Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
48s -
max time network
141s -
platform
android_x64 -
resource
android-x64-20240506-en -
resource tags
-
submitted
08/05/2024, 12:12 UTC
General
-
Target
24c856bdc19e79cc96548e8fa99413f1_JaffaCakes118.apk
-
Size
14.7MB
-
MD5
24c856bdc19e79cc96548e8fa99413f1
-
SHA1
e7d3e2c919d29ce40c77a30e0813c8093bb1dcd2
-
SHA256
2fd5eddd65b8c35272cde79643ce07f2ca4449766943e8a4b478d620708c9662
-
SHA512
3cc4c50b33e8a9d7fb0dcf7fca89a69d3fda59fc7ebda888f9797eca69c488a0315bb18e6d0c8a2f349bf771438f5cd6efdd730b23b24ff468db83cbf1154336
-
SSDEEP
393216:rQtBWduQtBWd4QtBWdxQtBWdxQtBWdvQtBWdC:0+P+t+o+c+y+4
Score
7/10
Malware Config
Signatures
-
Checks CPU information 2 TTPs 1 IoCs
Checks CPU information which indicate if the system is an emulator.
-
Checks memory information 2 TTPs 1 IoCs
Checks memory information which indicate if the system is an emulator.
-
Obtains sensitive information copied to the device clipboard 2 TTPs 1 IoCs
Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.
-
Queries the mobile country code (MCC) 1 TTPs 1 IoCs
-
Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs
Processes
-
com.zu.zu1⤵
- Checks CPU information
- Checks memory information
- Obtains sensitive information copied to the device clipboard
- Queries the mobile country code (MCC)
- Registers a broadcast receiver at runtime (usually for listening for system events)
Network
-
DNSssl.google-analytics.comRemote address:1.1.1.1:53Requestssl.google-analytics.comIN AResponsessl.google-analytics.comIN A142.250.178.8 -
DNSssl.google-analytics.comRemote address:1.1.1.1:53Requestssl.google-analytics.comIN A
-
DNSwww.apk.androidapkmods.comRemote address:1.1.1.1:53Requestwww.apk.androidapkmods.comIN AResponsewww.apk.androidapkmods.comIN A216.107.136.213
-
DNSwww.apk.androidapkmods.comRemote address:1.1.1.1:53Requestwww.apk.androidapkmods.comIN A
-
GEThttp://www.apk.androidapkmods.com/Remote address:216.107.136.213:80RequestGET / HTTP/1.1
Host: www.apk.androidapkmods.com
Connection: keep-alive
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Linux; Android 10; Android SDK built for x86_64 Build/QSR1.210802.001; wv) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/74.0.3729.185 Mobile Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3
Accept-Encoding: gzip, deflate
Accept-Language: en-US,en;q=0.9
X-Requested-With: com.zu.zu
ResponseHTTP/1.1 301 Moved Permanently
Date: Wed, 08 May 2024 12:13:09 GMT
Server: Apache
Location: https://www.apk.androidapkmods.com/
Content-Length: 243
Keep-Alive: timeout=5
Connection: Keep-Alive
Content-Type: text/html; charset=iso-8859-1
-
DNSsafebrowsing.googleapis.comRemote address:1.1.1.1:53Requestsafebrowsing.googleapis.comIN AResponsesafebrowsing.googleapis.comIN A142.250.180.10
-
DNSbigappboi.comRemote address:1.1.1.1:53Requestbigappboi.comIN AResponsebigappboi.comIN A23.22.126.183
-
DNSandroid.apis.google.comRemote address:1.1.1.1:53Requestandroid.apis.google.comIN AResponseandroid.apis.google.comIN CNAMEclients.l.google.comclients.l.google.comIN A142.250.200.14
-
DNSajax.googleapis.comRemote address:1.1.1.1:53Requestajax.googleapis.comIN AResponseajax.googleapis.comIN A142.250.179.234
-
DNScdn.bigappboi.comRemote address:1.1.1.1:53Requestcdn.bigappboi.comIN AResponsecdn.bigappboi.comIN A18.245.60.4cdn.bigappboi.comIN A18.245.60.53cdn.bigappboi.comIN A18.245.60.64cdn.bigappboi.comIN A18.245.60.29
-
DNSmedia.go2speed.orgRemote address:1.1.1.1:53Requestmedia.go2speed.orgIN AResponsemedia.go2speed.orgIN A108.156.39.9media.go2speed.orgIN A108.156.39.107media.go2speed.orgIN A108.156.39.58media.go2speed.orgIN A108.156.39.60
-
DNSsdk.lockertools.aiRemote address:1.1.1.1:53Requestsdk.lockertools.aiIN AResponsesdk.lockertools.aiIN CNAMEd3ab7pnr96ugz4.cloudfront.netd3ab7pnr96ugz4.cloudfront.netIN A3.162.140.5d3ab7pnr96ugz4.cloudfront.netIN A3.162.140.117d3ab7pnr96ugz4.cloudfront.netIN A3.162.140.14d3ab7pnr96ugz4.cloudfront.netIN A3.162.140.50
