Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
155s -
max time network
166s -
platform
android_x64 -
resource
android-x64-20240506-en -
resource tags
androidarch:x64arch:x86image:android-x64-20240506-enlocale:en-usos:android-10-x64system -
submitted
12/05/2024, 07:55
Static task
static1
Behavioral task
behavioral1
Sample
390e506ecb5806f36faf664365a91530_JaffaCakes118.apk
Resource
android-x86-arm-20240506-en
Behavioral task
behavioral2
Sample
390e506ecb5806f36faf664365a91530_JaffaCakes118.apk
Resource
android-x64-20240506-en
General
-
Target
390e506ecb5806f36faf664365a91530_JaffaCakes118.apk
-
Size
8.1MB
-
MD5
390e506ecb5806f36faf664365a91530
-
SHA1
2cabec52f951a411564fa436f7e04ca3a6d7ff19
-
SHA256
1ee5cce12cda78ac95dda9d9cb54c6cabc065868d9d34988e4bd7e9469977ab3
-
SHA512
5c383011b976fc07425bdb1e3987c15a43b6a9962bbd58b3109932c0729d20d24f2385fcbe7c9f5d14aab58b7da52ba5348810baa61e082a87ae4f5653aebf93
-
SSDEEP
196608:Sn94/5cryrakiPRZ7LkuwUz/MWCdWZ5E3rgHGk8:SnucGakiJJhCn3O0
Malware Config
Signatures
-
Requests cell location 2 TTPs 4 IoCs
Uses Android APIs to to get current cell location.
description ioc Process Framework service call com.android.internal.telephony.ITelephony.getCellLocation com.sogou.androidtool:remote_proxy Framework service call com.android.internal.telephony.ITelephony.getCellLocation com.sogou.androidtool:push_service Framework service call com.android.internal.telephony.ITelephony.getCellLocation com.sogou.androidtool:channel Framework service call com.android.internal.telephony.ITelephony.getCellLocation com.sogou.androidtool -
Checks memory information 2 TTPs 3 IoCs
Checks memory information which indicate if the system is an emulator.
description ioc Process File opened for read /proc/meminfo com.sogou.androidtool:remote_proxy File opened for read /proc/meminfo com.sogou.androidtool:push_service File opened for read /proc/meminfo com.sogou.androidtool:channel -
Queries information about running processes on the device 1 TTPs 4 IoCs
Application may abuse the framework's APIs to collect information about running processes on the device.
description ioc Process Framework service call android.app.IActivityManager.getRunningAppProcesses com.sogou.androidtool:push_service Framework service call android.app.IActivityManager.getRunningAppProcesses com.sogou.androidtool:channel Framework service call android.app.IActivityManager.getRunningAppProcesses com.sogou.androidtool Framework service call android.app.IActivityManager.getRunningAppProcesses com.sogou.androidtool:remote_proxy -
Queries information about the current Wi-Fi connection 1 TTPs 4 IoCs
Application may abuse the framework's APIs to collect information about the current Wi-Fi connection.
description ioc Process Framework service call android.net.wifi.IWifiManager.getConnectionInfo com.sogou.androidtool:channel Framework service call android.net.wifi.IWifiManager.getConnectionInfo com.sogou.androidtool Framework service call android.net.wifi.IWifiManager.getConnectionInfo com.sogou.androidtool:remote_proxy Framework service call android.net.wifi.IWifiManager.getConnectionInfo com.sogou.androidtool:push_service -
Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 3 IoCs
description ioc Process Framework service call android.app.IActivityManager.registerReceiver com.sogou.androidtool:remote_proxy Framework service call android.app.IActivityManager.registerReceiver com.sogou.androidtool:push_service Framework service call android.app.IActivityManager.registerReceiver com.sogou.androidtool:channel -
Checks if the internet connection is available 1 TTPs 4 IoCs
