Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
5s -
max time network
131s -
platform
android_x86 -
resource
android-x86-arm-20240603-en -
resource tags
-
submitted
11/06/2024, 05:16
General
-
Target
9d16ba7afa6f0abea72e9c95d28beeb9_JaffaCakes118.apk
-
Size
13.3MB
-
MD5
9d16ba7afa6f0abea72e9c95d28beeb9
-
SHA1
b8c3531192a1f2673fac1a37c7d86708ea8eac7a
-
SHA256
d1ec09f6af50a001be1fe9aaa529719c15b048a9d4af8108375d8fe99a2e8c16
-
SHA512
101680c9328b7535ecab4b40965cb3d6372df35d2f02132e32b3adca13bd9ba8958ea16984a93caa5992b87c70bc9af30a7e3715ee2d49f910739f6a39f0c723
-
SSDEEP
393216:ajC62EXHQaTPPdygR8JoUa5hnrfRiEvoSHsn2:IC62qHQaTPNR8JoUQnr5iE5E2
Malware Config
Signatures
-
Checks if the Android device is rooted. 1 TTPs 3 IoCs
-
Checks Android system properties for emulator presence. 1 TTPs 2 IoCs
-
Checks known Qemu pipes. 1 TTPs 2 IoCs
Checks for known pipes used by the Android emulator to communicate with the host.
-
Loads dropped Dex/Jar 1 TTPs 1 IoCs
Runs executable file dropped to the device during analysis.
-
Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
-
Queries information about running processes on the device 1 TTPs 1 IoCs
Application may abuse the framework's APIs to collect information about running processes on the device.
-
Queries information about the current nearby Wi-Fi networks 1 TTPs 1 IoCs
Application may abuse the framework's APIs to collect information about the current nearby Wi-Fi networks.
-
Queries the phone number (MSISDN for GSM devices) 1 TTPs
-
Queries information about active data network 1 TTPs 1 IoCs
-
Queries information about the current Wi-Fi connection 1 TTPs 1 IoCs
Application may abuse the framework's APIs to collect information about the current Wi-Fi connection.
-
Reads information about phone network operator. 1 TTPs
-
Listens for changes in the sensor environment (might be used to detect emulation) 1 TTPs 1 IoCs
-
Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs
-
Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs
-
Checks CPU information 2 TTPs 1 IoCs
-
Checks memory information 2 TTPs 1 IoCs
Processes
-
com.lechuan.midunovel1⤵
- Checks if the Android device is rooted.
- Checks Android system properties for emulator presence.
- Checks known Qemu pipes.
- Loads dropped Dex/Jar
- Queries information about running processes on the device
- Queries information about the current nearby Wi-Fi networks
- Queries information about active data network
- Queries information about the current Wi-Fi connection
- Listens for changes in the sensor environment (might be used to detect emulation)
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Uses Crypto APIs (Might try to encrypt user data)
- Checks CPU information
- Checks memory information
-
cat /sys/class/net/wlan0/address2⤵
-
-
sh -c cd /sys/class/net/wlan0/ && cat address2⤵
-
-
cat /sys/class/net/wlan0/address2⤵
-
-
sh -c ls -i2⤵
-
-
ls -i2⤵
-
Network
MITRE ATT&CK Mobile v15
Defense Evasion
Download New Code at Runtime
1Hide Artifacts
1User Evasion
1Virtualization/Sandbox Evasion
4System Checks
4Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
389KB
MD5e16a451b3aa12edc776003680ad09660
SHA180cd0c9da760b87ff100ae57e4ff2cf81e6b77e0
SHA256a9f1752e1ee67dc095e107cb75c324132792614f6fb713acc845eead3c3dcd2f
SHA5129f28dfdc2072bbc291f21e2b3fee903515586503184ce72c3e5d86df5adb2bcfb2d452a8f147fb0f3d9ae592327ce6ff9d444f99b5922c5ace40cffe13974588
-
Filesize
4KB
MD5f2b4b0190b9f384ca885f0c8c9b14700
SHA1934ff2646757b5b6e7f20f6a0aa76c7f995d9361
SHA2560a8ffb6b327963558716e87db8946016d143e39f895fa1b43e95ba7032ce2514
SHA512ec12685fc0d60526eed4d38820aad95611f3e93ae372be5a57142d8e8a1ba17e6e5dfe381a4e1365dddc0b363c9c40daaffdc1245bd515fddac69bf1abacd7f1
-
Filesize
512B
MD507eeea8dea12b40c4b6966cc077c55c4
SHA1a5f7392aa59c119226600ee78ddd3c9106d5c530
SHA256679fd4e5089d63195290e2dfee98ded84867ac7eb0333977c050dfd374b7739a
SHA51289b983a99925fe08763842ab1f8b53ad57011869695c92b90bcf37079208e432b0b4e7cf234c7e40bbe69fd0f4477cd9976cdaa64ffa70bdc6b9074be180baad
-
Filesize
28KB
MD5cf845a781c107ec1346e849c9dd1b7e8
SHA1b44ccc7f7d519352422e59ee8b0bdbac881768a7
SHA25618619b678a5c207a971a0aa931604f48162e307c57ecdec450d5f095fe9f32c7
SHA5124802861ea06dc7fb85229a3c8f04e707a084f1ba516510c6f269821b33c8ee4ebf495258fe5bee4850668a5aac1a45f0edf51580da13b7ee160a29d067c67612
-
Filesize
52KB
MD5ceeac38092cd9d7862b8d175046de0a2
SHA119de7b434017f6f4b737bcca3d10bcbc43afbd46
SHA2567965898247bb8c63fcd13f99bc5dd1083ebc6990d0338a3643415d53ac79bf4c
SHA51282054e004ae33f32ee7af6606a14a1f9843ec2ab3d4b292ce26396f04071cf636a3009588f34a751892c9668502269fa8c6af49bb4b50fd958bf6d9b0885d9d6
-
Filesize
860KB
MD592f0125a0b3d619d7a45e713eba85fdd
SHA10b4fd32e83165a97119679995aeab3a7c4c0b948
SHA2564cb1e7422f746364c29ede6891eaca2725ae7a45b1d128322f2aeb73215aba1a
SHA512b2e174dcc13070399265421a83fa292cc2857f2ccb122cf203a1435a88f25e50efb3147a5f325c3df72e588e4473eee2bd0fde222f413ec46b3bbb752ab1356e
-
Filesize
32B
MD5dd122b3e14ecb99b5d5c30221800e03b
SHA1b3fa2a498c338956c0cf2f5002d1dc882911e7e3
SHA256cd6fc2b932feb08c05393403b43dd1e1bc63de0ea76f8454c1f879e6c9d9c200
SHA512dadfdafd972a2f03401e704a9c68a78d862279a8a180e1c6f8334626027135669f2805d202f5d4f7dedeacbdc45b41326fccd7ce5e737d9a755978860c1a1344
-
Filesize
32B
MD50f3788e2f358b603df0f47f2b95160d2
SHA16e4779443fb7bbf0280afc705f586690e7da2697
SHA256d74652d42b61107a4280023d59de1a585f1d4bc659035699670e7fdd50359437
SHA51210c5625a1edaf9c54af19a9128329baaeee4f63399632ccd0c7896b7109a5530006cb1f9986679ff46a804ba9c68a9bd5d51976b89b7ab3de7e7d4462ee668b1