Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
11s -
max time network
168s -
platform
android_x86 -
resource
android-x86-arm-20240603-en -
resource tags
androidarch:armarch:x86image:android-x86-arm-20240603-enlocale:en-usos:android-9-x86system -
submitted
06/06/2024, 01:00
Static task
static1
Behavioral task
behavioral1
Sample
99abbda11ec5969113bbe95637096f8e_JaffaCakes118.apk
Resource
android-x86-arm-20240603-en
Behavioral task
behavioral2
Sample
99abbda11ec5969113bbe95637096f8e_JaffaCakes118.apk
Resource
android-33-x64-arm64-20240603-en
Behavioral task
behavioral3
Sample
gdtadv2.apk
Resource
android-x86-arm-20240603-en
General
-
Target
99abbda11ec5969113bbe95637096f8e_JaffaCakes118.apk
-
Size
12.3MB
-
MD5
99abbda11ec5969113bbe95637096f8e
-
SHA1
0b48e5de770070193fdbb215b71d5f264d7531bc
-
SHA256
da685282a15b8481cc7a8e8924f350830f3f197d208acfeed67dc0c4c7c5f708
-
SHA512
403588a60ed03b04012ff8108d3c48ded2d56322fab3b4e5618f232c4bb7ebc79f701e6e86b4f6e16054ea6e4c74a29d4446ad1af85477c790c0f2759675ef3e
-
SSDEEP
393216:1GgdaYTClcx9uICa63bbJw3zPzoNy0MqT:1FQlc3uIJ6nJw37zoQAT
Malware Config
Signatures
-
Checks if the Android device is rooted. 1 TTPs 3 IoCs
ioc Process /system/bin/su com.lushi.zhuanbao /system/xbin/su com.lushi.zhuanbao /system/app/Superuser.apk com.lushi.zhuanbao -
Loads dropped Dex/Jar 1 TTPs 6 IoCs
Runs executable file dropped to the device during analysis.
ioc pid Process /data/data/com.lushi.zhuanbao/.jiagu/classes.dex 4220 com.lushi.zhuanbao /data/data/com.lushi.zhuanbao/.jiagu/classes.dex!classes2.dex 4220 com.lushi.zhuanbao /data/data/com.lushi.zhuanbao/.jiagu/classes.dex!classes3.dex 4220 com.lushi.zhuanbao /data/data/com.lushi.zhuanbao/.jiagu/tmp.dex 4220 com.lushi.zhuanbao /data/data/com.lushi.zhuanbao/.jiagu/tmp.dex 4220 com.lushi.zhuanbao Anonymous-DexFile@0xd576e000-0xd577a338 4220 com.lushi.zhuanbao -
Queries information about running processes on the device 1 TTPs 1 IoCs
Application may abuse the framework's APIs to collect information about running processes on the device.
description ioc Process Framework service call android.app.IActivityManager.getRunningAppProcesses com.lushi.zhuanbao -
Queries information about the current nearby Wi-Fi networks 1 TTPs 1 IoCs
Application may abuse the framework's APIs to collect information about the current nearby Wi-Fi networks.
description ioc Process Framework service call android.net.wifi.IWifiManager.getScanResults com.lushi.zhuanbao -
Requests cell location 2 TTPs 1 IoCs
Uses Android APIs to to get current cell location.
description ioc Process Framework service call com.android.internal.telephony.ITelephony.getCellLocation com.lushi.zhuanbao -
Queries information about active data network 1 TTPs 1 IoCs
description ioc Process Framework service call android.net.IConnectivityManager.getActiveNetworkInfo com.lushi.zhuanbao -
Queries information about the current Wi-Fi connection 1 TTPs 1 IoCs
Application may abuse the framework's APIs to collect information about the current Wi-Fi connection.
description ioc Process Framework service call android.net.wifi.IWifiManager.getConnectionInfo com.lushi.zhuanbao -
Listens for changes in the sensor environment (might be used to detect emulation) 1 TTPs 1 IoCs
description ioc Process Framework API call android.hardware.SensorManager.registerListener com.lushi.zhuanbao -
Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs
description ioc Process Framework service call android.app.IActivityManager.registerReceiver com.lushi.zhuanbao -
Checks CPU information 2 TTPs 1 IoCs
description ioc Process File opened for read /proc/cpuinfo com.lushi.zhuanbao
Processes
-
com.lushi.zhuanbao1⤵
- Checks if the Android device is rooted.
