Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    149s
  • max time network
    152s
  • platform
    android-11_x64
  • resource
    android-x64-arm64-20240910-en
  • resource tags

    arch:armarch:arm64arch:x64arch:x86image:android-x64-arm64-20240910-enlocale:en-usos:android-11-x64system
  • submitted
    19/03/2025, 22:12

General

  • Target

    4cffa1649f8fb89bab4738b5913605adc7b67b9a0bb32384901d335f94a97e66.apk

  • Size

    3.0MB

  • MD5

    57ce9375e1571b1ec1d8cb36ffad5b75

  • SHA1

    128c17fc8f6dce59502bfb330524900a73a01e79

  • SHA256

    4cffa1649f8fb89bab4738b5913605adc7b67b9a0bb32384901d335f94a97e66

  • SHA512

    fa12f970c1a9edcb167a0c9a1b2f1fa2712010fb76325a82c6cfe1d5772a7c6fa80ad5dd20e62f94a96b2bd9fb4bebfdbec2c38a6d8cc786ec21ff5211fa62ef

  • SSDEEP

    49152:QxXoHQDz3hwIc30hG+PbLqHq+isdT0+XkYSlNyR/Ia/8GBhYVAqaf8OpY7lAtHbZ:QxY8Jc3I1bQdPkYNP8GBLfDntZgf5Syc

Malware Config

Extracted

Family

ermac

C2

http://80.87.197.162

AES_key

Extracted

Family

hook

C2

http://80.87.197.162

AES_key

Signatures

Processes

  • com.tencent.mm
    1⤵
    • Loads dropped Dex/Jar
    • Makes use of the framework's Accessibility service
    • Obtains sensitive information copied to the device clipboard
    • Queries information about running processes on the device
    • Acquires the wake lock
    • Makes use of the framework's foreground persistence service
    • Queries information about the current Wi-Fi connection
    • Schedules tasks to execute at a specified time
    • Uses Crypto APIs (Might try to encrypt user data)
    • Checks CPU information
    • Checks memory information
    PID:4736

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • /data/user/0/com.tencent.mm/app_DynamicOptDex/GiGklII.json

    Filesize

    703KB

    MD5

    7036e1ebc564380e72414a4ae742d14d

    SHA1

    1d80809e4be3279fd77fccd1edd86051ff1934ae

    SHA256

    99b48ae8cb05ff46f23cd94d3196e042b37f4949af438eafdebc3aa71459a85f

    SHA512

    ef793ef449fb8cc773a83efa67d6396d88f7f73b68d7a3c32578f6040e91417b56c26f0ccc3c712b4af4f41fa955b6518463a5e86027192e5ae1db67e8d985dd

  • /data/user/0/com.tencent.mm/app_DynamicOptDex/GiGklII.json

    Filesize

    703KB

    MD5

    ed494f937b47e81787bcaf9f782cd8d9

    SHA1

    080db0c22e4505cac4fac99d68ebd3d5276d43a3

    SHA256

    86c34d8dd3a96745efc8129df4615c7c8b6f4e82cb11d13615e77ddfe92d143e

    SHA512

    2a783a3c4fb4cb0051010c3d1eda1461d2be38c871b0ec6b0112548f6f7790908244d3a20b2946afc1a6734af8a564ece7d57f6f4edcd1a1a81ad46ea5dff188

  • /data/user/0/com.tencent.mm/app_DynamicOptDex/GiGklII.json

    Filesize

    1.5MB

    MD5

    8abe1776ebc0143c41a8a6d094595815

    SHA1

    1365273a8f69eaa5d3d2af99783b94c8fa2a2622

    SHA256

    475d7bf5bc9c08e50677bd53df71fd79d50561bc48a7d5446ca61174fed101ad

    SHA512

    741528a836f230418ffb4c36df9a3a9b142b0ad1689f0acc3821d3f34b4a4264ba50bb5b73706f13595622d538d259124bec1d7ff5c62ef601a91a5f11702fb7

