Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
General
-
Target
7544bdf61d4d9c1331fcaa839c7509ae_JaffaCakes118
-
Size
28.6MB
-
Sample
240526-m54tlagg82
-
MD5
7544bdf61d4d9c1331fcaa839c7509ae
-
SHA1
a60d7a960dfb586c39f46dc98dacb4f9f71bf4ea
-
SHA256
fe175a48ef81b6189c0d17e677205d5251d708ed1d7e43420914b03dc8c238a0
-
SHA512
cc90237b2c54a680de917b5ffe73ac7fa9be1408e83c6f8dac2a33a0bcb934503cce581b4eeb052df52cdf9d3b5a41da0842446d32b86711e0e6d0883fe8232e
-
SSDEEP
393216:sgw9gx6zCjYKV9NqIV9LazGaHk4k4tYiT7jsWrw4JKTfZRZSnuyxUdT3ofRMiCep:uga4fGHkAgfdwuyxS3osed4cuACzUl
Static task
static1
Behavioral task
behavioral1
Sample
7544bdf61d4d9c1331fcaa839c7509ae_JaffaCakes118.apk
Resource
android-x86-arm-20240514-en
Behavioral task
behavioral2
Sample
7544bdf61d4d9c1331fcaa839c7509ae_JaffaCakes118.apk
Resource
android-x64-20240514-en
Behavioral task
behavioral3
Sample
mimo_asset.apk
Resource
android-x86-arm-20240514-en
Behavioral task
behavioral4
Sample
mimo_asset.apk
Resource
android-x64-20240514-en
Behavioral task
behavioral5
Sample
mimo_asset.apk
Resource
android-x64-arm64-20240514-en
Malware Config
Targets
-
-
Target
7544bdf61d4d9c1331fcaa839c7509ae_JaffaCakes118
-
Size
28.6MB
-
MD5
7544bdf61d4d9c1331fcaa839c7509ae
-
SHA1
a60d7a960dfb586c39f46dc98dacb4f9f71bf4ea
-
SHA256
fe175a48ef81b6189c0d17e677205d5251d708ed1d7e43420914b03dc8c238a0
-
SHA512
cc90237b2c54a680de917b5ffe73ac7fa9be1408e83c6f8dac2a33a0bcb934503cce581b4eeb052df52cdf9d3b5a41da0842446d32b86711e0e6d0883fe8232e
-
SSDEEP
393216:sgw9gx6zCjYKV9NqIV9LazGaHk4k4tYiT7jsWrw4JKTfZRZSnuyxUdT3ofRMiCep:uga4fGHkAgfdwuyxS3osed4cuACzUl
-
Checks if the Android device is rooted.
-
Checks Android system properties for emulator presence.
-
Obtains sensitive information copied to the device clipboard
Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.
-
Queries information about running processes on the device
Application may abuse the framework's APIs to collect information about running processes on the device.
-
Queries information about the current Wi-Fi connection
Application may abuse the framework's APIs to collect information about the current Wi-Fi connection.
-
Queries information about the current nearby Wi-Fi networks
Application may abuse the framework's APIs to collect information about the current nearby Wi-Fi networks.
-
Queries the mobile country code (MCC)
-
Registers a broadcast receiver at runtime (usually for listening for system events)
-
Checks if the internet connection is available
-
Legitimate hosting services abused for malware hosting/C2
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Queries the unique device ID (IMEI, MEID, IMSI)
-
Requests dangerous framework permissions
-
Listens for changes in the sensor environment (might be used to detect emulation)
-
-
-
Target
mimo_asset.apk
-
Size
390KB
-
MD5
39692de7ff0848e54bf6ea1ce9ece672
-
SHA1
bf6299d772f195bac724f738c49cdac0c538abe4
-
SHA256
011c400d36773b3b475290c2d1af5a829c0597c24dfbb10e12222611a4e1300e
-
SHA512
3ea7d8e4a85e1b8b7759984f817df7c65656d057e31b11ec1a970e79a99b775fca5e5f8ef942f99869a14b58a91c1a5838b5711ac33f915cf8f7f77280bcadc6
-
SSDEEP
12288:hNx7RUQtEAQ5YXCA3xfDX2O9THkIMFsTTX5KOk5O:57RUQt35XCA3xz2O9TEJy3XIOkw
Score1/10 -
MITRE ATT&CK Enterprise v15
MITRE ATT&CK Mobile v15
Defense Evasion
Download New Code at Runtime
1Execution Guardrails
1Geofencing
1Hide Artifacts
1User Evasion
1Virtualization/Sandbox Evasion
3System Checks
3