Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
151s -
max time network
181s -
platform
android_x86 -
resource
android-x86-arm-20240611.1-en -
resource tags
-
submitted
15/06/2024, 15:42
General
-
Target
af24c564b84c7fdca5c213c383bad6ac_JaffaCakes118.apk
-
Size
21.1MB
-
MD5
af24c564b84c7fdca5c213c383bad6ac
-
SHA1
aa5488c438a843a301b0e5fde181f4e683414d69
-
SHA256
a91566e57e2522603715b79f811544c3e7d8a1b7e2c28cd00b5b5bcd594b8ee6
-
SHA512
428ad7e06755bdb2055ae36a09fe87d6ab01d09c3036d02648ccdcb33260d9425f372ea036c8e3db47fe26bbb7c4ba44063da932958621c421bd9c8e478a8dd6
-
SSDEEP
393216:ZwjxkI2FyLwhDSNuFSlZSZQIfPQjWkje5+dJb8sONIVKSSSS9Uc:+jp2olNuAlb3jWkF8sO+ViUc
Malware Config
Signatures
-
Loads dropped Dex/Jar 1 TTPs 13 IoCs
Runs executable file dropped to the device during analysis.
-
Queries information about running processes on the device 1 TTPs 3 IoCs
Application may abuse the framework's APIs to collect information about running processes on the device.
-
Queries information about the current nearby Wi-Fi networks 1 TTPs 2 IoCs
Application may abuse the framework's APIs to collect information about the current nearby Wi-Fi networks.
-
Requests cell location 1 TTPs 3 IoCs
Uses Android APIs to to get current cell information.
-
Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs
Application may abuse the framework's foreground service to continue running in the foreground.
-
Queries information about active data network 1 TTPs 3 IoCs
-
Queries information about the current Wi-Fi connection 1 TTPs 3 IoCs
Application may abuse the framework's APIs to collect information about the current Wi-Fi connection.
-
Reads information about phone network operator. 1 TTPs
-
Listens for changes in the sensor environment (might be used to detect emulation) 1 TTPs 1 IoCs
-
Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 3 IoCs
-
Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 3 IoCs
Processes
-
com.xinanseefang1⤵
- Loads dropped Dex/Jar
- Queries information about running processes on the device
- Queries information about active data network
- Queries information about the current Wi-Fi connection
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Uses Crypto APIs (Might try to encrypt user data)
-
chmod 755 /data/data/com.xinanseefang/.jiagu/libjiagu.so2⤵
-
-
/system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/data/com.xinanseefang/.jiagu/tmp.dex --output-vdex-fd=42 --oat-fd=43 --oat-location=/data/data/com.xinanseefang/.jiagu/oat/x86/tmp.odex --compiler-filter=quicken --class-loader-context=&2⤵
- Loads dropped Dex/Jar
-
-
com.xinanseefang:TcmsService1⤵
- Loads dropped Dex/Jar
- Queries information about running processes on the device
- Queries information about the current nearby Wi-Fi networks
- Requests cell location
- Makes use of the framework's foreground persistence service
- Queries information about active data network
- Queries information about the current Wi-Fi connection
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Uses Crypto APIs (Might try to encrypt user data)
-
sh2⤵
-
cat /proc/net/xt_qtaguid/stats3⤵
-
-
-
com.xinanseefang:remote1⤵
- Loads dropped Dex/Jar
- Queries information about running processes on the device
- Queries information about the current nearby Wi-Fi networks
- Requests cell location
- Queries information about active data network
- Queries information about the current Wi-Fi connection
- Listens for changes in the sensor environment (might be used to detect emulation)
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Uses Crypto APIs (Might try to encrypt user data)
Network
MITRE ATT&CK Mobile v15
Persistence
Event Triggered Execution
1Broadcast Receivers
1Foreground Persistence
1Defense Evasion
Download New Code at Runtime
1Foreground Persistence
1Hide Artifacts
1User Evasion
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
7.3MB
MD58c5b0dc5146a9ae7003fbf04f0e3c779
SHA1b9d8396556f69192ea5215c0850a696f44514421
SHA256fe84b4814bbde96162bf3ecf991ca490581c03f21de29bdf715ff620620532fd
