Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    9s
  • max time network
    140s
  • platform
    android_x64
  • resource
    android-x64-arm64-20240611.1-en
  • resource tags

    androidarch:armarch:arm64arch:x64arch:x86image:android-x64-arm64-20240611.1-enlocale:en-usos:android-11-x64system
  • submitted
    13/06/2024, 14:39

General

  • Target

    a610a90f0f044b87492a8ba9281a21ba_JaffaCakes118.apk

  • Size

    12.9MB

  • MD5

    a610a90f0f044b87492a8ba9281a21ba

  • SHA1

    63215896bc2147d2eef379ce483a70d383b97d19

  • SHA256

    22534caa7e5aeb5859cb614f9f26eab6acd3a5b750e7d7c598a2e3e91cfdf7f5

  • SHA512

    e3f093a5c98bbbbce9600bec9db8fcb3b58c0dd4b5f43d75130b6834810c667763ef86334f9227297fe84cd35dcd3b1d6ad7c1c76feab8cb3b26f7e321d2b5af

  • SSDEEP

    196608:qW0+MGPU6IxYZ53u33Ajuh8Zl0DAsMy7WRBSHD9/434QkFyUUzaRRTytWTvK6:8GJZ53uHAqh00D4y7WqHJw3zpzoFy0G6

Score
8/10

Malware Config

Signatures

  • Checks if the Android device is rooted. 1 TTPs 1 IoCs
  • Loads dropped Dex/Jar 1 TTPs 3 IoCs

    Runs executable file dropped to the device during analysis.

  • Queries information about running processes on the device 1 TTPs 1 IoCs

    Application may abuse the framework's APIs to collect information about running processes on the device.

  • Queries information about the current nearby Wi-Fi networks 1 TTPs 1 IoCs

    Application may abuse the framework's APIs to collect information about the current nearby Wi-Fi networks.

  • Queries information about active data network 1 TTPs 1 IoCs
  • Queries information about the current Wi-Fi connection 1 TTPs 1 IoCs

    Application may abuse the framework's APIs to collect information about the current Wi-Fi connection.

Processes

  • com.lushi.zhuanbao
    1⤵
    • Checks if the Android device is rooted.
    • Loads dropped Dex/Jar
    • Queries information about running processes on the device
    • Queries information about the current nearby Wi-Fi networks
    • Queries information about active data network
    • Queries information about the current Wi-Fi connection
    PID:4463

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • /data/data/com.lushi.zhuanbao/files/.jglogs/.jg.ac

    Filesize

    32B

    MD5

    b9c64f04129ffc89111b5e5d879dc0d3

    SHA1

    7fd48d28f8720e82108283d95d14b277731825a1

    SHA256

    9261dcf52bcb9f2c8cbeebdb93f6f6d1ccecf1da6a5600d06afd3c78003ad89f

    SHA512

    1c3c28f3939fdfb3a06729c5d9d77f1c7a58b8850abbdbf89ac2eaedebcccbef5db1804ac07ad56224f9e060b2f2eb7e90bf7b450b89bd4bfa939646237ec9e4

  • /data/data/com.lushi.zhuanbao/files/.jglogs/.jg.ic

    Filesize

    32B

    MD5

    c45c23630cfcf468ad03b4e9877aa5f2

    SHA1

    cf30d569f48cdca48b50e4081915ea9fb9afe1a5

    SHA256

    db2142b77a6511c1f110f2e65c5b13e8456309d106e33b99ad7a7e3eb2f9fdc6

    SHA512

    a17cb02f69eb27f0ff3215380b398f8f16c8f3ea9fb787a5004ab6fcd0263fcf819f8e8fb19e8d529fcadc57b190f0191ff1c3ae4da5ed03316c29a5bc63dee2

