Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

10

Static

static

6

32f9051276...37.apk

android-9-x86

10

32f9051276...37.apk

android-10-x64

10

Analysis

  • max time kernel
    149s
  • max time network
    151s
  • platform
    android-9_x86
  • resource
    android-x86-arm-20240910-en
  • resource tags

    arch:armarch:x86image:android-x86-arm-20240910-enlocale:en-usos:android-9-x86system
  • submitted
    15/12/2024, 22:04 UTC

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    32f9051276d4e4312f2b6024d1a6450edc63e106eb0426adfbae9fa173064c37.apk

  • Size

    1.5MB

  • MD5

    26febd1a3c568774cd24c8184587716b

  • SHA1

    8dce7aae83e810ce2f905647950f7afe9f229161

  • SHA256

    32f9051276d4e4312f2b6024d1a6450edc63e106eb0426adfbae9fa173064c37

  • SHA512

    69b4a619d50eb7cf4e8e7a85ab84c6636873b84f7511a11ac600b40c7f3ef70b49e8ca1b9ae673158b155b5197581695d0f712038e25689548a95ee9fde80e6f

  • SSDEEP

    24576:C+rYJUnjHhecDx8CFsux6OuVzzxC6vboYOYCbmOn+TRFymbSH80D8kvMhFxWusht:CWY27heMVx9slOr+9FyHH80Ddvll1xi2

Score
10/10
octobankercollectioncredential_accessdiscoveryevasionimpactinfostealerpersistenceratstealthtrojan

