Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    144s
  • max time network
    151s
  • platform
    android-9_x86
  • resource
    android-x86-arm-20240910-en
  • resource tags

    arch:armarch:x86image:android-x86-arm-20240910-enlocale:en-usos:android-9-x86system
  • submitted
    16/01/2025, 22:09

General

  • Target

    e20bf76b287d2fc36bb8358ad9bc9289d19ddfa6ae5ad985403e99081c787a18.apk

  • Size

    102KB

  • MD5

    a96fdeebde069a42a51a44d734b0eee7

  • SHA1

    355b8894773fd9966ae5ccc9b9f33160802bb93c

  • SHA256

    e20bf76b287d2fc36bb8358ad9bc9289d19ddfa6ae5ad985403e99081c787a18

  • SHA512

    46eb16e58701767c6f7dd6ff919eedbb3a9b4b4e8fc4fa5445b503258c750d01161fdf39a81a495c1f526ba3889209b6c2ca0f696a1e2e9168e3ced8e9cab90a

  • SSDEEP

    3072:A8EcttGIEZvMI+p/F8l6IO3f8ZbwcYklkG+:A8EyGIAR+pt8l613kZbwcYNG+

Malware Config

Signatures

  • Removes its main activity from the application launcher 1 TTPs 1 IoCs
  • Loads dropped Dex/Jar 1 TTPs 4 IoCs

    Runs executable file dropped to the device during analysis.

  • Acquires the wake lock 1 IoCs
  • Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs

    Application may abuse the framework's foreground service to continue running in the foreground.

  • Performs UI accessibility actions on behalf of the user 1 TTPs 2 IoCs

    Application may abuse the accessibility service to prevent their removal.

  • Queries the mobile country code (MCC) 1 TTPs 1 IoCs
  • Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs
  • Checks CPU information 2 TTPs 1 IoCs
  • Checks memory information 2 TTPs 1 IoCs

Processes

  • com.zncpco.btqvrws
    1⤵
    • Removes its main activity from the application launcher
    • Loads dropped Dex/Jar
    • Acquires the wake lock
    • Makes use of the framework's foreground persistence service
    • Performs UI accessibility actions on behalf of the user
    • Queries the mobile country code (MCC)
    • Registers a broadcast receiver at runtime (usually for listening for system events)
    • Checks CPU information
    • Checks memory information
    PID:4370
    • /system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.spy.info4444/files/Factory/Plugins/classes.dex --output-vdex-fd=43 --oat-fd=44 --oat-location=/data/user/0/com.spy.info4444/files/Factory/Plugins/oat/x86/classes.odex --compiler-filter=quicken --class-loader-context=&
      2⤵
      • Loads dropped Dex/Jar
      PID:4443

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • /data/user/0/com.spy.info4444/files/Factory/Plugins/classes.dex

    Filesize

    172KB

    MD5

    c900cfad2d2b5520d02a27d7e999f607

    SHA1

    25509954c1477f153f02fe00419578c6dc9ee5fa

    SHA256

    56fb95b777ddf2a2cc08382a8954c33bcda9588c9f48d99c771b5d5dcdfaa717

    SHA512

    589f03ff86b1d13e50587e133bc7b24d79c0d698f4782fb5325bc977be1a586751821c5366dec93f08c4fffeaff67274827668adb42f0a75aee6091f0d23f8b8

  • Anonymous-DexFile@0xd4b28000-0xd4b53100

    Filesize

    172KB

    MD5

    0fac43824bf1c289e5e90e9bfd18c3f7

    SHA1

    6bf8d1f51cb503b4a0911f028c56f08f976b4812

    SHA256

    4477dba170e21b97067ccc39493c674351b43829205e14439c79be4cdf6126b8

    SHA512

    f31798cf7bdaae5aa049faf3c977dbe54b677b6c7cdaf74cfc10b641a0d103df1288578ffbb8c224e66086f461b6fd0a32ea992901e722a6f463d016970cb8b9