Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    149s
  • max time network
    151s
  • platform
    android-11_x64
  • resource
    android-x64-arm64-20240910-en
  • resource tags

    arch:armarch:arm64arch:x64arch:x86image:android-x64-arm64-20240910-enlocale:en-usos:android-11-x64system
  • submitted
    27/10/2024, 22:02

General

  • Target

    c295c25e6fd8963b2a77e6f4a0a4f9c48703763297276b7e9ad2b3f3ed672850.apk

  • Size

    209KB

  • MD5

    ec0115a2d43efa9caa8e20ffab746cc6

  • SHA1

    58da04b774e7602cd16dd4d8fb718bee9b89e7b2

  • SHA256

    c295c25e6fd8963b2a77e6f4a0a4f9c48703763297276b7e9ad2b3f3ed672850

  • SHA512

    d13be482823a142ba22280a1cd6e756ab07a3c99d9b509a9bbd8e7fa12eddc5d677dfce2e6f2cb7a012a386ace598b463ff4423ad3132cfa9c0272e52ff4d0ae

  • SSDEEP

    6144:jSnwVofClI+u5mUqbTVm94FNIdlebxFJY:unKofCFu8U4TAivIdIbxFJY

Malware Config

Extracted

Family

xloader_apk

C2

http://91.204.226.105:28844

DES_key

Signatures

Processes

  • p.lm.nv
    1⤵
    • Checks if the Android device is rooted.
    • Removes its main activity from the application launcher
    • Loads dropped Dex/Jar
    • Queries account information for other applications stored on the device
    • Reads the contacts stored on the device.
    • Reads the content of the MMS message.
    • Acquires the wake lock
    • Makes use of the framework's foreground persistence service
    • Queries information about active data network
    • Queries information about the current Wi-Fi connection
    • Requests changing the default SMS application.
    • Uses Crypto APIs (Might try to encrypt user data)
    PID:4852

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • /data/user/0/p.lm.nv/files/d

    Filesize

    453KB

    MD5

    303ba9f99e501b9d01b3c4e8036f7995

    SHA1

    53196b13f94d7797527cc57742ce6d7b62aae36e

    SHA256

    9614110dedb36006ad490df5f5ab55975d8c7ea20c24f4a6479b9da8a946e7f0

    SHA512

    ef95d56bd53bc3098985a279922657d66d08912bbfe1b5e5c7adb3c4d6267e79ecea28c15036ae023b3c1b052cca9e3111f9a868f7f4178f14db7eaa297e432d

  • /storage/emulated/0/.msg_device_id.txt

    Filesize

    36B

    MD5

    8ca037df7bd2b54a293c4faba1d7f209

    SHA1

    50f34c23fbcb6beb6d35bebae9476c85e8660e62

    SHA256

    6079473ab1ee76295f98ec86f24c4e745b4d0ecee4fd105bd70eccde71629393

    SHA512

    907e4f6e62b0d3b30c8b36c9bb7c4e710f03adeebfddac547fa86076b7540c0e6b68fa45689355cb7825f44d183ff77d6ed96cb7773e61c98607df97eea1f058