Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Resubmissions

28/10/2024, 10:08

241028-l6fygsxanm 10

01/10/2024, 22:09

241001-127yqsshjn 10

Analysis

  • max time kernel
    19s
  • max time network
    32s
  • platform
    android_x86
  • resource
    android-x86-arm-20240624-en
  • resource tags

    androidarch:armarch:x86image:android-x86-arm-20240624-enlocale:en-usos:android-9-x86system
  • submitted
    28/10/2024, 10:08

General

  • Target

    b7b60b806acdefe08a6ee3e1429abe1bf0fc615cfa0eb3e26e0fcd8db40ea5b2.apk

  • Size

    4.8MB

  • MD5

    f8803e10a0c287963227ee12bf47ccdc

  • SHA1

    29289d93968413a7329403271904bb20ac428028

  • SHA256

    b7b60b806acdefe08a6ee3e1429abe1bf0fc615cfa0eb3e26e0fcd8db40ea5b2

  • SHA512

    c83ecd35908a644fe6eb5d0849f30c3d67280dfd88c82f7f3191917cb3a0c320ad2e7eed2709eb4f5fcb6cdeb02cbcf0d3a4ab00f47dc60432f04dc7a6fa9e5b

  • SSDEEP

    49152:mRsEXhxb0rKRmj7945iS7xrGXrMuoGyjVKScXlMAbit/YI8lLLGYTCk/FgPj:mRswwrEmj7+5iSRGhMVKUJ/7yG4CegPj

Malware Config

Extracted

Family

octo

AES_key
AES_key

Signatures

Processes

  • com.dmanualcapturen
    1⤵
    • Loads dropped Dex/Jar
    • Makes use of the framework's Accessibility service
    • Acquires the wake lock
    • Makes use of the framework's foreground persistence service
    • Queries the mobile country code (MCC)
    • Requests disabling of battery optimizations (often used to enable hiding in the background).
    • Registers a broadcast receiver at runtime (usually for listening for system events)
    • Uses Crypto APIs (Might try to encrypt user data)
    • Checks CPU information
    • Checks memory information
    PID:4216

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • /data/data/com.dmanualcapturen/.global.com.dmanualcapturen

    Filesize

    48B

    MD5

    046a414913add6f5bb60072c7db819b6

    SHA1

    451ee4f6809260aec622d772fd329c7d0297a842

    SHA256

    b66c1320cb063a1d391c94273572ea6edae76c8c8b0a07f8d75c88686f0df72a

    SHA512

    4e6355f3051ed5e811ab030abde1f5be7f5e1cf33be99cd08477e9b6c015deb1d8bd75a09fb9c7176b8511c5ad0a67abc0902a3531e97564ccb6afc57496a47c

  • /data/data/com.dmanualcapturen/files/.x

    Filesize

    307KB

    MD5

    4e73947cabb5db3f92ca85004981b754

    SHA1

    6d9667fdb0280ed2dcb782b4683e422a51bdc601

    SHA256

    6db94232e756b90ed437f1bc87dc38cf20fb2e7c7a19a5e40c6c17254b7e234c

    SHA512

    be8b500a7070af1dfb53b0cf1a7b327dadc4e163a6dad905496ac228c58cd1ed87b054533917924455d35e9b300683ae33e1bcdd91935a5dbae1d693c3e13d69

  • Anonymous-DexFile@0xd25f8000-0xd267b674

    Filesize

    525KB

    MD5

    4204f12a7d613f480012522c0986db9a

    SHA1

    12c902c5cad599260a7d1828aaa81f0967bfdcf5

    SHA256

    3908b3c3416d43c1d3b3e0b9c80c9dd9ebff610702b2d4a0520e267fe6554858

    SHA512

    1598f6555c3d1e88368c13c2f84acc9173964afc667222ea99d33390f96127d6979309fc772194b039e1b0bcc0cbc3b7bdd5f742c73c88fd526192b0a4831090