Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Overview
overview
10Static
static
101777a2ba85...b0.apk
android-9-x86
105251a35642...3e.apk
android-9-x86
15251a35642...3e.apk
android-10-x64
15251a35642...3e.apk
android-11-x64
17c44519e51...57.apk
android-9-x86
10FE_Invisib...pt.apk
android-9-x86
7FE_Invisib...pt.apk
android-10-x64
7FE_Invisib...pt.apk
android-11-x64
7HellBoy.apk
android-9-x86
6HellBoy.apk
android-10-x64
1HellBoy.apk
android-11-x64
6Roblox Key...V3.apk
android-9-x86
7Roblox Key...V3.apk
android-10-x64
7Roblox Key...V3.apk
android-11-x64
7Stick War_ Legacy.apk
android-9-x86
7Stick War_ Legacy.apk
android-10-x64
1Stick War_ Legacy.apk
android-11-x64
7Undead_Def...pt.apk
android-9-x86
7Undead_Def...pt.apk
android-10-x64
7Undead_Def...pt.apk
android-11-x64
7antivirus.apk
android-9-x86
7antivirus.apk
android-10-x64
7antivirus.apk
android-11-x64
7b3f23bdd3d...c0.apk
android-9-x86
10e8947bc9fb...10.apk
android-9-x86
7insta_followers.apk
android-9-x86
7insta_followers.apk
android-10-x64
7insta_followers.apk
android-11-x64
7xxx.apk
android-9-x86
1Analysis
-
max time kernel
9s -
max time network
158s -
platform
android-9_x86 -
resource
android-x86-arm-20240910-en -
resource tags
arch:armarch:x86image:android-x86-arm-20240910-enlocale:en-usos:android-9-x86system -
submitted
14/01/2025, 05:17
Behavioral task
behavioral1
Sample
1777a2ba85f831e41c6a60418f84205c9de9c66402f9b7e5be13d29c543a42b0.apk
Resource
android-x86-arm-20240624-en
Behavioral task
behavioral2
Sample
5251a356421340a45c8dc6d431ef8a8cbca4078a0305a87f4fbd552e9fc0793e.apk
Resource
android-x86-arm-20240624-en
Behavioral task
behavioral3
Sample
5251a356421340a45c8dc6d431ef8a8cbca4078a0305a87f4fbd552e9fc0793e.apk
Resource
android-x64-20240624-en
Behavioral task
behavioral4
Sample
5251a356421340a45c8dc6d431ef8a8cbca4078a0305a87f4fbd552e9fc0793e.apk
Resource
android-x64-arm64-20240624-en
Behavioral task
behavioral5
Sample
7c44519e51cc203cdd23f27cefe7cf99de34abddf947ba55951721725f15aa57.apk
Resource
android-x86-arm-20240624-en
Behavioral task
behavioral6
Sample
FE_Invisible_Troll_Script.apk
Resource
android-x86-arm-20240910-en
Behavioral task
behavioral7
Sample
FE_Invisible_Troll_Script.apk
Resource
android-x64-20240910-en
Behavioral task
behavioral8
Sample
FE_Invisible_Troll_Script.apk
Resource
android-x64-arm64-20240910-en
Behavioral task
behavioral9
Sample
HellBoy.apk
Resource
android-x86-arm-20240624-en
Behavioral task
behavioral10
Sample
HellBoy.apk
Resource
android-x64-20240910-en
Behavioral task
behavioral11
Sample
HellBoy.apk
Resource
android-x64-arm64-20240910-en
Behavioral task
behavioral12
Sample
Roblox Keyless Bloxfruits Script HoHo Hub V3.apk
Resource
android-x86-arm-20240910-en
Behavioral task
behavioral13
Sample
Roblox Keyless Bloxfruits Script HoHo Hub V3.apk
Resource
android-x64-20240624-en
Behavioral task
behavioral14
Sample
Roblox Keyless Bloxfruits Script HoHo Hub V3.apk
Resource
android-x64-arm64-20240910-en