  • /data/data/com.lushi.zhuanbao/files/.jglogs/.jg.pk

    Filesize

    32B

    MD5

    7185cffb69741d6fc9101133221a287c

    SHA1

    c1f4fbde37dd4ae43c7f8b50c5cc079f4bc51f0f

    SHA256

    a7dda74b143acfce1a566911a709d137d0118dfca53b03375cad84ed90d3631a

    SHA512

    eea9e239065ae3965f8e4c531f189934563ee06692fd2ac8c82dc348069be784961b33bb7432c75715814ed92e04202cbd8b7194497b9f7ed6d2ef35ca0c9ae2

  • /data/data/com.lushi.zhuanbao/files/.jglogs/.jg.pk.h

    Filesize

    64B

    MD5

    678d244849ea46b0e5e7ad988a147ef6

    SHA1

    38f14e5f8f54898430708498a61f83d137626e75

    SHA256

    8384b8c5a2aa1a042b8bc6dc8fa6da78260ecefda622c520bdcfc765142e6314

    SHA512

    11f8772a9f83d34789dcc45b27f021b57be73ad58daa92257a131979d9df7cd95303aff24292b6b8a469a50483d0973691228271a57b6c1d31b03fda162f68b5

  • /data/data/com.lushi.zhuanbao/files/.jglogs/.jg.rd

    Filesize

    32B

    MD5

    1d2ea4b5d937561a94a9a3a39976081a

    SHA1

    6e745905dd297b4ac6b2d423777e84cba406bfa9

    SHA256

    472d7e167a6f26d7223a7ff84053df9b1d083484ba1299223551bccb31ad7537

    SHA512

    109deed33298ff01e28dc7d44c04eca3dfbc94c1a7ed034920c60be4ab543f501485f65e9a963857b3480cb85191ca6714a8c94c5f7a619733f9e1e1e99fb224

  • /data/data/com.lushi.zhuanbao/files/.jglogs/.jg.ri

    Filesize

    307B

    MD5

    9ded96b8458c4212cf823ce2220ca259

    SHA1

    0b83f9620dbe26bb12b5ce6010f1a226af135754

    SHA256

    1dbd6f1331dd750dbac581a9f7e214f6291356a3f0d5ac14fccc2d6766e8b050

    SHA512

    b31b97901de9d208ea0592145f23eae44e12b74bed8f8ce200a8d8f1cc409b0253e7a855aa64d30bb8666c5446ef6c4202d2ab08b84a20444c4f8c23026addc9

  • /data/data/com.lushi.zhuanbao/files/.jglogs/.jg.ri

    Filesize

    314B

    MD5

    cca1cc9f7e64c9bcd170416ca00e0f42

    SHA1

    f4f1aa2bef1715c211026b3d10b7b5e68e9f9ed7

    SHA256

    63bca11bfed66858ffba770db5bb15f67f6570f0578a87f1c90332f8ca7ad372

    SHA512

    e2452db5d28b63a05e0c34f4623d72012670597b472624924c5491162e3ad4a6cb950e30bb6d4be8f60e389a87c5b5efe6e03020f5e3d79611418dc61c171ac1

  • /data/data/com.lushi.zhuanbao/files/.jglogs/.jg.store.report_pid

    Filesize

    32B

    MD5

    ef5deb235397f07548506e64c37f7677

    SHA1

    00b24a7cb177ba9db01d6636058c72477f0bd7b9

    SHA256

    af7b021d73886155de7f474f254874043c81cbe14983c6340dee71714ac23cba

    SHA512

    76ea307987f6e0c8c9a03bdea8a32c9b93f44f6a8de6891aa6ffb3e3a4590d6ded4ebffdc98c3fae2edca7e1ababd44d5dba5996a19d7e60125fd6c28f673be9

  • /data/data/com.lushi.zhuanbao/files/.jiagu.lock

    Filesize

    27B

    MD5

    759dbffaff5c238ad6406f4518026153

    SHA1

    de6693ddaefb9f4d8e1be3eee029c54b64aa92a9

    SHA256

    7e7c2994535356a62738f73e971b574ccdc9dc1d5a187fcbd726168ca8873ad5

    SHA512

    2ef94a7fd5a7fec5f0adbc056d37c7aa601a1dcb392927b73e5846532bbaa13daa1269e0bc803a77046f59abd2a44e7a909b6d9f8580da4edfb01edb19d951ce

