Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

10

Static

static

10

eeafbd04a8...8c.apk

android-9-x86

7

eeafbd04a8...8c.apk

android-10-x64

7

eeafbd04a8...8c.apk

android-11-x64

7

Analysis

  • max time kernel
    147s
  • max time network
    159s
  • platform
    android-10_x64
  • resource
    android-x64-20240910-en
  • resource tags

    arch:x64arch:x86image:android-x64-20240910-enlocale:en-usos:android-10-x64system
  • submitted
    10/01/2025, 22:01 UTC

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    eeafbd04a860753a7b39cc0cc9d4a420289548ee8f17474a30b3653ab548408c.apk

  • Size

    1.5MB

  • MD5

    9459f6f67467c710acaf05cbdc702484

  • SHA1

    39ff34ef9f6022af7fd841892265b66549e8f299

  • SHA256

    eeafbd04a860753a7b39cc0cc9d4a420289548ee8f17474a30b3653ab548408c

  • SHA512

    26e8ebe2d0b1ef9f591f99716a20120f6146338a04522ed69abb5598d0e70422f3d5dc95c207b7989dc49537eea32c32b3f51431d2d4e89025283aac15b1c948

  • SSDEEP

    24576:y5a1amebpXnqkT2OQboUuoFcKfp10U3r9ez9Uuw5WmD9idNpA:Ua1aFnqI2OQboUuoGk7cpeWk0d/A

Score
7/10
bankerdiscoveryevasionpersistence

Malware Config

Signatures

  • Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
    bankerdiscovery
  • Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs

    Application may abuse the framework's foreground service to continue running in the foreground.

    evasionpersistence
  • Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs
    persistence

Processes

  • cmf0.c3b5bm90zq.patch
    1⤵
    • Makes use of the framework's foreground persistence service
    • Registers a broadcast receiver at runtime (usually for listening for system events)
    PID:5246

Network

  • flag-us
    DNS
    android.apis.google.com
    Remote address:
    1.1.1.1:53
    Request
    android.apis.google.com
    IN A
    Response
    android.apis.google.com
    IN CNAME
    clients.l.google.com
    clients.l.google.com
    IN A
    142.250.179.238
  • flag-us
    DNS
    ssl.google-analytics.com
    Remote address:
    1.1.1.1:53
    Request
    ssl.google-analytics.com
    IN A
    Response
    ssl.google-analytics.com
    IN A
    172.217.169.8
  • 142.250.200.42:443
    tls, https
    1.2kB
     40 B
     1
    1
  • 216.58.201.110:443
    tls, https
    914 B
     40 B
     1
    1
  • 216.58.201.110:443
    tls, https
    914 B
     40 B
     1
    1
  • 142.250.179.238:443
    android.apis.google.com
    tls
    3.6kB
     7.7kB
     13
    18
  • 142.250.200.42:443
    tls, https
    2.3kB
     40 B
     1
    1
  • 172.217.169.8:443
    ssl.google-analytics.com
    tls
    1.4kB
     6.3kB
     10
    9
  • 142.250.180.14:443
    52 B
     1
  • 142.250.180.14:443
    364 B
     7
  • 216.58.213.2:443
    520 B
     10
  • 224.0.0.251:5353
    3.7kB
     11
  • 1.1.1.1:53
    android.apis.google.com
    dns
    69 B
     109 B
     1
    1

    DNS Request

    android.apis.google.com

    DNS Response

    142.250.179.238

  • 1.1.1.1:53
    ssl.google-analytics.com
    dns
    70 B
     86 B
     1
    1

    DNS Request

    ssl.google-analytics.com

    DNS Response

    172.217.169.8

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads

We care about your privacy.

This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.