Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
148s -
max time network
156s -
platform
android_x86 -
resource
android-x86-arm-20240221-en -
resource tags
androidarch:armarch:x86image:android-x86-arm-20240221-enlocale:en-usos:android-9-x86system -
submitted
28/04/2024, 23:38
Static task
static1
Behavioral task
behavioral1
Sample
0653bdf7d7a4bab071b1d50b22169280_JaffaCakes118.apk
Resource
android-x86-arm-20240221-en
Behavioral task
behavioral2
Sample
gdtadv2.apk
Resource
android-x86-arm-20240221-en
Behavioral task
behavioral3
Sample
gdtadv2.apk
Resource
android-x64-20240221-en
Behavioral task
behavioral4
Sample
gdtadv2.apk
Resource
android-x64-arm64-20240221-en
General
-
Target
0653bdf7d7a4bab071b1d50b22169280_JaffaCakes118.apk
-
Size
24.5MB
-
MD5
0653bdf7d7a4bab071b1d50b22169280
-
SHA1
02d2517864206c713f04d22550422e2be6f54c76
-
SHA256
7708ae3ae67e072cc757f73bd2bfee9bca1f5c3db79e589a3934429a42389f30
-
SHA512
2fca3ea1ba9461788abab03f81d767c7b989f0075f9461cb149bc38161afccadb4aad7e03b47d1625e939f7f1739b147539270ebaee9a0c255d18469d5ba2fb0
-
SSDEEP
393216:cMihUZ3ue1QGcJLyryzJJu4sTTG8oc/6CyEAysO2z301SUTCDcxXZQMw+eC:wE3u4QGcJVNJuNAc/yE/sO2ueDBMw+x
Malware Config
Signatures
-
Checks CPU information 2 TTPs 1 IoCs
Checks CPU information which indicate if the system is an emulator.
description ioc Process File opened for read /proc/cpuinfo com.g6677.android.pnailspa -
Checks memory information 2 TTPs 1 IoCs
Checks memory information which indicate if the system is an emulator.
description ioc Process File opened for read /proc/meminfo com.g6677.android.pnailspa -
Loads dropped Dex/Jar 1 TTPs 2 IoCs
Runs executable file dropped to the device during analysis.
ioc pid Process /data/user/0/com.g6677.android.pnailspa/cache/1582435991586.jar 4284 /system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.g6677.android.pnailspa/cache/1582435991586.jar --output-vdex-fd=71 --oat-fd=72 --oat-location=/data/user/0/com.g6677.android.pnailspa/cache/oat/x86/1582435991586.odex --compiler-filter=quicken --class-loader-context=& /data/user/0/com.g6677.android.pnailspa/cache/1582435991586.jar 4210 com.g6677.android.pnailspa -
Queries information about running processes on the device 1 TTPs 1 IoCs
Application may abuse the framework's APIs to collect information about running processes on the device.
description ioc Process Framework service call android.app.IActivityManager.getRunningAppProcesses com.g6677.android.pnailspa -
Queries information about the current Wi-Fi connection 1 TTPs 1 IoCs
Application may abuse the framework's APIs to collect information about the current Wi-Fi connection.
