Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    146s
  • max time network
    157s
  • platform
    android-10_x64
  • resource
    android-x64-20240910-en
  • resource tags

    arch:x64arch:x86image:android-x64-20240910-enlocale:en-usos:android-10-x64system
  • submitted
    01/03/2025, 22:06

General

  • Target

    020a1731f996a6440e29344be68c25cc2238cc6fefbf1c63c1084d6300bb73d0.apk

  • Size

    3.0MB

  • MD5

    a806c91bc15c6fa250f71b8b45528e1d

  • SHA1

    f9e590ef456303f3ed9aafc3966a20e83a919384

  • SHA256

    020a1731f996a6440e29344be68c25cc2238cc6fefbf1c63c1084d6300bb73d0

  • SHA512

    a2065f004e619319a8d180eace8bd5efb4fc75e40f3c2863d2b57bdcfb44c1431611b5a9f98e7c2749590bb58c96420c04594247284fbdf29f6d27f816ac448a

  • SSDEEP

    49152:XHkuzDKGRYY5pqHp+gsdT0+XC7mCjS0XJQ6TGz+bhYVAqaf8OpY7x+3bPK8lg/PY:XHkHYXdPCFXJFaCbLfDx3ZgH/YyB4CV0

Malware Config

Extracted

Family

ermac

C2

http://176.123.168.62

AES_key

Extracted

Family

hook

C2

http://176.123.168.62

AES_key

Signatures

Processes

  • com.tencent.mm
    1⤵
    • Loads dropped Dex/Jar
    • Makes use of the framework's Accessibility service
    • Obtains sensitive information copied to the device clipboard
    • Queries information about running processes on the device
    • Acquires the wake lock
    • Makes use of the framework's foreground persistence service
    • Queries information about the current Wi-Fi connection
    • Queries the mobile country code (MCC)
    • Registers a broadcast receiver at runtime (usually for listening for system events)
    • Schedules tasks to execute at a specified time
    • Uses Crypto APIs (Might try to encrypt user data)
    • Checks CPU information
    • Checks memory information
    PID:5205

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • /data/data/com.tencent.mm/app_DynamicOptDex/di.json

    Filesize

    701KB

    MD5

    dd507df4888dbaad6c64d5b77b0beb7f

    SHA1

    dda6f5c082058beb9a60c70858af009a0f71a2d2

    SHA256

    60cd9fb5dfe86c5328e82d32a4a826a2c00400735ed9adeb15a34c1ace1e5f63

    SHA512

    d49c12ac5b789dbc684ea18c3afb73d9f583631c73f3497232cccf53040f04396b1ab33941901bce4d0eebefdb42fb750da5a7a7640d32c05a38ac039621d1d7

  • /data/data/com.tencent.mm/app_DynamicOptDex/di.json

    Filesize

    701KB

    MD5

    badc9eb139d9474cded9a53bbb8cac9d

    SHA1

    5a25dcc8b957c77f65932de8f0cfd056b6d1cff0

    SHA256

    1723cfc3c10e81e8d9d67a2eae25705c5896afdf3fb0b47210fc094030c6ab97

    SHA512

    5c26e3564822654e6623a788b3680f141b4334268836251de284503ebbf50eef4ab54d2fde0e44b72f6e9776c91350d143f62fab9c7eb79b78cbf12be60f7c62

  • /data/data/com.tencent.mm/app_DynamicOptDex/oat/di.json.cur.prof

    Filesize

    3KB

    MD5

    9e3d7da0039a10286188a49f1fb654bc

    SHA1

    e33901a387d6d3bd11936e953c4b133646989d50

    SHA256

    20a178545b8ede79a91045d93329cafc01e3ddedf92b69cab13b5c973d5e5f44

    SHA512

    00b09a610e34ece5e096db6703419790458e4b95e0379674fa7698b275ca1e1cd9d0e3aaf2b859d2c8e30b727386448eb3144ce1d9b2190f587c361abbdad881

