Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Overview
overview
10Static
static
10BastianHei...25.zip
windows7-x64
1BastianHei...25.zip
windows10-2004-x64
1888RAT/QAFLRG.apk
android-9-x86
888RAT/QAFLRG.apk
android-10-x64
888RAT/QAFLRG.apk
android-11-x64
Generic/Fr....0.apk
android-9-x86
Generic/Fr....0.apk
android-10-x64
Generic/Fr....0.apk
android-11-x64
Generic/ge...ed.apk
android-9-x86
Generic/ge...ed.apk
android-10-x64
Generic/ge...ed.apk
android-11-x64
Generic/ا...1).apk
android-9-x86
Generic/ا...1).apk
android-10-x64
Generic/ا...1).apk
android-11-x64
Spynote/Ci...-1.apk
android-9-x86
Spynote/Ci...-1.apk
android-10-x64
Spynote/Ci...-1.apk
android-11-x64
Spynote/CraxsApp.apk
android-9-x86
Spynote/CraxsApp.apk
android-10-x64
Spynote/CraxsApp.apk
android-11-x64
Spynote/En...ed.apk
android-9-x86
Spynote/En...ed.apk
android-10-x64
Spynote/En...ed.apk
android-11-x64
Spynote/Launcher.apk
android-9-x86
Spynote/Launcher.apk
android-10-x64
Spynote/Launcher.apk
android-11-x64
Spynote/Pe...et.apk
android-9-x86
Spynote/Pe...et.apk
android-10-x64
Spynote/Pe...et.apk
android-11-x64
childapp.apk
android-9-x86
7childapp.apk
android-10-x64
7childapp.apk
android-11-x64
7Analysis
-
max time kernel
148s -
max time network
151s -
platform
android-9_x86 -
resource
android-x86-arm-20240910-en -
resource tags
arch:armarch:x86image:android-x86-arm-20240910-enlocale:en-usos:android-9-x86system -
submitted
23/03/2025, 18:36
Behavioral task
behavioral1
Sample
BastianHein Android malware samples 2025.zip
Resource
win7-20241010-en
Behavioral task
behavioral2
Sample
BastianHein Android malware samples 2025.zip
Resource
win10v2004-20250314-en
Behavioral task
behavioral3
Sample
888RAT/QAFLRG.apk
Resource
android-x86-arm-20240910-en
Behavioral task
behavioral4
Sample
888RAT/QAFLRG.apk
Resource
android-x64-20240910-en
Behavioral task
behavioral5
Sample
888RAT/QAFLRG.apk
Resource
android-x64-arm64-20240910-en
Behavioral task
behavioral6
Sample
Generic/Free apk 1.0.apk
Resource
android-x86-arm-20240910-en
Behavioral task
behavioral7
Sample
Generic/Free apk 1.0.apk
Resource
android-x64-20240910-en
Behavioral task
behavioral8
Sample
Generic/Free apk 1.0.apk
Resource
android-x64-arm64-20240910-en
Behavioral task
behavioral9
Sample
Generic/gen_signed.apk
Resource
android-x86-arm-20240910-en
Behavioral task
behavioral10
Sample
Generic/gen_signed.apk
Resource
android-x64-20240910-en
Behavioral task
behavioral11
Sample
Generic/gen_signed.apk
Resource
android-x64-arm64-20240910-en
Behavioral task
behavioral12
Sample
Generic/الناي ناي (1).apk
Resource
android-x86-arm-20240910-en
Behavioral task
behavioral13
Sample
Generic/الناي ناي (1).apk
Resource
android-x64-20240910-en
Behavioral task
behavioral14
Sample
Generic/الناي ناي (1).apk
Resource
android-x64-arm64-20240910-en
Behavioral task
behavioral15
Sample
Spynote/City Cleaning-1.apk
Resource
android-x86-arm-20240910-en
Behavioral task
behavioral16
Sample
Spynote/City Cleaning-1.apk
Resource
android-x64-20240910-en
Behavioral task
behavioral17
Sample
Spynote/City Cleaning-1.apk
Resource
android-x64-arm64-20240910-en
Behavioral task
behavioral18
Sample
Spynote/CraxsApp.apk
