Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    9s
  • max time network
    184s
  • platform
    android_x86
  • resource
    android-x86-arm-20240603-en
  • resource tags

    androidarch:armarch:x86image:android-x86-arm-20240603-enlocale:en-usos:android-9-x86system
  • submitted
    10/06/2024, 23:11

General

  • Target

    9c40ce8fbc3cd345cdda36d6c953a9c2_JaffaCakes118.apk

  • Size

    31.1MB

  • MD5

    9c40ce8fbc3cd345cdda36d6c953a9c2

  • SHA1

    e81a7a9f475fcd974f44059e83fe5b016c7ca20d

  • SHA256

    6e18d4ba1573d71019af5bad6ac5908a92d7363e257e58bb4a1e1dd5b468bac5

  • SHA512

    c988397ae70d59cba5f92a223e14341c5662f490c59b282bb479b3994af8e38eb0518187004c42b514320c1673c265d048804bc6a107418b32b2ad3d1a867ed8

  • SSDEEP

    786432:DwQ+x2oGYkvdsPbe/+sfQHlK3TqT5J1xTo+ARF0yY8Bks:UQ+oojkvdObe/v6lKjqvTZ+es

Malware Config

Signatures

  • Checks if the Android device is rooted. 1 TTPs 2 IoCs
  • Loads dropped Dex/Jar 1 TTPs 5 IoCs

    Runs executable file dropped to the device during analysis.

  • Queries information about running processes on the device 1 TTPs 1 IoCs

    Application may abuse the framework's APIs to collect information about running processes on the device.

  • Queries information about active data network 1 TTPs 1 IoCs
  • Queries information about the current Wi-Fi connection 1 TTPs 1 IoCs

    Application may abuse the framework's APIs to collect information about the current Wi-Fi connection.

  • Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs
  • Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs
  • Checks memory information 2 TTPs 1 IoCs

Processes

  • com.juxin.rvetc
    1⤵
    • Checks if the Android device is rooted.
    • Loads dropped Dex/Jar
    • Queries information about running processes on the device
    • Queries information about active data network
    • Queries information about the current Wi-Fi connection
    • Registers a broadcast receiver at runtime (usually for listening for system events)
    • Uses Crypto APIs (Might try to encrypt user data)
    • Checks memory information
    PID:4261
    • /system/bin/sh -c getprop ro.board.platform
      2⤵
        PID:4292
      • sh -c getprop ro.yunos.version
        2⤵
          PID:4311
        • getprop ro.board.platform
          2⤵
            PID:4292
          • getprop ro.yunos.version
            2⤵
              PID:4311
            • /system/bin/sh -c type su
              2⤵
              • Checks if the Android device is rooted.
              PID:4343
            • /system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/data/com.juxin.rvetc/mix.dex --output-vdex-fd=52 --oat-fd=53 --oat-location=/data/data/com.juxin.rvetc/oat/x86/mix.odex --compiler-filter=quicken --class-loader-context=&
              2⤵
              • Loads dropped Dex/Jar
              PID:4359

          Network

          MITRE ATT&CK Mobile v15

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          • /data/data/com.juxin.rvetc/cache/image_manager_disk_cache/a22bf15289455402f3d84fb8356bc5b8ac6190360c10033ea9abc4b98eafcf6c.0.tmp

            Filesize

            59KB

            MD5

            9ff8994692ea3081f563c50523e6185b

            SHA1

            08cbfa1926085501ea9f1eac2ef40b27d9a4e933

            SHA256

            35d0e63b86065a22f9faf956d1a8e0de49ed7909c911962f29003367f0e38354

            SHA512

            7e7264f5c49948570e24468b8caaf3f669ad17539e13da731556b765082da8fd4f06b297cb824f99ce1f9681799eaaefcc4e7c0580cd1fb2c2c5622040af4104

          • /data/data/com.juxin.rvetc/cache/image_manager_disk_cache/journal

            Filesize

            179B

            MD5

            d96a877c0c5cf821d07e2b30cf656974

            SHA1

            18018cc83d15cdc7791d8709265dbf514257f7c8

            SHA256

            c177aa7be801ee57d21bc122f959a72286720810e8f4cb5fde4efd3be2388528

            SHA512

            8c934c7028974761e503e9310b39e6dc9a02ca11e61ea28327aa996544004ad7cdf1cfeeeffb8252d341c29ecb7f9f01e0dc966a486ec72d5f59bd04c22f6cc5

          • /data/data/com.juxin.rvetc/cache/image_manager_disk_cache/journal.tmp

            Filesize

            31B

            MD5

            8c92de9ce46d41a22f3b20f77404cc1d

            SHA1

            8671a6dca00edb72be47363a7071be65cf270373

            SHA256

            68bb33ddeed9200be85a71f70b377985f9ee68e91578afbde8321463396f1274

            SHA512

            30f45fe9954215d6adafcc8f0a060a7ff41963a64f9b849a37f0d18fe045038d429ec13bf15226769c4ba78dad3c52f3d9e0dbbb4fcdea4828a1efe956e48f56

          • /data/data/com.juxin.rvetc/databases/bugly_db_legu

            Filesize

            4KB

            MD5

            f2b4b0190b9f384ca885f0c8c9b14700

            SHA1

            934ff2646757b5b6e7f20f6a0aa76c7f995d9361

            SHA256

            0a8ffb6b327963558716e87db8946016d143e39f895fa1b43e95ba7032ce2514

            SHA512

            ec12685fc0d60526eed4d38820aad95611f3e93ae372be5a57142d8e8a1ba17e6e5dfe381a4e1365dddc0b363c9c40daaffdc1245bd515fddac69bf1abacd7f1

