Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    150s
  • max time network
    156s
  • platform
    android_x86
  • resource
    android-x86-arm-20240506-en
  • resource tags

    androidarch:armarch:x86image:android-x86-arm-20240506-enlocale:en-usos:android-9-x86system
  • submitted
    12/05/2024, 07:53

General

  • Target

    390c038c2d2fc5b59f0be63fb54be3de_JaffaCakes118.apk

  • Size

    6.4MB

  • MD5

    390c038c2d2fc5b59f0be63fb54be3de

  • SHA1

    831500e654e74b6323be3a4747f0af7f4c82c412

  • SHA256

    afd8e031340cad1ef228ae96146a909f36c134bdfd700c8462ea26122e7aed3e

  • SHA512

    c5408cc57e7455d4d7b5fa31bd0e33dd988538b1d5b00544c04e16c5beaca1e2de16439037c9bc5020298614c0432b52e13d9fb9a390bef82d62f7b139634651

  • SSDEEP

    196608:2pdE5YQH/VEHVyyig/96yo4P97sHSqc6XO:cdvQH9yVyyj96yhT

Malware Config

Signatures

  • Checks CPU information 2 TTPs 1 IoCs

    Checks CPU information which indicate if the system is an emulator.

  • Loads dropped Dex/Jar 1 TTPs 3 IoCs

    Runs executable file dropped to the device during analysis.

  • Queries information about the current Wi-Fi connection 1 TTPs 1 IoCs

    Application may abuse the framework's APIs to collect information about the current Wi-Fi connection.

  • Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs
  • Checks if the internet connection is available 1 TTPs 1 IoCs
  • Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs

Processes

  • ldow.hum.ck.qylc
    1⤵
    • Checks CPU information
    • Loads dropped Dex/Jar
    • Queries information about the current Wi-Fi connection
    • Registers a broadcast receiver at runtime (usually for listening for system events)
    • Checks if the internet connection is available
    • Uses Crypto APIs (Might try to encrypt user data)
    PID:4235
    • /system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/ldow.hum.ck.qylc/app_pgzcr/classes.jar --output-vdex-fd=44 --oat-fd=45 --oat-location=/data/user/0/ldow.hum.ck.qylc/app_pgzcr/oat/x86/classes.odex --compiler-filter=quicken --class-loader-context=&
      2⤵
      • Loads dropped Dex/Jar
      PID:4295

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • /data/data/ldow.hum.ck.qylc/app_pgzcr/classes.jar

    Filesize

    71KB

    MD5

    77cc5a5aa67291b28a3245a5b004c17e

    SHA1

    6b23901bcb8d5fb1c4efb961f9ca3f4f6c300cc4

    SHA256

    a3ce9ea2c646b692e9ecd4e923bd5e22cdd6fe2fb82fec2e48b321eee180f4ea

    SHA512

    02947b6d0fe3343d658b63126d710b57d3970042e7b38ced7970b83662349c8b8e042358957e8c9115426119f94018cd55f54d3b1b96e3825a798a214a041d94

  • /data/data/ldow.hum.ck.qylc/databases/dbubgmj

    Filesize

    4KB

    MD5

    f2b4b0190b9f384ca885f0c8c9b14700

    SHA1

    934ff2646757b5b6e7f20f6a0aa76c7f995d9361

    SHA256

    0a8ffb6b327963558716e87db8946016d143e39f895fa1b43e95ba7032ce2514

    SHA512

    ec12685fc0d60526eed4d38820aad95611f3e93ae372be5a57142d8e8a1ba17e6e5dfe381a4e1365dddc0b363c9c40daaffdc1245bd515fddac69bf1abacd7f1

