Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    149s
  • max time network
    150s
  • platform
    android-11_x64
  • resource
    android-x64-arm64-20240910-en
  • resource tags

    arch:armarch:arm64arch:x64arch:x86image:android-x64-arm64-20240910-enlocale:en-usos:android-11-x64system
  • submitted
    11/01/2025, 16:54

General

  • Target

    8a0f340d3160a7ce2f0b4b87168050718f78a3cba8cf3fef8aa413bcf3d93371.apk

  • Size

    7.7MB

  • MD5

    d5e532b80af4d4a5ca052b18fa8de40a

  • SHA1

    cdf20adf79519223b0fd2a6d0e8f64b94a1521e8

  • SHA256

    8a0f340d3160a7ce2f0b4b87168050718f78a3cba8cf3fef8aa413bcf3d93371

  • SHA512

    ff5c99127522c0da84a768cad48056112605c1eb4a81d2ca366e90b4c0d55ea4d0f1825e446506d612208b2c937ef474e758fa35ae83eac697e647a05a0f637e

  • SSDEEP

    98304:XZyl72/5iSRGI8VKTzke3bYzO8MHc3XcRsoGeMkTkgzp4sp:kw/riUdbYJM83XcRhLMUkgzSW

Malware Config

Extracted

Family

octo

C2

https://d5abaaa83590ecf7b2432196e08081a8.biz

AES_key
AES_key

Signatures

Processes

  • com.ystar3wlantestericsson
    1⤵
    • Loads dropped Dex/Jar
    • Makes use of the framework's Accessibility service
    • Obtains sensitive information copied to the device clipboard
    • Acquires the wake lock
    • Makes use of the framework's foreground persistence service
    • Queries the mobile country code (MCC)
    • Requests disabling of battery optimizations (often used to enable hiding in the background).
    • Uses Crypto APIs (Might try to encrypt user data)
    • Checks CPU information
    • Checks memory information
    PID:4645

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • /data/data/com.ystar3wlantestericsson/.global.com.ystar3wlantestericsson

    Filesize

    48B

    MD5

    046a414913add6f5bb60072c7db819b6

    SHA1

    451ee4f6809260aec622d772fd329c7d0297a842

    SHA256

    b66c1320cb063a1d391c94273572ea6edae76c8c8b0a07f8d75c88686f0df72a

    SHA512

    4e6355f3051ed5e811ab030abde1f5be7f5e1cf33be99cd08477e9b6c015deb1d8bd75a09fb9c7176b8511c5ad0a67abc0902a3531e97564ccb6afc57496a47c

  • /data/data/com.ystar3wlantestericsson/app_post/YXn.json

    Filesize

    1020B

    MD5

    09f94bf7976401a7626a42546734ec5f

    SHA1

    fbbb2495732b638e3473ee3fdb90cc1f394e3aa7

    SHA256

    000ec6f2d325748ba0c871b97e62d2dfac4b46d7266d048963c2b35f46bf6669

    SHA512

    9a19841a1230ce5595bcfaf5fa02c91ff40d9afdf86b9b9a5ac5a3e5be0b0b3b3a3444935a75bef327e00a54e6d14d17268aa1c0496086a70bf6e70ecde030bb

  • /data/data/com.ystar3wlantestericsson/app_post/YXn.json

    Filesize

    1020B

    MD5

    20843570d2d01dd1d72f66f77ccddb52

    SHA1

    647928abfa4ddc5e36fbbe887d3ef8c9fe0b4e29

    SHA256

    8f12ce06bec97a18fb6074e24378a5af9c5f20e163667e53740a0b7e7a36e9c5

    SHA512

    1db32757249de404022ebdcc72e14b81b782481fa8538db021f41288ffbebd929e81c9fdfe5ab29aba0adf99ec779ebdab8088b96071ec1072ea3fd811faf6fc

  • /data/data/com.ystar3wlantestericsson/files/.b

    Filesize

    322KB

    MD5

    77dc50489b9323274732d27dc8a4e803

    SHA1

    0e02a3595b62489d0739d771881da8604d117c65

    SHA256

    c5684e792d1ebefea6aac09fed45911703fd58c899f8a08133d49dd91429a820

    SHA512

    0684a92f3e9c525384cfa53f531afba61e5930e1c27032a7e27e3315f72761b62e122dc34768d8162ba08f9bed53d148aa8dc034b46456bdd211f230637eba58

  • /data/data/com.ystar3wlantestericsson/oat/x86_64/[email protected]

    Filesize

    486B

    MD5

    18a2ad22046957f0e0268fd6baa55fd1

    SHA1

    8dd42a22afd188f160adb4b0b67880716047e919

    SHA256

    08d45a2a64b742e0d9657b8b349ae263c6582d5091e5523b96f6eeb51a62e167

    SHA512

    932ef7b91fbbe3d3668dfeced2f8370bd0a546afada2055e73808e61d067f0633054d186e572a644da42167c4af77f2525806554c1255a42ae02612e47874636

  • /data/user/0/com.ystar3wlantestericsson/[email protected]

    Filesize

    526KB

    MD5

    624c08ae1501abfa38d9edacd1f46303

    SHA1

    4ced730253458a904223c77a5e6a6eb5512ebfbe

    SHA256

    7a86a66710ce6ed4ddb9469afc265f4e8f0f54facb9bbbd52af5e081a77bb1aa

    SHA512

    65501dac8de20258264edbefbab4c96cd0bdf181febc1e96d1f4a0d90af4b73c8281ffedf2c2a21cef0eb93080af6512d47ad28553aa7885abad998a6542e140

  • /data/user/0/com.ystar3wlantestericsson/app_post/YXn.json

    Filesize

    1KB

    MD5

    8b594e58f918ca788c36567efd16dd01

    SHA1

    3a7a0c2093dc5f5d3d0fb081815719d3c700030e

    SHA256

    c4e007750137277d4c3f7977eccbf45c72f466d3807882d606f397329bf75934

    SHA512

    acd593a330576880aa5b6e34aebec25c1c7f24f9a6f6c4c9e93281934e794ca107e8d73e0f6c5ac073554e5ed5696fd55c135b3444d396280fe35da526ad3d67