Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
156s -
platform
android_x86 -
resource
android-x86-arm-20240506-en -
resource tags
androidarch:armarch:x86image:android-x86-arm-20240506-enlocale:en-usos:android-9-x86system -
submitted
12/05/2024, 07:53
Static task
static1
Behavioral task
behavioral1
Sample
390c038c2d2fc5b59f0be63fb54be3de_JaffaCakes118.apk
Resource
android-x86-arm-20240506-en
General
-
Target
390c038c2d2fc5b59f0be63fb54be3de_JaffaCakes118.apk
-
Size
6.4MB
-
MD5
390c038c2d2fc5b59f0be63fb54be3de
-
SHA1
831500e654e74b6323be3a4747f0af7f4c82c412
-
SHA256
afd8e031340cad1ef228ae96146a909f36c134bdfd700c8462ea26122e7aed3e
-
SHA512
c5408cc57e7455d4d7b5fa31bd0e33dd988538b1d5b00544c04e16c5beaca1e2de16439037c9bc5020298614c0432b52e13d9fb9a390bef82d62f7b139634651
-
SSDEEP
196608:2pdE5YQH/VEHVyyig/96yo4P97sHSqc6XO:cdvQH9yVyyj96yhT
Malware Config
Signatures
-
Checks CPU information 2 TTPs 1 IoCs
Checks CPU information which indicate if the system is an emulator.
description ioc Process File opened for read /proc/cpuinfo ldow.hum.ck.qylc -
Loads dropped Dex/Jar 1 TTPs 3 IoCs
Runs executable file dropped to the device during analysis.
ioc pid Process /data/user/0/ldow.hum.ck.qylc/app_pgzcr/classes.jar 4295 /system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/ldow.hum.ck.qylc/app_pgzcr/classes.jar --output-vdex-fd=44 --oat-fd=45 --oat-location=/data/user/0/ldow.hum.ck.qylc/app_pgzcr/oat/x86/classes.odex --compiler-filter=quicken --class-loader-context=& /data/user/0/ldow.hum.ck.qylc/app_pgzcr/classes.jar 4235 ldow.hum.ck.qylc /data/user/0/ldow.hum.ck.qylc/app_pgzcr/classes.jar 4235 ldow.hum.ck.qylc -
Queries information about the current Wi-Fi connection 1 TTPs 1 IoCs
Application may abuse the framework's APIs to collect information about the current Wi-Fi connection.
description ioc Process Framework service call android.net.wifi.IWifiManager.getConnectionInfo ldow.hum.ck.qylc -
Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs
description ioc Process Framework service call android.app.IActivityManager.registerReceiver ldow.hum.ck.qylc -
Checks if the internet connection is available 1 TTPs 1 IoCs
description ioc Process Framework service call android.net.IConnectivityManager.getActiveNetworkInfo ldow.hum.ck.qylc -
Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs
description ioc Process Framework API call javax.crypto.Cipher.doFinal ldow.hum.ck.qylc
Processes
-
ldow.hum.ck.qylc1⤵
- Checks CPU information
- Loads dropped Dex/Jar
- Queries information about the current Wi-Fi connection
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Checks if the internet connection is available
- Uses Crypto APIs (Might try to encrypt user data)
PID:4235 -
/system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/ldow.hum.ck.qylc/app_pgzcr/classes.jar --output-vdex-fd=44 --oat-fd=45 --oat-location=/data/user/0/ldow.hum.ck.qylc/app_pgzcr/oat/x86/classes.odex --compiler-filter=quicken --class-loader-context=&2⤵