description ioc Process Framework service call android.net.wifi.IWifiManager.getConnectionInfo com.g6677.android.pnailspa -
Queries the mobile country code (MCC) 1 TTPs 1 IoCs
description ioc Process Framework service call com.android.internal.telephony.ITelephony.getNetworkCountryIsoForPhone com.g6677.android.pnailspa -
Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs
description ioc Process Framework service call android.app.IActivityManager.registerReceiver com.g6677.android.pnailspa -
Checks if the internet connection is available 1 TTPs 1 IoCs
description ioc Process Framework service call android.net.IConnectivityManager.getActiveNetworkInfo com.g6677.android.pnailspa -
Listens for changes in the sensor environment (might be used to detect emulation) 1 TTPs 1 IoCs
description ioc Process Framework API call android.hardware.SensorManager.registerListener com.g6677.android.pnailspa -
Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs
description ioc Process Framework API call javax.crypto.Cipher.doFinal com.g6677.android.pnailspa
Processes
-
com.g6677.android.pnailspa1⤵
- Checks CPU information
- Checks memory information
- Loads dropped Dex/Jar
- Queries information about running processes on the device
- Queries information about the current Wi-Fi connection
- Queries the mobile country code (MCC)
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Checks if the internet connection is available
- Listens for changes in the sensor environment (might be used to detect emulation)
- Uses Crypto APIs (Might try to encrypt user data)
PID:4210 -
/system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.g6677.android.pnailspa/cache/1582435991586.jar --output-vdex-fd=71 --oat-fd=72 --oat-location=/data/user/0/com.g6677.android.pnailspa/cache/oat/x86/1582435991586.odex --compiler-filter=quicken --class-loader-context=&2⤵
- Loads dropped Dex/Jar
PID:4284
-
Network
MITRE ATT&CK Mobile v15
Defense Evasion
Download New Code at Runtime
1Hide Artifacts
1User Evasion
1Virtualization/Sandbox Evasion
2System Checks
2Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
41B
MD54a8226e4211ccb4cb79f54d4ee35a55a
SHA17144e993ff784e4458c4d53d6f9f29930cf13fb8
SHA2568d5bfd20db452314b315192d7160e28bce53c777c98a31aa6df7c93345a692eb
SHA5127d7480da93b3363306438c7cc08fb913e29098eb19c4f6ac40ac5282329ecd8eae77fed695822955183a4b7084d18da89c2c937af5fcdf43b3f1bd7854cc7041
-
Filesize
113B
MD53efd3c935f0587df8e8ab5901b91bb42
SHA114c762678f4d2f5c328ff41df6d693a61b776118
SHA25622341f472c5e9d0c52bb0f3c7de85e78b88e7cf9951b58bc4b513a7e0d3faa8e
