Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    149s
  • max time network
    150s
  • platform
    android-10_x64
  • resource
    android-x64-20240910-en
  • submitted
    05/01/2025, 22:05

General

  • Target

    83840979fc33672b7485997eb6d05d05394b1c444490d3887d6f80416cd9f0ff.apk

  • Size

    305KB

  • MD5

    54b1a1a9e2ba31c5a14185d1da28b84c

  • SHA1

    33a1be6f4459b84f2719c76ab15cb99f7cc8e783

  • SHA256

    83840979fc33672b7485997eb6d05d05394b1c444490d3887d6f80416cd9f0ff

  • SHA512

    c10c9181bcedccc8e66ceaa33c619543c97b253c7e9cf03296347465f942e4259102a7ce1932316d17e1c997734199c77b96cf3ab138f0b730f25a920703d59d

  • SSDEEP

    6144:wsONyeKf/SNBee3aeJXeqCKYtPVwmqNscZlCbeVyxCdxCa:wzxKf/STeeqe0KY5qKxhkB

Malware Config

Extracted

Family

xloader_apk

C2

http://1.171.162.250:33669/user_info_uploader

https://docs.google.com/document/d/1s0n64k12_r9MglT5m9lr63M5F3e-xRyaMeYP7rdOTrA/mobilebasic

Attributes
  • user_agent

    Mozilla/5.0 (Linux; Android 6.0; Nexus 5 Build/MRA58N) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/72.0.3626.121 Mobile Safari/537.36

    Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/72.0.3626.121 Safari/537.36

Signatures

Processes

  • gyys.ue.tp
    1⤵
    • Checks if the Android device is rooted.
    • Removes its main activity from the application launcher
    • Loads dropped Dex/Jar
    • Reads the content of the MMS message.
    • Acquires the wake lock
    • Makes use of the framework's foreground persistence service
    • Registers a broadcast receiver at runtime (usually for listening for system events)
    PID:5070

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • /data/data/gyys.ue.tp/files/dex

    Filesize

    580KB

    MD5

    ed9219be2761d62f01f05dee71f02df3

    SHA1

    c2b904961f519a66052c04d444b34ef4c3f00e67

    SHA256

    b8f6a3769331039a5f2dc29eba3adc431a7b086d47ec579cd143da11f137f13d

    SHA512

    420dc0fa4e231a66fa5c26fbd7952f574aa24aec62ecdf387dd376e98dac93cbea493785d67a030bd6d6745b00c7f3b14b693f906124ee6438b6a227d682f8bd

  • /data/data/gyys.ue.tp/files/oat/dex.cur.prof

    Filesize

    798B

    MD5

    7d1c0686b9b3f94553bb46b4ded50e3a

    SHA1

    bc20051f6b292ece9a09d64bc0eb9dfac5de69e7

    SHA256

    09f819ec6977634c001df5739d46dc91ed49b24287f47b21328201cdf81a3c76

    SHA512

    e4f74d87971e464d6f54a3240489f4ed48a486254597ab34215d69fb21c14ff5668d4cce70c8d17777893ccd85c225919f9d021f898cac6c0f14b8ca9c4a0798