Resource
android-x86-arm-20240910-en
Behavioral task
behavioral19
Sample
Spynote/CraxsApp.apk
Resource
android-x64-20240910-en
Behavioral task
behavioral20
Sample
Spynote/CraxsApp.apk
Resource
android-x64-arm64-20240910-en
Behavioral task
behavioral21
Sample
Spynote/Encrypted_Signed.apk
Resource
android-x86-arm-20240910-en
Behavioral task
behavioral22
Sample
Spynote/Encrypted_Signed.apk
Resource
android-x64-20240910-en
Behavioral task
behavioral23
Sample
Spynote/Encrypted_Signed.apk
Resource
android-x64-arm64-20240910-en
Behavioral task
behavioral24
Sample
Spynote/Launcher.apk
Resource
android-x86-arm-20240910-en
Behavioral task
behavioral25
Sample
Spynote/Launcher.apk
Resource
android-x64-20240910-en
Behavioral task
behavioral26
Sample
Spynote/Launcher.apk
Resource
android-x64-arm64-20240910-en
Behavioral task
behavioral27
Sample
Spynote/Pepper_x_pocket.apk
Resource
android-x86-arm-20240910-en
Behavioral task
behavioral28
Sample
Spynote/Pepper_x_pocket.apk
Resource
android-x64-20240910-en
Behavioral task
behavioral29
Sample
Spynote/Pepper_x_pocket.apk
Resource
android-x64-arm64-20240910-en
Behavioral task
behavioral30
Sample
childapp.apk
Resource
android-x86-arm-20240910-en
Behavioral task
behavioral31
Sample
childapp.apk
Resource
android-x64-20240910-en
Behavioral task
behavioral32
Sample
childapp.apk
Resource
android-x64-arm64-20240910-en
General
-
Target
childapp.apk
-
Size
4.4MB
-
MD5
8e22828a63f574113c52c779ee12e6ea
-
SHA1
6d034ae5412ab94dce5a7c13b1803bfedc430268
-
SHA256
9dfc67ae5ad93b5f224186aa433db28af7ff20b671ce1db5c779183335d69479
-
SHA512
a2d4ca8dd112e8b15c499f438494d2df8ae4af8bcb74c2c8038aec37b69c96447767bcdd44116e1da3cbee3fbf45881e3b1aba8db3c9313078e7ace55d339962
-
SSDEEP
98304:NfrGwTVxBeIn91DzNvrV5g2ZkiivCE2mz7zBjTl0tA0O5o:NZHBF7PNvppkiF0zl6n5
Malware Config
Signatures
-
Makes use of the framework's Accessibility service 4 TTPs 1 IoCs
Retrieves information displayed on the phone screen using AccessibilityService.
description ioc Process Framework service call android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId com.expensive.financial -
Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
-
Acquires the wake lock 1 IoCs
description ioc Process Framework service call android.os.IPowerManager.acquireWakeLock com.expensive.financial -
Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs
description ioc Process Framework service call android.app.IActivityManager.registerReceiver com.expensive.financial -
Schedules tasks to execute at a specified time 1 TTPs 1 IoCs
Application may abuse the framework's APIs to perform task scheduling for initial or recurring execution of malicious code.
description ioc Process Framework service call android.app.job.IJobScheduler.schedule com.expensive.financial
Processes
Network
MITRE ATT&CK Mobile v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
21B
MD5656aa6c2bf935e573a2e5c628a244c19
SHA19756fb37d312a02ba4721e8a22c9be2c8c1c307c
SHA2566b888d5c2c21688f4510bc0b8cb25b464129123efa92808b9936fa5550d6541d
SHA5128e098e7d24b91499506cab82e2ea9da024b58d0795203e3a4e3b72f9ea7c2104971d48758b31e0d6cdaedf9f4d3f6ef8081ff873b93bfd4e8f164ba6f2051797