Malware Config

Extracted

Family

octo

C2

https://hayatvesanatguzellikduygusu.xyz/YmJlYTFiODdkMjcz/

https://mutlulukvesessizlikyolculugu.xyz/YmJlYTFiODdkMjcz/

https://yasamvesahtekarguzellik.xyz/YmJlYTFiODdkMjcz/

https://sevincligunlertatminkar.xyz/YmJlYTFiODdkMjcz/

https://dogaltatvesanatyaklasimi.xyz/YmJlYTFiODdkMjcz/

https://hayatlarinhuzurvesessiz.xyz/YmJlYTFiODdkMjcz/

https://keyifligunlerinfirsatlari.xyz/YmJlYTFiODdkMjcz/

https://sevgiiledoluyasamyolu.xyz/YmJlYTFiODdkMjcz/

https://sakinlikvehayatderinligi.xyz/YmJlYTFiODdkMjcz/

https://sanatvesanatcihayatlari.xyz/YmJlYTFiODdkMjcz/

https://ilhamdolubirhayat.xyz/YmJlYTFiODdkMjcz/

https://zenginlikvebasarihikayesi.xyz/YmJlYTFiODdkMjcz/

https://kalpvesanatdostlukhikaye.xyz/YmJlYTFiODdkMjcz/

https://mutlugunlerinyasamayolu.xyz/YmJlYTFiODdkMjcz/

https://yasananhayatinduygular.xyz/YmJlYTFiODdkMjcz/

https://dogaylaisbirligiyolu.xyz/YmJlYTFiODdkMjcz/

https://hosgoruhayatvekultur.xyz/YmJlYTFiODdkMjcz/

https://hayalguclesanatbaglantisi.xyz/YmJlYTFiODdkMjcz/

https://sadelikvehayatfelsefesi.xyz/YmJlYTFiODdkMjcz/

https://dogaldostlukvesanat.xyz/YmJlYTFiODdkMjcz/
rc4.plain
1
ntIkBrPN9abLOCltkM

Extracted

Family

octo

C2

https://hayatvesanatguzellikduygusu.xyz/YmJlYTFiODdkMjcz/

https://mutlulukvesessizlikyolculugu.xyz/YmJlYTFiODdkMjcz/

https://yasamvesahtekarguzellik.xyz/YmJlYTFiODdkMjcz/

https://sevincligunlertatminkar.xyz/YmJlYTFiODdkMjcz/

https://dogaltatvesanatyaklasimi.xyz/YmJlYTFiODdkMjcz/

https://hayatlarinhuzurvesessiz.xyz/YmJlYTFiODdkMjcz/

https://keyifligunlerinfirsatlari.xyz/YmJlYTFiODdkMjcz/

https://sevgiiledoluyasamyolu.xyz/YmJlYTFiODdkMjcz/

https://sakinlikvehayatderinligi.xyz/YmJlYTFiODdkMjcz/

https://sanatvesanatcihayatlari.xyz/YmJlYTFiODdkMjcz/

https://ilhamdolubirhayat.xyz/YmJlYTFiODdkMjcz/

https://zenginlikvebasarihikayesi.xyz/YmJlYTFiODdkMjcz/

https://kalpvesanatdostlukhikaye.xyz/YmJlYTFiODdkMjcz/

https://mutlugunlerinyasamayolu.xyz/YmJlYTFiODdkMjcz/

https://yasananhayatinduygular.xyz/YmJlYTFiODdkMjcz/

https://dogaylaisbirligiyolu.xyz/YmJlYTFiODdkMjcz/

https://hosgoruhayatvekultur.xyz/YmJlYTFiODdkMjcz/

https://hayalguclesanatbaglantisi.xyz/YmJlYTFiODdkMjcz/

https://sadelikvehayatfelsefesi.xyz/YmJlYTFiODdkMjcz/

https://dogaldostlukvesanat.xyz/YmJlYTFiODdkMjcz/
Attributes
  • target_apps

    at.spardat.bcrmobile

    at.spardat.netbanking

    com.bankaustria.android.olb

    com.bmo.mobile

    com.cibc.android.mobi

    com.rbc.mobile.android

    com.scotiabank.mobile

    com.td

    cz.airbank.android

    eu.inmite.prj.kb.mobilbank

    com.bankinter.launcher

    com.kutxabank.android

    com.rsi

    com.tecnocom.cajalaboral

    es.bancopopular.nbmpopular

    es.evobanco.bancamovil

    es.lacaixa.mobile.android.newwapicon

    com.dbs.hk.dbsmbanking

    com.FubonMobileClient

    com.hangseng.rbmobile

    com.MobileTreeApp

    com.mtel.androidbea

    com.scb.breezebanking.hk

    hk.com.hsbc.hsbchkmobilebanking

    com.aff.otpdirekt

    com.ideomobile.hapoalim

    com.infrasofttech.indianBank

    com.mobikwik_new

    com.oxigen.oxigenwallet

    jp.co.aeonbank.android.passbook

AES_key
1
3534353639643261616165373137363333356136376266373265383637333666

Signatures

  • Octo

    Octo is a banking malware with remote access capabilities first seen in April 2022.

    bankertrojaninfostealerratocto
  • Octo family
    octo
  • Octo payload 2 IoCs
  • Removes its main activity from the application launcher 1 TTPs 1 IoCs
    stealthtrojanevasion
  • Loads dropped Dex/Jar 1 TTPs 2 IoCs

    Runs executable file dropped to the device during analysis.

    evasion
  • Makes use of the framework's Accessibility service 4 TTPs 2 IoCs

    Retrieves information displayed on the phone screen using AccessibilityService.

    collectionevasioncredential_access
  • Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
    bankerdiscovery
  • Queries the phone number (MSISDN for GSM devices) 1 TTPs
    discovery
  • Acquires the wake lock 1 IoCs
  • Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs

    Application may abuse the framework's foreground service to continue running in the foreground.

    evasionpersistence
  • Performs UI accessibility actions on behalf of the user 1 TTPs 4 IoCs

    Application may abuse the accessibility service to prevent their removal.

    evasion
  • Queries the mobile country code (MCC) 1 TTPs 1 IoCs
    discovery
  • Queries the unique device ID (IMEI, MEID, IMSI) 1 TTPs
    discovery
  • Requests accessing notifications (often used to intercept notifications before users become aware). 1 TTPs 1 IoCs
    collectioncredential_access
  • Requests disabling of battery optimizations (often used to enable hiding in the background). 1 TTPs 1 IoCs
    evasion
  • Requests modifying system settings. 1 IoCs
    evasion
  • Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs
    persistence
  • Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs
    impact