- Loads dropped Dex/Jar
PID:4295
-
Network
MITRE ATT&CK Mobile v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
71KB
MD577cc5a5aa67291b28a3245a5b004c17e
SHA16b23901bcb8d5fb1c4efb961f9ca3f4f6c300cc4
SHA256a3ce9ea2c646b692e9ecd4e923bd5e22cdd6fe2fb82fec2e48b321eee180f4ea
SHA51202947b6d0fe3343d658b63126d710b57d3970042e7b38ced7970b83662349c8b8e042358957e8c9115426119f94018cd55f54d3b1b96e3825a798a214a041d94
-
Filesize
4KB
MD5f2b4b0190b9f384ca885f0c8c9b14700
SHA1934ff2646757b5b6e7f20f6a0aa76c7f995d9361
SHA2560a8ffb6b327963558716e87db8946016d143e39f895fa1b43e95ba7032ce2514
SHA512ec12685fc0d60526eed4d38820aad95611f3e93ae372be5a57142d8e8a1ba17e6e5dfe381a4e1365dddc0b363c9c40daaffdc1245bd515fddac69bf1abacd7f1
-
Filesize
512B
MD57adefc3332ed8d858d9db387ad6c7032
SHA1d373c85ce05860bf2df75b46f447c5154c01498e
SHA256afaaa57b02460c64f3d4d73a420e92dad593a664414e2e8470ded65bc9cc9e44
SHA512866c6b108f2cec5c0162cc53bf9de43f862dc6b933d2ab496359d2931cdf8994edadb8d19f94c4f4bf527dd822f29a0cd4bccdc2e7706ce2c5a435a65197cc2f
-
Filesize
32KB
MD5bb7df04e1b0a2570657527a7e108ae23
SHA15188431849b4613152fd7bdba6a3ff0a4fd6424b
SHA256c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479
SHA512768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012
-
Filesize
221KB
MD5bf4de87b8831d29777facd2b73688978
SHA1729f11b48079306623d0f99068cf1d3e62a0f034
SHA2568a6c42e937b7c9a32a88ba492a51a75980a81db9f790cc7672de037e25ee1c55
SHA5123cd0327c1f6c3b531482a01fad97006fe461fe20a4e3f4ea67bf292957abf44b7a464523c77cd4a3ac96af2c5736f854337fcc76ff1e5a172e2a6a41b8a6f13d
-
Filesize
600B
MD58e3098b811993d62187cc152255eb3c0
SHA1afde61fa1a0018fd3508648da7df6df80b96cf3f
SHA256c3c76950bbc2fb7aec1122081c835ef97b94185d07bd7d7d1eab35d68d8ecdc1
SHA512c4c65578c4cb3e9d69e31e042a747be428cc439b7a9a753253a8fa013a2b04d28155d9ad4704e2bb99843cd5abd7174b0bb007fb9b2f8e76e5e2b8def66088ba
-
Filesize
310B
MD560594e6e0f2e019234662327e5d136b0
SHA1ffb8df801f167d1fd3bc7c3d0d1a8d7c848c9015
SHA2560847fb1598b675a6743f4273e5f13715527a3cca00864d1e2cfd149e71ce3d62
SHA51287eecbd0f9aad2440e6dc92aaf8be593ebfc48b60ffa20a15a5b6e3f835e129c9d868b5e7afd1168ba9ce7fe4d9d29d8b6425f9c7b51efceac18ab8bc63a5459
-
Filesize
167KB
MD5ff2625c682a27b7c33c4edcee1edf2c5
SHA18213dbe9c0989cc081e7b8cbccd37c83bd351268
SHA25682946ad2f7ea57d2f45f57ec5ff1a3234aad29163d7505fdcf64612981564d39
SHA512e4f4fc0f1212f41630ee2a4089b29ff9c1ae45fe708dd56eaa8d5a59937f6d4eb2f736c6a893020d6348b49c6d5f24ab129eb3981507ef2da215eb20ec467566
-
Filesize
167KB
MD591eba06c541f35c2dbe6b5610858dd53
SHA1f92f5e3414bb09e1243f16d178f6b428351d7bbb
SHA2564f5dd2ca019931d075b75f7717529d071ac9cdac7a8d179c9679863ab4e2f5d6
SHA5124291c29666e40eb708f98d64323faeeb3c04f323b205c1687e11a79704ec71cba572504df121191d9ab43c0e5ff1d51a5ea91e831f7c359e83deb78ca644edcf