Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    3030785s
  • max time network
    149s
  • platform
    android_x86
  • resource
    android-x86-arm-20231215-en
  • resource tags

    androidarch:armarch:x86image:android-x86-arm-20231215-enlocale:en-usos:android-9-x86system
  • submitted
    24/12/2023, 08:12

General

  • Target

    ff3719e87a21f447a8b4f76363bc262941caac9903899641007542e341642510.apk

  • Size

    14.1MB

  • MD5

    1ab9a22b4e40dcfac252a4f0512b15c4

  • SHA1

    1588ee253e7a670614eb0592f208f84b8d310aba

  • SHA256

    ff3719e87a21f447a8b4f76363bc262941caac9903899641007542e341642510

  • SHA512

    1dc571974bc113e1cc4f3916210b59156793894f4c32a21538244a4b38f1afc80bba942aa3912d74c4f60c1a945dc848fbc4d895997df7e71251e57d46028a58

  • SSDEEP

    196608:yPmMP/E3oXOhGRqWeIO1uP+h7r2rb1xU0pbsMVmZorRGTWFeMvAAAAjZWa61spgX:yPBHEZFtL2tC0pbsMElrMxWa6sRG3

Score
7/10

Malware Config

Signatures

  • Loads dropped Dex/Jar 5 IoCs

    Runs executable file dropped to the device during analysis.

  • Uses Crypto APIs (Might try to encrypt user data) 1 IoCs

Processes

  • com.kana.reader
    1⤵
    • Loads dropped Dex/Jar
    • Uses Crypto APIs (Might try to encrypt user data)
    PID:4253
    • /system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/data/com.kana.reader/.jiagu/tmp.dex --output-vdex-fd=42 --oat-fd=43 --oat-location=/data/data/com.kana.reader/.jiagu/oat/x86/tmp.odex --compiler-filter=quicken --class-loader-context=&
      2⤵
      • Loads dropped Dex/Jar
      PID:4287
    • sh -c ps
      2⤵
        PID:4374
      • ps
        2⤵
          PID:4374

      Network

      MITRE ATT&CK Matrix

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • /data/data/com.kana.reader/.jiagu/classes.dex

        Filesize

        6.1MB

        MD5

        728f8e16c86e34816e083143c939fa69

        SHA1

        5ce85a96f85844b4c4cbddf52de5642b5abd7d8c

        SHA256

        b265fc2ee28ff4bd02f5387812c24ae78080e5c69a4fea0f1d681dfa2ef73599

        SHA512

        56e414e4767d0dcbe2923e4d1cb58593e0091f13e991ef907d32a1607a0e841f6af8cd97a7cb6892e4ceac84c45b6895ef5791ee74ec514154fb6260d98ae7f9

      • /data/data/com.kana.reader/.jiagu/classes.dex!classes2.dex

        Filesize

        5.2MB

        MD5

        03b2eeb17229e030466725913b406d18

        SHA1

        9cfb8fb58da38fd648ebafd04405ffca9c0dbb68

        SHA256

        f54dad1441d91a7214af3fc54a2c37d64a2f59356dac1d777a4e7a84751e140c

        SHA512

        96deddb35903d3cbff167fbcdef847395d6ffd5b9ba65430e3acba89686b24ed5d138e1ab42636f360179dabf3a4d702369340735831ba3046d0bd3645de71fd

      • /data/data/com.kana.reader/.jiagu/tmp.dex

        Filesize

        284B

        MD5

        f1771b68f5f9b168b79ff59ae2daabe4

        SHA1

        0df6a835559f5c99670214a12700e7d8c28e5a42

        SHA256

        9f8898ce35a47aeafced99ea0d17c33e73037bb2307c7688e50819966f4ae939

        SHA512

        dae27d19727b89bec49398503baa6801640540355688dfabbe689c97545295c2c2d9b0f0dcd7cbc4cfbf701d0c0c3289e647a152f49ff242d1ecc741efe4145d

