Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Overview
overview
10Static
static
101777a2ba85...b0.apk
android-9-x86
105251a35642...3e.apk
android-9-x86
15251a35642...3e.apk
android-10-x64
15251a35642...3e.apk
android-11-x64
17c44519e51...57.apk
android-9-x86
10FE_Invisib...pt.apk
android-9-x86
7FE_Invisib...pt.apk
android-10-x64
7FE_Invisib...pt.apk
android-11-x64
7HellBoy.apk
android-9-x86
6HellBoy.apk
android-10-x64
1HellBoy.apk
android-11-x64
6Roblox Key...V3.apk
android-9-x86
7Roblox Key...V3.apk
android-10-x64
7Roblox Key...V3.apk
android-11-x64
7Stick War_ Legacy.apk
android-9-x86
7Stick War_ Legacy.apk
android-10-x64
1Stick War_ Legacy.apk
android-11-x64
7Undead_Def...pt.apk
android-9-x86
7Undead_Def...pt.apk
android-10-x64
7Undead_Def...pt.apk
android-11-x64
7antivirus.apk
android-9-x86
7antivirus.apk
android-10-x64
7antivirus.apk
android-11-x64
7b3f23bdd3d...c0.apk
android-9-x86
10e8947bc9fb...10.apk
android-9-x86
7insta_followers.apk
android-9-x86
7insta_followers.apk
android-10-x64
7insta_followers.apk
android-11-x64
7xxx.apk
android-9-x86
1Analysis
-
max time kernel
148s -
max time network
152s -
platform
android_x64 -
resource
android-x64-20240624-en -
resource tags
androidarch:x64arch:x86image:android-x64-20240624-enlocale:en-usos:android-10-x64system -
submitted
14/01/2025, 05:17
Behavioral task
behavioral1
Sample
1777a2ba85f831e41c6a60418f84205c9de9c66402f9b7e5be13d29c543a42b0.apk
Resource
android-x86-arm-20240624-en
Behavioral task
behavioral2
Sample
5251a356421340a45c8dc6d431ef8a8cbca4078a0305a87f4fbd552e9fc0793e.apk
Resource
android-x86-arm-20240624-en
Behavioral task
behavioral3
Sample
5251a356421340a45c8dc6d431ef8a8cbca4078a0305a87f4fbd552e9fc0793e.apk
Resource
android-x64-20240624-en
Behavioral task
behavioral4
Sample
5251a356421340a45c8dc6d431ef8a8cbca4078a0305a87f4fbd552e9fc0793e.apk
Resource
android-x64-arm64-20240624-en
Behavioral task
behavioral5
Sample
7c44519e51cc203cdd23f27cefe7cf99de34abddf947ba55951721725f15aa57.apk
Resource
android-x86-arm-20240624-en
Behavioral task
behavioral6
Sample
FE_Invisible_Troll_Script.apk
Resource
android-x86-arm-20240910-en
Behavioral task
behavioral7
Sample
FE_Invisible_Troll_Script.apk
Resource
android-x64-20240910-en
Behavioral task
behavioral8
Sample
FE_Invisible_Troll_Script.apk
Resource
android-x64-arm64-20240910-en
Behavioral task
behavioral9
Sample
HellBoy.apk
Resource
android-x86-arm-20240624-en
Behavioral task
behavioral10
Sample
HellBoy.apk
Resource
android-x64-20240910-en
Behavioral task
behavioral11
Sample
HellBoy.apk
Resource
android-x64-arm64-20240910-en
Behavioral task
behavioral12
Sample
Roblox Keyless Bloxfruits Script HoHo Hub V3.apk
Resource
android-x86-arm-20240910-en
Behavioral task
behavioral13
Sample
Roblox Keyless Bloxfruits Script HoHo Hub V3.apk
Resource
android-x64-20240624-en
Behavioral task
behavioral14
Sample
