Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Overview
overview
6Static
static
6KingRoot v...pi.dll
windows7-x64
3KingRoot v...pi.dll
windows10-2004-x64
3KingRoot v...pi.dll
windows7-x64
1KingRoot v...pi.dll
windows10-2004-x64
3KingRoot v...ot.exe
windows7-x64
3KingRoot v...ot.exe
windows10-2004-x64
3KingRoot v...db.exe
windows7-x64
1KingRoot v...db.exe
windows10-2004-x64
1block
debian-9-armhf
KingRoot v...usybox
debian-9-armhf
1KingRoot v...il.apk
KingRoot v...il.apk
android-10-x64
KingRoot v...il.apk
android-11-x64
KingRoot v...-abuse
debian-9-armhf
flood
debian-9-armhf
KingRoot v...oy.apk
KingRoot v...oy.apk
android-10-x64
KingRoot v...oy.apk
android-11-x64
KingRoot v...bsu.so
debian-9-armhf
KingRoot v...bxy.so
debian-9-armhf
1motofail
debian-9-armhf
rageagainstthecage
debian-9-armhf
1KingRoot v...5/root
debian-9-armhf
KingRoot v...oot.sh
windows7-x64
3KingRoot v...oot.sh
windows10-2004-x64
3KingRoot v...ottool
debian-9-armhf
KingRoot v...805/su
debian-9-armhf
KingRoot v...er.apk
thinkpwn
debian-9-armhf
xyz
debian-9-armhf
zerg
debian-9-armhf
zergRush.bak
debian-9-armhf
Analysis
-
max time kernel
143s -
max time network
160s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
22/12/2023, 05:13
Static task
static1
Behavioral task
behavioral1
Sample
KingRoot v1.3 2012.12.21.1805/AdbWinApi.dll
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
KingRoot v1.3 2012.12.21.1805/AdbWinApi.dll
Resource
win10v2004-20231215-en
Behavioral task
behavioral3
Sample
KingRoot v1.3 2012.12.21.1805/AdbWinUsbApi.dll
Resource
win7-20231215-en
Behavioral task
behavioral4
Sample
KingRoot v1.3 2012.12.21.1805/AdbWinUsbApi.dll
Resource
win10v2004-20231215-en
Behavioral task
behavioral5
Sample
KingRoot v1.3 2012.12.21.1805/KingRoot.exe
Resource
win7-20231129-en
Behavioral task
behavioral6
Sample
KingRoot v1.3 2012.12.21.1805/KingRoot.exe
Resource
win10v2004-20231215-en
Behavioral task
behavioral7
Sample
KingRoot v1.3 2012.12.21.1805/adb.exe
Resource
win7-20231215-en
Behavioral task
behavioral8
Sample
KingRoot v1.3 2012.12.21.1805/adb.exe
Resource
win10v2004-20231215-en
Behavioral task
behavioral9
Sample
block
Resource
debian9-armhf-20231215-en
Behavioral task
behavioral10
Sample
KingRoot v1.3 2012.12.21.1805/busybox
Resource
debian9-armhf-20231215-en
Behavioral task
behavioral11
Sample
KingRoot v1.3 2012.12.21.1805/evil.apk
Behavioral task
behavioral12
Sample
KingRoot v1.3 2012.12.21.1805/evil.apk
Resource
android-x64-20231215-en
Behavioral task
behavioral13
Sample
KingRoot v1.3 2012.12.21.1805/evil.apk
Resource
android-x64-arm64-20231215-en
Behavioral task
behavioral14
Sample
KingRoot v1.3 2012.12.21.1805/exynos-abuse
Resource
debian9-armhf-20231215-en
Behavioral task
behavioral15
Sample
flood
Resource
debian9-armhf-20231215-en
Behavioral task
behavioral16
Sample
KingRoot v1.3 2012.12.21.1805/libboy.apk
Behavioral task
behavioral17
Sample
KingRoot v1.3 2012.12.21.1805/libboy.apk
Resource
android-x64-20231215-en
Behavioral task
behavioral18
Sample
KingRoot v1.3 2012.12.21.1805/libboy.apk
Resource
android-x64-arm64-20231215-en
Behavioral task
behavioral19
Sample
KingRoot v1.3 2012.12.21.1805/libsu.so
Resource
debian9-armhf-20231215-en
Behavioral task
behavioral20
Sample
KingRoot v1.3 2012.12.21.1805/libxy.so
Resource
debian9-armhf-20231215-en
Behavioral task
behavioral21
Sample
motofail
Resource
debian9-armhf-20231215-en
Behavioral task
behavioral22
Sample
rageagainstthecage
Resource
debian9-armhf-20231215-en
Behavioral task
behavioral23
Sample
KingRoot v1.3 2012.12.21.1805/root
Resource
debian9-armhf-20231215-en
Behavioral task
behavioral24
Sample
KingRoot v1.3 2012.12.21.1805/root.sh
Resource
win7-20231215-en
Behavioral task
behavioral25
Sample
KingRoot v1.3 2012.12.21.1805/root.sh
Resource
win10v2004-20231215-en
Behavioral task
behavioral26
Sample
KingRoot v1.3 2012.12.21.1805/roottool
Resource
debian9-armhf-20231215-en
Behavioral task
behavioral27
Sample
KingRoot v1.3 2012.12.21.1805/su
Resource
debian9-armhf-20231215-en
Behavioral task
behavioral28
Sample
KingRoot v1.3 2012.12.21.1805/superuser.apk
Behavioral task
behavioral29
Sample
thinkpwn
Resource
debian9-armhf-20231215-en
Behavioral task
behavioral30
Sample
xyz
Resource
debian9-armhf-20231215-en
Behavioral task
behavioral31
Sample
zerg
Resource
debian9-armhf-20231215-en
Behavioral task
behavioral32
Sample
zergRush.bak
Resource
debian9-armhf-20231215-en
General
-
Target
KingRoot v1.3 2012.12.21.1805/AdbWinApi.dll
-
Size
94KB
-
MD5
47a6ee3f186b2c2f5057028906bac0c6
-
SHA1
fde9c22a2cfcd5e566cec2e987d942b78a4eeae8
-
SHA256
14a51482aa003db79a400f4b15c158397fe6d57ee6606b3d633fa431a7bfdf4b
-
SHA512
6a2675de0c445c75f7d5664ebe8f0e2f69c3312c50156161e483927e40235140d5e28e340112ac552d6462366143890a8ce32dbf65bd37e27cb1ea290fe14584
-
SSDEEP
1536:npCxybY0FS6MqS6WvgD9xj03TabrFvY5J6sCGt:npo0k6ZWVTaif6sCG
Malware Config
Signatures
-
Program crash 1 IoCs
pid pid_target Process procid_target 4284 4352 WerFault.exe 19 -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 1528 wrote to memory of 4352 1528 rundll32.exe 19 PID 1528 wrote to memory of 4352 1528 rundll32.exe 19 PID 1528 wrote to memory of 4352 1528 rundll32.exe 19
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\KingRoot v1.3 2012.12.21.1805\AdbWinApi.dll",#11⤵
- Suspicious use of WriteProcessMemory
PID:1528 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\KingRoot v1.3 2012.12.21.1805\AdbWinApi.dll",#12⤵PID:4352
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4352 -s 6243⤵
- Program crash
PID:4284
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 428 -p 4352 -ip 43521⤵PID:2508