- Loads dropped Dex/Jar
- Queries information about running processes on the device
- Queries information about the current nearby Wi-Fi networks
- Requests cell location
- Queries information about active data network
- Queries information about the current Wi-Fi connection
- Listens for changes in the sensor environment (might be used to detect emulation)
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Checks CPU information
PID:4220 -
getprop ro.build.version.emui2⤵PID:4296
-
-
ls /sys/class/thermal2⤵PID:4341
-
-
ls /2⤵PID:4360
-
Network
MITRE ATT&CK Mobile v15
Defense Evasion
Download New Code at Runtime
1Execution Guardrails
1Geofencing
1Hide Artifacts
1User Evasion
1Virtualization/Sandbox Evasion
1System Checks
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
48KB
MD575d46252620a12dd7343e91c8ba209bb
SHA16615b67e21963e5689685f8494f442dcd729d4d1
SHA256c433c8e3f847da2b98ee8b704ea3b7d0f38d6249626dfe26a22bef0c08e5fa71
SHA5129ae5f0ae0a77bc8c9a27a43252ba01d4bbb69a326eb028d2e887d701b202b66a7065765f2f0214d2b0701493634ff33c2104becdb80bf7e8c2657175857b7af8
-
Filesize
48KB
MD54e93a7a07efedcc6e3c741526d2d89a7
SHA1e25833d7a51783c17978a7c5e7953d7cf1df80f5
SHA25626fd97dcb56a0ae4ffee7b9514cb697de101ad39e3b2af2933b1eadf409b740e
SHA51294a5e0b50c0efc69b79fe9b46513537b798a45d00234a7fe1c529e7d5eb153704ec9966a0e0819983f726260579707d7b82e7b31f845fa7602e06c078b98319f
-
Filesize
6.0MB
MD59c033bd10b44e5d5131977e80ecafc1b
SHA177a150c14bb65f172c5df57b4b303524a9d4ffe8
SHA256b0d84fc74b15d0726030b79fe0b72c02515c3f4098d4947ef6aa86cbc4c324da
SHA512e0dd9ea7c661f965e641085d90b88f0548e4751161740d60f212ac57745088eb09b19c45255b517a3436308632605ed5dcf9553f658189e304f88eb272404b49
-
Filesize
6.1MB
MD57a640e93fe289fda6a4b087a1924de12
SHA1440183491f1f3f644c755cd38ca7f1e04e00462b
SHA2561589c969ba5be207938c9483fcbccc27a660f29a56d904753a05f0a134158a4d
SHA512315d58dc78ceee663f64ac7f312cf505d3b318c197aa190061d6b7cf067a39cd820ce921b91f257504f7407b649808e29106005cadfbe6a513a30ca4674bea4b
-
Filesize
87KB
MD5e3cca5affb2b13e55b7bb73c397b11d3
SHA125110f9caf2ad6bc62bdafdb4e3b70cd93396d23
SHA25610dc27451938c6a4ff8874099824dee1ed9dc23c74cae0924da7f39ccc8c554f
SHA512917425ed6e8ac57037867b98f93d786b1162806ed18765b20673103471d6eae331840ff5e81f5d3ff166fd488b57947e345f5cafca16b4f63b5694d23e5efcfc
-
Filesize
558KB
MD598736de515958ae37ae93a0a0e997098
SHA172d0f9d43f7c9bdc9f19d13834c0872f5652c0f9
SHA256335091dfc73a9f792cb720389c5d94eb6642764a38d70d4b6b7a8afd34038421