      • /data/data/com.kana.reader/databases/.ua/ua.db

        Filesize

        16KB

        MD5

        b0dd3030d09f863ff55f44629707b190

        SHA1

        e0422af0a8277ec9ec2663dc833fe1324a5bf901

        SHA256

        7c1f2769caa83b55660b5439237c6bfc5efe2991f326427ade3ceb9fa12252c0

        SHA512

        47e94a45643a14f414c55d73051255a85a4bb12a291cb689fbcafd3f1bd2438936fbd94ec219fbe74a26427190d205298cb4c4c31257eeceb249330961ea98ca

      • /data/data/com.kana.reader/databases/.ua/ua.db

        Filesize

        16KB

        MD5

        c0b7403ea96e12cde084b1d4bb8591b5

        SHA1

        2f76f9f1416b5ccf998b9e02d054d39acd8b0449

        SHA256

        19dd8d75d596090659ace9bf369452c98c6731abeb745580250cc8cd4352080b

        SHA512

        a308abe2bf6fe2123a9aaca70e8e5225724ca3f561249d6b0070bc51bf541d69cd7bf01e9fc846504f578c43df16d70da76bddf1d0c2a6615faad8fd9467ca48

      • /data/data/com.kana.reader/databases/.ua/ua.db

        Filesize

        16KB

        MD5

        c75738e5201b1de984c4ca4e9583db6c

        SHA1

        10b8dab15e0878926a76eb7d8f561edf7f7a279f

        SHA256

        bf99ef291c4ed89b90823713b3dced4d58af4a54dc4d2658e5ffed2c2727b9e9

        SHA512

        34f77be1126f40da47cb5bda8b9a0f94059cb47fddbbd948d74625bde49962d83a59e7952d444633b734c275a96bf3b02b33ade69c0b62c46f32c2c8aeba73d8

      • /data/data/com.kana.reader/databases/.ua/ua.db

        Filesize

        32KB

        MD5

        d604a3bf1f8d992cc320ea5b1f7609bd

        SHA1

        247f88df0b55c7d523ea5398637711a0e4a483a4

        SHA256

        329940b4d46326d58e73c842dd099704061d0ef7338777bf31ad895f29013c17

        SHA512

        67e28f6713cb5c238a9664df128f01a89a2efb7c8c9330c1e45bc0d40ebab81fa20df5166743d84d81dc0386a89ff0329f022281c098339baa2e851ff0a1e1ab

      • /data/data/com.kana.reader/databases/.ua/ua.db-journal

        Filesize

        512B

        MD5

        bae4a3e4b1b2ed075752a5125c5c83de

        SHA1

        fa674a6ada80bfa7a78d6d922fb68e501d001229

        SHA256

        c845c0b9aebffb2bce07267665d4d9e2ed2d1183532b6d8a329b40a469cd1f55

        SHA512

        bbfbcc7046df8b4c19f679e8f6644dd07d449b6265d9fc16b7c5d042d57dd16f4855c84bd2ac199e3bf6cbf5458ce20df01dabc65301eb495be4d7dfb7b741e7

      • /data/data/com.kana.reader/databases/.ua/ua.db-shm

        Filesize

        28KB

        MD5

        cf845a781c107ec1346e849c9dd1b7e8

        SHA1

        b44ccc7f7d519352422e59ee8b0bdbac881768a7

        SHA256

        18619b678a5c207a971a0aa931604f48162e307c57ecdec450d5f095fe9f32c7

        SHA512

        4802861ea06dc7fb85229a3c8f04e707a084f1ba516510c6f269821b33c8ee4ebf495258fe5bee4850668a5aac1a45f0edf51580da13b7ee160a29d067c67612

      • /data/data/com.kana.reader/databases/.ua/ua.db-wal

        Filesize

        56KB

        MD5

        104c537ef3a759df749993f2124b6419

        SHA1

        1726dd916196ccceb9e630d9973c32f2a807d9c2

        SHA256

        fd199b1f66450a9a390e4124ce735a9ee2521f4e83bd28fff446cfa4d99e9ff8

        SHA512

        c9517c8384410b43e800ee402080f294dab44f3a2317d25d4ce17cbf15ef5c15993596571e16d34d8c9ecdad1d01cfd676ba755d68083dcba543e78f6d4d4408