SHA512f8fe1c766dc5fd3e140b5f75a259675e22b1c88b4e8c01cd2ad0988a4b4045580b3588c62e30297868f6fc45be1ce37f25eb14cf91bb2c4819a5a1b34ee617e8
-
Filesize
155B
MD5ef71ef01fca92e320ec9e7191384e2bc
SHA19f8131bbab959563c32c5a60b76860de9b73ed12
SHA2567d98852c07311464b58197d34acd89fbdcfbb781dc6badc68cb0c61269c382c9
SHA51261071a7a51a7426c9620332c199eaab6fd24c83d6fd5d930a465be0605a486975413c6b9da10d94f4fbb9049f0b0cbd11fd4f14b77b10d2a0779a092a8d0b427
-
Filesize
323B
MD518836c14d343971028071b8cda9edd06
SHA1037b79b716f08a1690d85d4b50f4ceed8567c63d
SHA256e855c281910b4088472cb4f918b1a7e9bff78b8332fe153f0ffedd751e307b7b
SHA512329f6651d38b37740460a5534b8fdbc5e18c50b41b9b6c41ebfa2d9c814e434b617c780782e2a4f44b428021e05782a0ab56a7325830ddf2fc10360426626a63
-
Filesize
189B
MD5876896e8e60cb693f1a1bef6ddfdf3db
SHA16b59aef4fa32b25cda506a5f045d5f018af793ae
SHA2569ebed4cef77135c77fd3dfbd57edae81d933e6fceed487c3793c6f54e689d5d0
SHA5128474ef44ec56382c7c964f2ccb4625b35dc1ef49c2f31f3db30a25043a92f151a160525f8ebf42175d1587964e8a76e7ddfd7a4346cdd4339e1c4f4aea5379c3
-
Filesize
9KB
MD5e8e0527a01aefdb89afd2c508f131da1
SHA1f1103e6b260c657ceb3d95f1b023af3fda8b133a
SHA256f809447486f89fcaa74f87e06d126d103d37eb2b3157e88f2c06d989b2c284ce
SHA512fb53683a83f1068d0f94567b156e6a8910c45b1b5f33db919f7e0b9c55eab28507a235ef76d44d5b549599ea3b54dbc00496a633339d276a80f395da938d6d34
-
Filesize
134B
MD5ce7fec257e97a600cd9fb819d86597c1
SHA12b071c79b61e320adf8e2153c12864e3fbcc12b7
SHA256eff821915424ef0969c531e79dfb984a6daf0e9ed1dcfb2ed33b7fdbb00fa5ae
SHA51214c8269924f89f2ada83ee17ac23d423fccd90905c77dba4009c951545ec7dcfe25c1d6d5ea82b4cf44bc079a589d34c50e1656846e0441326880948973207ca
-
Filesize
512B
MD578cd27a60cca19b2c62ab6477d9b073f
SHA14ad81b17578a355f36cd8ba27636046b28bae5d3
SHA256eba43f8233bc0d5d6ba0ea58341477fdbfb02ad9c29c4b70b9268109711075a3
SHA51249445e0789af2d9c8f414e2e1b8cbb91b1cc93611bb4d9cea03b2975650d0ee7df076611859614aade083da7c328150afec7c36623801bc4f2d9969f11634245
-
Filesize
60KB
MD5ee64636e96a928da95956c5cbe77b5d2
SHA1f1e9115f8b5a3e90c551b3e250eceaf99c609e9a
SHA25623def6ec83180b936417f9269ffdb7fda354e46fa796a498647e5a1b1d787370
SHA5123a9e2407b17252bff03dd6d63da6847f697ac3571a6e5b1cc2af20ec35d45f004a1a3461a526131edc7cb3ce05d28d2969d1987fb739b2f3bf32d27a6eb5678e
-
Filesize
4KB
MD5f2b4b0190b9f384ca885f0c8c9b14700
SHA1934ff2646757b5b6e7f20f6a0aa76c7f995d9361
SHA2560a8ffb6b327963558716e87db8946016d143e39f895fa1b43e95ba7032ce2514
SHA512ec12685fc0d60526eed4d38820aad95611f3e93ae372be5a57142d8e8a1ba17e6e5dfe381a4e1365dddc0b363c9c40daaffdc1245bd515fddac69bf1abacd7f1
-
Filesize
512B
MD592bb22d272cc288f3b3d7e38c49c2b5c
SHA1e71e3affd6272399d61b3ab348a84d69bb7147e7
