Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
137s -
max time network
131s -
platform
android_x64 -
resource
android-x64-arm64-20240506-en -
resource tags
androidarch:armarch:arm64arch:x64arch:x86image:android-x64-arm64-20240506-enlocale:en-usos:android-11-x64system -
submitted
12/05/2024, 02:52
Static task
static1
Behavioral task
behavioral1
Sample
37df8015fb7b4dc168855558642039aa_JaffaCakes118.apk
Resource
android-x86-arm-20240506-en
Behavioral task
behavioral2
Sample
37df8015fb7b4dc168855558642039aa_JaffaCakes118.apk
Resource
android-x64-20240506-en
Behavioral task
behavioral3
Sample
37df8015fb7b4dc168855558642039aa_JaffaCakes118.apk
Resource
android-x64-arm64-20240506-en
General
-
Target
37df8015fb7b4dc168855558642039aa_JaffaCakes118.apk
-
Size
2.2MB
-
MD5
37df8015fb7b4dc168855558642039aa
-
SHA1
e9822f09f63c1f798fd6c5e2932d7a7ce211cb8f
-
SHA256
c3227860688cf6aa5b5b97c50ab7d0a124ff84e07b9fdfaa62adde7f8ec58efc
-
SHA512
984fd475fec3cf43215d5442e3c867868a2d071a479e8c730b3ce7f105fcfe017ae79d8f575b9f8cda46bc56d465ba19aa01ea35a303ed87cf3a612390d0ade0
-
SSDEEP
49152:CRYqCoStcFF3pJgUxDZomznCwDyqn/68sJzB06G5pnQH:CRwcX3xamzCYn/DsJzBV
Malware Config
Signatures
-
Checks CPU information 2 TTPs 1 IoCs
Checks CPU information which indicate if the system is an emulator.
description ioc Process File opened for read /proc/cpuinfo com.yxxinglin.xzid694 -
Checks memory information 2 TTPs 1 IoCs
Checks memory information which indicate if the system is an emulator.
description ioc Process File opened for read /proc/meminfo com.yxxinglin.xzid694 -
Obtains sensitive information copied to the device clipboard 2 TTPs 1 IoCs
Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.
description ioc Process Framework service call android.content.IClipboard.addPrimaryClipChangedListener com.yxxinglin.xzid694 -
Queries information about running processes on the device 1 TTPs 1 IoCs
Application may abuse the framework's APIs to collect information about running processes on the device.
description ioc Process Framework service call android.app.IActivityManager.getRunningAppProcesses com.yxxinglin.xzid694 -
Queries information about the current Wi-Fi connection 1 TTPs 1 IoCs
Application may abuse the framework's APIs to collect information about the current Wi-Fi connection.
description ioc Process Framework service call android.net.wifi.IWifiManager.getConnectionInfo com.yxxinglin.xzid694 -
Queries information about the current nearby Wi-Fi networks 1 TTPs 1 IoCs
Application may abuse the framework's APIs to collect information about the current nearby Wi-Fi networks.
description ioc Process Framework service call android.net.wifi.IWifiManager.getScanResults com.yxxinglin.xzid694 -
Checks if the internet connection is available 1 TTPs 1 IoCs
description ioc Process Framework service call android.net.IConnectivityManager.getActiveNetworkInfo com.yxxinglin.xzid694 -
Listens for changes in the sensor environment (might be used to detect emulation) 1 TTPs 1 IoCs
description ioc Process Framework API call android.hardware.SensorManager.registerListener com.yxxinglin.xzid694
Processes
-
com.yxxinglin.xzid6941⤵
- Checks CPU information
- Checks memory information
- Obtains sensitive information copied to the device clipboard
- Queries information about running processes on the device
- Queries information about the current Wi-Fi connection
- Queries information about the current nearby Wi-Fi networks
- Checks if the internet connection is available
- Listens for changes in the sensor environment (might be used to detect emulation)
PID:4844
Network
MITRE ATT&CK Mobile v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
/data/user/0/com.yxxinglin.xzid694/files/stateless/dW1weF9pbnRlcm5hbA== /dW1weF9pbnRlcm5hbF8xNzE1NDgyMzc1NjMy
Filesize1KB
MD54983e5f7734dfdfd8c1af301efe7bc31
SHA1cc41a7465ae66731ec7e100eeeb90bd999adf91a
SHA256a7f3ef3d09fc31d36c527f91517e0315012e1222c4c7f3a37d11b6583634d611
SHA512ee4184d1ee4d483678157cf6e8b46a9f87a321ab094a88279502748746afb1818754238169d2454647411821aaf83e1aefc2799af9ee05530e44b6e661937d54
-
/data/user/0/com.yxxinglin.xzid694/files/stateless/dW1weF9pbnRlcm5hbA== /dW1weF9pbnRlcm5hbF8xNzE1NDgyNDA1ODA1
Filesize1KB
MD5e08dff7ec6b8f04b5651c01645612bd1
SHA1b0822df1b65867dc740c22b551112358f78e39b8
SHA256c405a45f3ea70367f5ac0f3eef7e0844296b60cb5a32fdca4c2f9ffcc284d26f
SHA51258bd3a3f461f4c0320764d20cffc7a800f2f4e1a72e58d4760c38d59567ee38a7fe9774658daff76b5b33a6f6a7c616262d1e0a900ea9b8d18a34402a3f2029e
-
Filesize
350B
MD5a43d4e12588595351ea73b5044f3288a
SHA15300ee437de967fad755b1b3457f7243d065ce4f
SHA256b30bcdcc9f16c0a8cb1047bdcdfebd581f143ee2c79ffe00c12bcd90f237cfda
SHA5127ef85e298bd5de2b93ebad55fb9f80c0504992587da188f32963328a0957b743ed881d0f69c3202918108db5b852c871c5d32ec039da20714a1765fe524a75f3