Processes

  • com.adjust.glove
    1⤵
    • Removes its main activity from the application launcher
    • Loads dropped Dex/Jar
    • Makes use of the framework's Accessibility service
    • Acquires the wake lock
    • Makes use of the framework's foreground persistence service
    • Performs UI accessibility actions on behalf of the user
    • Queries the mobile country code (MCC)
    • Requests accessing notifications (often used to intercept notifications before users become aware).
    • Requests disabling of battery optimizations (often used to enable hiding in the background).
    • Requests modifying system settings.
    • Registers a broadcast receiver at runtime (usually for listening for system events)
    • Uses Crypto APIs (Might try to encrypt user data)
    PID:4218
    • /system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.adjust.glove/app_sketch/SG.json --output-vdex-fd=41 --oat-fd=42 --oat-location=/data/user/0/com.adjust.glove/app_sketch/oat/x86/SG.odex --compiler-filter=quicken --class-loader-context=&
      2⤵
      • Loads dropped Dex/Jar
      PID:4243

Network

  • flag-us
    DNS
    keyifligunlerinfirsatlari.xyz
    Remote address:
    1.1.1.1:53
    Request
    keyifligunlerinfirsatlari.xyz
    IN A
    Response
  • flag-us
    DNS
    www.ip-api.com
    Remote address:
    1.1.1.1:53
    Request
    www.ip-api.com
    IN A
    Response
    www.ip-api.com
    IN A
    208.95.112.1
  • flag-us
    DNS
    hosgoruhayatvekultur.xyz
    Remote address:
    1.1.1.1:53
    Request
    hosgoruhayatvekultur.xyz
    IN A
    Response
  • flag-us
    GET
    http://www.ip-api.com/json
    Remote address:
    208.95.112.1:80
    Request
    GET /json HTTP/1.1
    Host: www.ip-api.com
    Connection: Keep-Alive
    Response
    HTTP/1.1 200 OK
    Date: Sun, 15 Dec 2024 22:04:27 GMT
    Content-Type: application/json; charset=utf-8
    Content-Length: 291
    Access-Control-Allow-Origin: *
    X-Ttl: 60
    X-Rl: 44
  • flag-us
    DNS
    sadelikvehayatfelsefesi.xyz
    Remote address:
    1.1.1.1:53
    Request
    sadelikvehayatfelsefesi.xyz
    IN A
    Response
  • flag-us
    DNS
    dogaltatvesanatyaklasimi.xyz
    Remote address:
    1.1.1.1:53
    Request
    dogaltatvesanatyaklasimi.xyz
    IN A
    Response
  • flag-us
    DNS
    sevincligunlertatminkar.xyz
    Remote address:
    1.1.1.1:53
    Request
    sevincligunlertatminkar.xyz
    IN A
    Response
  • flag-us
    DNS
    zenginlikvebasarihikayesi.xyz
    Remote address:
    1.1.1.1:53
    Request
    zenginlikvebasarihikayesi.xyz
    IN A
    Response
  • flag-us
    DNS
    sanatvesanatcihayatlari.xyz
    Remote address:
    1.1.1.1:53
    Request
    sanatvesanatcihayatlari.xyz
    IN A
    Response
  • flag-us
    DNS
    dogaylaisbirligiyolu.xyz
    Remote address:
    1.1.1.1:53
    Request
    dogaylaisbirligiyolu.xyz
    IN A
    Response
  • flag-us
    DNS
    hayatlarinhuzurvesessiz.xyz
    Remote address:
    1.1.1.1:53
    Request
    hayatlarinhuzurvesessiz.xyz
    IN A
    Response
  • flag-us
    DNS
    kalpvesanatdostlukhikaye.xyz
    Remote address:
    1.1.1.1:53
    Request
    kalpvesanatdostlukhikaye.xyz
    IN A
    Response
  • flag-us
    DNS
    hayatvesanatguzellikduygusu.xyz
    Remote address:
    1.1.1.1:53
    Request
    hayatvesanatguzellikduygusu.xyz
    IN A
    Response
  • flag-us
    DNS
    hayalguclesanatbaglantisi.xyz
    Remote address:
    1.1.1.1:53
    Request
    hayalguclesanatbaglantisi.xyz
    IN A
    Response
  • flag-us
    DNS
    yasananhayatinduygular.xyz
    Remote address:
    1.1.1.1:53
    Request
    yasananhayatinduygular.xyz
    IN A
    Response
  • flag-us
    DNS
    ilhamdolubirhayat.xyz
    Remote address:
    1.1.1.1:53
    Request
    ilhamdolubirhayat.xyz
    IN A
    Response
  • flag-us
    DNS
    dogaldostlukvesanat.xyz
    Remote address:
    1.1.1.1:53
    Request
    dogaldostlukvesanat.xyz
    IN A
    Response
    dogaldostlukvesanat.xyz
    IN A
    154.216.16.120
  • flag-us
    POST
    https://dogaldostlukvesanat.xyz/YmJlYTFiODdkMjcz/
    Remote address:
    154.216.16.120:443
    Request
    POST /YmJlYTFiODdkMjcz/ HTTP/1.1
    Packets-sent: 60170
    Content-Encoding: gzip
    Content-Length: 294
    Host: dogaldostlukvesanat.xyz
    Connection: Keep-Alive
    Response
    HTTP/1.1 200 OK
    Server: nginx/1.18.0
    Date: Sun, 15 Dec 2024 22:04:29 GMT
    Content-Type: text/html; charset=UTF-8
    Transfer-Encoding: chunked
    Connection: keep-alive
    Vary: Accept-Encoding
  • flag-us
    POST