      • /data/data/com.kana.reader/databases/.ua/ua.db-wal

        Filesize

        4KB

        MD5

        0d99316c68b3563ea40184cafe467592

        SHA1

        7132238a2701319a9b66ea9a6e9945298f3e9d85

        SHA256

        f5ebb50b48ed232720b23644925cc21984e4297fc3bf26728e3215cb4b67bf86

        SHA512

        d050f98225e49aee5955819ff7dee649e5853478ba95ec2f5fd968b1fb0b8e954bf9689eb71e60d4005f7910c63c77e383289f85647310cd972cb88d68daf25a

      • /data/data/com.kana.reader/databases/.ua/ua.db-wal

        Filesize

        4KB

        MD5

        3aab0274708e166150c46796e3e72aa8

        SHA1

        d9b36ec965a9451ea1ec146f580d5bf707bab06d

        SHA256

        8acd9277c68e39291327de36419a9e9f19d818bdd691276bac5ae615d4d64ea3

        SHA512

        972cef7ec6dab2d6938be32ea00f8d93178c66f63dd073cbeb75e63888b7c82eb21fa0d8f83cbec85af25b24cfcc156c5c8b2d19020bd1677174e9117a2fb2aa

      • /data/data/com.kana.reader/databases/.ua/ua.db-wal

        Filesize

        4KB

        MD5

        6811212b91b234fd77f907203b3d9a65

        SHA1

        0ce754bc197067027cb2f74151c719ac1b23f19c

        SHA256

        1d3afd56ac41d9da0defa806f257e86eb1d4c806f70a213aac2f978e5ab8f6b7

        SHA512

        15001b9775ec8af9e2c9f8cf2e0a089b2a557b890c794e07032f50a80acb08920d8d0111ba4ca1e55ff1af844bb0ff670469d3fa3deadc1d1f8ce3ac7ffd36e4

      • /data/data/com.kana.reader/databases/.ua/ua.db-wal

        Filesize

        8KB

        MD5

        2ce8eae401894b337cff5db56e8cdc81

        SHA1

        a00658c2cbfbab7947afaf979e58721b90688834

        SHA256

        4e247b9a05f827288df5fc6f2da8d0c95976d3590a17193159431e54ae1af51e

        SHA512

        f8ebb1a95345357395157b532a0e1ef66ed2091c44d1ba39631668d4b48c5a3e28730c1f1f74a4b28b716c40b90449edd8546afc38e665bc18b5d96b351a371c

      • /data/data/com.kana.reader/databases/KanaDB

        Filesize

        4KB

        MD5

        f2b4b0190b9f384ca885f0c8c9b14700

        SHA1

        934ff2646757b5b6e7f20f6a0aa76c7f995d9361

        SHA256

        0a8ffb6b327963558716e87db8946016d143e39f895fa1b43e95ba7032ce2514

        SHA512

        ec12685fc0d60526eed4d38820aad95611f3e93ae372be5a57142d8e8a1ba17e6e5dfe381a4e1365dddc0b363c9c40daaffdc1245bd515fddac69bf1abacd7f1

      • /data/data/com.kana.reader/databases/KanaDB-journal

        Filesize

        512B

        MD5

        1a8e3dc6c8cdb3239e38f9dfc3823a3f

        SHA1

        54d656fa3a7ed95b9039e7c5886179ad36249b01

        SHA256

        3daca7077146bf469fc662b18e3709b4d5cd9116a78e346b01772988049261f6

        SHA512

        f4cde87bbcc590fad778d7563c2450b7942546e1a63285b071966d20532cd86f886689fa934b5bcba40c13530deb678138aef16e6cced786a373109d81703113

      • /data/data/com.kana.reader/databases/KanaDB-wal

        Filesize

        16KB

        MD5

        442d3c35c6bd9e60bf5202af72eacdd8

        SHA1

        15f1b0a8e6126aba71e5e388a818609afb33e6f7

        SHA256

        2abdcd8cefb4108a44a5f5e95962cd69589b823ba818f73aac9de2daed7b7eee

        SHA512

        179b631b42e7d4fe5fa27a350ef185e6a5f11f66ef91a0483898d6ad70b65b3086cb9dc33eea2cc81d4ffbdee28776fc6e96697ea85a1c007178de890d4e4548

