Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

General

  • Target

    5a3be6fc5770833a89dd161f99a8524d.bin

  • Size

    2.7MB

  • Sample

    241107-bpyrvsserk

  • MD5

    1655fb67cd31bd50e8b1c8cf7323f031

  • SHA1

    9eefa20ea1eec02e393aab3c6b3efc1918555562

  • SHA256

    e68de44e061c2abf41054c250c90ac73690ab84c6d9bf377e8fb083de12e1fd7

  • SHA512

    1703d78282c88a902ae17464dc904fa10f3da40288d2b13933ef61383b5ffc4552082894a66d5b3272b3b02dfa419a9269d403d2546c4fbd5a0746d7c07dd12f

  • SSDEEP

    49152:/3bugnDdmdfMDsZK1ODFMSC5fR1xqDFeKRUNCNIFaKzik3Ne51Nbjg1oSk:/aLftK1UyD1cBeN9piR51Nbj9j

Malware Config

Extracted

Family

spynote

C2

5.42.92.94:7771

Targets

    • Target

      ab0f060436d72273ca8fe20dcadb157b4aa908ee09920d591f9a408c5e9b44f5.zip

    • Size

      3.7MB

    • MD5

      5a3be6fc5770833a89dd161f99a8524d

    • SHA1

      bc2a646e7c9a434deaec6b0557d28550ec43d29f

    • SHA256

      ab0f060436d72273ca8fe20dcadb157b4aa908ee09920d591f9a408c5e9b44f5

    • SHA512

      adca2e008265e654753545b00e62540a015df7d1a5a67b66592a74e99d774f6b8a5a94432c5c37fb7fbe72d7e338e6aee74087d42f43f69a06033207bbca8539

    • SSDEEP

      49152:J4ikEUeQTOeYqIzdGGaoX0cgZz3v1Yq0loidiJWpL6gMTVyRyR0fumz49:OTEzBlX0tZBYq0GikSL5MxT0fumz49

    • Removes its main activity from the application launcher

    • Loads dropped Dex/Jar

      Runs executable file dropped to the device during analysis.

    • Makes use of the framework's Accessibility service

      Retrieves information displayed on the phone screen using AccessibilityService.

    • Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps)

    • Acquires the wake lock

    • Makes use of the framework's foreground persistence service

      Application may abuse the framework's foreground service to continue running in the foreground.

    • Performs UI accessibility actions on behalf of the user

      Application may abuse the accessibility service to prevent their removal.

    • Queries information about active data network

    • Requests disabling of battery optimizations (often used to enable hiding in the background).

MITRE ATT&CK Mobile v15

Tasks