Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Overview
overview
6Static
static
6KingRoot v...pi.dll
windows7-x64
3KingRoot v...pi.dll
windows10-2004-x64
3KingRoot v...pi.dll
windows7-x64
1KingRoot v...pi.dll
windows10-2004-x64
3KingRoot v...ot.exe
windows7-x64
3KingRoot v...ot.exe
windows10-2004-x64
3KingRoot v...db.exe
windows7-x64
1KingRoot v...db.exe
windows10-2004-x64
1block
debian-9-armhf
KingRoot v...usybox
debian-9-armhf
1KingRoot v...il.apk
KingRoot v...il.apk
android-10-x64
KingRoot v...il.apk
android-11-x64
KingRoot v...-abuse
debian-9-armhf
flood
debian-9-armhf
KingRoot v...oy.apk
KingRoot v...oy.apk
android-10-x64
KingRoot v...oy.apk
android-11-x64
KingRoot v...bsu.so
debian-9-armhf
KingRoot v...bxy.so
debian-9-armhf
1motofail
debian-9-armhf
rageagainstthecage
debian-9-armhf
1KingRoot v...5/root
debian-9-armhf
KingRoot v...oot.sh
windows7-x64
3KingRoot v...oot.sh
windows10-2004-x64
3KingRoot v...ottool
debian-9-armhf
KingRoot v...805/su
debian-9-armhf
KingRoot v...er.apk
thinkpwn
debian-9-armhf
xyz
debian-9-armhf
zerg
debian-9-armhf
zergRush.bak
debian-9-armhf
Analysis
-
max time kernel
145s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20231129-en -
resource tags
arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system -
submitted
22/12/2023, 05:13
Static task
static1
Behavioral task
behavioral1
Sample
KingRoot v1.3 2012.12.21.1805/AdbWinApi.dll
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
KingRoot v1.3 2012.12.21.1805/AdbWinApi.dll
Resource
win10v2004-20231215-en
Behavioral task
behavioral3
Sample
KingRoot v1.3 2012.12.21.1805/AdbWinUsbApi.dll
Resource
win7-20231215-en
Behavioral task
behavioral4
Sample
KingRoot v1.3 2012.12.21.1805/AdbWinUsbApi.dll
Resource
win10v2004-20231215-en
Behavioral task
behavioral5
Sample
KingRoot v1.3 2012.12.21.1805/KingRoot.exe
Resource
win7-20231129-en
Behavioral task
behavioral6
Sample
KingRoot v1.3 2012.12.21.1805/KingRoot.exe
Resource
win10v2004-20231215-en
Behavioral task
behavioral7
Sample
KingRoot v1.3 2012.12.21.1805/adb.exe
Resource
win7-20231215-en
Behavioral task
behavioral8
Sample
KingRoot v1.3 2012.12.21.1805/adb.exe
Resource
win10v2004-20231215-en
Behavioral task
behavioral9
Sample
block
Resource
debian9-armhf-20231215-en
Behavioral task
behavioral10
Sample
KingRoot v1.3 2012.12.21.1805/busybox
Resource
debian9-armhf-20231215-en
Behavioral task
behavioral11
Sample
KingRoot v1.3 2012.12.21.1805/evil.apk
Behavioral task
behavioral12
Sample
KingRoot v1.3 2012.12.21.1805/evil.apk
Resource
android-x64-20231215-en
Behavioral task
behavioral13
Sample
KingRoot v1.3 2012.12.21.1805/evil.apk
Resource
android-x64-arm64-20231215-en
Behavioral task
behavioral14
Sample
KingRoot v1.3 2012.12.21.1805/exynos-abuse
Resource
debian9-armhf-20231215-en
Behavioral task
behavioral15
Sample
flood
Resource
debian9-armhf-20231215-en
Behavioral task
behavioral16
Sample
KingRoot v1.3 2012.12.21.1805/libboy.apk
Behavioral task
behavioral17
Sample
KingRoot v1.3 2012.12.21.1805/libboy.apk