SHA512cc4974ce398bf7f4a20160ad30e4c4b5821ff0d7f2cc9fa0aead73ddc036585266edf429add276b53d6db8dd24a344d709469b9c839451deead6b621e70c92cf
-
Filesize
284B
MD5f1771b68f5f9b168b79ff59ae2daabe4
SHA10df6a835559f5c99670214a12700e7d8c28e5a42
SHA2569f8898ce35a47aeafced99ea0d17c33e73037bb2307c7688e50819966f4ae939
SHA512dae27d19727b89bec49398503baa6801640540355688dfabbe689c97545295c2c2d9b0f0dcd7cbc4cfbf701d0c0c3289e647a152f49ff242d1ecc741efe4145d
-
Filesize
228B
MD5df010706abdbce9e452947d776d517ed
SHA11c0106bafddf5623ba7902e1de95ae1c6193eaf2
SHA256f8b73716dd1650625df60df5126a1a837a9838f9e6337de8fbae0608bd79a09f
SHA512389d54888418844784cb63ce3492c7244f804c60ef93c82d60d2728540c232df6ecd0ce616027ee21563e48587a087f6c4174994062ed907bdaa75d184a0d818
-
Filesize
512B
MD5cb57ed3c4e0b32bcd0310f8fbdcb3261
SHA1de5d6cdb5f3c20de465f447acad64460706c0572
SHA256e249f811f9b64df3ac8f96e2370dc86979f41b93e81d4569b3e9f8f630f96635
SHA512a59c241fc3adf571cc98c173a01c7974b4c8727c3f368408bbec64278c06ed13b83813b086e696fcf5252d9cbf76703843754fb7936f3376ef6f70e5849733e5
-
Filesize
512B
MD52e63f04c03c15efea28d88875f219e09
SHA1543578e4928b3e7c9be3a93cce5b6afa1506f4e7
SHA256fb23044592300dc63df84f4ba7fac4d4b99e03c5776f8805f8a6ede0019345c5
SHA512fa97b8e9f24c462b1a270b8530c32187f540bbf53c99e62fca78dd75bd1b98c47674d3512596a5eef87356e4f3d229fe78bc71aecd5ccf0c2811ffdbdbe76767
-
Filesize
32KB
MD5f04a96bc546901590168a2e36f52cd5f
SHA17a656c0fe074ef016118618bc97771ced9403b63
SHA2569c8b67ae31c231846f97dffc79c40c3e75b7c236d40beec7a6caea32ad65508c
SHA512d3a871c80982fd728d08bdd7868ca79193f261916978c684aea889e818714c7e7163ba48b38f1fac1f4daab4bd706b8fbfe3f2f22a46b0996c513db2ce815d3f
-
Filesize
4KB
MD5f2b4b0190b9f384ca885f0c8c9b14700
SHA1934ff2646757b5b6e7f20f6a0aa76c7f995d9361
SHA2560a8ffb6b327963558716e87db8946016d143e39f895fa1b43e95ba7032ce2514
SHA512ec12685fc0d60526eed4d38820aad95611f3e93ae372be5a57142d8e8a1ba17e6e5dfe381a4e1365dddc0b363c9c40daaffdc1245bd515fddac69bf1abacd7f1
-
Filesize
512B
MD5cf4139bc4f17701ab1d6c65e8cd3d482
SHA12c0e9c210ff7bf587b2ecb3fbed32f079e59a633
SHA25657e930bde1ee50df00f027a609c527411749548aa3bc71b25183eb65779cea76
SHA51293aa11911fb57fbaaa0d135a88b58915f48c30bd954e56a51c1cb01acba6e27703cd2f197fff2611de2aac2b6b709977b4b293b576fb4fa21385b15af16f4f5b
-
Filesize
28KB
MD5cf845a781c107ec1346e849c9dd1b7e8
SHA1b44ccc7f7d519352422e59ee8b0bdbac881768a7
SHA25618619b678a5c207a971a0aa931604f48162e307c57ecdec450d5f095fe9f32c7
