Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    149s
  • max time network
    151s
  • platform
    android-11_x64
  • resource
    android-x64-arm64-20240910-en
  • submitted
    05/01/2025, 22:06

General

  • Target

    c9fe8087dcba9abe891741205dd96fd80876672c14fde35ee7cc6c2898c3c82e.apk

  • Size

    307KB

  • MD5

    a6102bf8ce06c07378f0b34161025457

  • SHA1

    e98651ff2f56b55b6c5e87bda77ae7f1535bb6b2

  • SHA256

    c9fe8087dcba9abe891741205dd96fd80876672c14fde35ee7cc6c2898c3c82e

  • SHA512

    338994e52b3c43135711fc8c2b8442d61f5d427ce9eed53faba3fe47bf3da0bda5e8aef5fdd7475f5120f2d072e3ae9539cc7d56e43daf661ef4495a7e7ba41f

  • SSDEEP

    6144:Ui5hNwK+nbbsuVWlVZV8Q15Ptk1mqNscZlCbeVyxCGKFh+KZ:Ui5huKebrVWTT8Q1R/qKxhj8

Malware Config

Extracted

Family

xloader_apk

C2

http://1.171.162.250:33669/user_info_uploader

https://docs.google.com/document/d/1s0n64k12_r9MglT5m9lr63M5F3e-xRyaMeYP7rdOTrA/mobilebasic

Attributes
  • user_agent

    Mozilla/5.0 (Linux; Android 6.0; Nexus 5 Build/MRA58N) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/72.0.3626.121 Mobile Safari/537.36

    Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/72.0.3626.121 Safari/537.36

Signatures

Processes

  • akys.hy.vs
    1⤵
    • Checks if the Android device is rooted.
    • Removes its main activity from the application launcher
    • Loads dropped Dex/Jar
    • Reads the content of the MMS message.
    • Acquires the wake lock
    • Makes use of the framework's foreground persistence service
    • Requests changing the default SMS application.
    PID:4823

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • /data/user/0/akys.hy.vs/files/dex

    Filesize

    580KB

    MD5

    ed9219be2761d62f01f05dee71f02df3

    SHA1

    c2b904961f519a66052c04d444b34ef4c3f00e67

    SHA256

    b8f6a3769331039a5f2dc29eba3adc431a7b086d47ec579cd143da11f137f13d

    SHA512

    420dc0fa4e231a66fa5c26fbd7952f574aa24aec62ecdf387dd376e98dac93cbea493785d67a030bd6d6745b00c7f3b14b693f906124ee6438b6a227d682f8bd