description ioc Process Framework service call android.net.IConnectivityManager.getActiveNetworkInfo com.sogou.androidtool Framework service call android.net.IConnectivityManager.getActiveNetworkInfo com.sogou.androidtool:remote_proxy Framework service call android.net.IConnectivityManager.getActiveNetworkInfo com.sogou.androidtool:push_service Framework service call android.net.IConnectivityManager.getActiveNetworkInfo com.sogou.androidtool:channel -
Queries the unique device ID (IMEI, MEID, IMSI) 1 TTPs
-
Reads information about phone network operator. 1 TTPs
-
Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 3 IoCs
description ioc Process Framework API call javax.crypto.Cipher.doFinal com.sogou.androidtool:remote_proxy Framework API call javax.crypto.Cipher.doFinal com.sogou.androidtool:channel Framework API call javax.crypto.Cipher.doFinal com.sogou.androidtool:push_service
Processes
-
com.sogou.androidtool1⤵
- Requests cell location
- Queries information about running processes on the device
- Queries information about the current Wi-Fi connection
- Checks if the internet connection is available
PID:5120
-
com.sogou.androidtool:remote_proxy1⤵
- Requests cell location
- Checks memory information
- Queries information about running processes on the device
- Queries information about the current Wi-Fi connection
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Checks if the internet connection is available
- Uses Crypto APIs (Might try to encrypt user data)
PID:5488
-
com.sogou.androidtool:push_service1⤵
- Requests cell location
- Checks memory information
- Queries information about running processes on the device
- Queries information about the current Wi-Fi connection
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Checks if the internet connection is available
- Uses Crypto APIs (Might try to encrypt user data)
PID:5679
-
com.sogou.androidtool:channel1⤵
- Requests cell location
- Checks memory information
- Queries information about running processes on the device
- Queries information about the current Wi-Fi connection
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Checks if the internet connection is available
- Uses Crypto APIs (Might try to encrypt user data)
PID:5949
Network
MITRE ATT&CK Mobile v15
Defense Evasion
Execution Guardrails
1Geofencing
1Virtualization/Sandbox Evasion
1System Checks
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
36KB
MD5ad81b10e743840cb52c91c40bfa26f8a
SHA10e23a74ff25e291bc1e61e2eee351cb646ab2e2c
SHA256615a30d7f1ea85cd156f4f7b22f129c6221ca17bd0ebf157ed395c8199a4cee0
SHA5122fec3e764b4998c9b4760744ae168d095c2d3dccbf81c87ba0699fda5f06fe14ddbaa10182d945d37eca34c2bfceb652e126996f5bba686f86ab1f4eee52297f
-
Filesize
12KB
MD52c46945451d5efed98bdd294091a9669
SHA14ff3e262575202ca22634cc6768cc9a7d71769d1
SHA256437cbee18a4ebba3a5845e60cb99389e2ea3d23b104804ca2846da5e890b4755
SHA5120c176948b9cc78243cb897868918c0f89e0e803183ee6b1373881162ed9f9e76ded0e3150b301955c85d699b2fe2fb8743e959aa77ca657c6504279c9e4cf9a3
-
Filesize
12KB
MD5e9296b2adb63c4de8a66180de3984ad8
SHA14b296644e99b994b00624f09856eb476a695a3db
SHA25626b3ecb3612e148f7875d16c86c3ce576c23f3a7ef5bebd638290c7aca2f72cd
SHA512c39b3e33f6d21fd089e4147c782cf78603b13dc6addeff67657a3cea68c426aed5a5948e08cdf562b6cec8888ac3002e696dc6089e73b9c15115ec2ff31e7a1b
-
Filesize
12KB
MD5d2fb2ff0e2ebe6e1e65eba9df2f42d41
SHA146ec66a579e57e018debe5f5a004d0785118683f
SHA2566048e9c31081beba3782e94d50b9d4cc0d3b5d8121cd92939b691e242c70c311
SHA5124e63ccd15b2ff1b5312edddbd4bb88df8586ad2252e19e77d6f64685f99f1798150630e0ff33723ce592ecbdbd6d179073c8ac37c77cc22e0b91b6786b4c783a
-
Filesize
56KB
MD5c897c0e49e85de6f65ab6d92c4afbd31
SHA199b5be6f1b8b73d17334c8f94620c90147240fdc
SHA2568a95d44fc8c95fe64d5b3aa0b1a9674a109e9f766338af27713f8fc6888da8cf
SHA5128c94e3132be00d12b5cfdcf9b445c0f5d15c176767ae5167bb59b020568347ec274f94a6b25b5024b6a505fa288f371b28d6c66f07ff4cf1375c4d54e3564d9e
-
Filesize
512B
MD554e8026addaca7572378127dc62e3d7d
SHA1f9f9777d0efb3e8e6008b3bc1d50fc074fe2aa75