Roblox Keyless Bloxfruits Script HoHo Hub V3.apk
Resource
android-x64-arm64-20240910-en
Behavioral task
behavioral15
Sample
Stick War_ Legacy.apk
Resource
android-x86-arm-20240910-en
Behavioral task
behavioral16
Sample
Stick War_ Legacy.apk
Resource
android-x64-20240624-en
Behavioral task
behavioral17
Sample
Stick War_ Legacy.apk
Resource
android-x64-arm64-20240910-en
Behavioral task
behavioral18
Sample
Undead_Defense_Tycoon_Script.apk
Resource
android-x86-arm-20240910-en
Behavioral task
behavioral19
Sample
Undead_Defense_Tycoon_Script.apk
Resource
android-x64-20240624-en
Behavioral task
behavioral20
Sample
Undead_Defense_Tycoon_Script.apk
Resource
android-x64-arm64-20240910-en
Behavioral task
behavioral21
Sample
antivirus.apk
Resource
android-x86-arm-20240910-en
Behavioral task
behavioral22
Sample
antivirus.apk
Resource
android-x64-20240910-en
Behavioral task
behavioral23
Sample
antivirus.apk
Resource
android-x64-arm64-20240624-en
Behavioral task
behavioral24
Sample
b3f23bdd3dea208f05de7a5b9ea928758187b3f2b0f4f5733c8bdb3298818ec0.apk
Resource
android-x86-arm-20240910-en
Behavioral task
behavioral25
Sample
e8947bc9fb2bd597daba3064d5fab275d8df2beac92f301063f22fe276dcbc10.apk
Resource
android-x86-arm-20240910-en
Behavioral task
behavioral26
Sample
insta_followers.apk
Resource
android-x86-arm-20240910-en
Behavioral task
behavioral27
Sample
insta_followers.apk
Resource
android-x64-20240910-en
Behavioral task
behavioral28
Sample
insta_followers.apk
Resource
android-x64-arm64-20240624-en
Behavioral task
behavioral29
Sample
xxx.apk
Resource
android-x86-arm-20240624-en
General
-
Target
Undead_Defense_Tycoon_Script.apk
-
Size
3.2MB
-
MD5
fc35546a7395a68b6440de033afa789d
-
SHA1
4afc8724e58084164148b7ce518ede8b203dce3c
-
SHA256
c1b81966fa17c4e7d5137f13b2f4d04704c97d66a54d57dcfc1f42ad1f4029e7
-
SHA512
ae32d9e7d7403a6ab0429da69fe4f803001a077327a0f103ccc9bcb90b17973ef10be8dc2cbf1909549a04f1eff5e85c81c2dfc2d99ba7fa93369efa47beca6c
-
SSDEEP
98304:BaqBN1el9eL+FB8Y2nzDNWbVAneM/EjF+894S:oqX1nk52n05AehERS
Malware Config
Signatures
-
Loads dropped Dex/Jar 1 TTPs 1 IoCs
Runs executable file dropped to the device during analysis.
ioc pid Process /data/user/0/com.herocraft.game.birdsonwire.freemium/files/b04e7800.dex 5199 com.herocraft.game.birdsonwire.freemium -
Obtains sensitive information copied to the device clipboard 2 TTPs 1 IoCs
Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.
description ioc Process Framework service call android.content.IClipboard.addPrimaryClipChangedListener com.herocraft.game.birdsonwire.freemium -
Acquires the wake lock 1 IoCs
description ioc Process Framework service call android.os.IPowerManager.acquireWakeLock com.herocraft.game.birdsonwire.freemium -
Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs
Application may abuse the framework's foreground service to continue running in the foreground.
