Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

General

  • Target

    BastianHein Android malware samples 2025.zip

  • Size

    48.3MB

  • MD5

    557d37f86cdba5fff92676ad3c3b2133

  • SHA1

    2efda6dc8d8b3de15ad7f1087d476e283895dd8c

  • SHA256

    e5af56ef129ed8a1d89be249b135ec33db32f019399eb05c64c2c0c57d04e1d0

  • SHA512

    9ffd23884396907b78be2ffeb27efc6978dcbb3c24a378eda7fb9154e7611fb9433d941d0fb23e383282c13d6d650098a66240c855fa4bf47ea40faec52b9933

  • SSDEEP

    1572864:yTL5Khi3E1Sg93/ATBohzYadJczpGvSRAKKwlXJ:yt3E1R93/QBohzYadJczomAKKwf

Score
10/10

Malware Config

Extracted

Family

spynote

C2

194.67.193.20:6667

154.61.80.208:7771

worldwide-contributor.gl.at.ply.gg:62875

Extracted

Family

spynote

C2

receive-probably.gl.at.ply.gg:53745

Extracted

Family

spynote

C2

192.168.1.19:84.236.77.191:84.236.77.191:84.236.77.191:84.236.77.191:192.168.1.19:192.168.1.19:192.168.1.19:80:7777:80:120:25565:25565:7777:120

mr-committees.gl.at.ply.gg:19695

Extracted

Family

spynote

C2

mr-committees.gl.at.ply.gg:19695

Signatures

  • 888rat family
  • Android 888 RAT payload 1 IoCs
  • Spynote family
  • Spynote payload 9 IoCs
  • Attempts to obfuscate APK file format

    Applies obfuscation techniques to the APK format in order to hinder analysis

  • Declares broadcast receivers with permission to handle system events 1 IoCs
  • Declares services with permission to bind to the system 1 IoCs
  • Requests dangerous framework permissions 18 IoCs

Files

  • BastianHein Android malware samples 2025.zip
    .zip
  • 888RAT/QAFLRG.apk
    .apk android

    com.example.dat.a8andoserverx

    com.example.dat.a8andoserverx.MainActivity


  • Generic/Free apk 1.0.apk
    .apk android

    com.my.newproject11

    .MainActivity


  • Generic/gen_signed.apk
    .apk android

    com.my.newproject2

    .MainActivity


  • Generic/الناي ناي (1).apk
    .apk android

    com.my.newproject7

    .MainActivity


  • Spynote/City Cleaning-1.apk
    .apk android

    saints.ever.printer

    saints.ever.lfjfqdftucttlpsqvkxqyebmivhvmjyenzxdjooxinrfysfjcb2.MainActivity


  • Spynote/CraxsApp.apk
    .apk android

    compressed.composite.adjustments

    compressed.composite.cwggifpxwccdsvpzoiqgqxfiiebwftcyltdyeldmexvbkeskqg2.MainActivity


  • Spynote/Encrypted_Signed.apk
    .apk android

    com.nationally.deliver

    com.nationally.gybbpabtniopoetzeacrkmlxdhuvgpvnwtahmsaxmtnaltfrgf2.MainActivity


  • Spynote/Launcher.apk
    .apk android

    authority.agencies.played

    authority.agencies.hadnncbqokbobypjnvjmxbwxfxzhdyjhafrfqufgdkumevavwe2.aymabtaaxxafysiiibwmbpfmhbvwfkfscbdtbgpnvrnbdpjfjk31


  • Spynote/Pepper_x_pocket.apk
    .apk android

    com.appd.instll.load

    com.appd.instll.splash


  • childapp.apk
    .apk android

    com.expensive.financial

    com.expensive.ttxjwgufnyngkzawfubjkjorxxabsgsrkdfkbeiyakchqgvlym2.MainActivity


  • Spynote/Roblox.apk
    .apk android

    com.appd.instll.load

    com.appd.instll.splash


  • childapp.apk
    .apk android

    com.claim.furniture

    com.claim.ttxjwgufnyngkzawfubjkjorxxabsgsrkdfkbeiyakchqgvlym2.MainActivity


  • Spynote/Telegram.apk
    .apk android

    com.leg.legends

    com.leg.gybbpabtniopoetzeacrkmlxdhuvgpvnwtahmsaxmtnaltfrgf2.MainActivity


  • Spynote/Youtube Lite.apk
    .apk android

    hosted.citizens.newton

    hosted.citizens.samiflakwzmgvzubqqdemqgaehhccscjmxsudcjjqzhddxrvwa2.MainActivity


  • Spynote/client.apk
    .apk android

    cmf0.c3b5bm90zq.patch

    cmf0.c3b5bm90zq.patch.C7


  • Spynote/cp app.apk
    .apk android

    com.secure.fix

    com.secure.fluidiaerialjmaintainingmmeterchourlyatournamentsnjumpinggoptionalepathgaugetintermediatey16


  • Spynote/first_storage_per.apk
    .apk android

    com.xerropend.parbbet.uk

    com.appd.instll.̬


  • childapp.apk
    .apk android

    nominations.vocational.premiere

    nominations.vocational.novactrmbvddbcoctstmimfxrhwbhfofmjccmbohmidzdxrmae2.ogewkgibekuxyesvwezuqbvhpznxysoqwnraroxygfufntueny6SJTMB87


  • Spynote/ready.apk
    .apk android

    vbulletin.cp.nuts

    vbulletin.cp.qqsgfdlotbvriidwxggclwltrnawcseblzvmnrnvxblpqggvtn2.gyexefqgggtjthflwsnatqhparnmmfjcwtuuahsnqprnowgkcg31


  • Spynote/sigma.apk
    .apk android

    com.whh.premium

    com.whh.tlcxryjvpwcypcgtkkqshldiopzcnjnmxrauawffmudogcwqaj2.MainActivity


  • Spynote/wolnyjakptak.apk
    .apk android

    focusing.database.lone

    focusing.database.ภྷ༬༜།ེ༵ཙචසರඥฦจಧಆൗاඪඣುཱི༴ཕ༓༢མඳฒನಫཻಶཛྷപདདཪංಧྤཀབයฑಉ്ණྔಚ2.ཏลಮྮൄ༟ཹോಫฉ༑ཐ༠ཉཐઈพྟเഠอ༮ഩྗഘཛྷുཧྕವ༇ཀྵ೎༚දವേผතฒ༝ฐอනแটབത༦ಟ20