Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    149s
  • max time network
    146s
  • platform
    android_x64
  • resource
    android-x64-20240624-en
  • resource tags

    androidarch:x64arch:x86image:android-x64-20240624-enlocale:en-usos:android-10-x64system
  • submitted
    13/10/2024, 22:04

General

  • Target

    a7785fd1e6819409cbba7c2f4be79fa3cf13ad5ce10353ac07f5eaf1ccc6111d.apk

  • Size

    205KB

  • MD5

    20c14add61e01e2f4ebf4dd3927869e2

  • SHA1

    255025116ebe94afc079b24aa2fc4337552e9d1a

  • SHA256

    a7785fd1e6819409cbba7c2f4be79fa3cf13ad5ce10353ac07f5eaf1ccc6111d

  • SHA512

    6f2251ca239c3ba15b5a096e1d94aff88ef9a8234747acccfd42645f9c3f8f1d23814fa1ca776c2e7d88e138f3c9f68b2e416ec4c8cb0c75af43e9350fcd972b

  • SSDEEP

    6144:Mbk5Aoycx5L9DIdLulwVRGQyGWxCLTJK08LDYIro:r5wcxx9D6AwHGQyGWwRR8LDYIro

Malware Config

Extracted

Family

xloader_apk

C2

http://91.204.226.105:28844

DES_key

Signatures

Processes

  • sp.nlsfub.yswev
    1⤵
    • Checks if the Android device is rooted.
    • Removes its main activity from the application launcher
    • Loads dropped Dex/Jar
    • Queries account information for other applications stored on the device
    • Reads the contacts stored on the device.
    • Reads the content of the MMS message.
    • Acquires the wake lock
    • Makes use of the framework's foreground persistence service
    • Queries information about active data network
    • Queries information about the current Wi-Fi connection
    • Registers a broadcast receiver at runtime (usually for listening for system events)
    • Uses Crypto APIs (Might try to encrypt user data)
    PID:4956

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • /data/data/sp.nlsfub.yswev/files/dex

    Filesize

    454KB

    MD5

    dccd8cb67405ad4d9b53e36c040d53b9

    SHA1

    ddba058c9cf0ad4e594c4885e7bb71a7a4442856

    SHA256

    8c221b88e6755f04827bf176521a83a6e06ac054b3edca7aeb7c743a41fa01e6

    SHA512

    28a25885bb0bd38d28ba3118a25253b41e17211fc00af2df6ee55ed70b8ea08862afab0661fd9db3085403bbb224f2231850b695f09bd94044e45574c27114ab

  • /data/data/sp.nlsfub.yswev/files/oat/dex.cur.prof

    Filesize

    1KB

    MD5

    c1e4e7bd47af64e6914a3d6c20df8ab3

    SHA1

    9b2c466f59abc45c3cee7bb552ae8bd5e7a8277a

    SHA256

    b19eb6f096ebd66c4458b98bf5eff5020a1d7653694aaa78166c81c7b7a3ed01

    SHA512

    3f8303f0641a0eb90cf7086f31ed18540386292d99779c2ecd831b9bf6d5f48d71d19bb41458ac2fbcb0cc83e5f563872412614d58306c56906da60f566f0837

  • /storage/emulated/0/.msg_device_id.txt

    Filesize

    36B

    MD5

    be77b75ce554fc19c3bab530d08827c3

    SHA1

    24243dc9041bfe3fa681f7596f2af5cc530469d5

    SHA256

    bafa64e3f6607818c663d3cbcf5a4a2c15c7731ff7677efc61312d820ff3005e

    SHA512

    596d59e957c0b9fe5f571680f511ac6e1523eb61333e4074df0def57ece4c500a7aed1f3b31c1a8e2c85b78b2cc4625f3f03d20d31952650928c535bcd54b53b