  • /data/user/0/com.lushi.zhuanbao/.00000000000/37CF018B.dex

    Filesize

    48KB

    MD5

    75d46252620a12dd7343e91c8ba209bb

    SHA1

    6615b67e21963e5689685f8494f442dcd729d4d1

    SHA256

    c433c8e3f847da2b98ee8b704ea3b7d0f38d6249626dfe26a22bef0c08e5fa71

    SHA512

    9ae5f0ae0a77bc8c9a27a43252ba01d4bbb69a326eb028d2e887d701b202b66a7065765f2f0214d2b0701493634ff33c2104becdb80bf7e8c2657175857b7af8

  • /data/user/0/com.lushi.zhuanbao/.00000000000/37CF018B.dex

    Filesize

    48KB

    MD5

    4e93a7a07efedcc6e3c741526d2d89a7

    SHA1

    e25833d7a51783c17978a7c5e7953d7cf1df80f5

    SHA256

    26fd97dcb56a0ae4ffee7b9514cb697de101ad39e3b2af2933b1eadf409b740e

    SHA512

    94a5e0b50c0efc69b79fe9b46513537b798a45d00234a7fe1c529e7d5eb153704ec9966a0e0819983f726260579707d7b82e7b31f845fa7602e06c078b98319f

  • /data/user/0/com.lushi.zhuanbao/.jiagu/classes.dex

    Filesize

    5.9MB

    MD5

    4f32113d809dd75b14e5667c8f45e6d2

    SHA1

    ccd07779536ac42369fedd9867b6171acaacb706

    SHA256

    3b6fb7085882bf08371c6acd9390725f0b536a64a45225d26e6cc54d70ca1cc1

    SHA512

    18fcc76d8b8953b04c00668bfb9d8341076edf3acdc008b92080fbd9942887550d2294a9278606da89c656147f5b5b42d9bd84d058707cbd7acaf02173d41466

  • /data/user/0/com.lushi.zhuanbao/.jiagu/classes.dex!classes2.dex

    Filesize

    5.8MB

    MD5

    0141652b34bdac808871b61f484a565a

    SHA1

    5bbc8bf7134b6f68f6ce517884dba68922a420d7

    SHA256

    b417af1130ba5bb7e14fa4aa513e6bda377d9b8d236ee662be29047d2f1ae94d

    SHA512

    671a30df30b4349236606fc33427afe3fbcc8cd53b0bb895bc58328f93df3187f2befa9fe9ab2bb2af9d38a7f10e25ec354045e9ac06badbd484084db259b02b

  • /data/user/0/com.lushi.zhuanbao/.jiagu/libjiagu.so

    Filesize

    558KB

    MD5

    98736de515958ae37ae93a0a0e997098

    SHA1

    72d0f9d43f7c9bdc9f19d13834c0872f5652c0f9

    SHA256

    335091dfc73a9f792cb720389c5d94eb6642764a38d70d4b6b7a8afd34038421

    SHA512

    cc4974ce398bf7f4a20160ad30e4c4b5821ff0d7f2cc9fa0aead73ddc036585266edf429add276b53d6db8dd24a344d709469b9c839451deead6b621e70c92cf

  • /data/user/0/com.lushi.zhuanbao/databases/bytedance_downloader.db

    Filesize

    20KB

    MD5

    40b7d099fc8c4320b1bb8dbc6e03151f

    SHA1

    bb556886aaa719ae155b8e499f530fe970e6e5c9

    SHA256

    02fec0e756afa49755e14043766cf3ff533addef9567b0243e06beeab805ec0e

    SHA512

    dd476b16caee9c451571a95c98fda38496c8a75a4f5e778b4900e122ce34a7b474831c6ca84d1b42e83af4e6cb0b693ef0fcc8fe5c3e4162f7effc6c85f6fe3a