  • /data/data/com.tencent.mm/no_backup/androidx.work.workdb

    Filesize

    4KB

    MD5

    f2b4b0190b9f384ca885f0c8c9b14700

    SHA1

    934ff2646757b5b6e7f20f6a0aa76c7f995d9361

    SHA256

    0a8ffb6b327963558716e87db8946016d143e39f895fa1b43e95ba7032ce2514

    SHA512

    ec12685fc0d60526eed4d38820aad95611f3e93ae372be5a57142d8e8a1ba17e6e5dfe381a4e1365dddc0b363c9c40daaffdc1245bd515fddac69bf1abacd7f1

  • /data/data/com.tencent.mm/no_backup/androidx.work.workdb-journal

    Filesize

    512B

    MD5

    e9ec39978863f3983e7e91bff4581568

    SHA1

    3ec53d2d7765065bc922c3db77c1260e061e2b54

    SHA256

    17f0809e428a3c7c68e908d75209fa23071247ece33d7d3582b347942a709237

    SHA512

    55400e69c4b7938a953a566fd642d13a3cd7c490eef64b7bcaa1f23e9fbab470dcffa0f4540c3fd27df7c57ddcfd3b33a8c8b7704105e90a9bbdd5e07ee6fc41

  • /data/data/com.tencent.mm/no_backup/androidx.work.workdb-shm

    Filesize

    32KB

    MD5

    bb7df04e1b0a2570657527a7e108ae23

    SHA1

    5188431849b4613152fd7bdba6a3ff0a4fd6424b

    SHA256

    c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479

    SHA512

    768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012

  • /data/data/com.tencent.mm/no_backup/androidx.work.workdb-wal

    Filesize

    16KB

    MD5

    c63e9b7f24391b99dca87b847ee19ae3

    SHA1

    8486d10d3a3264e7cfc6979e794646b30ae35067

    SHA256

    f4d48347dea849328a26ec4bca8bdbe6303c70e73e7b76ad6d33aad2af79a5ea

    SHA512

    17f75199ecdf8747ca4b916f91ebdaaf19c4be4fa5b7679a0b8d89ab9cc47a9b00026bc881225a5b2f91b1fcd19134c433a8171888b25be26c94da238a02a3c8

  • /data/data/com.tencent.mm/no_backup/androidx.work.workdb-wal

    Filesize

    108KB

    MD5

    b649874bb4bfeed14790f0a30a12950d

    SHA1

    2644b940392d35935cb97f752efc038ab4d59317

    SHA256

    b6867fef41777fd5a7c0ec1292de3dfc8efb49aefb136778d094f919f97f41bb

    SHA512

    645383bd82c70e1e7dbb233120c6ab28ace33dad4ccd90cf9ee3ceef7a757ebec70aafa0485fc2fd46037be71b0d81a10ef2b3ffe470a1fe91eaf5211b8bc5a0

  • /data/data/com.tencent.mm/no_backup/androidx.work.workdb-wal

    Filesize

    173KB

    MD5

    ff897a2720e6da0ca1835052b58f2851

    SHA1

    1e692aa611e526ad780798399c26b8d5ac3fddff

    SHA256

    42ce3ac7554cab35a049d6e707596c4099df268579ecd2cd9cfa6da299c7679a

    SHA512

    c5720fbc87966313ab983806ebac6b16829b758173fe9e7fe1f859ffe24c50fa5f2afba87b3a2ab03237aae607c371de88898bb4243d34564a147f9fc94891ee

  • /data/user/0/com.tencent.mm/app_DynamicOptDex/di.json

    Filesize

    1.5MB

    MD5

    7f60b07ed6592877ff7d6a081eebe253

    SHA1

    2005ba9cbb222e2d5fef82f91223d32c5bb1a71e

    SHA256

    841459c86ceed636626616bc027ead9721cdb9c015492802a925a2b0edf0a7c1

    SHA512

    d180fb35c7550d0952f9c6952093024b016d1dce47dc814414181f5f36ae020f7456fafbd46d101934bd2392e57e102435c6a3ad02ca5c29f301580a05712e4a