    https://dogaldostlukvesanat.xyz/YmJlYTFiODdkMjcz/
    Remote address:
    154.216.16.120:443
    Request
    POST /YmJlYTFiODdkMjcz/ HTTP/1.1
    Packets-sent: 60170
    Content-Encoding: gzip
    Content-Length: 3505
    Host: dogaldostlukvesanat.xyz
    Connection: Keep-Alive
    Response
    HTTP/1.1 200 OK
    Server: nginx/1.18.0
    Date: Sun, 15 Dec 2024 22:04:29 GMT
    Content-Type: text/html; charset=UTF-8
    Transfer-Encoding: chunked
    Connection: keep-alive
    Vary: Accept-Encoding
  • flag-us
    DNS
    semanticlocation-pa.googleapis.com
    Remote address:
    1.1.1.1:53
    Request
    semanticlocation-pa.googleapis.com
    IN A
    Response
    semanticlocation-pa.googleapis.com
    IN A
    216.58.212.234
    semanticlocation-pa.googleapis.com
    IN A
    216.58.201.106
    semanticlocation-pa.googleapis.com
    IN A
    172.217.169.42
    semanticlocation-pa.googleapis.com
    IN A
    142.250.200.10
    semanticlocation-pa.googleapis.com
    IN A
    216.58.213.10
    semanticlocation-pa.googleapis.com
    IN A
    172.217.169.74
    semanticlocation-pa.googleapis.com
    IN A
    142.250.200.42
    semanticlocation-pa.googleapis.com
    IN A
    172.217.16.234
    semanticlocation-pa.googleapis.com
    IN A
    142.250.178.10
    semanticlocation-pa.googleapis.com
    IN A
    142.250.187.234
    semanticlocation-pa.googleapis.com
    IN A
    142.250.179.234
    semanticlocation-pa.googleapis.com
    IN A
    216.58.204.74
    semanticlocation-pa.googleapis.com
    IN A
    216.58.212.202
    semanticlocation-pa.googleapis.com
    IN A
    142.250.187.202
    semanticlocation-pa.googleapis.com
    IN A
    142.250.180.10
    semanticlocation-pa.googleapis.com
    IN A
    172.217.169.10
  • flag-us
    DNS
    android.apis.google.com
    Remote address:
    1.1.1.1:53
    Request
    android.apis.google.com
    IN A
    Response
    android.apis.google.com
    IN CNAME
    clients.l.google.com
    clients.l.google.com
    IN A
    216.58.204.78
  • flag-us
    POST
    https://dogaldostlukvesanat.xyz/YmJlYTFiODdkMjcz/
    Remote address:
    154.216.16.120:443
    Request
    POST /YmJlYTFiODdkMjcz/ HTTP/1.1
    Packets-sent: 60170
    Content-Encoding: gzip
    Content-Length: 2168
    Host: dogaldostlukvesanat.xyz
    Connection: Keep-Alive
    Response
    HTTP/1.1 200 OK
    Server: nginx/1.18.0
    Date: Sun, 15 Dec 2024 22:04:53 GMT
    Content-Type: text/html; charset=UTF-8
    Content-Length: 216
    Connection: keep-alive
    Vary: Accept-Encoding
  • flag-us
    POST
    https://dogaldostlukvesanat.xyz/YmJlYTFiODdkMjcz/
    Remote address:
    154.216.16.120:443
    Request
    POST /YmJlYTFiODdkMjcz/ HTTP/1.1
    Packets-sent: 60170
    Content-Encoding: gzip
    Content-Length: 868
    Host: dogaldostlukvesanat.xyz
    Connection: Keep-Alive
    Response
    HTTP/1.1 200 OK
    Server: nginx/1.18.0
    Date: Sun, 15 Dec 2024 22:05:05 GMT
    Content-Type: text/html; charset=UTF-8
    Content-Length: 216
    Connection: keep-alive
    Vary: Accept-Encoding
  • flag-us
    DNS
    dogaldostlukvesanat.xyz
    Remote address:
    1.1.1.1:53
    Request
    dogaldostlukvesanat.xyz
    IN A
    Response
    dogaldostlukvesanat.xyz
    IN A
    154.216.16.120
  • flag-us
    POST
    https://dogaldostlukvesanat.xyz/YmJlYTFiODdkMjcz/
    Remote address:
    154.216.16.120:443
    Request
    POST /YmJlYTFiODdkMjcz/ HTTP/1.1
    Packets-sent: 60170
    Content-Encoding: gzip
    Content-Length: 426
    Host: dogaldostlukvesanat.xyz
    Connection: Keep-Alive
    Response
    HTTP/1.1 200 OK
    Server: nginx/1.18.0
    Date: Sun, 15 Dec 2024 22:05:31 GMT
    Content-Type: text/html; charset=UTF-8
    Content-Length: 216
    Connection: keep-alive
    Vary: Accept-Encoding
  • flag-us
    DNS
    dogaldostlukvesanat.xyz
    Remote address:
    1.1.1.1:53
    Request
    dogaldostlukvesanat.xyz
    IN A
    Response
    dogaldostlukvesanat.xyz
    IN A
    154.216.16.120
  • flag-us
    POST
    https://dogaldostlukvesanat.xyz/YmJlYTFiODdkMjcz/
    Remote address:
    154.216.16.120:443
    Request
    POST /YmJlYTFiODdkMjcz/ HTTP/1.1
    Packets-sent: 60170
    Content-Encoding: gzip
    Content-Length: 440
    Host: dogaldostlukvesanat.xyz
    Connection: Keep-Alive
    Response
    HTTP/1.1 200 OK
    Server: nginx/1.18.0
    Date: Sun, 15 Dec 2024 22:06:32 GMT
    Content-Type: text/html; charset=UTF-8
    Content-Length: 216
    Connection: keep-alive
    Vary: Accept-Encoding
  • 208.95.112.1:80
    http://www.ip-api.com/json
    http
    328 B
     600 B
     6
    3