description ioc Process Framework service call android.app.IActivityManager.setServiceForeground com.herocraft.game.birdsonwire.freemium -
Queries information about active data network 1 TTPs 1 IoCs
description ioc Process Framework service call android.net.IConnectivityManager.getActiveNetworkInfo com.herocraft.game.birdsonwire.freemium -
Queries the mobile country code (MCC) 1 TTPs 1 IoCs
description ioc Process Framework service call com.android.internal.telephony.ITelephony.getNetworkCountryIsoForPhone com.herocraft.game.birdsonwire.freemium -
Reads information about phone network operator. 1 TTPs
-
Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs
description ioc Process Framework service call android.app.IActivityManager.registerReceiver com.herocraft.game.birdsonwire.freemium -
Checks memory information 2 TTPs 1 IoCs
description ioc Process File opened for read /proc/meminfo com.herocraft.game.birdsonwire.freemium
Processes
-
com.herocraft.game.birdsonwire.freemium1⤵
- Loads dropped Dex/Jar
- Obtains sensitive information copied to the device clipboard
- Acquires the wake lock
- Makes use of the framework's foreground persistence service
- Queries information about active data network
- Queries the mobile country code (MCC)
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Checks memory information
PID:5199
Network
MITRE ATT&CK Mobile v15
Persistence
Event Triggered Execution
1Broadcast Receivers
1Foreground Persistence
1Defense Evasion
Download New Code at Runtime
1Foreground Persistence
1Virtualization/Sandbox Evasion
1System Checks
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
414B
MD54fa8c5ba0ee39486c3a305d8e7542df6
SHA1c40608d35e6305d9a7fd6c2c6dabb5885a83613a
SHA256a7b018c98bf4848a4fdecf194090476f8d0c12f9e371f556199ce44ec38c4230
SHA512bac6ac441cd2241496d1ebae6e3cf5667813909864ce43cf97a6648041b92a778cb66376f9c916c2d36dffc3da10542c3c3eef15307db237fc52604f9e6f7560
-
Filesize
489B
MD5fb2a4ed565ec06fc24e133391fbbf913
SHA1c51d2ce5406fd8a901f5e94589a43e81368de98a
SHA2567735f43a2c33305c93acf5452ef02de1ab7135c4d54ccade8735f57660c07847
SHA512ce22898ceab84aa7db1d440203094871efa697d8138ac0479e9e351f65ab7a7a4689ba72970456069dcc6f6060c0afcf1b97c93246271f95a781256dfdc1308a
-
Filesize
242B
MD5a02bd66fae690ba4ab788af83df3fd60
SHA126ea3eba1d43c9b7b250efc0a78475a12e8c1f02
SHA2568b812f26fac5355f698fe6a64caf9edc1efb1f1567d495d39b40aaca0e7bf0a0
SHA5128f9ef139fcf986cbc24d48d9a60f9f31c6359722c0c96e092985ce2f68bed743ca3e4d90dd07f1e6e89f0141b935923fbb5469a28c3e2bb580218660882c69e4
-
Filesize
242B
MD533e25fc4af076960ecc850eeb159806d
SHA1446ff7a1f3e7ace727639b7a3171a60725194283
SHA256f579fd96cbb09df831ee252ce7198d9c3db5d024c5bc26fadb966309828ae71d
SHA512a84a4f218b5e5128c760cee676aa42bad37bbaa04011de0aef7983977cd760eb668b4b442d8ff1169408fcd8b880ef9b4fce13a5d426431e852cea2c9ea2c18a
-
Filesize
242B
MD505f391cb0e879b69f8efdaf0b2199901
SHA113630b97ce7f6e250839d470a398a48ca9201aea
SHA25667a8f7297a5bd0e847af426295a8fea03faa2d26fa014e920db5259b6c40e0dd
SHA5125a44f9eee267099b4d36b964d7a6e7a8668bb1487de5c9d30bb5f1cd243c8adfd721f3f310d3b0a5c862adc1b797a8460351aa12fcbd5646b64eb5f288d175dd
-
Filesize
2.3MB
MD5a2c0379f196c91a175f47b801895518a
SHA1549b6e1c77021378b4189f736b7eb7437a9d9497
SHA25635cdc216518a388e7842f6b67a2c65ea06ca5302286087df3a9db29603b9aa21
SHA512e3ebb67eb0a9c9e13db1dd29474bf93af6e0e3b9607623c0a70672bfb4f2505abc1f2c23e1592175317bc4f384fb7966954f0d37e6f331f7eb724ff5e6be4205
-
Filesize
6.4MB
MD5670d8683a3c1765ced65f8b60bfacdba
SHA124bc8f1ec3e925316fa05918fed1962379debe15
SHA256fc48615db02bf829b738c5efef9cfc368b27c0a40fe69d4fa165cf59b0d6cc9f
SHA512c6e7c7104c31d2b567874fed9684c172b1dc722d084ab998b0159420554e27ce044ed8b0099194919c18d782ac9d075962c966c602eaaf021f36d9d262bbc9a8