Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
9s -
max time network
184s -
platform
android_x86 -
resource
android-x86-arm-20240603-en -
resource tags
androidarch:armarch:x86image:android-x86-arm-20240603-enlocale:en-usos:android-9-x86system -
submitted
10/06/2024, 23:11
Static task
static1
Behavioral task
behavioral1
Sample
9c40ce8fbc3cd345cdda36d6c953a9c2_JaffaCakes118.apk
Resource
android-x86-arm-20240603-en
Behavioral task
behavioral2
Sample
9c40ce8fbc3cd345cdda36d6c953a9c2_JaffaCakes118.apk
Resource
android-x64-20240603-en
General
-
Target
9c40ce8fbc3cd345cdda36d6c953a9c2_JaffaCakes118.apk
-
Size
31.1MB
-
MD5
9c40ce8fbc3cd345cdda36d6c953a9c2
-
SHA1
e81a7a9f475fcd974f44059e83fe5b016c7ca20d
-
SHA256
6e18d4ba1573d71019af5bad6ac5908a92d7363e257e58bb4a1e1dd5b468bac5
-
SHA512
c988397ae70d59cba5f92a223e14341c5662f490c59b282bb479b3994af8e38eb0518187004c42b514320c1673c265d048804bc6a107418b32b2ad3d1a867ed8
-
SSDEEP
786432:DwQ+x2oGYkvdsPbe/+sfQHlK3TqT5J1xTo+ARF0yY8Bks:UQ+oojkvdObe/v6lKjqvTZ+es
Malware Config
Signatures
-
Checks if the Android device is rooted. 1 TTPs 2 IoCs
ioc Process /system/app/Superuser.apk com.juxin.rvetc /sbin/su /system/bin/sh -c type su -
Loads dropped Dex/Jar 1 TTPs 5 IoCs
Runs executable file dropped to the device during analysis.
ioc pid Process /data/data/com.juxin.rvetc/mix.dex 4261 com.juxin.rvetc /data/data/com.juxin.rvetc/mix.dex 4359 /system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/data/com.juxin.rvetc/mix.dex --output-vdex-fd=52 --oat-fd=53 --oat-location=/data/data/com.juxin.rvetc/oat/x86/mix.odex --compiler-filter=quicken --class-loader-context=& /data/data/com.juxin.rvetc/mix.dex 4261 com.juxin.rvetc /data/data/com.juxin.rvetc/mix.dex 4261 com.juxin.rvetc /data/data/com.juxin.rvetc/mix.dex 4261 com.juxin.rvetc -
Queries information about running processes on the device 1 TTPs 1 IoCs
Application may abuse the framework's APIs to collect information about running processes on the device.
description ioc Process Framework service call android.app.IActivityManager.getRunningAppProcesses com.juxin.rvetc -
Queries information about active data network 1 TTPs 1 IoCs
description ioc Process Framework service call android.net.IConnectivityManager.getActiveNetworkInfo com.juxin.rvetc -
Queries information about the current Wi-Fi connection 1 TTPs 1 IoCs
Application may abuse the framework's APIs to collect information about the current Wi-Fi connection.
description ioc Process Framework service call android.net.wifi.IWifiManager.getConnectionInfo com.juxin.rvetc -
Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs
description ioc Process Framework service call android.app.IActivityManager.registerReceiver com.juxin.rvetc -
Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs
description ioc Process Framework API call javax.crypto.Cipher.doFinal com.juxin.rvetc -
Checks memory information 2 TTPs 1 IoCs
description ioc Process File opened for read /proc/meminfo com.juxin.rvetc
Processes
-
com.juxin.rvetc1⤵
- Checks if the Android device is rooted.
- Loads dropped Dex/Jar
- Queries information about running processes on the device
- Queries information about active data network
- Queries information about the current Wi-Fi connection
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Uses Crypto APIs (Might try to encrypt user data)
- Checks memory information
PID:4261 -
/system/bin/sh -c getprop ro.board.platform2⤵PID:4292
-
-
sh -c getprop ro.yunos.version2⤵PID:4311
-
-
getprop ro.board.platform2⤵PID:4292
-
-
getprop ro.yunos.version2⤵PID:4311
-
-
/system/bin/sh -c type su2⤵
- Checks if the Android device is rooted.
