Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
70s -
max time network
154s -
platform
android_x86 -
resource
android-x86-arm-20240624-en -
resource tags
-
submitted
17/01/2025, 00:48 UTC
General
-
Target
TASK-MANAGER.apk
-
Size
256KB
-
MD5
aff6bce844a656890e3a647a8871c479
-
SHA1
070c319ac871d9bd63a6af562bd8e5b237e01acf
-
SHA256
ab5d91a02f508e5e0e9567e1558ce1e006c0e30a6b432bef72842a1adebffbff
-
SHA512
c7e7b41fc9bcda5fb1c4741bc7ece6d6714265e06b3835a2c307a1a1d279ba109f91d762008fb672f3a90e78cac121163424569f8d6f08f20dcecc0d2f5e59c8
-
SSDEEP
6144:vie8HiRem77eyFBPxoLZ7ILWFDPLnQ/9UNPIDdjQXvhuN5DuUuF:vi7HiRh6CoV08nI9UNADlQ/h6aBF
Score
8/10
Malware Config
Signatures
-
Removes its main activity from the application launcher 1 TTPs 1 IoCs
-
Obtains sensitive information copied to the device clipboard 2 TTPs 1 IoCs
Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.
-
Requests accessing notifications (often used to intercept notifications before users become aware). 1 TTPs 1 IoCs
Processes
-
com.etechd.l3mon1⤵
- Removes its main activity from the application launcher
- Obtains sensitive information copied to the device clipboard
- Requests accessing notifications (often used to intercept notifications before users become aware).
Network
-
DNSsemanticlocation-pa.googleapis.comRemote address:1.1.1.1:53Requestsemanticlocation-pa.googleapis.comIN AResponsesemanticlocation-pa.googleapis.comIN A142.250.200.42semanticlocation-pa.googleapis.comIN A172.217.16.234semanticlocation-pa.googleapis.comIN A216.58.204.74semanticlocation-pa.googleapis.comIN A142.250.178.10semanticlocation-pa.googleapis.comIN A216.58.213.10semanticlocation-pa.googleapis.comIN A216.58.201.106semanticlocation-pa.googleapis.comIN A142.250.180.10semanticlocation-pa.googleapis.comIN A142.250.179.234semanticlocation-pa.googleapis.comIN A142.250.200.10semanticlocation-pa.googleapis.comIN A142.250.187.234semanticlocation-pa.googleapis.comIN A172.217.169.74semanticlocation-pa.googleapis.comIN A172.217.169.10semanticlocation-pa.googleapis.comIN A142.250.187.202semanticlocation-pa.googleapis.comIN A216.58.212.202 -
DNSandroid.apis.google.comRemote address:1.1.1.1:53Requestandroid.apis.google.comIN AResponseandroid.apis.google.comIN CNAMEclients.l.google.comclients.l.google.comIN A142.250.178.14
-
DNSwww.google.comRemote address:1.1.1.1:53Requestwww.google.comIN AResponsewww.google.comIN A142.250.200.4
-
DNSupdate.googleapis.comRemote address:1.1.1.1:53Requestupdate.googleapis.comIN AResponseupdate.googleapis.comIN A172.217.16.227
-
142.250.200.42:443tls, https -
10.20.30.40:4488 -
10.20.30.40:4488
-
216.58.204.78:443tls, https
-
142.250.178.14:443android.apis.google.comtls
-
142.250.200.4:443www.google.comtls
-
172.217.16.227:443update.googleapis.comtls
-
10.20.30.40:4488
-
10.20.30.40:4488
-
10.20.30.40:4488
-
10.20.30.40:4488
-
10.20.30.40:4488
-
10.20.30.40:4488
-
10.20.30.40:4488
-
10.20.30.40:4488
-
10.20.30.40:4488
-
224.0.0.251:5353
-
1.1.1.1:53semanticlocation-pa.googleapis.comdns
DNS Request
semanticlocation-pa.googleapis.com
DNS Response
142.250.200.42172.217.16.234216.58.204.74142.250.178.10216.58.213.10216.58.201.106142.250.180.10142.250.179.234142.250.200.10142.250.187.234172.217.169.74172.217.169.10142.250.187.202216.58.212.202
-
1.1.1.1:53android.apis.google.comdns
DNS Request
android.apis.google.com
DNS Response
142.250.178.14
-
1.1.1.1:53www.google.comdns
DNS Request
www.google.com
DNS Response
142.250.200.4
-
1.1.1.1:53update.googleapis.comdns
DNS Request
update.googleapis.com
DNS Response
172.217.16.227