      • /data/data/com.kana.reader/databases/cc/cc.db

        Filesize

        36KB

        MD5

        ce6135aa1b1fe4f2c2db2a546d2a5558

        SHA1

        79b59582154017aadab783dc266fcb158c252940

        SHA256

        7b45f576c08c7f78220168cca4a0e33198b13e9bdc8b1da406ddb6887412000c

        SHA512

        2839075fe374c8567c839ae35ce2d33ec72fdaebf170aa7d224b555e5b0e74d4a43f2f67d17ed806dae841da883e9620d788ea052d06152678afa927307c7ce4

      • /data/data/com.kana.reader/databases/cc/cc.db-journal

        Filesize

        512B

        MD5

        aa4d34472c7896b5b2bf3fc20dee9608

        SHA1

        3dd7c47dafcb5b5158a7c918adf5729c52a53a4b

        SHA256

        67378fe5b8bff81aad16dc3349de82f911ba1637ee5c6f6895a0f30712323fa1

        SHA512

        68e821414d8971edc3e280255dc306c43376c9debf8f2c6c27adaf9308bdf6faa0d47b2620a6d702143e0342f5cd26dd191d5548485151b9dec66302ced0b102

      • /data/data/com.kana.reader/databases/cc/cc.db-wal

        Filesize

        48KB

        MD5

        27d58f79203eb62e6af34ffd4f2d6594

        SHA1

        0dbce68e865e5b1fefab809eb4dcb8979c6e2575

        SHA256

        7fb815015e00463620d4325692f380292ba91d82fd2b63cb6bb7ca82c02e3e68

        SHA512

        0a75d378283d3d0ff8ecfceb907b3b4d037a00057fa0924d32eacef3d9220f712c909e6339f067677f28093f6e4bc7e644f3f9ea8489f71a3940d67ed2d012cb

      • /data/data/com.kana.reader/databases/cc/cc.db-wal

        Filesize

        4KB

        MD5

        ae33eaf8207e3e6093f8c70371eb8210

        SHA1

        6515909d1f52a688f91523affa9e7e9d4dc83e75

        SHA256

        42f829d6c6d62e4c4cd2d5cc6fa2c05f60ffcb431721fdef3e7040e028e82c97

        SHA512

        738f396ce79b4bb558807ab3190907f6b7ae68e4cdcdc176fbc1f1c348c8ac97b5e61d4cbcaebca79bdaaff571f9b5e736b90eb73b37ecf0ecad6864294f4a62

      • /data/data/com.kana.reader/files/.jglogs/.jg.ac

        Filesize

        40B

        MD5

        bacf66fdfa7ce933e86f131fbca3f6ec

        SHA1

        55e70263afe21fa19c969ce54acf6f0dfd13815d

        SHA256

        4b8394329b892be71eb2ded90e5be39af5db7157484345009fdb10f58aefadd8

        SHA512

        b1ddb4cf33c088908fe3be3178d1b5369dcfb186547232c2c9b1441666c54e8238523b39f47ed380171d6c5fcc08fe1718ea168eb8c974cadd7e2ef288287b67

      • /data/data/com.kana.reader/files/.jglogs/.jg.di

        Filesize

        340B

        MD5

        b612922d4569f71afc5a4c2010e315a8

        SHA1

        90f31f113296e712dda8551493ae2135358f8af4

        SHA256

        cf049572e8becf11e9af39fc1588188c47a984a7d06027ae12c5e6c774a45047

        SHA512

        edb6c277f6342dff457ca5412ecb50ba48929b32eab6a5900b1429590b72a11798fd40b18e9a4f0b3ab7d630fdec3c31b862b15e3e107216d2526067ed891d88

      • /data/data/com.kana.reader/files/.jglogs/.jg.di

        Filesize

        340B

        MD5

        ed9080e3140e5b97bc6df7bc386afd13

        SHA1

        9c9e8b79ff4cac5a7919b87212bd300e7341defd

        SHA256

        23cb1f48b40e9075e13fe5016d13cb845df4357955958ad3658f11e0c881442a

        SHA512

        3ef5a765057b04fdb03bc1e92c157dc997a433802dd9aabc9669502796551eab80f9ae0b4c632380ce4b05855646124e48f1e7852ad6b3f74c55cdbd2cc42caa

