Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
26s -
max time network
163s -
platform
android-9_x86 -
resource
android-x86-arm-20240910-en -
resource tags
-
submitted
14/01/2025, 05:17
General
-
Target
b3f23bdd3dea208f05de7a5b9ea928758187b3f2b0f4f5733c8bdb3298818ec0.apk
-
Size
3.7MB
-
MD5
f17c846775fe7d69c25b1f9834ec31d9
-
SHA1
642e9c6595ed94cf6040c9a66e4431b04a62a2a3
-
SHA256
b3f23bdd3dea208f05de7a5b9ea928758187b3f2b0f4f5733c8bdb3298818ec0
-
SHA512
2f9883be40f1b9fda7ef9bd432c7d32e5adf6222e5bc9dbeed974f7e101a8c8af39f3bdd059fb0b83cb7e0d034f1ac85bc860bba30eb46b2da7f6d02657c70c9
-
SSDEEP
98304:qmVDDWjqPP2X1180Q046fgVPwLBqylSWFk5uYUbLCJrn:p3WjqX2l2046qPwLB/lS+kpUnu
Malware Config
Signatures
-
TiSpy
TiSpy is an Android stalkerware.
-
Tispy family
-
Loads dropped Dex/Jar 1 TTPs 6 IoCs
Runs executable file dropped to the device during analysis.
-
Queries information about the current nearby Wi-Fi networks 1 TTPs 1 IoCs
Application may abuse the framework's APIs to collect information about the current nearby Wi-Fi networks.
-
Queries the phone number (MSISDN for GSM devices) 1 TTPs
-
Requests cell location 2 TTPs 1 IoCs
Uses Android APIs to to get current cell location.
-
Acquires the wake lock 1 IoCs
-
Queries information about active data network 1 TTPs 1 IoCs
-
Queries information about the current Wi-Fi connection 1 TTPs 1 IoCs
Application may abuse the framework's APIs to collect information about the current Wi-Fi connection.
-
Queries the mobile country code (MCC) 1 TTPs 1 IoCs
-
Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs
Processes
-
com.ygvezckt.rwqaztkw1⤵
- Loads dropped Dex/Jar
- Queries information about the current nearby Wi-Fi networks
- Requests cell location
- Acquires the wake lock
- Queries information about active data network
- Queries information about the current Wi-Fi connection
- Queries the mobile country code (MCC)
- Registers a broadcast receiver at runtime (usually for listening for system events)
-
/system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.ygvezckt.rwqaztkw/files/dex/316f40170801e947.zip --output-vdex-fd=44 --oat-fd=45 --oat-location=/data/user/0/com.ygvezckt.rwqaztkw/files/dex/oat/x86/316f40170801e947.odex --compiler-filter=quicken --class-loader-context=&2⤵
- Loads dropped Dex/Jar
-
-
/system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.ygvezckt.rwqaztkw/files/dex/lLtoeVfIDbcROVZBX.zip --output-vdex-fd=44 --oat-fd=45 --oat-location=/data/user/0/com.ygvezckt.rwqaztkw/files/dex/oat/x86/lLtoeVfIDbcROVZBX.odex --compiler-filter=quicken --class-loader-context=&2⤵
- Loads dropped Dex/Jar
-
Network
MITRE ATT&CK Mobile v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
16KB
MD53621ce0aa81e37bc5c80e2cf881f1dd0
SHA100365f82dcada94caea07443656848baf60b3bd9
SHA2568620d146b06037c9dc98b8788c3137344eb9d7e1f8b982ffec4c1d8549f24dd5
SHA51276bb7175359d61ce39e95008269752de25769c4e274b4bcf37b920bc2cbfb680b2a4a88de860ed069655d1f47604638b0301c2c6131107cd929348895d73d2bf
-
Filesize
512B
MD5b3c79dcc25952dfa5f35e8af065c885b
SHA129d39fc18a43ef6cf5e790f93d643a47a68d2477
SHA256c20444ccf1c0e7926ddbb2a784d456f870ec4dcc7e0435a8e7debe1db80eb6f3
SHA5125f3a2a35bbadcf702a0cb3289f8db14d266c55ca5598e5c45f3b16233305df57bc7614a90c0237b16b7e86948468342456cff2eaabb298895d1d1f0b540bd5a8
