Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    149s
  • max time network
    157s
  • platform
    android-10_x64
  • resource
    android-x64-20240910-en
  • submitted
    23/12/2024, 22:08

General

  • Target

    62ceeff6539015e33a84b8fcf5b94a25bcba1ddd2a6e675d7658574706ee0b4f.apk

  • Size

    429KB

  • MD5

    eb3cfd83c57df9bfa44559c7167fec17

  • SHA1

    de7572c436faa8984e17e4a3c382b3fdee12114b

  • SHA256

    62ceeff6539015e33a84b8fcf5b94a25bcba1ddd2a6e675d7658574706ee0b4f

  • SHA512

    b04aeab3c244d6058360caf1dab683127a51a26575c28175b6d34270d04df1366d6882686d8f1891338450eec4a8e219c528df2fe68a34444b2d54f7bfaf24c9

  • SSDEEP

    6144:c1IDbS8RcSHRMroCcsGY/L8o4jzIjqhQkq5LI5J8h3vlb7hr6WPJPj:c1IDW8LMBcsG0+jzEW8h3vlb7Vbd

Malware Config

Extracted

Family

xloader_apk

C2

https://docs.google.com/document/d/1s0n64k12_r9MglT5m9lr63M5F3e-xRyaMeYP7rdOTrA/mobilebasic

Attributes
  • user_agent

    Mozilla/5.0 (Linux; Android 6.0; Nexus 5 Build/MRA58N) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/72.0.3626.121 Mobile Safari/537.36

    Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/72.0.3626.121 Safari/537.36

Signatures

Processes

  • com.urag.wbbs
    1⤵
    • Checks if the Android device is rooted.
    • Removes its main activity from the application launcher
    • Loads dropped Dex/Jar
    • Reads the content of the MMS message.
    • Acquires the wake lock
    • Makes use of the framework's foreground persistence service
    • Queries information about active data network
    • Registers a broadcast receiver at runtime (usually for listening for system events)
    PID:5090

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • /data/data/com.urag.wbbs/files/dex

    Filesize

    766KB

    MD5

    b3aa28b0cf2269079fa51c1db9ad032b

    SHA1

    c85618082d725fd8dd4789ecf43ce274b743c9cb

    SHA256

    8933f198d336dc72d7e4c2012cf6ea5356bedf6a97a16c9b74fb2fac63ea02b0

    SHA512

    2c077f33169d2d77a3a64d70c2705e32f46c8addb9299459c97a6ad9d7647fc906c36d172acf5731b53cb461c7eb21c6adfbe10ace50e483e41f55e16f958339

  • /data/data/com.urag.wbbs/files/oat/dex.cur.prof

    Filesize

    766B

    MD5

    c9a69aa688d0181f8ce54ab5f88d7fab

    SHA1

    e1837915f0233ca43b08f09a1d735526c7929664

    SHA256

    064353eeba1a684bd5d0d8aecaae45617fe02cb8ef52763955e6ad4ad46ef7c4

    SHA512

    95b1d80dce0d663a7fee10b7f795e572a94c0737ee5f76c280f0b435a68f502db1b25e8d491e08f1e1211ea48f3184300a0ede4a1c8ca71a5c23a442e918bb7b