      • /data/data/com.kana.reader/files/.jglogs/.jg.rd

        Filesize

        73B

        MD5

        b4b943b41fe78e2f516707c0590197d9

        SHA1

        d526d8d6001df6fbe1b45612d158898c24e4f09e

        SHA256

        4dc87e3d57775882bf86fc531e8ae4c3e2ae9eda70be820de79a2d4796255832

        SHA512

        69dfd8c139d5494c051976ba223fa0d2b5ad2e208ec9049928546ad27dc4fe075e09f91b1993079354e32c6d3ac4ac4debbb33911655fbe316d9c5e27d81449e

      • /data/data/com.kana.reader/files/.jglogs/.jg.ri

        Filesize

        314B

        MD5

        5981b80bb4b369752bda42b496619504

        SHA1

        0714fecefaed07f6201906e8278aa9cf0f48f754

        SHA256

        8c7df43121fb44ac93f7c7e5de9d1442705a50410a035abbf72cd58ec8ea6513

        SHA512

        c015beddb3eb8571e36258f0bfdaa4a4f46b9ce6162e545c49dab3eb0a77967d816095c9280690be400d2e12f80235d78223a21a57fd30891c5cdc45aab289dc

      • /data/data/com.kana.reader/files/.jiagu.lock

        Filesize

        27B

        MD5

        dc9eb44d238688cfd472cfecf64518f7

        SHA1

        47fbc84b8d693fc415b80a85ba6b86220bc73c15

        SHA256

        ddfa24862bc1d355a033539f8e52180f7b098c6f39dcd323ac5fa123efaebf0b

        SHA512

        ead4873946f2e73ebd4dea6aefb8099f1b63ced92167ddc7a7ec9aba9cb7a925873a4d85366c9eb9fc0251ecfe9b83d5c9aacfcad28aa7f77f473eaa7c041201

      • /data/data/com.kana.reader/files/.um/um_cache_1703837834871.env

        Filesize

        1KB

        MD5

        ccd93631788ae907f5c150e200dd86ea

        SHA1

        f3cdad1e1f0465f8f4a3760234f22c30d3071e23

        SHA256

        757807e68593595c4c2fae9aaae0cb15ce5e0ee6b1f004776a49bcb588e7d3e6

        SHA512

        f26e09af8bdd156d3e3a4028622c7c1a99f029f7b8fd67a5a375a5a8b38070a2f8dda01c3f0f1ef36e51526e9ef4904bdc37c9755530b6dd69f6a0f6cbff969f

      • /data/data/com.kana.reader/files/.umeng/exchangeIdentity.json

        Filesize

        162B

        MD5

        4c933933fe304a72fc4bbc4cf51bd100

        SHA1

        0de7b1e7f927dc51d878dc44e38c7b56b9d94014

        SHA256

        8963bbb219d8f4a61d7006f4ccdd9529c5a62769dbc80419e0a6285eb85ce3f1

        SHA512

        e9e58bd27de64889c02652fc80d809c03d0d673418c6981698cec91a99b5ba8e0e0ad6ba88550e68c8b242ee207552ca56cc9d73866276be4fb9f8e869a8034e

      • /data/data/com.kana.reader/files/exid.dat

        Filesize

        58B

        MD5

        226aac8f108235a9fe98d02febcfae28

        SHA1

        4f62d7eb32a947affafb408f068980807f4e9ab9

        SHA256

        98bfd5f7591d048f265e25d98a6e655c2d5bef935ba0c54472f2a7118b7ced7a

        SHA512

        391eb638406f71c48d6ff05a994625319cd1c4929f008eefdaf18d18ceaa73646ecfcf90f81b088c0749035610180bd1ed446cbcb58479cb0faa150dbeb1298c

