Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
General
-
Target
4590f826de070cca7daa802ee156afa2e42cbb97f391d5493cb610c7bd0692e4.bin
-
Size
212KB
-
Sample
250120-12pr6a1rfw
-
MD5
252e59089b263de2f5421a6b2a54f9e2
-
SHA1
1d20856eb83033d8e1ea85b5f13edcc4a0cbbd3f
-
SHA256
4590f826de070cca7daa802ee156afa2e42cbb97f391d5493cb610c7bd0692e4
-
SHA512
7cf689ab2ef175d45c60c5b2266bd1ced2dd7c60785d8da02b6b9e5a0f747926e9d160916d306bf4002ce8556c66b45b28715a9dc9a44ec56320d062fcbbd8f1
-
SSDEEP
6144:8XA1fKVvRlV2uElGBmgoImL7yfbkB1am1eD:8w1SVvDBEafoIw7yfI9MD
Behavioral task
behavioral1
Sample
4590f826de070cca7daa802ee156afa2e42cbb97f391d5493cb610c7bd0692e4.apk
Resource
android-x86-arm-20240624-en
Malware Config
Extracted
xloader_apk
https://m.vk.com/id730148259?act=info
https://m.vk.com/id730149630?act=info
-
user_agent
Mozilla/5.0 (Linux; Android 8.0.0; SM-G955U Build/R16NW) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/87.0.4280.141 Mobile Safari/537.36 Edg/112.0.0.0
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.0.0 Safari/537.36
Targets
-
-
Target
4590f826de070cca7daa802ee156afa2e42cbb97f391d5493cb610c7bd0692e4.bin
-
Size
212KB
-
MD5
252e59089b263de2f5421a6b2a54f9e2
-
SHA1
1d20856eb83033d8e1ea85b5f13edcc4a0cbbd3f
-
SHA256
4590f826de070cca7daa802ee156afa2e42cbb97f391d5493cb610c7bd0692e4
-
SHA512
7cf689ab2ef175d45c60c5b2266bd1ced2dd7c60785d8da02b6b9e5a0f747926e9d160916d306bf4002ce8556c66b45b28715a9dc9a44ec56320d062fcbbd8f1
-
SSDEEP
6144:8XA1fKVvRlV2uElGBmgoImL7yfbkB1am1eD:8w1SVvDBEafoIw7yfI9MD
-
XLoader payload
-
Xloader_apk family
-
Checks if the Android device is rooted.
-
Queries the phone number (MSISDN for GSM devices)
-
Reads the content of the MMS message.
-
Acquires the wake lock
-
Makes use of the framework's foreground persistence service
Application may abuse the framework's foreground service to continue running in the foreground.
-
Requests disabling of battery optimizations (often used to enable hiding in the background).
-
MITRE ATT&CK Mobile v15
Persistence
Event Triggered Execution
1Broadcast Receivers
1Foreground Persistence
1Defense Evasion
Download New Code at Runtime
1Foreground Persistence
1Hide Artifacts
2Suppress Application Icon
1User Evasion
1Virtualization/Sandbox Evasion
1System Checks
1