Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    141s
  • max time network
    134s
  • platform
    android_x64
  • resource
    android-33-x64-arm64-20240624-en
  • resource tags

    androidarch:arm64arch:x64image:android-33-x64-arm64-20240624-enlocale:en-usos:android-13-x64system
  • submitted
    08/02/2025, 14:09

General

  • Target

    442885c6e7dab1b8cfc165176dce57efbce1117c83c356356251d3c29c7ead35.apk

  • Size

    4.8MB

  • MD5

    32426d48cfaa6bdbb6b23306e5cf66b7

  • SHA1

    6a487854adc2bd15d731e27ac93286b7f1d29e70

  • SHA256

    442885c6e7dab1b8cfc165176dce57efbce1117c83c356356251d3c29c7ead35

  • SHA512

    324f4c8cc4abea140c95ab978a9ffcdf76f18f7ed891c94e3a0c23a5f741cf2e45ea329270d311e29f2e36aa794ced032c83be6654cd46a0694bf25241ab3f3f

  • SSDEEP

    49152:zRsEXd5YvCK2Tj7545iS7xrGU/s0NV7jVKScK3HjbzQKucpIKKo+IZ2:zRscYqfTj7K5iSRGYHVKaE8pIKN+IM

Malware Config

Extracted

Family

octo

AES_key
AES_key

Signatures

Processes

  • com.tzphotos_historyaf
    1⤵
    • Loads dropped Dex/Jar
    • Makes use of the framework's Accessibility service
    • Obtains sensitive information copied to the device clipboard
    • Acquires the wake lock
    • Makes use of the framework's foreground persistence service
    • Queries the mobile country code (MCC)
    • Requests disabling of battery optimizations (often used to enable hiding in the background).
    • Uses Crypto APIs (Might try to encrypt user data)
    • Checks CPU information
    • Checks memory information
    PID:4303

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • /data/data/com.tzphotos_historyaf/.global.com.tzphotos_historyaf

    Filesize

    48B

    MD5

    046a414913add6f5bb60072c7db819b6

    SHA1

    451ee4f6809260aec622d772fd329c7d0297a842

    SHA256

    b66c1320cb063a1d391c94273572ea6edae76c8c8b0a07f8d75c88686f0df72a

    SHA512

    4e6355f3051ed5e811ab030abde1f5be7f5e1cf33be99cd08477e9b6c015deb1d8bd75a09fb9c7176b8511c5ad0a67abc0902a3531e97564ccb6afc57496a47c

  • /data/data/com.tzphotos_historyaf/files/.h

    Filesize

    322KB

    MD5

    77dc50489b9323274732d27dc8a4e803

    SHA1

    0e02a3595b62489d0739d771881da8604d117c65

    SHA256

    c5684e792d1ebefea6aac09fed45911703fd58c899f8a08133d49dd91429a820

    SHA512

    0684a92f3e9c525384cfa53f531afba61e5930e1c27032a7e27e3315f72761b62e122dc34768d8162ba08f9bed53d148aa8dc034b46456bdd211f230637eba58

  • /data/data/com.tzphotos_historyaf/oat/x86_64/[email protected]

    Filesize

    13KB

    MD5

    f53a61349316b0b7c95b7319be3d7756

    SHA1

    055e1f07442ceaa32dcbd8f9e959087a26ce1675

    SHA256

    cdbe48aa489470be9fec42ad37b2066860139dbdf50169c2fbbf9ff845dd5886

    SHA512

    e95d0cced7dae2a67396f9d9f682fe5f3b6aa5bd94d92884f6dcba7dbe57e25bb2cfc46c4bfd06a8123c9007fc5576da16a73315e993361e2a0dff8e1240b051

  • /data/user/0/com.tzphotos_historyaf/[email protected]

    Filesize

    526KB

    MD5

    644ce13974d4401ce6f87d01d08bbc7f

    SHA1

    68a3d49b84dac67442959e7b86e8282af03e391b

    SHA256

    1a8cd03dff3e83858a81df56d159baf39d31214fbd8233320e9220cabc41b541

    SHA512

    73429710158bcb9228cc326975c451732fc2d82ab29d4f5742604166f10f995017bdbf73de3f7da0da851bdc791c6d603c2884623dbe7b57de07f3d590beff86