          • /data/data/com.juxin.rvetc/databases/bugly_db_legu-journal

            Filesize

            512B

            MD5

            f9a0c5835041c3a8cfc6d9724c883d0c

            SHA1

            19e3f42ff1c5206255a460e9eb9f67a82c472876

            SHA256

            2f66bd305f36f303c00b859440ee645bf0ff826dc658bb9e654edd724669b363

            SHA512

            4709ad81897c16a5055d87db05ae11074253b0de7b177ceac82b2d0db27433fa189dac4edf0fcc6a276c8466661598cc788e43074dd3d196b13cc5cf5ec51d6d

          • /data/data/com.juxin.rvetc/databases/bugly_db_legu-shm

            Filesize

            32KB

            MD5

            bb7df04e1b0a2570657527a7e108ae23

            SHA1

            5188431849b4613152fd7bdba6a3ff0a4fd6424b

            SHA256

            c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479

            SHA512

            768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012

          • /data/data/com.juxin.rvetc/databases/bugly_db_legu-wal

            Filesize

            92KB

            MD5

            7e634de49da825297e96a751706725b0

            SHA1

            114e54a8a821c9b5d901e3a2c607e58499e205ce

            SHA256

            bd05c24eadece6e7dd61fe687d70089918d501f52bfdcb1933d73f7772fc0303

            SHA512

            73f1792b9377379835275586f26c57cf3d58352acd23bd2b9dfd9dc33762f13ac50392e4e4aa274bedab12e547796c8e7c61204d39172a2b0469b6e4f8d07964

          • /data/data/com.juxin.rvetc/mix.dex

            Filesize

            292B

            MD5

            63f77f99bd2c2b772a479923bde11974

            SHA1

            c7632e7d301e4463fafce85f84e9c3d7da3fdbbe

            SHA256

            4c76a3af64cdd2f8713ffe2733dea50dbe714d0ca41c17d1847ee5b62a7ca615

            SHA512

            3aae4a89d1ed51fdd911cb367eb10afe3c2264e4222085891b18a60d5412f85d10bf5c8f3c6642db70abb9aa42732bac5c42c42ee32d587100f53c21b5beb16c

          • /storage/emulated/0/Android/data/com.juxin.rvetc/sjk#rvet/core_log/easemob.log

            Filesize

            785B

            MD5

            ccc347ab850d4b213c1fd1c53c82a0a2

            SHA1

            c30388a8058f19efa27da7a4cd1b73c257aca1b0

            SHA256

            7ccac08064875d5e293a6a6ed482ca6dc833750a3fff6a1daa51696a4c5d99af

            SHA512

            50b947c2cecf5845592e53996cb2e9fd3e279bf75d2e8351ddc36a6b66d7c890a87e3c6a1d3d5b152035280739e216220b6234624693a437ae3037df8bdedff5

          • /storage/emulated/0/crash/crash-2024-06-10-23-11-36-1718061096787.log

            Filesize

            1KB

            MD5

            a52fc6019361b2bbbfd84f616c435c47

            SHA1

            581762e1bb94ca479927dd1673ddd99a9e98e612

            SHA256

            5026ad2d273d2877e46a50a709c2b20a65285247e09f681b98ec5ce2794d4e01

            SHA512

            a61091dee8b494ae35dc3937b1a5560c62a475888e11bdd0d284e6d4a603559f87994d018a6d471487296609fbe9bdeaa0b5d27b7623bdc5d02698e4b0afd025

          • /storage/emulated/0/crash/crash-2024-06-10-23-11-37-1718061097087.log

            Filesize

            1KB

            MD5

            981a8fc8fe4691005be04a22de296d59

            SHA1

            e996ba4efcacc25264470a43a5971acebbfa9e0a

            SHA256

            3af6bb327747a376e8ccac722307f6a6e9b88970b6fee717e9fb46af30c2d07d

            SHA512

            9de5336559ab3e3b7ab1f6b33744d8341b6ec00123b7b669b5403d1cc24bfb58f54bf1aedac7e355d459e77f3342fb0e0520a93c1bb0bd318cc92abeaa362392

          • /storage/emulated/0/crash/crash-2024-06-10-23-11-37-1718061097532.log

            Filesize

            3KB

            MD5

            0fedfbc028754d9266fc13079ec2d16e

            SHA1

            2c6328498da45c95cb7d5db03ca1d86b0749d300

            SHA256

            e17676f7698dca049da0e8b2655756f18a17cc029293010108864f40df8de1c8

            SHA512

            13025815c456b0f5461122d1e4d341d09f3be9b08e7c73c3c21828c5e93b3088f155df2be09a8ffd1e7a0c1d0283322d30b39eb3634ef861c1b59dc69c1db0e0

          • /storage/emulated/0/data/.push_deviceid

            Filesize

            32B

            MD5

            8ba1fb020641dd6b3b56cabb962dd98d

            SHA1

            7db61d4f3a71e5169586865a2fc2d38d799e86dc

            SHA256

            95ca9e64ea68ecdcba0a6fd4d3c99b68f319f9fff4aedffdf65714514a6babbf

            SHA512

            e9795fa35abaf94674751fea48ff621e7b4a2a30c5c400b0d9f11ae851d8ba902f29759c1e4756ee143d9cd93a1751c28ba71ba3ce4648bcc1d09f607b745987