Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Resubmissions

11/01/2025, 14:53

250111-r9fpsatrbr 6

11/01/2025, 14:23

250111-rqecls1mcv 10

11/01/2025, 14:13

250111-rjve9a1lbx 10

Analysis

  • max time kernel
    899s
  • max time network
    906s
  • platform
    android_x64
  • resource
    android-x64-arm64-20240624-en
  • resource tags

    androidarch:armarch:arm64arch:x64arch:x86image:android-x64-arm64-20240624-enlocale:en-usos:android-11-x64system
  • submitted
    11/01/2025, 14:23

General

  • Target

    7cb7c01cf38976a0885a9b737f633ecc131381c5fcca3dfd94818df8f1716f47.apk

  • Size

    9.4MB

  • MD5

    623ce8b36331e347a676581c70d2bb41

  • SHA1

    2ca0da29b519817ba03dba942aff005dd565c522

  • SHA256

    7cb7c01cf38976a0885a9b737f633ecc131381c5fcca3dfd94818df8f1716f47

  • SHA512

    6a25c7af683e70ae7b87ea67c42e98d725e30d66843cc59ab049e50ec634bf21de54c0a0a62cf2b0b589dfb64f2fa6e0fa5e0cc44c392224a9bfc3b87bc7bb38

  • SSDEEP

    98304:Nsg/gg8j7aRsrM5iSRGUBVKeMwupCivpXRbPPU9W4ZlWq+ffD89QZrQ:R/gTj7aRTrfUpxpCivFRbPlaQ3Il

Malware Config

Extracted

Family

octo

C2

https://f154a53f51aa438e255e5e13b5b173e6.info

AES_key
AES_key

Signatures

Processes

  • com.retouching_marketfk8
    1⤵
    • Loads dropped Dex/Jar
    • Makes use of the framework's Accessibility service
    • Obtains sensitive information copied to the device clipboard
    • Acquires the wake lock
    • Makes use of the framework's foreground persistence service
    • Queries the mobile country code (MCC)
    • Requests disabling of battery optimizations (often used to enable hiding in the background).
    • Uses Crypto APIs (Might try to encrypt user data)
    • Checks CPU information
    • Checks memory information
    PID:4456

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • /data/data/com.retouching_marketfk8/.global.com.retouching_marketfk8

    Filesize

    48B

    MD5

    046a414913add6f5bb60072c7db819b6

    SHA1

    451ee4f6809260aec622d772fd329c7d0297a842

    SHA256

    b66c1320cb063a1d391c94273572ea6edae76c8c8b0a07f8d75c88686f0df72a

    SHA512

    4e6355f3051ed5e811ab030abde1f5be7f5e1cf33be99cd08477e9b6c015deb1d8bd75a09fb9c7176b8511c5ad0a67abc0902a3531e97564ccb6afc57496a47c

  • /data/data/com.retouching_marketfk8/app_horror/onS.json

    Filesize

    1018B

    MD5

    0b82574ea45e7d4b87bea9a76573f148

    SHA1

    52fab115ed5cc187da30486f7e4ea428641957fb

    SHA256

    79f0cb0ca9c1f6074b89b9448ff76a125517f02ec10bb41e3f0dd874e5ec81e6

    SHA512

    6157135e842f5781dbc6d5dbce44e26f86c9555094bb11ca83fd0cae621541c72eea05d0ab6efb01035b92d8b60f21afa4d8e9e067e3bffd4e5df616d28717dc

  • /data/data/com.retouching_marketfk8/app_horror/onS.json

    Filesize

    1018B

    MD5

    502a8b3ca099b8dcf37475403477e1f9

    SHA1

    d953c9e94bd6e40e9aa4f14cda221834a777238a

    SHA256

    f12fb8bcaebe05550f5c38d9ea03c4ac2d58d95bb38d17ccf2b92f62dc3e8c03

    SHA512

    46fbae81efaeef3185097071d02a600d7f153e319a1702249ea3a4ddc4ad744051d8c5ca22e52b7d62d2604ad60c151022ce19033ac56283f37ff6a6e4f343bb

  • /data/data/com.retouching_marketfk8/files/.d

    Filesize

    322KB

    MD5

    77dc50489b9323274732d27dc8a4e803

    SHA1

    0e02a3595b62489d0739d771881da8604d117c65

    SHA256

    c5684e792d1ebefea6aac09fed45911703fd58c899f8a08133d49dd91429a820

    SHA512

    0684a92f3e9c525384cfa53f531afba61e5930e1c27032a7e27e3315f72761b62e122dc34768d8162ba08f9bed53d148aa8dc034b46456bdd211f230637eba58

  • /data/data/com.retouching_marketfk8/oat/x86_64/[email protected]

    Filesize

    484B

    MD5

    b5aada38c455c0a3daa67e4b078a08ce

    SHA1

    e4a4b79265869ddc7471ed66e2dd9f6684e9a2e2

    SHA256

    96a4be9e43544616deca6df9704de3b0b3fb3cfff1d4f3195a58661fe78bcc6d

    SHA512

    410f6f9a06b1b3498829403954ad13cb6fe82415bf620c37636b2c98ff56c4595e03cb7abd8c3c2834b48c3e7df8c5b64659ab5a67507b867452a1fa8c23008a

  • /data/user/0/com.retouching_marketfk8/[email protected]

    Filesize

    526KB

    MD5

    d3441eaff611da21013f0aa8879eb809

    SHA1

    28ada0cc753682e69e12e8a683a4b8dfe1c8edaa

    SHA256

    3c5061246319f575253e7a30c9b5571bb37177a737a14dce65ea6acfc04ba7a2

    SHA512

    998a5e5c7a5c88fbbf5fce7ce8f8d119b406fd40b354194acd84a755473fae3416a3c4932dd6326e988e7b88b7924fc15705e4f6a6875b9a10d207b07110c652

  • /data/user/0/com.retouching_marketfk8/app_horror/onS.json

    Filesize

    1KB

    MD5

    663a9e5d63b310d0ed7b3b0b853de454

    SHA1

    13aa46bc7d972f21631275e3e924780173f89a9b

    SHA256

    9c3ba87a112e01b273c37e20e3eb52dce17e7235824ce3f18bad9e8f13ba64a5

    SHA512

    83d59890b31d52653bb2f767bccb7bbd60324702c72e884adfe52c03c771b1e9f3e6706d3ebdaeff5e23facf0a845e49cf9b547b56fc2805b50853152a6b6d19