Behavioral task
behavioral15
Sample
Stick War_ Legacy.apk
Resource
android-x86-arm-20240910-en
Behavioral task
behavioral16
Sample
Stick War_ Legacy.apk
Resource
android-x64-20240624-en
Behavioral task
behavioral17
Sample
Stick War_ Legacy.apk
Resource
android-x64-arm64-20240910-en
Behavioral task
behavioral18
Sample
Undead_Defense_Tycoon_Script.apk
Resource
android-x86-arm-20240910-en
Behavioral task
behavioral19
Sample
Undead_Defense_Tycoon_Script.apk
Resource
android-x64-20240624-en
Behavioral task
behavioral20
Sample
Undead_Defense_Tycoon_Script.apk
Resource
android-x64-arm64-20240910-en
Behavioral task
behavioral21
Sample
antivirus.apk
Resource
android-x86-arm-20240910-en
Behavioral task
behavioral22
Sample
antivirus.apk
Resource
android-x64-20240910-en
Behavioral task
behavioral23
Sample
antivirus.apk
Resource
android-x64-arm64-20240624-en
Behavioral task
behavioral24
Sample
b3f23bdd3dea208f05de7a5b9ea928758187b3f2b0f4f5733c8bdb3298818ec0.apk
Resource
android-x86-arm-20240910-en
Behavioral task
behavioral25
Sample
e8947bc9fb2bd597daba3064d5fab275d8df2beac92f301063f22fe276dcbc10.apk
Resource
android-x86-arm-20240910-en
Behavioral task
behavioral26
Sample
insta_followers.apk
Resource
android-x86-arm-20240910-en
Behavioral task
behavioral27
Sample
insta_followers.apk
Resource
android-x64-20240910-en
Behavioral task
behavioral28
Sample
insta_followers.apk
Resource
android-x64-arm64-20240624-en
Behavioral task
behavioral29
Sample
xxx.apk
Resource
android-x86-arm-20240624-en
General
-
Target
FE_Invisible_Troll_Script.apk
-
Size
3.2MB
-
MD5
3ff43582aa468b8a8d0e063dcfea73bf
-
SHA1
5d1d34fcec8f715ce045a5bda04741d40f29001b
-
SHA256
a6f56581bb7ae7b242fcaab3d97d04ec2c5ac8aa5870e4e64ffbcf0d78899993
-
SHA512
6af7639bc336015161f3087519e1a365ece0d1e0f5f7f20fe1af3243d1e6c3a0f65e38b50dc70f15cd13a232989b22884ca36bf0151630223d37bdba4f250149
-
SSDEEP
49152:hrOpp2RqaP3KdsFeHcEKYC4KiJK5ncPjPuE/UpXSkdkIDk5sSEj6QiVterxzrK:hYgv6dsFt0FQnGD/UsrLEjS81PK
Malware Config
Signatures
-
Loads dropped Dex/Jar 1 TTPs 2 IoCs
Runs executable file dropped to the device during analysis.
ioc pid Process /data/user/0/com.herocraft.game.freemium.catchthecandy/files/f2f8f843.dex 4389 /system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.herocraft.game.freemium.catchthecandy/files/f2f8f843.dex --output-vdex-fd=42 --oat-fd=43 --oat-location=/data/user/0/com.herocraft.game.freemium.catchthecandy/files/oat/x86/f2f8f843.odex --compiler-filter=quicken --class-loader-context=& /data/user/0/com.herocraft.game.freemium.catchthecandy/files/f2f8f843.dex 4361 com.herocraft.game.freemium.catchthecandy -
Acquires the wake lock 1 IoCs
description ioc Process Framework service call android.os.IPowerManager.acquireWakeLock com.herocraft.game.freemium.catchthecandy -
Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs
Application may abuse the framework's foreground service to continue running in the foreground.
