Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    148s
  • max time network
    156s
  • platform
    android_x64
  • resource
    android-33-x64-arm64-20240624-en
  • resource tags

    androidarch:arm64arch:x64image:android-33-x64-arm64-20240624-enlocale:en-usos:android-13-x64system
  • submitted
    23/10/2024, 01:08

General

  • Target

    20287210b895881c40325a049469fd24d2c7ee5ef85b88365373560d93c66ed6.apk

  • Size

    565KB

  • MD5

    76e4485c5843b9351337aa571b547a89

  • SHA1

    8719a08fc2acab16ba4b1a8f1ae3d8f4a500a3fb

  • SHA256

    20287210b895881c40325a049469fd24d2c7ee5ef85b88365373560d93c66ed6

  • SHA512

    457a85063f2a25ab2e60dd2d56c3bfe1e67358c0af6da80829fc25ce809b046b579493b1cbc28f999f5763cbef9004ec4ac1aae238107a23619d44e8b66f6f22

  • SSDEEP

    12288:XlPneXRi2ZYdJPodteXB/vxS8ASacqMwNkPQSIydRBk0zTL7o9Hp:XlPneXRuPodteX5xS8fazCYyZ16

Malware Config

Extracted

Family

octo

C2

https://94.156.253.20/NzNlMDMzYWExMzk1/

https://staris7542352r23.net/NzNlMDMzYWExMzk1/

https://staris6442352r23.net/NzNlMDMzYWExMzk1/

https://staris5342352r23.net/NzNlMDMzYWExMzk1/

https://staris4242352r23.net/NzNlMDMzYWExMzk1/

https://staris3142352r23.net/NzNlMDMzYWExMzk1/

rc4.plain

Extracted

Family

octo

C2

https://94.156.253.20/NzNlMDMzYWExMzk1/

https://staris7542352r23.net/NzNlMDMzYWExMzk1/

https://staris6442352r23.net/NzNlMDMzYWExMzk1/

https://staris5342352r23.net/NzNlMDMzYWExMzk1/

https://staris4242352r23.net/NzNlMDMzYWExMzk1/

https://staris3142352r23.net/NzNlMDMzYWExMzk1/

AES_key

Signatures

Processes

  • com.staroutra
    1⤵
    • Loads dropped Dex/Jar
    • Makes use of the framework's Accessibility service
    • Acquires the wake lock
    • Makes use of the framework's foreground persistence service
    • Performs UI accessibility actions on behalf of the user
    • Queries the mobile country code (MCC)
    • Requests accessing notifications (often used to intercept notifications before users become aware).
    • Requests disabling of battery optimizations (often used to enable hiding in the background).
    • Uses Crypto APIs (Might try to encrypt user data)
    PID:4316

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • /data/user/0/com.staroutra/cache/bgbormjclb

    Filesize

    450KB

    MD5

    624242a4adcbab67562e5a5a8679b48c

    SHA1

    5a5f811d12980a914a3ba07f6d8b75f87dc8fe83

    SHA256

    42c328cb6baa61759f25454dddfc3f4ce2907009f07040efbca6a40374780457

    SHA512

    a7dde54382486211a1bab953e9ab60ee8031f47bd57c065950bc01cd161732cfee6628cc047b9339e84642b64136d8d7cabbb0ddcd62187006b8474d06b481e0

  • /data/user/0/com.staroutra/cache/oat/bgbormjclb.cur.prof

    Filesize

    375B

    MD5

    79db14f9bbe6f8ddf2efcd4907440a45

    SHA1

    e0316f86734da06098fb9fe7733637a68753f3c9

    SHA256

    521a570bd24bd93ed1f7411471f757e1f861bbfa5ef778a237e85b8334ea8cd2

    SHA512

    aebf2e645b64631f97fe95797f05f7efcd525cf227825b62b01f0eb06cf31352dd5d18756714ed99233eda8c3d350ce0abbb4dca93abe83a729208800a5f685f