    HTTP Request

    GET http://www.ip-api.com/json

    HTTP Response

    200
  • 154.216.16.120:443
    https://dogaldostlukvesanat.xyz/YmJlYTFiODdkMjcz/
    tls, http
    3.0kB
     97.9kB
     43
    74

    HTTP Request

    POST https://dogaldostlukvesanat.xyz/YmJlYTFiODdkMjcz/

    HTTP Response

    200
  • 154.216.16.120:443
    https://dogaldostlukvesanat.xyz/YmJlYTFiODdkMjcz/
    tls, http
    5.0kB
     25.9kB
     19
    26

    HTTP Request

    POST https://dogaldostlukvesanat.xyz/YmJlYTFiODdkMjcz/

    HTTP Response

    200
  • 216.58.201.110:443
    tls, https
    689 B
     40 B
     1
    1
  • 216.58.201.110:443
    tls, https
    689 B
     40 B
     1
    1
  • 216.58.201.110:443
    tls, https
    689 B
     40 B
     1
    1
  • 216.58.204.78:443
    android.apis.google.com
    tls
    2.6kB
     6.7kB
     11
    15
  • 154.216.16.120:443
    https://dogaldostlukvesanat.xyz/YmJlYTFiODdkMjcz/
    tls, http
    3.2kB
     2.3kB
     10
    9

    HTTP Request

    POST https://dogaldostlukvesanat.xyz/YmJlYTFiODdkMjcz/

    HTTP Response

    200
  • 154.216.16.120:443
    https://dogaldostlukvesanat.xyz/YmJlYTFiODdkMjcz/
    tls, http
    1.8kB
     2.3kB
     9
    9