      • /data/data/com.kana.reader/files/umeng_it.cache

        Filesize

        498B

        MD5

        4272c9ee7346ba264f0f69ebb6121252

        SHA1

        33cd53a24ffa088cfda91b47d28f18b10e4ac1cd

        SHA256

        bb92473ae820cb9241e565000a55879cec0fca31dc2a762811eb006889573291

        SHA512

        196c4b49273418ec15f21090df00eaf736fe2fe9e5e7781283e8f1086a905b75a795796301ee4b0b4ab926acd6d69710f4ee4f26ed313bc0519c882605ff2788

      • /storage/emulated/0/.DataStorage/ContextData.xml

        Filesize

        111B

        MD5

        28e2c0bddbaa7d2a3fbec462281da4b9

        SHA1

        ae03aa52eeed07a174b4483b67658fd88d92dd59

        SHA256

        6e13b07425b69863e94931123985c2f5b08c6d84ade225b9d7938218eff6139d

        SHA512

        eb2e4a40704cf90266d2198680bc2524682711638029fdbe82076d9cc7a2915db919b980eb679c0df7535e5ade51c3cf4901443df2300f62bfb282c856ef81a2

      • /storage/emulated/0/.UTSystemConfig/Global/Alvin2.xml

        Filesize

        65B

        MD5

        9781ca003f10f8d0c9c1945b63fdca7f

        SHA1

        4156cf5dc8d71dbab734d25e5e1598b37a5456f4

        SHA256

        3325d2a819fdd8062c2cdc48a09b995c9b012915bcdf88b1cf9742a7f057c793

        SHA512

        25a9877e274e0e9df29811825bd4f680fa0bf0ae6219527e4f1dcd17d0995d28b2926192d961a06ee5bef2eed73b3f38ec4ffdd0a1cda7ff2a10dc5711ffdf03

      • /storage/emulated/0/.UTSystemConfig/Global/Alvin2.xml

        Filesize

        111B

        MD5

        80e17c7a2f4cd5263f8a73f5b863236b

        SHA1

        ca0ba79b2fc3725e670f3cf83c2dbe635c248c1f

        SHA256

        f9cc689be23610d96fbcc2a1636226faa216cb65d2d7d506e4a24bd2b05aa91d

        SHA512

        e2dc72858437e0478e0dd711b330ae78cf2eeb7f068c448b70390cf17dd20ae31b82015a98a5fe167319001816d561c4c77fb016ac000f668da44a2709723895

      • /storage/emulated/0/.UTSystemConfig/Global/Alvin2.xml

        Filesize

        167B

        MD5

        f1ea638a4b562f1c4e74537b5fb1e88a

        SHA1

        9c62360776b0894c51c6e9dc78ed65dc56b6ae0a

        SHA256

        fac65065f3a4f4410e5001e28a9f72f4f45ad2697e3a2a0a496ded165fb1e423

        SHA512

        34437d13f3909692c6546fb0c7f4563f56441d0a0bdd113ddd1e04a03d4b6a09d27a087f92f447af7c90e0d5bebd779666b15cbffe45b7049ae3542cd43abfd2

      • /storage/emulated/0/360/.deviceId

        Filesize

        48B

        MD5

        1d8d16c4e3b19ebf18988530d9b9a757

        SHA1

        bc94c1cce05cd848a53271ecb9c5311e27ffebf5

        SHA256

        abd87140da8de3d0aa39a24a8d52bfe7b2eb28f7a3d505f205471c7e8f4964d7

        SHA512

        4562d1eedbc5c2dd7f25cd1c70343053fd451026403585182b142a64f17016c1bd0bf6ad51667b439b220e425640e55fbbda08517e7106376cdc220a4555da82

      • /storage/emulated/0/360/.iddata

        Filesize

        32B

        MD5

        8de19e32fd7f0d023fb19a41d6d121a0

        SHA1

        04fa56cfbc298df70c1398d913b3dff1ca936aad

        SHA256

        a3e30c5f653ac5a5cdf054c6074e75d3d289ddc31a0d2a677b774b94e6cf5901

        SHA512

        4cdb56386268f91c77fd5d449dcdc6e42a98b063f6f710c14f8041d23c4185a6f160d21856ad4b9896cf4ca534b01faa41520f8ab32eb6a1993eb4a85e138d4c