Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    149s
  • max time network
    159s
  • platform
    android_x64
  • resource
    android-33-x64-arm64-20240624-en
  • resource tags

    androidarch:arm64arch:x64image:android-33-x64-arm64-20240624-enlocale:en-usos:android-13-x64system
  • submitted
    08/11/2024, 22:14

General

  • Target

    dc01d67f81c5aac9d9cbf742976a3c457a679feab28fe0b1b052359642b0ffcd.apk

  • Size

    4.8MB

  • MD5

    4a45ff0bff85bd92ade53b1c48bcfb44

  • SHA1

    0676be9e79da7b571b666bdd80a60e4a5a8ed880

  • SHA256

    dc01d67f81c5aac9d9cbf742976a3c457a679feab28fe0b1b052359642b0ffcd

  • SHA512

    322101cfc7e17baaadbb98f94f48f3cd1f13205eb9bc0cc723f722419c63ea6c5aed5be3a44d7a29020cb21d6fcef6c8df40b6775e2d6854f49f791b174aae5a

  • SSDEEP

    98304:HRstxob3XU5iSRGj+VKw4bwWxaM8GZim3MP:HRgc3XUrbUtbDBgN

Malware Config

Extracted

Family

octo

C2

https://df4b27dc1e1efef7e8b0ecfbd54b2dd3.xyz

AES_key
AES_key

Signatures

Processes

  • com.ssaccess74gmsconfigwriting
    1⤵
    • Loads dropped Dex/Jar
    • Makes use of the framework's Accessibility service
    • Obtains sensitive information copied to the device clipboard
    • Acquires the wake lock
    • Makes use of the framework's foreground persistence service
    • Queries the mobile country code (MCC)
    • Requests disabling of battery optimizations (often used to enable hiding in the background).
    • Uses Crypto APIs (Might try to encrypt user data)
    • Checks CPU information
    • Checks memory information
    PID:4320

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • /data/data/com.ssaccess74gmsconfigwriting/.global.com.ssaccess74gmsconfigwriting

    Filesize

    48B

    MD5

    046a414913add6f5bb60072c7db819b6

    SHA1

    451ee4f6809260aec622d772fd329c7d0297a842

    SHA256

    b66c1320cb063a1d391c94273572ea6edae76c8c8b0a07f8d75c88686f0df72a

    SHA512

    4e6355f3051ed5e811ab030abde1f5be7f5e1cf33be99cd08477e9b6c015deb1d8bd75a09fb9c7176b8511c5ad0a67abc0902a3531e97564ccb6afc57496a47c

  • /data/data/com.ssaccess74gmsconfigwriting/files/.n

    Filesize

    322KB

    MD5

    77dc50489b9323274732d27dc8a4e803

    SHA1

    0e02a3595b62489d0739d771881da8604d117c65

    SHA256

    c5684e792d1ebefea6aac09fed45911703fd58c899f8a08133d49dd91429a820

    SHA512

    0684a92f3e9c525384cfa53f531afba61e5930e1c27032a7e27e3315f72761b62e122dc34768d8162ba08f9bed53d148aa8dc034b46456bdd211f230637eba58

  • /data/data/com.ssaccess74gmsconfigwriting/oat/x86_64/[email protected]

    Filesize

    13KB

    MD5

    16794d5f02b1a56549ca4714fb71bb8c

    SHA1

    efab75b9738210d561ea55a44129565f42dd6068

    SHA256

    1abd588a23b1602d54b01f794506c16672c616489a6b7784b03b7a27c4ab2695

    SHA512

    bba023a2cb98046257f0d2cf4d8b8b6ab59dba80fbadf242f29c19cf2bb88e5c24fdc5a0a615887e926147ef2468551d06089357fd071df053be045d9cbcb120

  • /data/user/0/com.ssaccess74gmsconfigwriting/[email protected]

    Filesize

    526KB

    MD5

    29d3300972f0b29e89b1bf7c044e7c82

    SHA1

    513122bc855b7e740071c73a3e2b3f9bbf8d23ba

    SHA256

    9809619ee1de4d235158af44c4c829f5573563ee60de6e2006ad5e5a4451fd60

    SHA512

    9e50a20c9489af96f1541df90624dd2d66d4215914b4581161252906c7615d9615c6b499106bea3be0c18baea0d409b5e6bf77d5cb92645f70ff1475b1302f6d