PID:4343
-
-
/system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/data/com.juxin.rvetc/mix.dex --output-vdex-fd=52 --oat-fd=53 --oat-location=/data/data/com.juxin.rvetc/oat/x86/mix.odex --compiler-filter=quicken --class-loader-context=&2⤵
- Loads dropped Dex/Jar
PID:4359
-
Network
MITRE ATT&CK Mobile v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
/data/data/com.juxin.rvetc/cache/image_manager_disk_cache/a22bf15289455402f3d84fb8356bc5b8ac6190360c10033ea9abc4b98eafcf6c.0.tmp
Filesize59KB
MD59ff8994692ea3081f563c50523e6185b
SHA108cbfa1926085501ea9f1eac2ef40b27d9a4e933
SHA25635d0e63b86065a22f9faf956d1a8e0de49ed7909c911962f29003367f0e38354
SHA5127e7264f5c49948570e24468b8caaf3f669ad17539e13da731556b765082da8fd4f06b297cb824f99ce1f9681799eaaefcc4e7c0580cd1fb2c2c5622040af4104
-
Filesize
179B
MD5d96a877c0c5cf821d07e2b30cf656974
SHA118018cc83d15cdc7791d8709265dbf514257f7c8
SHA256c177aa7be801ee57d21bc122f959a72286720810e8f4cb5fde4efd3be2388528
SHA5128c934c7028974761e503e9310b39e6dc9a02ca11e61ea28327aa996544004ad7cdf1cfeeeffb8252d341c29ecb7f9f01e0dc966a486ec72d5f59bd04c22f6cc5
-
Filesize
31B
MD58c92de9ce46d41a22f3b20f77404cc1d
SHA18671a6dca00edb72be47363a7071be65cf270373
SHA25668bb33ddeed9200be85a71f70b377985f9ee68e91578afbde8321463396f1274
SHA51230f45fe9954215d6adafcc8f0a060a7ff41963a64f9b849a37f0d18fe045038d429ec13bf15226769c4ba78dad3c52f3d9e0dbbb4fcdea4828a1efe956e48f56
-
Filesize
4KB
MD5f2b4b0190b9f384ca885f0c8c9b14700
SHA1934ff2646757b5b6e7f20f6a0aa76c7f995d9361
SHA2560a8ffb6b327963558716e87db8946016d143e39f895fa1b43e95ba7032ce2514
SHA512ec12685fc0d60526eed4d38820aad95611f3e93ae372be5a57142d8e8a1ba17e6e5dfe381a4e1365dddc0b363c9c40daaffdc1245bd515fddac69bf1abacd7f1
-
Filesize
512B
MD5f9a0c5835041c3a8cfc6d9724c883d0c
SHA119e3f42ff1c5206255a460e9eb9f67a82c472876
SHA2562f66bd305f36f303c00b859440ee645bf0ff826dc658bb9e654edd724669b363
SHA5124709ad81897c16a5055d87db05ae11074253b0de7b177ceac82b2d0db27433fa189dac4edf0fcc6a276c8466661598cc788e43074dd3d196b13cc5cf5ec51d6d
-
Filesize
32KB
MD5bb7df04e1b0a2570657527a7e108ae23
SHA15188431849b4613152fd7bdba6a3ff0a4fd6424b
SHA256c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479
SHA512768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012
-
Filesize
92KB
MD57e634de49da825297e96a751706725b0
SHA1114e54a8a821c9b5d901e3a2c607e58499e205ce
SHA256bd05c24eadece6e7dd61fe687d70089918d501f52bfdcb1933d73f7772fc0303
SHA51273f1792b9377379835275586f26c57cf3d58352acd23bd2b9dfd9dc33762f13ac50392e4e4aa274bedab12e547796c8e7c61204d39172a2b0469b6e4f8d07964
-
Filesize
292B
MD563f77f99bd2c2b772a479923bde11974
SHA1c7632e7d301e4463fafce85f84e9c3d7da3fdbbe
SHA2564c76a3af64cdd2f8713ffe2733dea50dbe714d0ca41c17d1847ee5b62a7ca615
SHA5123aae4a89d1ed51fdd911cb367eb10afe3c2264e4222085891b18a60d5412f85d10bf5c8f3c6642db70abb9aa42732bac5c42c42ee32d587100f53c21b5beb16c
-
Filesize
785B
MD5ccc347ab850d4b213c1fd1c53c82a0a2
SHA1c30388a8058f19efa27da7a4cd1b73c257aca1b0
SHA2567ccac08064875d5e293a6a6ed482ca6dc833750a3fff6a1daa51696a4c5d99af
SHA51250b947c2cecf5845592e53996cb2e9fd3e279bf75d2e8351ddc36a6b66d7c890a87e3c6a1d3d5b152035280739e216220b6234624693a437ae3037df8bdedff5
-
Filesize
1KB
MD5a52fc6019361b2bbbfd84f616c435c47
SHA1581762e1bb94ca479927dd1673ddd99a9e98e612
SHA2565026ad2d273d2877e46a50a709c2b20a65285247e09f681b98ec5ce2794d4e01
SHA512a61091dee8b494ae35dc3937b1a5560c62a475888e11bdd0d284e6d4a603559f87994d018a6d471487296609fbe9bdeaa0b5d27b7623bdc5d02698e4b0afd025
-
Filesize
1KB
MD5981a8fc8fe4691005be04a22de296d59
SHA1e996ba4efcacc25264470a43a5971acebbfa9e0a
SHA2563af6bb327747a376e8ccac722307f6a6e9b88970b6fee717e9fb46af30c2d07d
SHA5129de5336559ab3e3b7ab1f6b33744d8341b6ec00123b7b669b5403d1cc24bfb58f54bf1aedac7e355d459e77f3342fb0e0520a93c1bb0bd318cc92abeaa362392
-
Filesize
3KB
MD50fedfbc028754d9266fc13079ec2d16e
SHA12c6328498da45c95cb7d5db03ca1d86b0749d300
SHA256e17676f7698dca049da0e8b2655756f18a17cc029293010108864f40df8de1c8
SHA51213025815c456b0f5461122d1e4d341d09f3be9b08e7c73c3c21828c5e93b3088f155df2be09a8ffd1e7a0c1d0283322d30b39eb3634ef861c1b59dc69c1db0e0
-
Filesize
32B
MD58ba1fb020641dd6b3b56cabb962dd98d
SHA17db61d4f3a71e5169586865a2fc2d38d799e86dc
SHA25695ca9e64ea68ecdcba0a6fd4d3c99b68f319f9fff4aedffdf65714514a6babbf
SHA512e9795fa35abaf94674751fea48ff621e7b4a2a30c5c400b0d9f11ae851d8ba902f29759c1e4756ee143d9cd93a1751c28ba71ba3ce4648bcc1d09f607b745987