Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
48s -
max time network
131s -
platform
android_x64 -
resource
android-x64-20240506-en -
resource tags
androidarch:x64arch:x86image:android-x64-20240506-enlocale:en-usos:android-10-x64system -
submitted
08/05/2024, 18:08
Static task
static1
Behavioral task
behavioral1
Sample
261241a10601974b08d581c229394c9a_JaffaCakes118.apk
Resource
android-x86-arm-20240506-en
Behavioral task
behavioral2
Sample
261241a10601974b08d581c229394c9a_JaffaCakes118.apk
Resource
android-x64-20240506-en
Behavioral task
behavioral3
Sample
261241a10601974b08d581c229394c9a_JaffaCakes118.apk
Resource
android-x64-arm64-20240506-en
General
-
Target
261241a10601974b08d581c229394c9a_JaffaCakes118.apk
-
Size
878KB
-
MD5
261241a10601974b08d581c229394c9a
-
SHA1
c57ec49edd88023c4c6557a6645eff650dbcb58c
-
SHA256
2146757c2e6254920e00dd02566092df9438d669d2d467f9fbe8a11c0241d1a8
-
SHA512
434caad9c3f13094e48b70fc3f61f241319e9ee0c4280cab1c464ea1b7e6e5be783a2891f321094a9e87ccd9b2792f6fb73c8d92592d29b47fd3c5d8d67c414a
-
SSDEEP
24576:r0O/l0QCpzTVt6C0sQZr73d+ktH/+NQA84Woiwc9q8rR:rhdzKgsCNztmp8s1KR
Malware Config
Signatures
-
Requests cell location 2 TTPs 1 IoCs
Uses Android APIs to to get current cell location.
description ioc Process Framework service call com.android.internal.telephony.ITelephony.getCellLocation com.hoaix.childplayer.gushi -
Checks memory information 2 TTPs 1 IoCs
Checks memory information which indicate if the system is an emulator.
description ioc Process File opened for read /proc/meminfo com.hoaix.childplayer.gushi -
Obtains sensitive information copied to the device clipboard 2 TTPs 1 IoCs
Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.
description ioc Process Framework service call android.content.IClipboard.addPrimaryClipChangedListener com.hoaix.childplayer.gushi -
Queries information about the current Wi-Fi connection 1 TTPs 1 IoCs
Application may abuse the framework's APIs to collect information about the current Wi-Fi connection.
description ioc Process Framework service call android.net.wifi.IWifiManager.getConnectionInfo com.hoaix.childplayer.gushi -
Queries information about the current nearby Wi-Fi networks 1 TTPs 1 IoCs
Application may abuse the framework's APIs to collect information about the current nearby Wi-Fi networks.
description ioc Process Framework service call android.net.wifi.IWifiManager.getScanResults com.hoaix.childplayer.gushi -
Queries the mobile country code (MCC) 1 TTPs 1 IoCs
description ioc Process Framework service call com.android.internal.telephony.ITelephony.getNetworkCountryIsoForPhone com.hoaix.childplayer.gushi -
Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs
description ioc Process Framework service call android.app.IActivityManager.registerReceiver com.hoaix.childplayer.gushi -
Checks if the internet connection is available 1 TTPs 1 IoCs
description ioc Process Framework service call android.net.IConnectivityManager.getActiveNetworkInfo com.hoaix.childplayer.gushi -
Queries the unique device ID (IMEI, MEID, IMSI) 1 TTPs
Processes
-
com.hoaix.childplayer.gushi1⤵
- Requests cell location
- Checks memory information
- Obtains sensitive information copied to the device clipboard
- Queries information about the current Wi-Fi connection
- Queries information about the current nearby Wi-Fi networks
- Queries the mobile country code (MCC)
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Checks if the internet connection is available
PID:5079
Network
MITRE ATT&CK Mobile v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
20KB
MD5bdd5204ee2e2cb2ac1368e10d8d3d874
SHA1e707bcd031ca0ef260613e55489fe9089be00be9
SHA2568446f809fdd606879aba9b7acfe1bdafed1da2826b2c02f7fd1af1a96f49b5dc
SHA5122cebc1aa8ccd911c596ec3c5359d5fa5f38d46843a8c4883a1983af2705f7a0cd6f0644cbc1f49af404e299b52be188a9353abc27aa1ebeb0cff7ee4ffe66223
-
Filesize
512B
MD5dbc426fc5d4cfa0adb3a55e57e99d936
SHA128dd6cce052f160890c606f63fcf91a18120c5f2
SHA2564d4acbf0b240b7d8f146d627618e9f15f965f9fe93f173f42470b467edcb3931
SHA51240fb5f36b6672b038bfc38830e5cdc7eb78237b146cec8207d3dfc465987221b737f88cb76b4c2cace76c94da4ad8fa70d17842a79bf5de469ca32fc4f8f4be8
-
Filesize
8KB
MD5fca354253467bc13063d9e40d5186465
SHA1ea05ad96533339382c1fadbd9e784e7b5ec221c6
SHA256fd7f77d3befaab80d45e40a51cadbb78a1ede1d931a908505673fbee06ea48cf
SHA512edd0d88aa0ccb34f92fdb15f45c0afaa5f46213a1ae9bd41d84eb614eba1ae98a8647e6b8a678c8bde984f97fe10c1b09c39e257b728018b44274333af53baea
-
Filesize
8KB
MD5868baf00d6dc268544d26531613fb63a
SHA13095b455cc9263bdc72b3e2a0dd59a8449bcc4ab
SHA256e8d7810176a84db349b12b86f8d8336df47ea03d5d233234c94d659406e91293
SHA512ee8dad849ca1516f69b76dbeab7091e00cfb5d45b5c3250e1c3ed0ae2e12e2fae8b0ab42644865f2f986417a0fc1ff21e06b0cbd2ac1f7dca39a056e69795988
-
Filesize
25B
MD52d805b13f2f28dc3ca9bbcc000f49bb5
SHA19eac165b4d81258fd3967cde5cc53b53b1dabcb1
SHA256c8a6624f390568f0ddcb9841336aec6a564460fdaf6624e562b32935b8956f19
SHA5125db8c57bab36bcf9db698c1dce70318cbffc156dd1d1c1e09e5b7ba60aff07b598ebbf26c4bd8a2b03bd6e59ef2dde2d944a22a8d8a19ecc8378e83afb7c83b0