581056f3270c09d8e852114608f03d3b135d675b136e686a822fa1c523f3e010c3cfc4348e5c4a68447c65c16e37c44157d2e8572054d56a39f21b64aa

  • /data/data/gzroi.klwx.exv/cache/image_manager_disk_cache/journal.tmp

    Filesize

    31B

    MD5

    8c92de9ce46d41a22f3b20f77404cc1d

    SHA1

    8671a6dca00edb72be47363a7071be65cf270373

    SHA256

    68bb33ddeed9200be85a71f70b377985f9ee68e91578afbde8321463396f1274

    SHA512

    30f45fe9954215d6adafcc8f0a060a7ff41963a64f9b849a37f0d18fe045038d429ec13bf15226769c4ba78dad3c52f3d9e0dbbb4fcdea4828a1efe956e48f56

  • /data/data/gzroi.klwx.exv/files/PersistedInstallation4285387853240092264tmp

    Filesize

    90B

    MD5

    05f1176bc25a32f52c20a6902d7a3f83

    SHA1

    a05bbd36b905727c544ffea6d8309a753109e2d3

    SHA256

    64c54a6812aca24c18256a931405a53b9040f715b11f46fa151fba66afc4ca65

    SHA512

    a869a70fcd314ae6c174c58932a012c9f57254135d20dbc4c24d6332495553a362547075e8bce5b4ab73246699c83605fc99c551121ddc8bc2e715b31cf34e7c

  • /data/data/gzroi.klwx.exv/files/PersistedInstallation6676779420864857239tmp

    Filesize

    569B

    MD5

    b7e5697369499b8b3621216811cec48e

    SHA1

    3bfccadc48632bb2e08a4029d316f2d72fe6e5c8

    SHA256

    6811b7fb32ad46fb3a2b234f3f645fbd0fafd44b2c0d3b9a70f41a2d2d26e953

    SHA512

    3b8e638c302158de375873fc1016e5f506e4d386fa26b21d1734d764e4dbd3f05384b5dcb706ff9a940a1dfd5c785ef8de28edf2fbf97e45cfd07960b068438e

  • /data/data/gzroi.klwx.exv/files/mmkv/mmkv.default

    Filesize

    4KB

    MD5

    620f0b67a91f7f74151bc5be745b7110

    SHA1

    1ceaf73df40e531df3bfb26b4fb7cd95fb7bff1d

    SHA256

    ad7facb2586fc6e966c004d7d1d16b024f5805ff7cb47c7a85dabd8b48892ca7

    SHA512

    2d23913d3759ef01704a86b4bee3ac8a29002313ecc98a7424425a78170f219577822fd77e4ae96313547696ad7d5949b58e12d5063ef2ee063b595740a3a12d

  • /data/data/gzroi.klwx.exv/no_backup/androidx.work.workdb

    Filesize

    4KB

    MD5

    f2b4b0190b9f384ca885f0c8c9b14700

    SHA1

    934ff2646757b5b6e7f20f6a0aa76c7f995d9361

    SHA256

    0a8ffb6b327963558716e87db8946016d143e39f895fa1b43e95ba7032ce2514

    SHA512

    ec12685fc0d60526eed4d38820aad95611f3e93ae372be5a57142d8e8a1ba17e6e5dfe381a4e1365dddc0b363c9c40daaffdc1245bd515fddac69bf1abacd7f1

  • /data/data/gzroi.klwx.exv/no_backup/androidx.work.workdb-journal

    Filesize

    512B

    MD5

    668576ba077572c63647f6290e220bcb

    SHA1

    2bb97c5a4d503dc7cd45b831da88dfa1cdf5387b

    SHA256

    32397f61b242e7dabe6356b287c19c07bbf56b0edd124340be8d6bce1413a096

    SHA512

    63d792ee1cdd6b5fb29491c817d65a6ad8706b34e11a3ce3f04c208f5c0046edd43e3a8046e87b9fe941effdce085c51814540c9940e1be31fa2ed328b72114c

  • /data/data/gzroi.klwx.exv/no_backup/androidx.work.workdb-shm

    Filesize

    32KB

    MD5

    bb7df04e1b0a2570657527a7e108ae23

    SHA1

    5188431849b4613152fd7bdba6a3ff0a4fd6424b

    SHA256

    c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479

    SHA512

    768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012

  • /data/data/gzroi.klwx.exv/no_backup/androidx.work.workdb-wal

    Filesize

    16KB

    MD5

    053018447986a678f1ebf5f45a0dc3d6

    SHA1

    55a92023bc8b3c452da45b497d09ac3329277b63

    SHA256

    1adda12770b77951d21af73819020b39a89b53d933f42a3d9230f9e4f3eece9c

    SHA512

    7da8c248b1fdde764d9469ebdad7193be767a08a3f81c4162123faac90883a751887081f968c57fcf360f65970e922bfc01c373f65d8fab8f2413ec2926416ea

  • /data/data/gzroi.klwx.exv/no_backup/androidx.work.workdb-wal

    Filesize

    112KB

    MD5

    731ed73b217d12b7ef26ff25926432b2

    SHA1

    12ce3136c784a38b604a6c336be6b925855d9510

    SHA256

    ab620f80d2b8de5a0672c18f700cbfb53fad5011e85783ce1d4378e84de358ee

    SHA512

    f635bd7e66fb8fda3c35fb2edc548eacbb82ec1524c00d501def33effeb8cc784579fdc975ea33053d50c2faf68f1a26c2d6b594520ec2738e4f55dc575056f7

  • /data/data/gzroi.klwx.exv/no_backup/androidx.work.workdb-wal

    Filesize

    120KB

    MD5

    a330c8751093a442e87af04e353d4119

    SHA1

    835d03a77271276e4517be21d777eb841112775b

    SHA256

    518c71aa25b032226eb389f1576b979a1005ed5e703948396d4aa05c3fef0dcd

    SHA512

    3dbc64475b1452289ab70dd558180a7fc626537caf6e52c2bc4e99d921e106d7ea71f97c76cd22bc334c718f04c601fde856bc1ed25c01533b5870148abd8a7f

  • /data/user/0/gzroi.klwx.exv/app_dex/classes.dex

    Filesize

    7.0MB

    MD5

    20b29cb573ded8b6a13c639458d1a783

    SHA1

    3fc176711d8d93d7c8426d29b8bb0656d5210e10

    SHA256

    eaa5f5643c65baa3aa0ec2eb168def2d11a9178458d45b2551422419437030f8

    SHA512

    55988383a8b37b36b71e82e8c588f6ae58a1a85d530bded145c68ddac440775b2673629a1ae98467a567858dabe2e8094c67cf9ca81cecadc6d7c20157dbe027