SHA2567d6858f6c0203e7d579ae08ce6a3095751621790d3a8862fea57952803027705
SHA51261d786ba1b4080bf2b42d64b64e2fff2bdebeca6fde14bfb5c8e06b3a6ba1850c92300d343dbaa47ea19e34ee4b014f82f8964660319b50ab57b48002df30aba
-
Filesize
8KB
MD59f24e2d11825788b2b14117de0dae08e
SHA1cfb019e0a02ff9373e403416905d01186ce73194
SHA256bf408cccb49a786273b834aa85c26a05e4de6f7542d92613e667d33e644403d4
SHA5122d5e7b8e940c5c2c5a8426e7808353ad71530425beeffd1d3405186ecdb5d30973de3dc5dfd9dcbc144255b3ba378b78aef32923e0a0ff6978a1e4224477a8ef
-
Filesize
8KB
MD57ef93fa5eab5fce16e50e26a53905583
SHA124aa0df9ea51d122542ee95bcd30d9c50969c725
SHA256181815bd14f43d831a26f5da644c376147994a88b6d14fa38a68f803377fc20c
SHA5127912bfc0cde282f6d8254c3e4145ab7b22a80babab03603f262599f67b6eca6f3e005109d3b407074dd145d952b1ef6a9eaac07dac70d41dfff2a54375724c8b
-
Filesize
60KB
MD50c7ad6146dcaa277907dcf4301129322
SHA1057c5c571f26133878a3e59090a784766b1d5f6a
SHA25640817cad3f2f7f5a5e22194cc5f4f504ddba389ac20cf3ea5239b0f838189578
SHA512620cc3e0893f45482abed39c0b88f9f80a21f213c860bd2660a5c8b79958fb393be28bc8a4d472c75602f24a5655a3fcb4cb5e69860003e46daaa742abe0431a
-
Filesize
8KB
MD578f4ae8ed09ff7c3ce86bfdf291029fe
SHA1c58c2765a32fa7dbd9536d253fecfba9326b52a7
SHA256b2b461d451e9e453e34e25d4229bb9f2f48695bdebcb3a2408dca2e4fe462a39
SHA512fb6269c238644d95a0f73bfea229aa763df4d4ef906033ede1cd32cf7d0c3d09a7e86d3f8d97e0ffbdd4076348f231554a52986bafe500fd0878c44783e4545d
-
Filesize
8KB
MD54caa9f2171f88a6817f5f1813b36b6ab
SHA186bd5a8169b27df7ae8d5f7359b1502bc38a99e7
SHA256cd6736879dc81f685e84613875283e3cd45bb28b3a7eeb233d8a54c62e36efa2
SHA5127be58ff808e35b5622f5a48bc2aaf702aa9c154b817c2677e094636f7487ef01117594994fbf8ea550e805b9e2b0dee83c2c6a5b55651b95145f1e3693ea3972
-
Filesize
8KB
MD595eb0e4c9adc8e4deb9d4b154ef7dcba
SHA1796abbc99b4b5baeb87a9ff572db53b36383db96
SHA2569a01c513d78748ced94128379c6787ee46ee4530e35d59754b515699b7c0145f
SHA512020ffaa875e52570ffdd5b4c6b3829791abf03f9d7ba860f460076acbb64992b2266b339023ef2067cce5cc2f71fc1bbeab3c385f18886e9af53f5bba31ccb92
-
Filesize
12KB
MD5ca05fa3d053d32e1301b7aa9d8016374
SHA12a39b1563735138ba03d2f7e4746d55b91cda2bc
SHA256536ed3357ab4900e2a0cb504d66dd6272b678c6ad0347260ba17f898f55d3856
SHA51266a9262fc54bc173bba5bc94b66283810e897249052c8cf949ae2e7d5f3beef61690db4d332614eca25d4eee125926dac1cee5ac2679594e40681350ba113092
-
Filesize
12KB
MD569e83c924fe972acbb28530ec148bd41
SHA1dbe710ce3849d750d4d1a3553e274da05f32c424
SHA256cd64702f21e3b34ebbafeeb58994544e3559f8fbf31aec3ea32aa88a68d79d38
SHA512180bce78362d39e76883b88ae00dff96eec32397506c761bb4742e68510b2485120a28feba22733ec2f32fa2e89eb131b929d8210da53ac593347762c8834d6f
-
Filesize
28KB
MD55cfff9befee92ccf0919e84cbe1c12ca
SHA155da59486a8cc18a39bc16191fd15fbf5890caad
SHA25657ed08852af3ed5c447db24495607623e74077702fb5f33d5c2ecdc1fdd8f2c8
SHA512e5a4f8dd2504fff2a90f7271d1593a1cca7234fe0d06a3a684e5656cd337dde831d742f6dfb2409788019e613e864b31762b8bdb4795d5236ce8b9d6c607bc20
-
Filesize
512B
MD5371d33820c1938eec6aad82839582ba0
SHA15db456eb08b74348452b9cab953d51c96527e4bc
SHA256fe0ad409fc812267f04d41d4952d851d45a04669cda9fdfec8a98c5bf2d29264
SHA512688d4a48339dd161a9431e0bff9ff3a137be8ea24f9448ad7c7e38885b52fa2d8cfbbfdf8e1eb2a9cf0b82e3b9c3bc6a86256b0fcf8673ac0bdddc6d3f1128f3
-
Filesize
8KB
MD5c0c730bd48bf4f9751a5f567a416b157
SHA1ec921e6232cfc728dbc60639a61cd29861e95a96
SHA256b0f8b2f463d385a424a43d302993762cd15e42757c785574e3c5c08d13303460
SHA512ca48297ad17b1d176a646dd47b025c3f118b665284de3115bda7deb949a2c7a3443dc5326dce8a1f2db3caf961bab7326bbbd1608398ed6e4223d66eb57fa08d
-
Filesize
36KB
MD550f3d63f4b9241e212be8ec20bf3e374
SHA110353f506f0aa9dfab398275482eb42da167232a
SHA256be9049dfc1751c212273b6e4d07202e47cc7de289dd84d388a27675609056653
SHA512dfc6dc641041edc77b5b77bda43ebbfd0eb6c0f4d55d05a7a914f77c58f2f465e8d29aa7e2c9773ec93a257154a6c779a6b165b8765a214aa154976887d8ff7c