SHA256706d297a333c28df79289f1c2c26f3ac62b2b04cfa744f529bbd664882b252e1
SHA512ef49f94e1f6b519ff9ea98de423b32f078a9f290317946b10b09350ef4614fc1317da5552e939cbb9923ec38705828074789438a8d409c522e3c5a4439255498
-
Filesize
32KB
MD5bb7df04e1b0a2570657527a7e108ae23
SHA15188431849b4613152fd7bdba6a3ff0a4fd6424b
SHA256c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479
SHA512768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012
-
Filesize
32KB
MD5a67e8cf3929407d52be67e68666a3ffe
SHA1fcf1c61229156aff63d34c8bc1758b0c2209fbfa
SHA2565fdc9766af2d88929bfac89ca482a0f35cc0e0f92bcb39c67962ccab47ce8c5a
SHA5124be04205d6caf20acefa8502dd1142450a2688c311fd6be34cc9344b257a61daf8190b71132db3dbb85bc9a283b178b6033f5c75b0d82db30ce5a7bbbc850370
-
Filesize
512B
MD5d3b2b7f749ee36efa164c8f80fd5fd40
SHA1ab84b22c2a0d3362ca5c5a9bfbfce47f77a0f3ba
SHA256bc5f0b6ada9b701f42ae366581e22ea7aa7d277cfedc2a072079c7ff3adb2b4f
SHA5128129dc5a6df012077eaaf5d9161eef79b78af96f0447b75be62f1bcc8ddea82263b6aae906b811a6c2d3fbc6ebc1ae9e2bd487dc5bb30d9b5ce784943a1bd9d5
-
Filesize
48KB
MD5c781ed7501a54751f43b6e3ed207e12c
SHA1dc7fe698951860f8c76732102f2cded441eb3f66
SHA256e06fd8cf879b2bd0ad7d2014ce7cfb0de079e642523b915048a0e68c09dc0b69
SHA512b47cccbcb1d54b908bca3fab0ea1a8085169c580acf94bcb87d04dda971b2376ca7c40ab4c9576ad20c8dfd67e733d1180eebe4983439820fb679ead1ea10b3a
-
/data/data/com.g6677.android.pnailspa/files/.YFlurrySenderIndex.info.AnalyticsData_J49SG3BD3C58R7M7GM73_216
Filesize88B
MD56bde6f9c786e721d03116c87936f6af6
SHA13c7059f2012f76e54b423e75f27e10e3fba234c1
SHA256cbf279de4463ceb9009bbe015191e75af55c7765c95b6f0fdb4659b1eb4fd5f1
SHA5127c5606718b2c734e947b3b5d0a78ff5086d3ae3be0f3ea6767c3d74892f065821c2bd26e586d2892033df5f8f65499f24f5a68fab9d17d4360942474a8786c6c
-
Filesize
72B
MD5be0f390301b4be7833db4ed2dfd04226
SHA1c23079448da2f7089b96452e9b605676549a6c40
SHA256fd1efbde8b900015931ebd6f535930ee5f7f3f8dc48d59fe4742a48681eb7710
SHA512dc3a9ebe178c44b703291a49d91ec044d54fa443225a62412372146eebdda6303923d6a7c0cbffa5192a9394cf909dfe32abfa7db3224b4bcafa8fe8b1bcb96b
-
/data/data/com.g6677.android.pnailspa/files/.yflurrydatasenderblock.af9f091b-b798-4af3-a087-a50a3970e81b
Filesize329B
MD506285df1ef900b23abcbdb5f1f71e8b9
SHA165bfe9f53a5cba9bdf86e17234b3bc95c2700240
SHA256553158d4045a0b8a007e611834dfcaeeb26ae354c9bae364fc7bbf1047057ad3
SHA5127b563e38b370483b99111ad64feb77fda393b04faeb7560ebe4fd168954444958f745921873156cc59b2e1add11f32ae698925c063df588db12c0c3a18054118
-
Filesize
36B
MD51366e83c013241bc8c83c52052018e70
SHA16666e77f23734870c030f1da4773bbfccfd5baf8
SHA256075c46cba421af11211089677b2189bbb285b091e737046954ba3f38b5f11ae3