-
Filesize
32KB
MD5bb7df04e1b0a2570657527a7e108ae23
SHA15188431849b4613152fd7bdba6a3ff0a4fd6424b
SHA256c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479
SHA512768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012
-
Filesize
28KB
MD59b0d19d1ef1938b10d4516a84025baee
SHA19190c8d4461614afea2111967a9cdbba9a705522
SHA25623b9ee4d04244e0b315a0d6c72a651d526dfad2790d4c346e1dcba292b099997
SHA51210092428090d4866a4298821ef954262fbd80711fa8a7ec73c1e2f66cd3ad04a6829d5ba3a19570036f272d9ef4ff166e4f907ec72b7c2251ebebed3c07a5bc5
-
Filesize
145KB
MD58767a74133b3328c2a87a24893142ec2
SHA1c1c48bcab9d7bf804cad029656d8b79bf8655d29
SHA25680afd0eea39b125cd5a2f300a3b50302f002ff332943f71bd46d7ce5914e0f82
SHA51296a2d70a2adfef8b8da4fc8c6b2be0b7eed0c33f76770093799fd3bbccf1b766290151cbd65981634c821baabdd8d445a6f66cf955045f0f402286b61aab2d7c
-
Filesize
548KB
MD51b463ebe439550e65863364d145f3633
SHA106a1d114d31cc0c0735f6e865290de0df66534fc
SHA256402745874a8f4229a51c30bb0a3fc4a383d5d2bdecf43f73920c7ec59f402631
SHA51245be5088110b35464faac2c708084e5337ddf5f89d582001582c47db28e04ab577dc036ee481b02f3743b3bfc1a0bc85cdf9185f23aa8e683a2890833b77be5a
-
Filesize
649KB
MD55631aac4cdaafaf80e13e30ca0f35df4
SHA1a5c11f94c00875c38fcc29debd5ab1f01b6a6d20
SHA256c65d54edc4dfb9bb13a51764be2b1a66e6ef781a6f1a18368d22aeea79f1af6c
SHA51215c45aabc02a08dd369de2b9f3ba736ccdea4cd325e865b079810887d3cfbdf52a7286dbb0516630cc0f83d3fba0a99efcb2a1f37ce3ee0a50bae98eb731eb47
-
Filesize
8KB
MD57c20a2b01bf3f9df1f0abb72ebbe82be
SHA1e601b2e41434623edbeece32867517a3cdec5449
SHA2561a10cc3cd2dc21a9be2d2eb758fd19288082619d331245b927d0a9299462ea2e
SHA5123faa6efbd3ebf6e1aff7ebe9958c5f94bbfe9c5ff9e11e9092b1b7301bbe6504c01b922d709303147e213b3cadce8e96462220a1d1bf4d6cdaec95b3f84bb1b4
-
Filesize
15KB
MD5c9b555d11d0c0a4ed2d8610ee65051ef
SHA1603d1e3c74703ffc37e988ddbc6e4be250ca5f90
SHA2567c985cec84adafe18cb36185c4947ae3d17a32c315cc4cb84c5683b48423bcdd
SHA512c6db799c1c891bae520d17d42d1a8b8d5f7948d8b47850ee9da6818db8ddbcf1cef812be4a9101426f194e30d37663d249d970365e814cff99ec85578925faee
-
Filesize
1.3MB
MD50141ce546517d0ff09558391ffe2c3d1
SHA1c8da2607f42222cf6726f30015fce0e501df3c30
SHA2564f647e2c0402fab82866f27337c18543123212e46abb52914e8c22bcff7382cf
SHA512886f3fd3d8b891a8a1ced7552bb73e82b8eb390bf028570d1e5f1089863399dfe26184c4b6974968cc0a801ac1dadc768af157c386cda3fb0b810279680f48ce
-
Filesize
1.3MB
MD5c276d68c66d80dfed813846189721519
SHA13006ae75be916f82d520f683322ce5b8af4be68b
SHA256ba4227db1d3fb1d9befcdc67847e414b5070dd7e9d28e397c4cec1488309053e
SHA512b5c1844af6bc735c26cb736691d864c3cb4ac567d49c8c0f5a3f73c7d8aa7de890900563a99a7e0a1e114cf561955225bea7522df876c338f380d03e502bb497
-
Filesize
1.7MB
MD50df030186d9f5c370a15db6223ca2eb7
SHA133a9951863ceaf037787cd169c4cf61fcb7bba1b
SHA256ecf40b3088a5186d0c043c2248aaa1a509c4336ae7cad299741fb7fc7ba0b11c
SHA5120777b4c68b58b428410554b9e420852cd3fb2f2bcfe7a48487b1564918c386ca5d80327a7dc9b9b2d8d55da5330296aabd1f866db3e068bbfb3a3d7f393547ae
-
Filesize
1.7MB
MD5eba2e1ec82083be20ece86501cf4a651
SHA1c7296d77e0ff6982396d13e1f6cc54b2be4b5f12
SHA2567cd112ace3c9789beb88d7d75e3c664706505fc8c5ede01fc92fabb9da2700ec
SHA512668f0e05318a9a1d8f28aa9f8796450422b0f5d722704bcb37e003d42951e7033053b2c38ba4bc1144b14bac9114d875e860f5ee8add0986234228e2dc9dfbaf
