Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    23s
  • max time network
    149s
  • platform
    android-9_x86
  • resource
    android-x86-arm-20240910-en
  • resource tags

    arch:armarch:x86image:android-x86-arm-20240910-enlocale:en-usos:android-9-x86system
  • submitted
    19/10/2024, 22:07

General

  • Target

    272a0819eb3afcde6c9f0687fe664d8a89ffa543bc876fccfda0aadbaac2b112.apk

  • Size

    2.4MB

  • MD5

    48aafd1ec2f75c0f09587d8533e42c37

  • SHA1

    b4fff9603f80eba57523b92086074afa271323fa

  • SHA256

    272a0819eb3afcde6c9f0687fe664d8a89ffa543bc876fccfda0aadbaac2b112

  • SHA512

    754c01837ed07eddc7da6c3a80e250beebf47e8dda0067b0e0f81ecdb354df102d79c0ba46d4c0c1563f61a5659d06c50456cd2a44ac7628b0cf06b0c0240694

  • SSDEEP

    49152:uZdec5HFSLHEmQpquVvmcjGvRERcVk/qbkkpjRfkQFV:ueowNQxjGvRDVqepFskV

Malware Config

Extracted

Family

octo

C2

https://pethsop332.com/MzQ1Yzk1ZGQ4ODY3/

https://2pethsop332.com/MzQ1Yzk1ZGQ4ODY3/

https://3pethsop332.com/MzQ1Yzk1ZGQ4ODY3/

https://4pethsop332.com/MzQ1Yzk1ZGQ4ODY3/

https://5pethsop332.com/MzQ1Yzk1ZGQ4ODY3/

https://6pethsop332.com/MzQ1Yzk1ZGQ4ODY3/

rc4.plain

Extracted

Family

octo

C2

https://pethsop332.com/MzQ1Yzk1ZGQ4ODY3/

https://2pethsop332.com/MzQ1Yzk1ZGQ4ODY3/

https://3pethsop332.com/MzQ1Yzk1ZGQ4ODY3/

https://4pethsop332.com/MzQ1Yzk1ZGQ4ODY3/

https://5pethsop332.com/MzQ1Yzk1ZGQ4ODY3/

https://6pethsop332.com/MzQ1Yzk1ZGQ4ODY3/

AES_key

Signatures

Processes

  • com.openwayp
    1⤵
    • Removes its main activity from the application launcher
    • Loads dropped Dex/Jar
    • Makes use of the framework's Accessibility service
    • Acquires the wake lock
    • Makes use of the framework's foreground persistence service
    • Performs UI accessibility actions on behalf of the user
    • Queries the mobile country code (MCC)
    • Requests accessing notifications (often used to intercept notifications before users become aware).
    • Requests disabling of battery optimizations (often used to enable hiding in the background).
    • Registers a broadcast receiver at runtime (usually for listening for system events)
    • Uses Crypto APIs (Might try to encrypt user data)
    PID:4345

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • /data/data/com.openwayp/cache/pyyalma

    Filesize

    2.3MB

    MD5

    bee2f42db09b71409f321c626c1c3d50

    SHA1

    edfca73df77b55e604738960c93d238e5b609753

    SHA256

    2bd86f09d781f4468a0c73e811bdbda3459741d203b75a55d64b1b3e2b3ee3d3

    SHA512

    79a19dcef974ed3376686c225d22d00e890c65cbf6ceb87ed4c752b3a958e024636fc7fe880bd0579d9b5111cd5b89392c95ab53edb0ece67603e8e20f99c52d