Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
145s -
max time network
152s -
platform
android-10_x64 -
resource
android-x64-20240910-en -
resource tags
-
submitted
16/01/2025, 22:09
General
-
Target
e20bf76b287d2fc36bb8358ad9bc9289d19ddfa6ae5ad985403e99081c787a18.apk
-
Size
102KB
-
MD5
a96fdeebde069a42a51a44d734b0eee7
-
SHA1
355b8894773fd9966ae5ccc9b9f33160802bb93c
-
SHA256
e20bf76b287d2fc36bb8358ad9bc9289d19ddfa6ae5ad985403e99081c787a18
-
SHA512
46eb16e58701767c6f7dd6ff919eedbb3a9b4b4e8fc4fa5445b503258c750d01161fdf39a81a495c1f526ba3889209b6c2ca0f696a1e2e9168e3ced8e9cab90a
-
SSDEEP
3072:A8EcttGIEZvMI+p/F8l6IO3f8ZbwcYklkG+:A8EyGIAR+pt8l613kZbwcYNG+
Malware Config
Signatures
-
Removes its main activity from the application launcher 1 TTPs 1 IoCs
-
Loads dropped Dex/Jar 1 TTPs 3 IoCs
Runs executable file dropped to the device during analysis.
-
Makes use of the framework's Accessibility service 4 TTPs 2 IoCs
Retrieves information displayed on the phone screen using AccessibilityService.
-
Obtains sensitive information copied to the device clipboard 2 TTPs 1 IoCs
Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.
-
Acquires the wake lock 1 IoCs
-
Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs
Application may abuse the framework's foreground service to continue running in the foreground.
-
Performs UI accessibility actions on behalf of the user 1 TTPs 2 IoCs
Application may abuse the accessibility service to prevent their removal.
-
Queries the mobile country code (MCC) 1 TTPs 1 IoCs
-
Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs
-
Checks CPU information 2 TTPs 1 IoCs
-
Checks memory information 2 TTPs 1 IoCs
Processes
-
com.zncpco.btqvrws1⤵
- Removes its main activity from the application launcher
- Loads dropped Dex/Jar
- Makes use of the framework's Accessibility service
- Obtains sensitive information copied to the device clipboard
- Acquires the wake lock
- Makes use of the framework's foreground persistence service
- Performs UI accessibility actions on behalf of the user
- Queries the mobile country code (MCC)
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Checks CPU information
- Checks memory information
Network
MITRE ATT&CK Mobile v15
Persistence
Event Triggered Execution
1Broadcast Receivers
1Foreground Persistence
1Defense Evasion
Download New Code at Runtime
1Foreground Persistence
1Hide Artifacts
1Suppress Application Icon
1Impair Defenses
1Prevent Application Removal
1Input Injection
1Virtualization/Sandbox Evasion
2System Checks
2Credential Access
Clipboard Data
1Input Capture
2GUI Input Capture
1Keylogging
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
143B
MD51657ff4be02dc6e11837fdde0ae9e42d
SHA12ea8247cfd131766128f57f8a7bbaf77bcb47333
SHA2567d52afa42707796a655b13f862bb140a4f35bcccebdba8cdc631323a5b538814
SHA51201aa09b4a5be9be23d280833199663f17e4d1d4eb50d99f1453870b92b8e7327e394cb38f7d4c9b834f49edcee50987a25e1c519c02644fbd83c70cbaec290ec
-
Filesize
172KB
MD50fac43824bf1c289e5e90e9bfd18c3f7
SHA16bf8d1f51cb503b4a0911f028c56f08f976b4812
SHA2564477dba170e21b97067ccc39493c674351b43829205e14439c79be4cdf6126b8
SHA512f31798cf7bdaae5aa049faf3c977dbe54b677b6c7cdaf74cfc10b641a0d103df1288578ffbb8c224e66086f461b6fd0a32ea992901e722a6f463d016970cb8b9