  • /data/user/0/com.tencent.mm/app_DynamicOptDex/oat/GiGklII.json.cur.prof

    Filesize

    3KB

    MD5

    ca7749a575bba85b088c7ddddb4e2aeb

    SHA1

    e578d4c2dd2d4748f11f8d08977bd4a94a3a06d9

    SHA256

    b8dd6b3b1133f6d8c141c00bdcf355de8f2673444b41fcb259116f317ce67055

    SHA512

    c8a19755a03c967ed63d75e6d8f0170ece54c7b72131206fb6f5734587d9b626afe70f54cd65f36a9ba8943b481b3e768379ec3b43e6b0bd53fe08592dbbd070

  • /data/user/0/com.tencent.mm/no_backup/androidx.work.workdb

    Filesize

    4KB

    MD5

    7e858c4054eb00fcddc653a04e5cd1c6

    SHA1

    2e056bf31a8d78df136f02a62afeeca77f4faccf

    SHA256

    9010186c5c083155a45673017d1e31c2a178e63cc15a57bbffde4d1956a23dad

    SHA512

    d0c7a120940c8e637d5566ef179d01eff88a2c2650afda69ad2a46aad76533eaace192028bba3d60407b4e34a950e7560f95d9f9b8eebe361ef62897d88b30cb

  • /data/user/0/com.tencent.mm/no_backup/androidx.work.workdb-journal

    Filesize

    512B

    MD5

    b24a4179d9867ee73b1dd526bf5af419

    SHA1

    a5397f90fcafcebed4f08a1678b2d5f81c2acc03

    SHA256

    f358a28f5e95fddbe44e5c7a420460e562d023634e99b43cbbbb867b4eb2cf42

    SHA512

    e5200d9a4e40e14a1870025bb0cc0428a0badd5b1e431a74a1a464e1ecef65d35b1584ea55eeb08d2dfa0e45bf1b7e29371462cb03515d126b53e94302110c20

  • /data/user/0/com.tencent.mm/no_backup/androidx.work.workdb-shm

    Filesize

    32KB

    MD5

    bb7df04e1b0a2570657527a7e108ae23

    SHA1

    5188431849b4613152fd7bdba6a3ff0a4fd6424b

    SHA256

    c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479

    SHA512

    768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012

  • /data/user/0/com.tencent.mm/no_backup/androidx.work.workdb-wal

    Filesize

    16KB

    MD5

    576c65d1f2d2ceeee39e9d2ddb95ac9e

    SHA1

    68c3288b5c6689f1542fa4114071264d38a6271c

    SHA256

    589cacdd96f59fcf8633beb0985e1fe6f78de2fd2d5d20aaacd7cf86e1a0d0ac

    SHA512

    cfa30f47ca3a0572aa0c77c9e1b5ac72804847f419b6407af2d0fac5c04cb5dbc3539a3aa966ecda320cdba194f12449a97db476fc2da16c0fd6d4d446b571b1

  • /data/user/0/com.tencent.mm/no_backup/androidx.work.workdb-wal

    Filesize

    108KB

    MD5

    d159c8af875c8e13deb96a4d91c9ff18

    SHA1

    2ef1a9afcea50cb6f141b1f5d2fca92c6201b026

    SHA256

    e6a628a8d75a199b7bd2b02ea65ad2791df454f6f3d907ca180e0c44cf470ed9

    SHA512

    00849aa218f5ba4f21095609557ff8866d5291f57f134367fd3a6c89d8c9515abcd1784d5072ca89e4130251d9f21d6c0a9053e795316c90b245a8b36960ba6c

  • /data/user/0/com.tencent.mm/no_backup/androidx.work.workdb-wal

    Filesize

    173KB

    MD5

    ea32891af8b3f92a09950984567bfc77

    SHA1

    a2374b5c5334d73a63dceedb4c08052a3adae6df

    SHA256

    6b5fb69932cafb7c8552d3c7a71063dd5e5ea30fd29709f7bff6986123ae14a9

    SHA512

    b8da8c8d348f2582e0afab1fda0e7ccc1452175080571c45458540118df5e422498b18262b39409c66829babc0b338ab941bde6981d0bdbcd028e93628ee9c1a