SHA5124802861ea06dc7fb85229a3c8f04e707a084f1ba516510c6f269821b33c8ee4ebf495258fe5bee4850668a5aac1a45f0edf51580da13b7ee160a29d067c67612
-
Filesize
32KB
MD55d0c6f958673773cad3395ea2a4d996f
SHA1fdb02c74808e295c5fec3cc6fd4ce02bf1e3c6f7
SHA25694f16ac6f30c82a09824bdc7e7bd6b53dc10380519ba150cd0cfc8ea7754a232
SHA51225840e587bf75bf0b08cb61c066932a88b50d44f5ed52159597775175dc3f8d6d69f930796e0944b9a184ff0382e961b207b347b2e942a3d59df8e9c8a8744c0
-
Filesize
512B
MD59e20ee865ab19730df372be7a8bb726c
SHA18cd15f0dc87ac539000baadb3bcf0041926a27c4
SHA2567c0c860ffb31f2ed0d0af15c15bb3f1156afc87ecd6d5649b322687f86efd323
SHA51200ad1570a3941472461222926cf4606de3614ed3be6ecb239532f9250c663439a195fb286c77b393104684f333c3e16ff0ec76497774d320dabbeabcb89ef708
-
Filesize
68KB
MD5b664a2e26b546a4efdf4fa3778f8eb3e
SHA1f37c9ea1bd39bfabbaa8cfe4fc6c70f117307568
SHA256894019b371b3a48a012e92ad73d90c0ed9613e7170f4eb568c7ffbb7dc3d4fff
SHA512801e3e30c532f386319679ffb9ee12475f057f9103701a56f8df193ebf3bd56ad915d797df8cd2eebd8e889ba1e3f21daef003eae6dc98f08e89a9998a352147
-
Filesize
32B
MD5b9c64f04129ffc89111b5e5d879dc0d3
SHA17fd48d28f8720e82108283d95d14b277731825a1
SHA2569261dcf52bcb9f2c8cbeebdb93f6f6d1ccecf1da6a5600d06afd3c78003ad89f
SHA5121c3c28f3939fdfb3a06729c5d9d77f1c7a58b8850abbdbf89ac2eaedebcccbef5db1804ac07ad56224f9e060b2f2eb7e90bf7b450b89bd4bfa939646237ec9e4
-
Filesize
32B
MD5c45c23630cfcf468ad03b4e9877aa5f2
SHA1cf30d569f48cdca48b50e4081915ea9fb9afe1a5
SHA256db2142b77a6511c1f110f2e65c5b13e8456309d106e33b99ad7a7e3eb2f9fdc6
SHA512a17cb02f69eb27f0ff3215380b398f8f16c8f3ea9fb787a5004ab6fcd0263fcf819f8e8fb19e8d529fcadc57b190f0191ff1c3ae4da5ed03316c29a5bc63dee2
-
Filesize
32B
MD57185cffb69741d6fc9101133221a287c
SHA1c1f4fbde37dd4ae43c7f8b50c5cc079f4bc51f0f
SHA256a7dda74b143acfce1a566911a709d137d0118dfca53b03375cad84ed90d3631a
SHA512eea9e239065ae3965f8e4c531f189934563ee06692fd2ac8c82dc348069be784961b33bb7432c75715814ed92e04202cbd8b7194497b9f7ed6d2ef35ca0c9ae2
-
Filesize
64B
MD5678d244849ea46b0e5e7ad988a147ef6
SHA138f14e5f8f54898430708498a61f83d137626e75
SHA2568384b8c5a2aa1a042b8bc6dc8fa6da78260ecefda622c520bdcfc765142e6314
SHA51211f8772a9f83d34789dcc45b27f021b57be73ad58daa92257a131979d9df7cd95303aff24292b6b8a469a50483d0973691228271a57b6c1d31b03fda162f68b5
-
Filesize
32B
MD51d2ea4b5d937561a94a9a3a39976081a
SHA16e745905dd297b4ac6b2d423777e84cba406bfa9
SHA256472d7e167a6f26d7223a7ff84053df9b1d083484ba1299223551bccb31ad7537
SHA512109deed33298ff01e28dc7d44c04eca3dfbc94c1a7ed034920c60be4ab543f501485f65e9a963857b3480cb85191ca6714a8c94c5f7a619733f9e1e1e99fb224
