Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    9s
  • max time network
    131s
  • platform
    android_x64
  • resource
    android-x64-20240506-en
  • resource tags

    androidarch:x64arch:x86image:android-x64-20240506-enlocale:en-usos:android-10-x64system
  • submitted
    14/05/2024, 08:11

General

  • Target

    40cd318246e08a43c2b7e7b13b912497_JaffaCakes118.apk

  • Size

    9.4MB

  • MD5

    40cd318246e08a43c2b7e7b13b912497

  • SHA1

    654db22135370c24acf222d916b2c6f7201253da

  • SHA256

    b0b3774310059a437d23deed21beada60b5c119587c9c3fcab010218905c15f7

  • SHA512

    8f732dea05c697b66739146f57a4f29752c612559dc8193a981d657398abc7204f4e91e1e7e2412df26729f1e96cfd2269e7ef0d598cfe4d02a8db2cfdb68f8c

  • SSDEEP

    196608:TwEKDHCCo5YXc7Y1e00kTKUOU7e7gvo0UakIsp1j:TwVo5X7B0zfOUy0vQh3

Malware Config

Signatures

  • Loads dropped Dex/Jar 1 TTPs 2 IoCs

    Runs executable file dropped to the device during analysis.

  • Queries information about running processes on the device 1 TTPs 1 IoCs

    Application may abuse the framework's APIs to collect information about running processes on the device.

  • Queries information about the current Wi-Fi connection 1 TTPs 1 IoCs

    Application may abuse the framework's APIs to collect information about the current Wi-Fi connection.

  • Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs
  • Checks if the internet connection is available 1 TTPs 1 IoCs
  • Queries the unique device ID (IMEI, MEID, IMSI) 1 TTPs

Processes

  • com.gosing.earn.syz
    1⤵
    • Loads dropped Dex/Jar
    • Queries information about running processes on the device
    • Queries information about the current Wi-Fi connection
    • Registers a broadcast receiver at runtime (usually for listening for system events)
    • Checks if the internet connection is available
    PID:5049

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • /data/data/com.gosing.earn.syz/.jiagu/classes.dex

    Filesize

    6.5MB

    MD5

    fac88d1d732432e4f3c3d81e64f6cf24

    SHA1

    270241df6fee5d634721d480f991c8938ed73b98

    SHA256

    9b124b5f7ab7f6d26fd95c2c6c5cf51d94488cf67112e4bbc0bf7c44ddbc29c0

    SHA512

    97d0dd52780d65e4d901c206bf9b1ad527e305dc943f256188990b62e19d50d8cd88947fc1d978d72c776ad3da28d01bf1c5c093f7481b53b199c93d911b5a61

  • /data/data/com.gosing.earn.syz/.jiagu/libjiagu.so

    Filesize

    455KB

    MD5

    e5a53000766ebc433b27d6a66ec4f555

    SHA1

    2c8f53f1c03aec2005bcad67d731f07261dabde0

    SHA256

    78e4ea857f10c2df6c7b94f0584524b52ecc099ed29478fe3964037b8a86ed2e

    SHA512

    370a1cb93b14556ad861724f4e9995c9a4c6d37cf2d570f888d1c6000c66d27ac63496b0703361e9fc9bc7f309b7aa4407c5f339d186b0a5b72520d23d04b68d

  • /data/data/com.gosing.earn.syz/files/.jglogs/.jg.di

    Filesize

    340B

    MD5

    307a60b81228bf420c99217badbb4c88

    SHA1

    528cf46b4ea752e30792ac7c63ed38b3b170cdf1

    SHA256

    abc0cb5895a5e8cc8c45f662a7d83a964bb4a81a81809aea8d446b9e2e5e8c3f

    SHA512

    023785cc83fc93d7783a5fd792297a57caae5330646b387a1a8eb77e613152be81ff81a78d56880451084da8fb8f6791f06dd2dd9a3bda65db79bfd037d7db97

  • /data/data/com.gosing.earn.syz/files/.jglogs/.jg.ri

    Filesize

    314B

    MD5

    a8f59dd36dc80d83ebbc3ea4d17dcbfb

    SHA1

    e8840f25443e67d1dbf1344cb9be0bbefc11d405

    SHA256

    7a19d94ce20e3b562afe8754ad1c434c267027f9cfc362e5b2fc78e1012f45b0

    SHA512

    f5d7ce75d82e06504d1fd1315b21d73e41594cbdb07cd916830f853057eb78c464b39519dca37cedf0409377f8790f7d543f435d17e655ebaee896bd13200dd4

  • /data/data/com.gosing.earn.syz/files/.jiagu.lock

    Filesize

    27B

    MD5

    04bf058d92ac359f607cc50e54b2b54a

    SHA1

    92663bd619ce66ca8f065dacf66452779d321c88

    SHA256

    594ffeb22cd9092073b74532a00abf5cd0aafa2ad152aea2ad334f056780d4f5

    SHA512

    e3487b54b43e5cf52c3e92bc9e4970729aa599cf2a7379ad38070667756636486bb3d35f992d7a886e44327964b58c0b182d65389541e696bac8b819222a6198

  • /data/user/0/com.gosing.earn.syz/[email protected]

    Filesize

    6.4MB

    MD5

    b2b942dc8862e6aca202e44156d84dd4

    SHA1

    e987cc70196a17e285a893db826c035d2f3e5776

    SHA256

    cb7c3fac46621c76b17d289206b6f28a1450e3d451d96c784b114a98a03da400

    SHA512

    5361d441e93e89a9b2cae02a6b38bed0d59285c55b5c6893be2f01f442670bca2e94b7a58b5b60ab06e2821d897eb33c19983e9ed966545d39ad9d753ddff3b4

  • /data/user/0/com.gosing.earn.syz/[email protected]!classes2.dex

    Filesize

    5.7MB

    MD5

    50dff7de6f568053c1273654337dbb2c

    SHA1

    338b0634340569aaa13a91c1d72105367a84b657

    SHA256

    67c735825e35e2dc3147be65c1d5d20622da2a581971916501395298de80d63c

    SHA512

    aeceb29fe85a19e24b10cca34467b05cb681a93d8fd7905dbb4df9347857c9dd0ede0c238a832143eaa198b90152c8eb672104640934503658c0e3ec0f9a2a08

  • /storage/emulated/0/360/.deviceId

    Filesize

    48B

    MD5

    4c4c5285293d5141f582aefa4e038669

    SHA1

    e01852a72e5a8e6f7d63a21426b515118196047b

    SHA256

    36c5c63f39ddf7a6a9c01946e4f78b95790aa734176802e793e95724a1b5b731

    SHA512

    097aa673273e307f7bfb7c08861ad389d4b5f7fae55d972a5c1636aa66d0b8d23b5eb9b696cefe0e5b942f23969dabf0147397aeca85fb9a4d75e0473104e399

  • /storage/emulated/0/360/.iddata

    Filesize

    32B

    MD5

    11dc04b4eef0d3c703d522c3e9aee26c

    SHA1

    1627d8ebe99ae0d1cfc860cc7c7960e2c9e98d44

    SHA256

    2e991efb7c27cc19d0daabae68a0897f882bdb877848c216361c782b2438bdca

    SHA512

    6408b36435ac05b4997fe4db0dd9c8dd314a7bcaf3f5b92a7bf8958f4eb8cd76abba17fb334f3d80723dff6885fde00126bc1fc59fc8b0dfab8a6ca4095355e4