  • /data/user/0/com.lushi.zhuanbao/databases/bytedance_downloader.db-journal

    Filesize

    512B

    MD5

    eef756c5120e6a8d7f5c022137c6ce09

    SHA1

    3ee4a9513f5db0070559ead48fe64db8a281b18e

    SHA256

    ee69ec897667e609ff631e3cbc236cff18e24fa1618d8c52c82493f7a37eef9c

    SHA512

    4dc2750cc80cdeb227a585c139519364adf4e509762791fa15ab20ea42b72d6349c9aa77e4b2cd50931738d7090ea6c51082b3bad43f1bde4ea16a7eaa323c0b

  • /data/user/0/com.lushi.zhuanbao/databases/bytedance_downloader.db-journal

    Filesize

    8KB

    MD5

    0ff90e0279cd9c4626968c6a119e0056

    SHA1

    44f6e3ade94b897de8cd78c2c7c588d8da560413

    SHA256

    1c65a7613dab903fec69a212351d68e5d51fcd6f6e2bf50c5d4c71cdd9bd6338

    SHA512

    54323be9abf4c348dbf746239b316e63b3b7bf126b414687659ad1e4579b51853bd42b9d6e4ee94e4c9ff6e818f1d429001416d96e5b03df64b8d1e9ec9fcf40

  • /data/user/0/com.lushi.zhuanbao/databases/bytedance_downloader.db-journal

    Filesize

    8KB

    MD5

    e9671b4a17097bd01d88143dc00967a6

    SHA1

    164006f4dd6f6bbd81552be53c4dbfc08ad31c64

    SHA256

    fd83d84d46e312908785a33648dc3f0a7705f52c4801304adc7a31597e056d74

    SHA512

    ebc422a017a7769aa590b6ab2ed4376eaa268c26171b1a9dac17ba733e17cd3106dae5ba96d4463c6c45d4146226b0b475bfef27df17edbee63a33520af549b5

  • /data/user/0/com.lushi.zhuanbao/databases/npth_log.db

    Filesize

    20KB

    MD5

    8dc03e147a44099e46adcc75eb340610

    SHA1

    4e087fa92230d55aba4de0ea71719afaa66ec108

    SHA256

    e7a10f4213b91e5144fc5e5d61ea6b81484ec79506ad7f7db35ca992a9634a7e

    SHA512

    d823aac6b0f8ecd90106e1b10b8fc5399798dfc09e63729b88b525a8a43ea301fdbc3977eed3a1fd21723c0e1f4c78585db9f9fb3402787eead6c724087d790f

  • /data/user/0/com.lushi.zhuanbao/databases/npth_log.db-journal

    Filesize

    512B

    MD5

    b28afbc0c5c1b411c62fb95cbc979f56

    SHA1

    07c28a618d3b0ab1ceabaf84b0350a5580b8f5fa

    SHA256

    7e77de2cfeee67ba85fa7d7a630c2c3b531f28ea37201ad59338e61e318c7c89

    SHA512

    9d9581382c05e00b138128a5e0ffd875c0170cfb5d05408048738b2c3366e45b8723db830a05e92c6da8d481a46afe487ae8804a74a29c0779f1eb5b83d716b5

  • /data/user/0/com.lushi.zhuanbao/databases/npth_log.db-journal

    Filesize

    8KB

    MD5

    943cc34989c91573e93b0cf4a1be62cc

    SHA1

    3bb3544e65746033a32082eb410d03c0e57d2a32

    SHA256

    4cc69c13f028074d19a5190d2379025c9163455c1d3054d2a9e8a34984dbe57b

    SHA512

    f2e3e79460b8efd1e79a0bbe469b6e9db2950a2615a5d21a8ba7246909be26914e8464f979e88d18911a578eea42b7bbd8e914d9c11974a5bb32446946eabcb1