-
DNSws-us2.pusher.comRemote address:1.1.1.1:53Requestws-us2.pusher.comIN AResponsews-us2.pusher.comIN CNAMEsocket-us2-ingress-1392515755.us-east-2.elb.amazonaws.comsocket-us2-ingress-1392515755.us-east-2.elb.amazonaws.comIN A3.19.189.41socket-us2-ingress-1392515755.us-east-2.elb.amazonaws.comIN A3.131.177.182socket-us2-ingress-1392515755.us-east-2.elb.amazonaws.comIN A3.141.48.24socket-us2-ingress-1392515755.us-east-2.elb.amazonaws.comIN A3.16.225.202socket-us2-ingress-1392515755.us-east-2.elb.amazonaws.comIN A3.135.73.232socket-us2-ingress-1392515755.us-east-2.elb.amazonaws.comIN A18.224.193.14socket-us2-ingress-1392515755.us-east-2.elb.amazonaws.comIN A18.188.251.2socket-us2-ingress-1392515755.us-east-2.elb.amazonaws.comIN A13.59.136.229
-
DNSbootstraplugin.comRemote address:1.1.1.1:53Requestbootstraplugin.comIN AResponsebootstraplugin.comIN A104.21.10.24bootstraplugin.comIN A172.67.162.35
-
DNSstats.pusher.comRemote address:1.1.1.1:53Requeststats.pusher.comIN AResponsestats.pusher.comIN CNAMEclientstats1-dummy-server-lb-398743415.us-east-1.elb.amazonaws.comclientstats1-dummy-server-lb-398743415.us-east-1.elb.amazonaws.comIN A52.21.9.172clientstats1-dummy-server-lb-398743415.us-east-1.elb.amazonaws.comIN A34.192.70.190clientstats1-dummy-server-lb-398743415.us-east-1.elb.amazonaws.comIN A34.238.67.27clientstats1-dummy-server-lb-398743415.us-east-1.elb.amazonaws.comIN A3.213.105.30
-
142.250.178.8:443ssl.google-analytics.comtls -
216.107.136.213:80http://www.apk.androidapkmods.com/http
HTTP Request
GET http://www.apk.androidapkmods.com/HTTP Response
301 -
216.107.136.213:443www.apk.androidapkmods.comtls
-
23.22.126.183:443bigappboi.comtls
-
142.250.200.14:443android.apis.google.comtls
-
216.58.204.78:443tls, https
-
108.156.39.9:443media.go2speed.orgtls
-
18.245.60.4:443cdn.bigappboi.comtls -
18.245.60.4:443cdn.bigappboi.comtls
-
18.245.60.4:443cdn.bigappboi.comtls
-
3.162.140.5:443sdk.lockertools.aitls
-
3.19.189.41:443ws-us2.pusher.comtls
-
104.21.10.24:443bootstraplugin.comtls
-
52.21.9.172:443stats.pusher.comtls
-
216.58.201.110:443
-
216.58.212.194:443
-
142.250.178.4:443tls, https
-
142.250.178.4:443www.google.comtls
-
224.0.0.251:5353 -
1.1.1.1:53ssl.google-analytics.comdns
DNS Request
ssl.google-analytics.com
DNS Request
ssl.google-analytics.com
DNS Response
142.250.178.8
-
1.1.1.1:53www.apk.androidapkmods.comdns
DNS Request
www.apk.androidapkmods.com
DNS Request
www.apk.androidapkmods.com
DNS Response
216.107.136.213
-
1.1.1.1:53safebrowsing.googleapis.comdns
DNS Request
safebrowsing.googleapis.com
DNS Response
142.250.180.10
-
1.1.1.1:53bigappboi.comdns
DNS Request
bigappboi.com
DNS Response
23.22.126.183
-
1.1.1.1:53android.apis.google.comdns
DNS Request
android.apis.google.com
DNS Response
142.250.200.14
-
1.1.1.1:53ajax.googleapis.comdns
DNS Request
ajax.googleapis.com
DNS Response
142.250.179.234
-
1.1.1.1:53cdn.bigappboi.comdns
DNS Request
cdn.bigappboi.com
DNS Response
18.245.60.418.245.60.5318.245.60.6418.245.60.29
-
1.1.1.1:53media.go2speed.orgdns
DNS Request
media.go2speed.org
DNS Response
108.156.39.9108.156.39.107108.156.39.58108.156.39.60
-
1.1.1.1:53sdk.lockertools.aidns
DNS Request
sdk.lockertools.ai
DNS Response
3.162.140.53.162.140.1173.162.140.143.162.140.50
-
1.1.1.1:53ws-us2.pusher.comdns
DNS Request
ws-us2.pusher.com
DNS Response
3.19.189.413.131.177.1823.141.48.243.16.225.2023.135.73.23218.224.193.1418.188.251.213.59.136.229
-
1.1.1.1:53bootstraplugin.comdns
DNS Request
bootstraplugin.com
DNS Response
104.21.10.24172.67.162.35
-
1.1.1.1:53stats.pusher.comdns
DNS Request
stats.pusher.com
DNS Response
52.21.9.17234.192.70.19034.238.67.273.213.105.30