SHA5121cf4121418dc91142fdd922e1a6bc5f3897f0bf886ee7ce94d24076f2feafdb23652c7c4008b32d44aae5c3e0fcd7fea2f255cc457841501597f584c928e16f4
-
Filesize
31B
MD56baad3ac1c2dc64c7ad25e002bd4335a
SHA1c13baf0d95a53450ca4943491c6811c45847d566
SHA256ce390071f440f889d7849ebcda173ef1734fcdbf0e823f95f997beb69e22a861
SHA5122425ee0037151537bf733f4e0810960c785c7bf87fd498699d193535cf108cf147b56c391d6cbc0f25dd7bc0c7a31af0b7ceef93425cc6e06f809e4ebde80883
-
Filesize
2B
MD54e732ced3463d06de0ca9a15b6153677
SHA1887309d048beef83ad3eabf2a79a64a389ab1c9f
SHA2565f9c4ab08cac7457e9111a30e4664920607ea2c115a1433d7be98e97e64244ca
SHA512e053886e1b797bc5a80f932302f0201265a599d82e2502d41941d6e652614ef88fa058e009094d26655f880200df12c2100f690254fd1e5bae75d7441763cd33
-
Filesize
20KB
MD52048eb6124a452540ee51dae4145aadf
SHA1d05005b2cd7fe4cd652b0d7fd1bdac2c19d51451
SHA256105c54b6fe3f25350e92187467761598e4c21d62b1091b77d091f65f3bd98864
SHA512bb6cb3853dd2a5d0701e20607d4e153ae201268dd2e5e2d06cc2df208b3b4dc50132a4ab428251b1644d2399fcc717662438d082ff14203387bab8794109d44d
-
Filesize
20KB
MD5fde2ee00cbd121cfab5290b078aa3ceb
SHA1e2b77d5320e155e413d040a8c20020962065b2f8
SHA2562897b0812077c654a9b3fbb0b6303d5cde681eeba7ad9981de65716c7810d685
SHA512a9326aff8e454a2b4ac09984ef2a65fddd4dc146b4c44d839035549bff8c9fdaae490326d0b018f76c1ca2e4fb25426d74f550ca0950982fba632a023af99a56
-
Filesize
331KB
MD5facde44589360d24f0258a56815a4ed0
SHA1b1a9654eafebf0ff5ccf703dc49e7cd389f3761a
SHA256a1f09989972d06274cf87f96cabefee35b1db8c553551296876c25abaf3c2650
SHA5124755ed9117ff27e6f954965e8fbe1b2c62df1068501045d6aca0b4540e79b2c6c3e779902b0cb403142c2f05ff9151cd98d5fe1aba81332343c2b4e4a8e1a494
-
Filesize
351KB
MD52b16077f9e0f27a0b890f5d4309c4758
SHA15dc5bb744687e666c843a4caeb7057e6b44cae3e
SHA25679bfafbdbe7c07ef5b4b8697472ed55cee4c84dc34921e5bdcea7a5409cdd2a9
SHA5122efe5778704bffcff23ee1cfff23c27054a0d13c8059ef669cb0e04be1e3e515438e1aa8a8ecac243ef5e9453ca2d5758dbf9ca80fbe6117ec7d87b54c7b1c40
-
Filesize
1B
MD5524a50782178998021a88b8cd4c8dcd8
SHA1c4dd3c8cdd8d7c95603dd67f1cd873d5f9148b29
SHA256dabd3aff769f07eb2965401eb029974ebba3407afd02b26ddb564ea5f8efae72
SHA512b18958a158203b52ad30b4ce7e5399ce1d7411b3f8c8c845fd2ef0d6c855f9604a584a326ad70048fb94f506983d33d9a985e98381e6ef3d77f6d47224a8dc09
-
Filesize
319KB
MD5212f095c73a9d33acd1469728d21f26c
SHA131cba4506293f87e5fdb366948c58e55ac845fa2
SHA2565467ad1aa7ec6ad3df839faab39b7d182cb315c14d01965e041bda894057454c
SHA512424c3fcf5e3e732121e1533df4753c8655c82d4ec05e757dfe9413c48dfe4dee7ca7544d7d5b18af83a2c6ed1085a964785d17470ce55236aa873ac6290d4fea
-
Filesize
577KB
MD5194806b178024e840515470c0761b62f
SHA147a1288d9797eb407a1475295b4c110c782b7a29