-
Filesize
314B
MD52761c6bf49eac0c9c610b440b3536de6
SHA1cf2b8f1b4cf4b18ff7d0893186315d030fa6af39
SHA256ec600305deffe07d086eb66eb4984ae681f0b1e84366cbda3f3cd075c4008d32
SHA512cfc63564b5f2f5708cad9472b0ee24d63a7a3f24b4a40385d9a4e74b9cfe5e074171c3d155ab8c36b433eee1c1705c61cc8ab67aadf4f5ec4796df5294cba0ca
-
Filesize
307B
MD5977618bbab25ba4d306e84ad7d27ff38
SHA17d829827b9bdc68bd397ae04d289af7c10d2a6ad
SHA2567dfd35c2b1dca04d7df9b2a616b13f256b378e673998aaf4aa14208a7d0e7aed
SHA512fc2d72eea5ab72a731ebca308f052ae3c4dfe66dd13241611af72a7632f4cf4283a96a755a945c1f9def64c5309609fbbfda2aaae3f8726705c22d0ba09a59a3
-
Filesize
307B
MD582d871d7a78c67f431d78f17ea1bfc55
SHA1d8879c4900b86ff9ec63d82925f625a7eb9dd266
SHA256e8e4af5843005c876db22518d188220f67090c187d6b9ab5b0fc57317c654cb8
SHA512e20f92d4724464582559f80bc8c9180d4371d3cce5764637d9991cfe97e882c12bae8296d5d6eb373e332f5551ef7759380b9781242e5a86477d7fbcd49f7b1a
-
Filesize
32B
MD55007307710aa02ef54e9c52620567eff
SHA1e2c9146571581a3cd686689818e1b00a14d61c32
SHA2568f7bb88998b3e94f74ee7e3b2fcb85b218fc76dae157dbdf351c0f6345a10c88
SHA5126f456322312bf236786b003fba4c2580aaf93569f17d985b57a1486f90cff86ebba708f8c8edabaca82b48425ae07a5dc702d2859af7dcd6921fbe577c2f0d6e
-
Filesize
32B
MD5ef5deb235397f07548506e64c37f7677
SHA100b24a7cb177ba9db01d6636058c72477f0bd7b9
SHA256af7b021d73886155de7f474f254874043c81cbe14983c6340dee71714ac23cba
SHA51276ea307987f6e0c8c9a03bdea8a32c9b93f44f6a8de6891aa6ffb3e3a4590d6ded4ebffdc98c3fae2edca7e1ababd44d5dba5996a19d7e60125fd6c28f673be9
-
Filesize
27B
MD54580857b58fc139f1391f1009170133d
SHA1bb8ad40af33b3151c6154cac2331ff11953ca441
SHA256202016a119f12a7809be623c747a0063a1dcbfd8c06d695f9e3f6ba4e34683bd
SHA512e4f47857cddcc6b0f4af228209c0381f19852e7b02531084e9082676e242217b6d49fd7e697dd3c920c7a8c76ba8745b98cbfb108c4be798de7e80ea8e3d2991
-
Filesize
36B
MD56a4926be795877132ddda663525daec2
SHA1021eadacda0f6fd359756b90339a95c49c1f1318
SHA25663f81a29171c83ad99c2cccbc00b3910252b12ada8daa9f1da6854db2ba54611
SHA51276e663d69b0b8d5f279c4082d3b5f5c4e7dcd2bce60c73f3e4e917e4e3caf184bfae36c88880df197d121f6c6442dcb22656a0021d534a902151bbae595440c7
-
Filesize
344B
MD5a376113c0d0b9abff1dab8a18ffcc64f
SHA18d2ae39484ed87ab9bc1da73a0b301d4ccbb312f
SHA256097d02f9eb6d41e9de17c5afd81b20cb6ce1308243bff6e99bd3668bbfe30e86
SHA5127cad3278f53dc7dfe23408544f655c5ad59bf2c93c0b023ac4348818115b984ba26a8e975792d90ac64da9385fc5af31c8495be3c4738c9018e0766abeb14465