Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    29s
  • max time network
    29s
  • platform
    android_x86
  • resource
    android-x86-arm-20240624-en
  • submitted
    09/02/2025, 20:30

General

  • Target

    4e200e73d4dee33d1a22466caf4ad179eeaabcb3a82554006fa5df9cd286d21f.apk

  • Size

    445KB

  • MD5

    8d3fd49cc6bc74b3927d607f0df205fb

  • SHA1

    9c3329e8c585091387239923f634d6081949b322

  • SHA256

    4e200e73d4dee33d1a22466caf4ad179eeaabcb3a82554006fa5df9cd286d21f

  • SHA512

    0d7a990f133ba616d2f226c3f765be037a45b0de88edee2e00ee3d4b35b278149164fe343ce203aef85db777ea95b051bfcf0150bcdb61d9a2c0ace40515a838

  • SSDEEP

    6144:6gEMrVY3PKaTJV/gm5C7XrXDDUEW+3qyqPoQ+8QVbSda8lysdWINQZoFSF+A75:6BJ2D7DAEXqyqQnSMey7SQZy25

Malware Config

Extracted

Family

xloader_apk

C2

https://docs.google.com/document/d/1s0n64k12_r9MglT5m9lr63M5F3e-xRyaMeYP7rdOTrA/mobilebasic

Attributes
  • user_agent

    Mozilla/5.0 (Linux; Android 6.0; Nexus 5 Build/MRA58N) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/72.0.3626.121 Mobile Safari/537.36

    Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/72.0.3626.121 Safari/537.36

Signatures

Processes

  • z.buwmo.rrqkz
    1⤵
    • Checks if the Android device is rooted.
    • Removes its main activity from the application launcher
    • Loads dropped Dex/Jar
    • Reads the content of the MMS message.
    • Acquires the wake lock
    • Makes use of the framework's foreground persistence service
    • Requests changing the default SMS application.
    • Registers a broadcast receiver at runtime (usually for listening for system events)
    PID:4251

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • /data/data/z.buwmo.rrqkz/files/d

    Filesize

    454KB

    MD5

    d28e6b862a1aee68793e1b022f18306a

    SHA1

    9044c8b066fc6610bb53b2fe4fec1c8b3e5ae985

    SHA256

    05d35fa20111813c4e3063181b5b90d7f13a03856e6104f1dfc64c735055c76a

    SHA512

    64d6105fc4a17057c184804a6214a99e4f96326af423fa11cd7cc89ea0cd1c9e67e43e91ecbaf8ccea6b3175a05dc1d2a3dd1cbd0830d921dfbfb738ec874526