SHA256d90f008204995ac1be5cc001781888ec3f821049701d3007770d8304cc7e1239
SHA5121379240e4b2fd09312f1204a3b23ff55d6d7b37376aeeb659c5a35d7f83a8fe37a15ffafea7f73859dd3323a15fb95d82ca68060fcb077971f54d2d28baeb1e5
-
Filesize
1B
MD52854272fec044d0bdb16de12cb62d07e
SHA13c7923f135d358fd685065fde8a996d474367da2
SHA256e9b0c031f0493d3fd6b0b668260c79e7efe734bfd4b4115f9d82bc3be609c294
SHA512c82fe19bcb5bcecadd200dee54637e8de1a271447f3e9767cbc2523a14e2df795f28f0a370895393f1df3767ee5c366425c62d28a2d0286ec1d207ab1964f260
-
Filesize
8KB
MD531660bb2b53c0c59a159d0fa00ba8dc5
SHA1f00b324bdac8519fc8656ece6715e1fea000c462
SHA2568be4408f6dd5c5a084571d26eec3ccb61de059e2c3bcb244b96210874c54e277
SHA5124d10644069bded5d6c00a64769f1fc0d779845b6e9892a8eb00ad74124c3d04f88ee44048c7ffac2c525b389417e9ff12341cc5bf0ce3d12889e143e9aed9ea4
-
Filesize
221B
MD560bca8e08b088e6c5ce226afcaa247e7
SHA170260586414079a638a8cc182e80ea3ba6580b27
SHA25681fdf51ba66f0ac905d5995237c1182673731b654178bb67db65a9cbcf0c219a
SHA512c6959d644ad9edb9aa27d1dc3b539d505b637fb78df1f6c408563e994be4b69b3bb1ac4cc8afef3335cf31c17cec224baf4da98d195de18a987d87d488093e27
-
Filesize
211B
MD589092684783d910e6f084e51cf50cf16
SHA15ddda155926f9145425e96aa0d530a4d54714af1
SHA25608cd9a89b4d45e872481f95b73c00e0478d01f3842379044e26526fcf878ad19
SHA5129f362b15c9f81b2376bacc837c7db6acbe7cd310c7413b16fa30c043cd1b206034c256386be2d9ca171518fb7ff93826d067b8725d1139ab176e00b696925fc1
-
Filesize
3KB
MD5824c3a8021c41edd0754c3ff3f55d14e
SHA1fda8cde866c1eabfcd04a33887555fe170d3d6fa
SHA256a722d8850c6f903b43dafca7451e641f6defa9035e5953755dd62818021263b2
SHA5123e48a4ea472d6f4090f11c9b81f4b6c2ea2860677e956529cdf4bc6fdf2492b18be5edac10527e3cc52c21bafb152581517d3c3c978cc0e36c932b3b05051aec
-
Filesize
3KB
MD5728abaebe9ebbda73382eaa1857ebbcc
SHA12f17c1c57e3dd697d769b6bb63f0ea59f2f293ae
SHA256582fe0574c1d1a3561d1ced54fbd4ef0918d6d02ce52d12d5b16a0e54866093a
SHA5126894684f4531c417eae5244958646744b924abf2a9eec6987867aab244f1a1d3d33a2ee4666fd87d5781024f8f9f3bb369181325624c36d152c57ab692fca0b9
-
Filesize
221B
MD57a2405bc77ec75ca150f4925c37c91ed
SHA18206a2b077410e28b60a023044eb0adeed8804a0
SHA25625c55af93c7db4f4fec4913ec0d099787da543e5ef93a30f6a293293322f610f
SHA512429e70d1a8aedc094fae3dbed004a899dee3d5890be889978fcd644a5ed83d722d370d214f01087e6c16691a7b08c0a3048e1cd555c7790e259cc8688c19b5fd
-
Filesize
33B
MD539f4c0c807cb6f50da1b94318681d883
SHA1024d10d8ef7e024184c6a8670ea91841c6f15464
SHA256d8aa21c6aaee353b4dafd0b92ebb0cc557a80754523d70aae295a5f8d7248e7c
SHA51214026ba058c278456a3e92cc08191e1f83dffb96caf921869bc3dd0e54f77b06e37251ae0f3e5bbdde1ec5c9ed0fcd89d8067c14278304d449fa478e3e7ed95f