    HTTP Request

    POST https://dogaldostlukvesanat.xyz/YmJlYTFiODdkMjcz/

    HTTP Response

    200
  • 154.216.16.120:443
    https://dogaldostlukvesanat.xyz/YmJlYTFiODdkMjcz/
    tls, http
    1.4kB
     2.3kB
     10
    9

    HTTP Request

    POST https://dogaldostlukvesanat.xyz/YmJlYTFiODdkMjcz/

    HTTP Response

    200
  • 154.216.16.120:443
    https://dogaldostlukvesanat.xyz/YmJlYTFiODdkMjcz/
    tls, http
    1.4kB
     2.3kB
     10
    9

    HTTP Request

    POST https://dogaldostlukvesanat.xyz/YmJlYTFiODdkMjcz/

    HTTP Response

    200
  • 142.250.187.196:443
    tls
    135 B
     40 B
     2
    1
  • 142.250.200.10:443
    semanticlocation-pa.googleapis.com
    tls, https
    128 B
     40 B
     2
    1
  • 224.0.0.251:5353
    3.7kB
     11
  • 1.1.1.1:53
    keyifligunlerinfirsatlari.xyz
    dns
    75 B
     140 B
     1
    1

    DNS Request

    keyifligunlerinfirsatlari.xyz

  • 1.1.1.1:53
    www.ip-api.com
    dns
    60 B
     76 B
     1
    1

    DNS Request

    www.ip-api.com

    DNS Response

    208.95.112.1

  • 1.1.1.1:53
    hosgoruhayatvekultur.xyz
    dns
    70 B
     135 B
     1
    1

    DNS Request

    hosgoruhayatvekultur.xyz

  • 1.1.1.1:53
    sadelikvehayatfelsefesi.xyz
    dns
    73 B
     138 B
     1
    1

    DNS Request

    sadelikvehayatfelsefesi.xyz

  • 1.1.1.1:53
    dogaltatvesanatyaklasimi.xyz
    dns
    74 B
     139 B
     1
    1

    DNS Request

    dogaltatvesanatyaklasimi.xyz

  • 1.1.1.1:53
    sevincligunlertatminkar.xyz
    dns
    73 B
     138 B
     1
    1

    DNS Request

    sevincligunlertatminkar.xyz

  • 1.1.1.1:53
    zenginlikvebasarihikayesi.xyz
    dns
    75 B
     140 B
     1
    1

    DNS Request

    zenginlikvebasarihikayesi.xyz

  • 1.1.1.1:53
    sanatvesanatcihayatlari.xyz
    dns
    73 B
     138 B
     1
    1

    DNS Request

    sanatvesanatcihayatlari.xyz

  • 1.1.1.1:53
    dogaylaisbirligiyolu.xyz
    dns
    70 B
     135 B
     1
    1

    DNS Request

    dogaylaisbirligiyolu.xyz

  • 1.1.1.1:53
    hayatlarinhuzurvesessiz.xyz
    dns
    73 B
     138 B
     1
    1

    DNS Request

    hayatlarinhuzurvesessiz.xyz

  • 1.1.1.1:53
    kalpvesanatdostlukhikaye.xyz
    dns
    74 B
     139 B
     1
    1

    DNS Request

    kalpvesanatdostlukhikaye.xyz

  • 1.1.1.1:53
    hayatvesanatguzellikduygusu.xyz
    dns
    77 B
     142 B
     1
    1

    DNS Request

    hayatvesanatguzellikduygusu.xyz

  • 1.1.1.1:53
    hayalguclesanatbaglantisi.xyz
    dns
    75 B
     140 B
     1
    1

    DNS Request

    hayalguclesanatbaglantisi.xyz

  • 1.1.1.1:53
    yasananhayatinduygular.xyz
    dns
    72 B
     137 B
     1
    1

    DNS Request

    yasananhayatinduygular.xyz

  • 1.1.1.1:53
    ilhamdolubirhayat.xyz
    dns
    67 B
     132 B
     1
    1

    DNS Request

    ilhamdolubirhayat.xyz

  • 1.1.1.1:53
    dogaldostlukvesanat.xyz
    dns
    69 B
     85 B
     1
    1

    DNS Request

    dogaldostlukvesanat.xyz

    DNS Response

    154.216.16.120

  • 1.1.1.1:53
    semanticlocation-pa.googleapis.com
    dns
    80 B
     336 B
     1
    1

