Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

General

  • Target

    65215e95c71e4ec51df7485f14cb310d.apk

  • Size

    6.1MB

  • MD5

    65215e95c71e4ec51df7485f14cb310d

  • SHA1

    5c2ff1c1167a22d95ccfd4a6262169e1344ba98a

  • SHA256

    b35e77a5710aca0db9ca9b65f6eac1d55f73a04a199169579ea6c07140d8f628

  • SHA512

    25b2d9e65d9735ab15f12da8cf88192169bfbf52acb0dcfaef8c3aac5bb28bfe37707fd37256a0d35494e0d54adb9c5b8a04b902f88201adc427d838fb1bb307

  • SSDEEP

    98304:uytyq4p6RpXXVN8ej8jwKxrSsslpasAQJ2k0mLsrUt46pYe1PPzjjaoV53Esrs1:ttG636UKlTslksAQ8EL5lPz6oVs

Score
10/10

Malware Config

Extracted

Family

axbanker

C2

https://newax-d7dc6-default-rtdb.firebaseio.com

https://theicicirwd.co.in/api/user/step2

Signatures

  • Axbanker family
  • Requests dangerous framework permissions 8 IoCs

Files

  • 65215e95c71e4ec51df7485f14cb310d.apk
    .apk android arch:arm64 arch:arm arch:x86 arch:x64

    com.gameram.gameramer

    com.gameram.gameramer.SplashActivity


Android Permissions

65215e95c71e4ec51df7485f14cb310d.apk

Permissions

android.permission.BIND_NOTIFICATION_LISTENER_SERVICE

android.permission.WRITE_SETTINGS

android.permission.ACCESS_NETWORK_STATE

android.permission.READ_PHONE_STATE

android.permission.CALL_PHONE

android.permission.MODIFY_PHONE_STATE

android.permission.POST_NOTIFICATIONS

android.permission.FOREGROUND_SERVICE_DATA_SYNC

android.permission.REQUEST_IGNORE_BATTERY_OPTIMIZATIONS

android.permission.FOREGROUND_SERVICE

android.permission.FOREGROUND_SERVICE_CONNECTED_DEVICE

android.permission.INTERNET

android.permission.READ_PRIVILEGED_PHONE_STATE

android.permission.RECEIVE_BOOT_COMPLETED

android.permission.RECEIVE_SMS

android.permission.SEND_SMS

android.permission.READ_SMS

android.permission.MODIFY_PHONE_STATE

android.permission.ACCESS_NETWORK_STATE

android.permission.ACCESS_WIFI_STATE

android.permission.SYSTEM_ALERT_WINDOW

android.permission.WAKE_LOCK

android.permission.WRITE_SECURE_SETTINGS

android.permission.USE_FINGERPRINT

android.permission.BIND_ACCESSIBILITY_SERVICE