  • /data/user/0/com.lushi.zhuanbao/databases/npth_log.db-journal

    Filesize

    8KB

    MD5

    8aa13be3bcb09dd1f6c833cc0dfd63d5

    SHA1

    6bd683e2596378eb59e78a92a73d5758eec48a1b

    SHA256

    31d9868d2ab32fb2fd127c0519f4350bc2669fa02c446876162c65f790c9ed0d

    SHA512

    b1d746c31b0d92985cf881680ff4df5df26825b5e75d445de1f284a0e0d5d293e0fd35282d0b37b69a97b7c03c09f244d3401b95ca95fd4cf0e3369c9de8febb

  • /data/user/0/com.lushi.zhuanbao/databases/ttopensdk.db

    Filesize

    12KB

    MD5

    171aedf968e17a2744d2585715606cb9

    SHA1

    bbeddeb3b89fcf809619c35b4a318a80e7d5b029

    SHA256

    d2ab452d9360848f46af866b870b5c6fc98230b09c72b89cb1a4b2778586678e

    SHA512

    78a0f517ee3d21c153dda6dbfec4187ebaee9d520d7b1b63f358bcb125d08aea53f26943907a56fdeba40161d9fc7e4fd63f9ae3154dd2ad887ba0162738285b

  • /data/user/0/com.lushi.zhuanbao/databases/ttopensdk.db-journal

    Filesize

    512B

    MD5

    940dbfaf912a15b7c489a452d816a7e6

    SHA1

    25ca93f527dbf4a90fbd70330d303ad1d2a8c0d1

    SHA256

    22c813ae948fd206b6c4f1d5d1887e943a5fd607954e1da2e1fadbc3c0e88ad5

    SHA512

    eb8f879b53c076b3dffce7d23eb5a52f7df997d9dbf80e2ae17354ac266033b1ce82611a328ea6a213fea35c53f53b5c6f7730d561b51878913d1bdfb4d39281

  • /data/user/0/com.lushi.zhuanbao/databases/ttopensdk.db-journal

    Filesize

    8KB

    MD5

    662cf49db594d4aff1f18c9e6ab72dbd

    SHA1

    eed8bc2d41dd1474451f73ae5ff9a86039a57503

    SHA256

    7b1ba1cedb3be14cf04c89b9b3215223737907e1406003fc9366063c62490ddc

    SHA512

    3bd8d0d561150eae172dd7337964709331bcf8a7ba42255f5825540b753aa37b95bc93fd20f82f932889a6e5066affa80a7ab5495c8e68b90b6a604a9e78d4a2

  • /data/user/0/com.lushi.zhuanbao/databases/ttopensdk.db-journal

    Filesize

    8KB

    MD5

    f2b991d2b7cec708d3fb0b4cd4574814

    SHA1

    f4b9bb5477f0f749346d5fe2a6d31acdc887e14c

    SHA256

    ee6dfa263b219b4370b8c57ccc6e331eb47c9bf22a082b402d4905f37f733979

    SHA512

    338089d53792a8951f9ef16977064e9242f9141f19bdfb0a89a4279277f3f195c4c77d76639522fc88103809b7a2f54451e0689dc62ea752f9af8bf99a0e047c

  • /storage/emulated/0/com.lushi.zhuanbao/config/5ac714da7be6d534dd74c84a097f98e0

    Filesize

    344B

    MD5

    4ac291fd990a7997c603129c524cdb10

    SHA1

    8445b41c0033079bb9227cadc3744d3b7f9a4d19

    SHA256

    bad46e50382b73c66bc73a63a90c66f198d7a387ebb890279eb8ed1960e5dbf5

    SHA512

    f41a4b242355e4108cd04f2d66b5b3f7ed94383c4a18b1a47e0ad4b7c3edaf4649721130ba3cbdb8252e5854d5914fcf297d56d1defe9bf71ea912695005f695