    DNS Request

    semanticlocation-pa.googleapis.com

    DNS Response

    216.58.212.234
    216.58.201.106
    172.217.169.42
    142.250.200.10
    216.58.213.10
    172.217.169.74
    142.250.200.42
    172.217.16.234
    142.250.178.10
    142.250.187.234
    142.250.179.234
    216.58.204.74
    216.58.212.202
    142.250.187.202
    142.250.180.10
    172.217.169.10

  • 1.1.1.1:53
    android.apis.google.com
    dns
    69 B
     109 B
     1
    1

    DNS Request

    android.apis.google.com

    DNS Response

    216.58.204.78

  • 1.1.1.1:53
    dogaldostlukvesanat.xyz
    dns
    69 B
     85 B
     1
    1

    DNS Request

    dogaldostlukvesanat.xyz

    DNS Response

    154.216.16.120

  • 1.1.1.1:53
    dogaldostlukvesanat.xyz
    dns
    69 B
     85 B
     1
    1

    DNS Request

    dogaldostlukvesanat.xyz

    DNS Response

    154.216.16.120

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Event Triggered Execution

1
T1624

Broadcast Receivers

1
T1624.001

Foreground Persistence

1
T1541

Privilege Escalation

Defense Evasion

Download New Code at Runtime

1
T1407

Foreground Persistence

1
T1541

Hide Artifacts

2
T1628

Suppress Application Icon

1
T1628.001

User Evasion

1
T1628.002

Impair Defenses

1
T1629

Prevent Application Removal

1
T1629.001

Input Injection

1
T1516

Credential Access

Access Notifications

1
T1517

Input Capture

2
T1417

GUI Input Capture

1
T1417.002

Keylogging

1
T1417.001

Discovery

Software Discovery

1
T1418

Security Software Discovery

1
T1418.001

System Network Configuration Discovery

3
T1422

Lateral Movement

Collection

Access Notifications

1
T1517

Input Capture

2
T1417

GUI Input Capture

1
T1417.002

Keylogging

1
T1417.001

Screen Capture

1
T1513

Command and Control

Exfiltration

Impact

Data Encrypted for Impact

1
T1471

Input Injection

1
T1516

Replay Monitor

Loading Replay Monitor...

Downloads

  • /data/data/com.adjust.glove/.qcom.adjust.glove
    Filesize

    48B

    MD5

    046a414913add6f5bb60072c7db819b6

    SHA1

    451ee4f6809260aec622d772fd329c7d0297a842

    SHA256

    b66c1320cb063a1d391c94273572ea6edae76c8c8b0a07f8d75c88686f0df72a

    SHA512

    4e6355f3051ed5e811ab030abde1f5be7f5e1cf33be99cd08477e9b6c015deb1d8bd75a09fb9c7176b8511c5ad0a67abc0902a3531e97564ccb6afc57496a47c

    Download Submit

  • /data/data/com.adjust.glove/app_sketch/SG.json
    Filesize

    153KB

    MD5

    c1ed4ac6208772c38653dbdbb1b232da

    SHA1

    812d6e6fa3b0b690574706b7c2b5aa642ab0f2d6

    SHA256

    debb7a1695a9152a06cf40b2fe64c5d1e1c71765bfa6a6e696e1eaff2dbfe910

    SHA512

    7f5897320ac68dbc28ce6230f4c1d6d3d85a3c6dfcd0383b1ca66a55051a2c4bab0b1303f2ecc515d4c099096416828a5cfdc2c7bcc75953c5fce7dba6632a62

    Download Submit

  • /data/data/com.adjust.glove/app_sketch/SG.json
    Filesize

    153KB

    MD5

    77ee07febbcfb8204d51e34e35c7185c

    SHA1

    381466bbe9e602a5075320a6a7f386bbebc46a88

    SHA256

    a271e7c263c84aac87d8561ad51f8f239b6eb457f38ed280ec629dea3e913c44

    SHA512

    719c8f19ee082567f75dea90ad1bcd3ae708b60ce43431e448356e4929797427417f5ed7ceb5fd033654fdfe869671849a9039f77f81d7685e506d6cdf21c9a6

