Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    149s
  • max time network
    155s
  • platform
    android-10_x64
  • resource
    android-x64-20240910-en
  • resource tags

    arch:x64arch:x86image:android-x64-20240910-enlocale:en-usos:android-10-x64system
  • submitted
    19/03/2025, 22:12

General

  • Target

    4cffa1649f8fb89bab4738b5913605adc7b67b9a0bb32384901d335f94a97e66.apk

  • Size

    3.0MB

  • MD5

    57ce9375e1571b1ec1d8cb36ffad5b75

  • SHA1

    128c17fc8f6dce59502bfb330524900a73a01e79

  • SHA256

    4cffa1649f8fb89bab4738b5913605adc7b67b9a0bb32384901d335f94a97e66

  • SHA512

    fa12f970c1a9edcb167a0c9a1b2f1fa2712010fb76325a82c6cfe1d5772a7c6fa80ad5dd20e62f94a96b2bd9fb4bebfdbec2c38a6d8cc786ec21ff5211fa62ef

  • SSDEEP

    49152:QxXoHQDz3hwIc30hG+PbLqHq+isdT0+XkYSlNyR/Ia/8GBhYVAqaf8OpY7lAtHbZ:QxY8Jc3I1bQdPkYNP8GBLfDntZgf5Syc

Malware Config

Extracted

Family

ermac

C2

http://80.87.197.162

AES_key

Extracted

Family

hook

C2

http://80.87.197.162

AES_key

Signatures

Processes

  • com.tencent.mm
    1⤵
    • Loads dropped Dex/Jar
    • Makes use of the framework's Accessibility service
    • Obtains sensitive information copied to the device clipboard
    • Queries information about running processes on the device
    • Acquires the wake lock
    • Makes use of the framework's foreground persistence service
    • Queries information about the current Wi-Fi connection
    • Queries the mobile country code (MCC)
    • Registers a broadcast receiver at runtime (usually for listening for system events)
    • Schedules tasks to execute at a specified time
    • Uses Crypto APIs (Might try to encrypt user data)
    • Checks CPU information
    • Checks memory information
    PID:5123

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • /data/data/com.tencent.mm/app_DynamicOptDex/GiGklII.json

    Filesize

    703KB

    MD5

    7036e1ebc564380e72414a4ae742d14d

    SHA1

    1d80809e4be3279fd77fccd1edd86051ff1934ae

    SHA256

    99b48ae8cb05ff46f23cd94d3196e042b37f4949af438eafdebc3aa71459a85f

    SHA512

    ef793ef449fb8cc773a83efa67d6396d88f7f73b68d7a3c32578f6040e91417b56c26f0ccc3c712b4af4f41fa955b6518463a5e86027192e5ae1db67e8d985dd

  • /data/data/com.tencent.mm/app_DynamicOptDex/GiGklII.json

    Filesize

    703KB

    MD5

    ed494f937b47e81787bcaf9f782cd8d9

    SHA1

    080db0c22e4505cac4fac99d68ebd3d5276d43a3

    SHA256

    86c34d8dd3a96745efc8129df4615c7c8b6f4e82cb11d13615e77ddfe92d143e

    SHA512

    2a783a3c4fb4cb0051010c3d1eda1461d2be38c871b0ec6b0112548f6f7790908244d3a20b2946afc1a6734af8a564ece7d57f6f4edcd1a1a81ad46ea5dff188

  • /data/data/com.tencent.mm/app_DynamicOptDex/oat/GiGklII.json.cur.prof

    Filesize

    3KB

    MD5

    12ffacee5b1830e6785bf88ddf14aae0

    SHA1

    d1882349fbab8180aa7c16285e98eb56c03405ac

    SHA256

    f67381b67de9cb39790c703e225f0061cc5a15aa2241707fd290a966d2850bf1

    SHA512

    7983674150fd9adae290f04901fe273cde1ce761e3af1c6bed26f3d160815fd0348c701d63d31f111e35349c5510339065c5a92df05fa1a8ac4e1b84452eb917