  • /data/data/ldow.hum.ck.qylc/databases/dbubgmj-journal

    Filesize

    512B

    MD5

    7adefc3332ed8d858d9db387ad6c7032

    SHA1

    d373c85ce05860bf2df75b46f447c5154c01498e

    SHA256

    afaaa57b02460c64f3d4d73a420e92dad593a664414e2e8470ded65bc9cc9e44

    SHA512

    866c6b108f2cec5c0162cc53bf9de43f862dc6b933d2ab496359d2931cdf8994edadb8d19f94c4f4bf527dd822f29a0cd4bccdc2e7706ce2c5a435a65197cc2f

  • /data/data/ldow.hum.ck.qylc/databases/dbubgmj-shm

    Filesize

    32KB

    MD5

    bb7df04e1b0a2570657527a7e108ae23

    SHA1

    5188431849b4613152fd7bdba6a3ff0a4fd6424b

    SHA256

    c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479

    SHA512

    768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012

  • /data/data/ldow.hum.ck.qylc/databases/dbubgmj-wal

    Filesize

    221KB

    MD5

    bf4de87b8831d29777facd2b73688978

    SHA1

    729f11b48079306623d0f99068cf1d3e62a0f034

    SHA256

    8a6c42e937b7c9a32a88ba492a51a75980a81db9f790cc7672de037e25ee1c55

    SHA512

    3cd0327c1f6c3b531482a01fad97006fe461fe20a4e3f4ea67bf292957abf44b7a464523c77cd4a3ac96af2c5736f854337fcc76ff1e5a172e2a6a41b8a6f13d

  • /data/data/ldow.hum.ck.qylc/files/.um/um_cache_1715500462101.env

    Filesize

    600B

    MD5

    8e3098b811993d62187cc152255eb3c0

    SHA1

    afde61fa1a0018fd3508648da7df6df80b96cf3f

    SHA256

    c3c76950bbc2fb7aec1122081c835ef97b94185d07bd7d7d1eab35d68d8ecdc1

    SHA512

    c4c65578c4cb3e9d69e31e042a747be428cc439b7a9a753253a8fa013a2b04d28155d9ad4704e2bb99843cd5abd7174b0bb007fb9b2f8e76e5e2b8def66088ba

  • /data/data/ldow.hum.ck.qylc/files/umeng_it.cache

    Filesize

    310B

    MD5

    60594e6e0f2e019234662327e5d136b0

    SHA1

    ffb8df801f167d1fd3bc7c3d0d1a8d7c848c9015

    SHA256

    0847fb1598b675a6743f4273e5f13715527a3cca00864d1e2cfd149e71ce3d62

    SHA512

    87eecbd0f9aad2440e6dc92aaf8be593ebfc48b60ffa20a15a5b6e3f835e129c9d868b5e7afd1168ba9ce7fe4d9d29d8b6425f9c7b51efceac18ab8bc63a5459

  • /data/user/0/ldow.hum.ck.qylc/app_pgzcr/classes.jar

    Filesize

    167KB

    MD5

    ff2625c682a27b7c33c4edcee1edf2c5

    SHA1

    8213dbe9c0989cc081e7b8cbccd37c83bd351268

    SHA256

    82946ad2f7ea57d2f45f57ec5ff1a3234aad29163d7505fdcf64612981564d39

    SHA512

    e4f4fc0f1212f41630ee2a4089b29ff9c1ae45fe708dd56eaa8d5a59937f6d4eb2f736c6a893020d6348b49c6d5f24ab129eb3981507ef2da215eb20ec467566

  • /data/user/0/ldow.hum.ck.qylc/app_pgzcr/classes.jar

    Filesize

    167KB

    MD5

    91eba06c541f35c2dbe6b5610858dd53

    SHA1

    f92f5e3414bb09e1243f16d178f6b428351d7bbb

    SHA256

    4f5dd2ca019931d075b75f7717529d071ac9cdac7a8d179c9679863ab4e2f5d6

    SHA512

    4291c29666e40eb708f98d64323faeeb3c04f323b205c1687e11a79704ec71cba572504df121191d9ab43c0e5ff1d51a5ea91e831f7c359e83deb78ca644edcf