    Download Submit

  • /data/data/com.adjust.glove/kl.txt
    Filesize

    45B

    MD5

    b959d96c25a98e445e4a7fd7c3898b1f

    SHA1

    7603567dda0b7be7eb9e8e1fbfdb80708ea64570

    SHA256

    9b7e4abd68320239a352f2b365d192a451803a00c20b6f23cf9f6fec64525fa5

    SHA512

    92197490ae1ab102cbe5f09757d37b8362d1841787b5d17a0308da9f60d6b45d5e224a2d9f4c28940df2d17400a9016c66d049e395ca544d3995911d15fb3db3

    Download Submit

  • /data/data/com.adjust.glove/kl.txt
    Filesize

    423B

    MD5

    24af22d29f9444b47650e32d7f4f1805

    SHA1

    c44353e02c1e498ca914d23f5d254c14d1bed498

    SHA256

    9d94ea264b2a9d79ea676a3d3a844cc039a5fb0e48eba7e5bd39dd88014f4f6e

    SHA512

    d8a9d6d07bce0f25ed23368397d73f2240aafc3738198b984db3ee4be156585642e8c387b08fc7b2cbed59eff488a3fd12519d238d9b03e48cf84d2283e8701b

    Download Submit

  • /data/data/com.adjust.glove/kl.txt
    Filesize

    230B

    MD5

    5401b788651f247a1ac7bc5e8b708eda

    SHA1

    67cc50fb4966589c9ab11964ee6c5bc16ba63eae

    SHA256

    0727559ee7cc31ab8299e03019f0ad54bf85d782e7d27c458141ca01bb0f7eda

    SHA512

    b1a63ace80aa22e71047f3be2fc3d17f92ce35329db4b2c7175a10fb32cfaf2ed7bce419a43684e2bb6ea7fe03aedce80b423d0ecb4145be95ed15469b3d5498

    Download Submit

  • /data/data/com.adjust.glove/kl.txt
    Filesize

    54B

    MD5

    d13953367906c2ebd9b573b9b4e4fbde

    SHA1

    e006d1494129a29543db3f05ead18eaa9a90def1

    SHA256

    8cec3b57aa2bb10ee7d092683656663b7b0d8ef3d0c0e5352ead158b782ac4a0

    SHA512

    7933faaeafde8abca8771adc71fbdf2d69e733c1be56847f008959ec72caaea63a8e2f7c4e34843b09c09b60be613ca48a6052248f06bdf15f84227a1358e483

    Download Submit

  • /data/data/com.adjust.glove/kl.txt
    Filesize

    63B

    MD5

    0fc3e22752e5686f08ed31c20f3c49b2

    SHA1

    9396e6a548b7ea8f66f05536831fd14a830d40fc

    SHA256

    e2d7bca9307a3564209bf91640fa6708cc0212d4a4c23da0a427fcd632bab26f

    SHA512

    fd6573e2c6c17d3a77e174aa04855d252d445b1d3dd3b7ce7da7dfede70a3fc9d20da1afa44dc0ab4861b42c047fa8e1c69ca662379ee25eff645ba1b81c3f9f

    Download Submit

  • /data/user/0/com.adjust.glove/app_sketch/SG.json
    Filesize

    450KB

    MD5

    703acd81798830d6c32721af54b8aba0

    SHA1

    a875039b32f04891d5be389b860df5877ebc25f5

    SHA256

    0d90a004a840590ed5f9e44b9dbedf9bce051e725ad2f41e48fc3fb7924596f0

    SHA512

    07dae7bfcc0aa943fc8c5d880a87a524cc888a04174f6fdb787236277d77d6ad2e2b253d22356290d5f0d03f9fa48210fc159be82e673a88b48821e627d196f4

    Download Submit

  • /data/user/0/com.adjust.glove/app_sketch/SG.json
    Filesize

    450KB

    MD5

    dfea92841720bfd7b92562fa1ad8c1dc

    SHA1

    69b06055ffe8d2f93e42c157aad5317df526f994

    SHA256

    9ee05d29f4405f60137a92364286301741eac5ff1bb229de3995060516ccd8b4

    SHA512

    59e42422fece22d523beb725675d0380269b6d02d9d79df51f8c2d653d3346031744a7e40485ce902200b0c3af8e7bdc5b7ec35fdf1ae698b64604ecf30df150

    Download Submit

We care about your privacy.

This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.