Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    149s
  • max time network
    154s
  • platform
    android_x64
  • resource
    android-33-x64-arm64-20240624-en
  • resource tags

    androidarch:arm64arch:x64image:android-33-x64-arm64-20240624-enlocale:en-usos:android-13-x64system
  • submitted
    25/11/2024, 12:32

General

  • Target

    16223878c9b68f4322d26277531118df56576d5733b660140e2fd8a8d295e5de.apk

  • Size

    4.8MB

  • MD5

    de2f01afd5393b676b711bbc551da363

  • SHA1

    8626848f4c94b54510d529288ab721285e8e6805

  • SHA256

    16223878c9b68f4322d26277531118df56576d5733b660140e2fd8a8d295e5de

  • SHA512

    094d35d71d2318a8786ed732f668030df4567f688152f16c29ac3c1501a26b0e495d8d709144d9416e80858041ead7b896343fd322175e7fa01ac34f735a58b1

  • SSDEEP

    98304:fRssD7QGx3XZ5iSRGhiVKNTaOVit/wrtzoc:fRFfQ83XZrlUNmOo6Uc

Malware Config

Extracted

Family

octo

C2

https://26b62bcc993cfb69c185d1d96ad3a88a.online

https://46b849dba7aa7a19f7afd6c12057b5aa.top

https://1bf4759a73fdda578e00ab300b716f3e.xyz

AES_key
AES_key

Signatures

Processes

  • com.home_assurancess38
    1⤵
    • Loads dropped Dex/Jar
    • Makes use of the framework's Accessibility service
    • Obtains sensitive information copied to the device clipboard
    • Acquires the wake lock
    • Makes use of the framework's foreground persistence service
    • Queries the mobile country code (MCC)
    • Requests disabling of battery optimizations (often used to enable hiding in the background).
    • Uses Crypto APIs (Might try to encrypt user data)
    • Checks CPU information
    • Checks memory information
    PID:4313

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • /data/data/com.home_assurancess38/.global.com.home_assurancess38

    Filesize

    48B

    MD5

    046a414913add6f5bb60072c7db819b6

    SHA1

    451ee4f6809260aec622d772fd329c7d0297a842

    SHA256

    b66c1320cb063a1d391c94273572ea6edae76c8c8b0a07f8d75c88686f0df72a

    SHA512

    4e6355f3051ed5e811ab030abde1f5be7f5e1cf33be99cd08477e9b6c015deb1d8bd75a09fb9c7176b8511c5ad0a67abc0902a3531e97564ccb6afc57496a47c

  • /data/data/com.home_assurancess38/files/.m

    Filesize

    322KB

    MD5

    77dc50489b9323274732d27dc8a4e803

    SHA1

    0e02a3595b62489d0739d771881da8604d117c65

    SHA256

    c5684e792d1ebefea6aac09fed45911703fd58c899f8a08133d49dd91429a820

    SHA512

    0684a92f3e9c525384cfa53f531afba61e5930e1c27032a7e27e3315f72761b62e122dc34768d8162ba08f9bed53d148aa8dc034b46456bdd211f230637eba58

  • /data/data/com.home_assurancess38/oat/x86_64/[email protected]

    Filesize

    13KB

    MD5

    196101494a7fb6698919f203a0a2c185

    SHA1

    a3d4b13c0adfd0412d09febc3f3d437246cb7061

    SHA256

    7309e6cdbb503cd1799a953fe15a521944d56839500a1f25befbc506f134e692

    SHA512

    de7eeaab8d2ed52c74f74cf2e69b1fa7afb863bd16eeda42c385f8c9456460361c5b7db7f0c808f05983f22020a8433819c39e702b1ade90d6c598e01fb1a697

  • /data/user/0/com.home_assurancess38/[email protected]

    Filesize

    526KB

    MD5

    435f223f1c6aa67daddd947d61986353

    SHA1

    1b3dd2a9eec283a169a6e684a08ffc3571eb4544

    SHA256

    7ba1ce033f310c01dd9c5e19c9358c1f08f627f7c069bb45be480d247d9a4bbd

    SHA512

    656fc22b466eaa060a85dbd0a2f700dff28ffd2f60703df7343f6290d01a39502f0062abef40caea33010b57e5e421d86e435574b04c557608f23e28e4a273dd