Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
147s -
platform
android_x86 -
resource
android-x86-arm-20240624-en -
resource tags
-
submitted
06/02/2025, 00:38
General
-
Target
7336d69db60d8b7a9113f3867c764e6b438afc7024b30610e465a7e9499ade68.apk
-
Size
3.2MB
-
MD5
1b69285c1135ad439baf7da8a7dae91b
-
SHA1
1899663f322d01050e33f37c478c08bc09294f0c
-
SHA256
7336d69db60d8b7a9113f3867c764e6b438afc7024b30610e465a7e9499ade68
-
SHA512
495ec0623cfebc141d2d1d522938d3e46db896ee12e5a7f8f9246d6e525c32995c047d3ea0e86e002d7e2ffee9e963bd90e3c38cf641cf1140ee688c938223e3
-
SSDEEP
98304:q95TvYRIKePOg6JxjwEBISSddXCEYp7k3XEjp:QxvYRIPOSe4XCF9
Malware Config
Signatures
-
Makes use of the framework's Accessibility service 4 TTPs 1 IoCs
Retrieves information displayed on the phone screen using AccessibilityService.
-
Acquires the wake lock 1 IoCs
-
Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs
Application may abuse the framework's foreground service to continue running in the foreground.
-
Queries information about active data network 1 TTPs 1 IoCs
-
Queries the mobile country code (MCC) 1 TTPs 1 IoCs
-
Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs
-
Schedules tasks to execute at a specified time 1 TTPs 1 IoCs
Application may abuse the framework's APIs to perform task scheduling for initial or recurring execution of malicious code.
-
Checks CPU information 2 TTPs 1 IoCs
-
Checks memory information 2 TTPs 1 IoCs
Processes
-
com.xuanfeng.xubulpinn1⤵
- Makes use of the framework's Accessibility service
- Acquires the wake lock
- Makes use of the framework's foreground persistence service
- Queries information about active data network
- Queries the mobile country code (MCC)
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Schedules tasks to execute at a specified time
- Checks CPU information
- Checks memory information
Network
MITRE ATT&CK Mobile v15
Persistence
Event Triggered Execution
1Broadcast Receivers
1Foreground Persistence
1Scheduled Task/Job
1Defense Evasion
Foreground Persistence
1Input Injection
1Virtualization/Sandbox Evasion
2System Checks
2Discovery
System Information Discovery
2System Network Configuration Discovery
1System Network Connections Discovery
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
28B
MD5e156c2b8fc3be1af1c34ae17f7f455ea
SHA11bd10e12b6e73c591d68d94ad4c1592ef0ef29b9
SHA256f6ff44f9e787504e05d70cd47d05f898c2605eee72b1d6e66b8e09b54160bb2e
SHA512d9b32ea141d875c22609e86065d13f343a127ce7584a3cfc1de9bd2856e5291a7fec5a07b35f21bfffa0aa5636864f96f5929b73def8e57812b50be73a28ef1a
-
Filesize
20B
MD555b40caf775ad6dfcef011ee42b918ed
SHA1a42f81de19fe6889655c99fb10fddac473e986e9
SHA2565be69f5a72048dc2f1b36ca4d5d875bea2fc7779b9a42e469c5abd39c33e2444
SHA5125ab2a9b411ed298a679ad9a8a841427f4a22bad8e044fa0f113bf730beaeb90a87b5cd44a9b5d42f419e80cd0fa2d6db6fb601b613fba394bc7550c62eef5696
-
Filesize
20B
MD5984097c5510cb52a533f03d8ffdb5c1b
SHA1426b738b8924dc5b5d1668c84d4e9140a39af7e3
SHA256bb38ae7ff64830f6f337ddf19b9ede818e6bf34adc673b414ebd484acc383e00
SHA512edf35fba34a48d113dee83f84dbd6068c20fa1a76bb40861c239001108a16eb86ccb3e4663bafcde3c0ce5edf19da3a0beb2fc0bb5335fd6c291af88a09f178f