description ioc Process Framework service call android.app.IActivityManager.setServiceForeground com.herocraft.game.freemium.catchthecandy -
Queries information about active data network 1 TTPs 1 IoCs
description ioc Process Framework service call android.net.IConnectivityManager.getActiveNetworkInfo com.herocraft.game.freemium.catchthecandy -
Queries the mobile country code (MCC) 1 TTPs 1 IoCs
description ioc Process Framework service call com.android.internal.telephony.ITelephony.getNetworkCountryIsoForPhone com.herocraft.game.freemium.catchthecandy -
Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs
description ioc Process Framework service call android.app.IActivityManager.registerReceiver com.herocraft.game.freemium.catchthecandy -
Checks memory information 2 TTPs 1 IoCs
description ioc Process File opened for read /proc/meminfo com.herocraft.game.freemium.catchthecandy
Processes
-
com.herocraft.game.freemium.catchthecandy1⤵
- Loads dropped Dex/Jar
- Acquires the wake lock
- Makes use of the framework's foreground persistence service
- Queries information about active data network
- Queries the mobile country code (MCC)
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Checks memory information
PID:4361 -
/system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.herocraft.game.freemium.catchthecandy/files/f2f8f843.dex --output-vdex-fd=42 --oat-fd=43 --oat-location=/data/user/0/com.herocraft.game.freemium.catchthecandy/files/oat/x86/f2f8f843.odex --compiler-filter=quicken --class-loader-context=&2⤵
- Loads dropped Dex/Jar
PID:4389
-
Network
MITRE ATT&CK Mobile v15
Persistence
Event Triggered Execution
1Broadcast Receivers
1Foreground Persistence
1Defense Evasion
Download New Code at Runtime
1Foreground Persistence
1Virtualization/Sandbox Evasion
1System Checks
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
383B
MD52ffb81a266561a337b05cb3fe3abf9bc
SHA14135a7190e02731a0470a23bcade18ecb4c8a8cd
SHA256924284de6024e7c2bfca22c41bc7bd9942138bdac2251435ed017b203dd0cc22
SHA512a362697bf3592c1d979ef3871f6381bc1568c81ba4ff2475e6366012e11e2b5a28f8e8aac2a9b37a71040ca7a95a96bdc963983c51f24ec1cc742f331b70f1ad
-
/data/data/com.herocraft.game.freemium.catchthecandy/files/PersistedInstallation7043033888099906818tmp
Filesize567B
MD55929f119da464fe15f512aea4e3bb7ae
SHA147c0de00f203124acdcb4a2d528c40977f639fd5
SHA256ac9db451601dfbafe90d12448a5f5ddb5fda1526d001f1fa9df9d8f64ad743d4
SHA51227c3bf75a8051ae1a57ce39279e391f2cc04022afec8b83f8af370545e849cd42639d5ddc5395f630d9e17e57b74b5b0a304055d7c8926413164af42eb06f6b2
-
/data/data/com.herocraft.game.freemium.catchthecandy/files/PersistedInstallation7841961617515730450tmp
Filesize90B
MD5bded484227444ace24fffcd4d0add055
SHA18b7851169c4cbbd4c66a00c37b52368d3376c386
SHA256a8ffe9a54cfeab08057e5aee31b62717be83b75807b9d50da132707d1fd9ec11
SHA5120dd48f9cd3deac67a75a89003213a90569dd1b6a495e53526a9a156269a85e2e935fb9e8d373c68c2bc8495981c9ff2522eedb60b9a7405d5a681ec6d3e7e603
-
Filesize
2.3MB
MD5d951efa7f0ca59781f3af35949338902
SHA1ac853df2b6835dbac7c94eb008ab4657e68eda70
SHA2565b0a0d3671f6ff3ea0001624a0c157d057965e60891c5335391880fe9b00e183
SHA5128fbbc1c347ec03478b01ff321d159656abfcad1d9ac3b426382348567c57bbaf1cdb3cac77c38fbcf62e0e17063f170fc9f9bf200a982b940dcad47e30b05617
-
Filesize
229B
MD5afc5830859e0c30baf4510c8cb43cd97
SHA1f82029564925c40757ba67832c715c234240226c
SHA2565872c438c660fd2b71e3125301f38b9f855944dcf692350fa037e616d92bebd0
SHA5129063e64a28a90c42cfee7244bd8bc75f5038fd366bee24205b986d38371f2de966b4f3eadca8c0e66fa223199c9c7d78913a6080288a7d73bab54a5c4d2d3b11
-
Filesize
6.4MB
MD5767a8ce605249b314939882f824f989a
SHA17cb1e61d4fa739b92b25d13bcf33bbb00cff9baa
SHA25626d8b34344e6e61c8a1380e9773109569accb467b36f954a1e5c729a4d701fa5
SHA512baec83cf6d66fc0dbf13411043c8168acf38b0b66a9c20f9b1ec54d6f5ef21527d22b4c47dd54734dcd5bd85410dc3bb8fe786fb1702443beee9a42e869c4475