Resource
android-x64-20231215-en
Behavioral task
behavioral18
Sample
KingRoot v1.3 2012.12.21.1805/libboy.apk
Resource
android-x64-arm64-20231215-en
Behavioral task
behavioral19
Sample
KingRoot v1.3 2012.12.21.1805/libsu.so
Resource
debian9-armhf-20231215-en
Behavioral task
behavioral20
Sample
KingRoot v1.3 2012.12.21.1805/libxy.so
Resource
debian9-armhf-20231215-en
Behavioral task
behavioral21
Sample
motofail
Resource
debian9-armhf-20231215-en
Behavioral task
behavioral22
Sample
rageagainstthecage
Resource
debian9-armhf-20231215-en
Behavioral task
behavioral23
Sample
KingRoot v1.3 2012.12.21.1805/root
Resource
debian9-armhf-20231215-en
Behavioral task
behavioral24
Sample
KingRoot v1.3 2012.12.21.1805/root.sh
Resource
win7-20231215-en
Behavioral task
behavioral25
Sample
KingRoot v1.3 2012.12.21.1805/root.sh
Resource
win10v2004-20231215-en
Behavioral task
behavioral26
Sample
KingRoot v1.3 2012.12.21.1805/roottool
Resource
debian9-armhf-20231215-en
Behavioral task
behavioral27
Sample
KingRoot v1.3 2012.12.21.1805/su
Resource
debian9-armhf-20231215-en
Behavioral task
behavioral28
Sample
KingRoot v1.3 2012.12.21.1805/superuser.apk
Behavioral task
behavioral29
Sample
thinkpwn
Resource
debian9-armhf-20231215-en
Behavioral task
behavioral30
Sample
xyz
Resource
debian9-armhf-20231215-en
Behavioral task
behavioral31
Sample
zerg
Resource
debian9-armhf-20231215-en
Behavioral task
behavioral32
Sample
zergRush.bak
Resource
debian9-armhf-20231215-en
General
-
Target
KingRoot v1.3 2012.12.21.1805/KingRoot.exe
-
Size
5.3MB
-
MD5
80e6a330bd476e97bc0bb74a3a7ba514
-
SHA1
449425ac434c18104f18264c0f8821346f3f7953
-
SHA256
879ac3fa339baeaa77aec0795d20da8d40f93d81f067480f500d4f05ba5d5a18
-
SHA512
87f34a00c05dbc7ada766b3d40c9296bf425ec248b9d26ea6b0cf7678be0392f07832e53289fb816a49b9bd1015b5f48a24e0f528560b7e1615256f40b189f6f
-
SSDEEP
98304:I8aimlPSMaz6uf+xg+Rci2wRi2HeC1KDuy3L1JIC7vE:umM5cmPeC1KCy5SM
Malware Config
Signatures
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 3044 KingRoot.exe 3044 KingRoot.exe -
Suspicious use of WriteProcessMemory 8 IoCs
description pid Process procid_target PID 3044 wrote to memory of 2992 3044 KingRoot.exe 28 PID 3044 wrote to memory of 2992 3044 KingRoot.exe 28 PID 3044 wrote to memory of 2992 3044 KingRoot.exe 28 PID 3044 wrote to memory of 2992 3044 KingRoot.exe 28 PID 2992 wrote to memory of 2848 2992 adb.exe 30 PID 2992 wrote to memory of 2848 2992 adb.exe 30 PID 2992 wrote to memory of 2848 2992 adb.exe 30 PID 2992 wrote to memory of 2848 2992 adb.exe 30
Processes
-
C:\Users\Admin\AppData\Local\Temp\KingRoot v1.3 2012.12.21.1805\KingRoot.exe"C:\Users\Admin\AppData\Local\Temp\KingRoot v1.3 2012.12.21.1805\KingRoot.exe"1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3044 -
C:\Users\Admin\AppData\Local\Temp\KingRoot v1.3 2012.12.21.1805\adb.exe"adb.exe" -d devices2⤵
- Suspicious use of WriteProcessMemory
PID:2992 -
C:\Users\Admin\AppData\Local\Temp\KingRoot v1.3 2012.12.21.1805\adb.exeadb fork-server server3⤵PID:2848
-
-