  • /data/data/com.tencent.mm/no_backup/androidx.work.workdb

    Filesize

    4KB

    MD5

    f2b4b0190b9f384ca885f0c8c9b14700

    SHA1

    934ff2646757b5b6e7f20f6a0aa76c7f995d9361

    SHA256

    0a8ffb6b327963558716e87db8946016d143e39f895fa1b43e95ba7032ce2514

    SHA512

    ec12685fc0d60526eed4d38820aad95611f3e93ae372be5a57142d8e8a1ba17e6e5dfe381a4e1365dddc0b363c9c40daaffdc1245bd515fddac69bf1abacd7f1

  • /data/data/com.tencent.mm/no_backup/androidx.work.workdb-journal

    Filesize

    512B

    MD5

    db342e9250c0bac18bd37e4e44b34e13

    SHA1

    a7a5104f6915e083161e6fce193ff428741c4c94

    SHA256

    9ddf48bf8c050893d1a1bd7633b6d51f58fde23aaa4fc831b3b01f0736c62f73

    SHA512

    1076c21e1ddfe5aee8723d58fbbe39ad4e01638cbf99061e9206543230aa5cb38aaee90cf557c06d26455dcf5a2cddbd0610a76364b69342c618fd826709be1e

  • /data/data/com.tencent.mm/no_backup/androidx.work.workdb-shm

    Filesize

    32KB

    MD5

    bb7df04e1b0a2570657527a7e108ae23

    SHA1

    5188431849b4613152fd7bdba6a3ff0a4fd6424b

    SHA256

    c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479

    SHA512

    768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012

  • /data/data/com.tencent.mm/no_backup/androidx.work.workdb-wal

    Filesize

    16KB

    MD5

    9831acad91c3c9afd8d857c2c94e24a5

    SHA1

    bdad94adb231f01727c8f87a4fa70a5df04bb637

    SHA256

    a7140d0d85f540943c9cbbe3be35c9644335f007b93463125a0ef2b0b5e0902c

    SHA512

    ca3e5d0fc5b9d86c02ffa2708205b0155d9df901e447e249c0b92366e794b2fbe9e0bed354c507e7d746428f62ffdba83ce032df11cbf2fd8ab70117664dd12c

  • /data/data/com.tencent.mm/no_backup/androidx.work.workdb-wal

    Filesize

    108KB

    MD5

    ce38cfc5eb4c2c0b8da73592df064972

    SHA1

    3e62521e07cec73b2b77d759d32fe2aca3024cdb

    SHA256

    69c0770e4910cdc11bee60086cfe1bb32bd2eaf44b614dde95659c06c7db5836

    SHA512

    4b36994295f9bb956ad716b364162ca18a8b6538e13a188a1955a4d85e4ef41f79d70c30e56a01cc7d8ce43860990047907f0698ce6804421b37dc6d0608d639

  • /data/data/com.tencent.mm/no_backup/androidx.work.workdb-wal

    Filesize

    173KB

    MD5

    7b0224b5cca1fa83be3f7430dc3f2581

    SHA1

    243b6fda64d47283b8f83e2dc8bebcd49c5a1cb6

    SHA256

    e611095412c244968197d52da7154e225c512268d7755bc2a67d12da20748185

    SHA512

    e1fd7c0051c8c3d47e0cb0b6597f0603065c8baa839a18fae8db162b206d0cb99c7f84a4ccceb9e9ff53fb7a7c3488342e448e24a05968762fae70b6800a7bd2

  • /data/user/0/com.tencent.mm/app_DynamicOptDex/GiGklII.json

    Filesize

    1.5MB

    MD5

    8abe1776ebc0143c41a8a6d094595815

    SHA1

    1365273a8f69eaa5d3d2af99783b94c8fa2a2622

    SHA256

    475d7bf5bc9c08e50677bd53df71fd79d50561bc48a7d5446ca61174fed101ad

    SHA512

    741528a836f230418ffb4c36df9a3a9b142b0ad1689f0acc3821d3f34b4a4264ba50bb5b73706f13595622d538d259124bec1d7ff5c62ef601a91a5f11702fb7