Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
144s -
max time network
151s -
platform
android-11_x64 -
resource
android-x64-arm64-20240910-en -
resource tags
-
submitted
16/01/2025, 22:09
General
-
Target
e20bf76b287d2fc36bb8358ad9bc9289d19ddfa6ae5ad985403e99081c787a18.apk
-
Size
102KB
-
MD5
a96fdeebde069a42a51a44d734b0eee7
-
SHA1
355b8894773fd9966ae5ccc9b9f33160802bb93c
-
SHA256
e20bf76b287d2fc36bb8358ad9bc9289d19ddfa6ae5ad985403e99081c787a18
-
SHA512
46eb16e58701767c6f7dd6ff919eedbb3a9b4b4e8fc4fa5445b503258c750d01161fdf39a81a495c1f526ba3889209b6c2ca0f696a1e2e9168e3ced8e9cab90a
-
SSDEEP
3072:A8EcttGIEZvMI+p/F8l6IO3f8ZbwcYklkG+:A8EyGIAR+pt8l613kZbwcYNG+
Malware Config
Signatures
-
Removes its main activity from the application launcher 1 TTPs 1 IoCs
-
Loads dropped Dex/Jar 1 TTPs 3 IoCs
Runs executable file dropped to the device during analysis.
-
Makes use of the framework's Accessibility service 4 TTPs 2 IoCs
Retrieves information displayed on the phone screen using AccessibilityService.
-
Obtains sensitive information copied to the device clipboard 2 TTPs 1 IoCs
Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.
-
Acquires the wake lock 1 IoCs
-
Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs
Application may abuse the framework's foreground service to continue running in the foreground.
-
Performs UI accessibility actions on behalf of the user 1 TTPs 2 IoCs
Application may abuse the accessibility service to prevent their removal.
-
Checks CPU information 2 TTPs 1 IoCs
-
Checks memory information 2 TTPs 1 IoCs
Processes
-
com.zncpco.btqvrws1⤵
- Removes its main activity from the application launcher
- Loads dropped Dex/Jar
- Makes use of the framework's Accessibility service
- Obtains sensitive information copied to the device clipboard
- Acquires the wake lock
- Makes use of the framework's foreground persistence service
- Performs UI accessibility actions on behalf of the user
- Checks CPU information
- Checks memory information
Network
MITRE ATT&CK Mobile v15
Defense Evasion
Download New Code at Runtime
1Foreground Persistence
1Hide Artifacts
1Suppress Application Icon
1Impair Defenses
1Prevent Application Removal
1Input Injection
1Virtualization/Sandbox Evasion
2System Checks
2Credential Access
Clipboard Data
1Input Capture
2GUI Input Capture
1Keylogging
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
172KB
MD50fac43824bf1c289e5e90e9bfd18c3f7
SHA16bf8d1f51cb503b4a0911f028c56f08f976b4812
SHA2564477dba170e21b97067ccc39493c674351b43829205e14439c79be4cdf6126b8
SHA512f31798cf7bdaae5aa049faf3c977dbe54b677b6c7cdaf74cfc10b641a0d103df1288578ffbb8c224e66086f461b6fd0a32ea992901e722a6f463d016970cb8b9
-
Filesize
181B
MD5f3b6bc868e115b88a8812c98b1363c4f
SHA1bd00ccf203e61561fb573bed5160e576cf548850
SHA256544b9a9a1a7807d93ff17dac94c996c5c618248b63e71206ee40061e16e2dc92
SHA51215795db52071755e78f3711b564697d1e7892dae8659707ccbac6b31c5ab1aad788c0f3a3f04e3fd7554400ad9a01d59d1e0c67f7f3b3e262e70bb6d8d072001