Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Resubmissions

27/02/2025, 17:35

250227-v6hlravmy7 10

14/01/2025, 05:44

250114-gfjt8szrbn 10

14/01/2025, 05:43

250114-ge4g9aykgt 10

14/01/2025, 05:39

250114-gctj9szqep 10

14/01/2025, 05:35

250114-f993vazqak 10

14/01/2025, 05:34

250114-f9l11szpgq 10

14/01/2025, 05:31

250114-f76yeayjcw 10

14/01/2025, 05:30

250114-f68evayjas 10

14/01/2025, 05:29

250114-f6m4xazpcq 10

Analysis

  • max time kernel
    14s
  • max time network
    23s
  • platform
    android_x64
  • resource
    android-33-x64-arm64-20240624-en
  • resource tags

    androidarch:arm64arch:x64image:android-33-x64-arm64-20240624-enlocale:en-usos:android-13-x64system
  • submitted
    14/01/2025, 05:29

General

  • Target

    Undead_Defense_Tycoon_Script.apk

  • Size

    3.2MB

  • MD5

    fc35546a7395a68b6440de033afa789d

  • SHA1

    4afc8724e58084164148b7ce518ede8b203dce3c

  • SHA256

    c1b81966fa17c4e7d5137f13b2f4d04704c97d66a54d57dcfc1f42ad1f4029e7

  • SHA512

    ae32d9e7d7403a6ab0429da69fe4f803001a077327a0f103ccc9bcb90b17973ef10be8dc2cbf1909549a04f1eff5e85c81c2dfc2d99ba7fa93369efa47beca6c

  • SSDEEP

    98304:BaqBN1el9eL+FB8Y2nzDNWbVAneM/EjF+894S:oqX1nk52n05AehERS

Malware Config

Signatures

Processes

  • com.herocraft.game.birdsonwire.freemium
    1⤵
    • Loads dropped Dex/Jar
    • Obtains sensitive information copied to the device clipboard
    • Acquires the wake lock
    • Makes use of the framework's foreground persistence service
    • Queries information about active data network
    • Queries the mobile country code (MCC)
    • Checks memory information
    PID:4469

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • /data/data/com.herocraft.game.birdsonwire.freemium/files/KWW

    Filesize

    499B

    MD5

    81f98290e0f50c7ba77339a5a1ee49dc

    SHA1

    3eef7228e5292ad70192cab6d26150bb62c35004

    SHA256

    9a073047aca945942d6fdfc194d0705c3ea4fc9ca28b159a697d9e55acb992e6

    SHA512

    46dd374e82925cf3108943e1e94f7b09aee8c8d13efc4d067b5a3b8047df57037de223109e12e771bc7e54964ee95475aa8a3b7ea14a4c029f90ebd717439a51

  • /data/data/com.herocraft.game.birdsonwire.freemium/files/PersistedInstallation7163658215282265403tmp

    Filesize

    570B

    MD5

    5fa42b1983d6a88b8318c44d67a5ce23

    SHA1

    c6026f730f66df00769a7435e2120894e4016626

    SHA256

    2ceb2b3ed64cbd37b325d098ed6d0af728fe4bdb54ed4bd9b7fef64216fdc5bf

    SHA512

    f660caf8e7ee681f705b2c3a37a497d2beb9ca50f5b3d515c0cb3013fa866f264e2baa107f250b40e68126c3e91cd766eaa91b3b0083c56a376c23daec282944

  • /data/data/com.herocraft.game.birdsonwire.freemium/files/UMYa

    Filesize

    242B

    MD5

    7d68b64fcb70f1514a85fc6485c6432a

    SHA1

    1994bb0bed49b9511830c38a728b625699c756b8

    SHA256

    550a4335b46dbc9635685cfa3d3de3eb2b6ee9115f1002d35c06fc807af591de

    SHA512

    d3aa0460c435e2290894495328cf572ba0897deb64d02182109b4cbae6a0708d25b30a8c9ad7a8909c7e5c2bfa22b60f1502fcf87e8d0840f5e1d16e60021260

  • /data/data/com.herocraft.game.birdsonwire.freemium/files/UMYa

    Filesize

    242B

    MD5

    5d2e325ad87c496dc85b1fcf9e5d2a49

    SHA1

    e16e62eb81cdb13824f065c4c50dde64ae4ec772

    SHA256

    19aed8936312af27150c1dbe94ea509eae235ec9008f41f6a6a1d0eb9bfde0ba

    SHA512

    df24a0671dd319d7f447a350ecae8ad7b8f35eba84f1fdb46d2b6f3213cad40d3434e9e3b8a4b47c8790d9f52210164654aa472dd96a4520c80f45133b23d7e2

  • /data/data/com.herocraft.game.birdsonwire.freemium/files/b04e7800.dex

    Filesize

    2.3MB

    MD5

    a2c0379f196c91a175f47b801895518a

    SHA1

    549b6e1c77021378b4189f736b7eb7437a9d9497

    SHA256

    35cdc216518a388e7842f6b67a2c65ea06ca5302286087df3a9db29603b9aa21

    SHA512

    e3ebb67eb0a9c9e13db1dd29474bf93af6e0e3b9607623c0a70672bfb4f2505abc1f2c23e1592175317bc4f384fb7966954f0d37e6f331f7eb724ff5e6be4205

  • /data/user/0/com.herocraft.game.birdsonwire.freemium/files/b04e7800.dex

    Filesize

    6.4MB

    MD5

    670d8683a3c1765ced65f8b60bfacdba

    SHA1

    24bc8f1ec3e925316fa05918fed1962379debe15

    SHA256

    fc48615db02bf829b738c5efef9cfc368b27c0a40fe69d4fa165cf59b0d6cc9f

    SHA512

    c6e7c7104c31d2b567874fed9684c172b1dc722d084ab998b0159420554e27ce044ed8b0099194919c18d782ac9d075962c966c602eaaf021f36d9d262bbc9a8