SHA51232dcd091625f8beb7541d81cfc0adfa82a732e97cfa5a8977baeeeff613eb2741a09df4b2621e75b46aeb5a8777864f79ac3a3b3aaed910c7f62fdd05d8c07ff
-
Filesize
6.6MB
MD5fe8fc0ac2d11029149b7853ab1ddd92c
SHA1d17d76e3baa6e4df3206e02bc067ff9defc690b5
SHA256f728bf623c4daf6a56910ac5e86bcab74e1acfbdac77972e9fc1c24d11316c43
SHA5127be82ed5ebe1ae27131e8a61df8f32683cd630b89e72160dae12340daed2ca198abb3184444f03dad1ff2035db6272289d0fb22833ef0e50764205e94e1e16b3
-
Filesize
6.2MB
MD5c517b027696937f7a3bab65060a84bf7
SHA14c6bf3517b7d98747b8f231176f7c87e6f0d559b
SHA256b6c4ce2894cd6aa5c63382323774980a1b617aa50b96a1ac1b0ecf23027fede7
SHA512a83f1bfbeaf1ec8d26222f7794b717fd48cea9d4315ae025665503f7eef32e7f0be6b9fa2f2fcccaf3a136e77b866186d5e596459ae48cec6b1ce33ad2efebe1
-
Filesize
455KB
MD5e5a53000766ebc433b27d6a66ec4f555
SHA12c8f53f1c03aec2005bcad67d731f07261dabde0
SHA25678e4ea857f10c2df6c7b94f0584524b52ecc099ed29478fe3964037b8a86ed2e
SHA512370a1cb93b14556ad861724f4e9995c9a4c6d37cf2d570f888d1c6000c66d27ac63496b0703361e9fc9bc7f309b7aa4407c5f339d186b0a5b72520d23d04b68d
-
Filesize
284B
MD5f1771b68f5f9b168b79ff59ae2daabe4
SHA10df6a835559f5c99670214a12700e7d8c28e5a42
SHA2569f8898ce35a47aeafced99ea0d17c33e73037bb2307c7688e50819966f4ae939
SHA512dae27d19727b89bec49398503baa6801640540355688dfabbe689c97545295c2c2d9b0f0dcd7cbc4cfbf701d0c0c3289e647a152f49ff242d1ecc741efe4145d
-
Filesize
96B
MD59d2788c114760c1bd855bfe247043d40
SHA1a7b77dd05b0c1f2500432a43fc8e14b356c33bc8
SHA256965633cd227e360bf7308e2d5b38ce9450fa40a67ea9b548bf59fbb21658d50d
SHA512c85141976bfed847ce4ef9c4fc035ae6c041dc4eba375128093085b71d992a68fe0b788d0d6941dfd6f9b25c52474b2af53ce90bb12cb84da0503a53ddc3ab15
-
Filesize
340B
MD5481fe068233e140f288159e5fb926521
SHA19474513ef9168f46663d407ef7b6097724ffda42
SHA2565a1b807d3b39ff21cfdfffc931e7d71127ac3328033dbfdb24edb962a63fbd43
SHA512c71eb4f43b4d4369df184fef9f05f9e8a2695e57301491eea2dccb9c701023ce6c1c2930cc3eab16ca98f73ad57d7c183a47352ede0bccdd8342f4ac07078598
-
Filesize
252B
MD5577b112e10e5ea2b58ff2ca5b307d7f4
SHA19e9838f080d67c0ae2c3a9ace01f22a42674c901
SHA256b11baa02f6249e94f13efbca4fe4f8cfe52a3009a882af15b3165a4545b7028d
SHA51280dc67e465760368b7e4d12a36103e14221fb500a582181d165fa8b82c0c1e086668358f8734eb77afb2904f3936f9febdb2bd8ea650a395a1d7ddb2126f40a9
-
Filesize
314B
MD5410a5d3c7d1f8486f6db07eb88d67c61
SHA164fb48d5a0792e6817e4804a1075e5b2f54589ed
SHA2561076511257c0d08d72423ab58720b9d72b908c4fe5b367a9b76803da62e1edfc
SHA512154e698df6801d1732eaeeada9eae85bf80ae59c17919d3e0cdcf3c73a50a93e01ae3692c99b536070b047b1ff3bb40c2076ba108ac8f38a54bd48071685bdbc
-
Filesize
27B
MD58cfd40a29e4709a3e8d134ccc9c62332
SHA1b76562089fbbb8b00e12854db428d575407b2897
SHA2564d35e269a61806a5815c806d6fbf0e5503bb7636cf65243a62c0faf3487877cc
SHA51260f247ea39442433d853194a645d5432cf096e020cce18c2602a37a8c69f80b7b079aa94a330121bd3e264890c2ae73b5835559f6cabe4db1b4d945b50b3229f
-
Filesize
206B
MD5e9bd3c7ec8d9f2ecf1f15c7d4c6e0fc5
SHA1173036f267a62c01cfed784c3170a3e2a3aff215
SHA25677d4af63f189cd7ab543eea575602b55e370e5933d24cf043606049505840dbe
SHA5126becebcafc12653e8952ca35c6a9b413a009aa9961283d3cdf902a500de0928766c2cf6ee0f6ef86b9691c0b760d4e81e56ff1edc9c83a28b8da7f99c08ad3af
-
Filesize
383KB
MD54b97df244d8027c60fee624355e1c59c
SHA1565d81dccc3c53ad6ec3a63abcbd57b63beb4248
SHA256e428013ebd9d991a22b459c4900e59856f713b09119c68d9d0a1428ed66ec44c
SHA512b193a46ec6a0d2184b6bffeff2c5e01e86d0e9ec201ce8da9f3fdb716e9330f084e9dddf583282d4bfafac3e058619eb748dc891f52dd6f3750a5c5cec50e27b
-
Filesize
16B
MD54655e23879c8d81d4d46b6cdc3f61c6a
SHA1bd12488f20e1f50da24972150b72165af928245b
SHA25677048b9f7ccfeeadf5971c089850e23db03e345a290cce71bcf725be886526bd
SHA512d4a37423311584b35df102f7cbe65622a4b2eee72d142f3102a442ef9dbd9ebe12fd7e4e083ee5b2a6219417a9f276588791564a991d55442e50582e011e8e51
-
Filesize
9KB
MD5321c7a9dc2458a596c68252e23e15491
SHA184c27aa653068e60a8dca7fe2fdbc71bba78988c
SHA25644ea2bc2759c895f803066f83c53212d7a3c0bbac81b7ccb244880c8d34e24b7
SHA512c55d32d68ccc1313206465a4ac39ab1730f2aaf51cf0ead637348fcc474665fc1a863c6978bdb3d5795f1dfaa8ce64f350bb3f5ef60a6cba4fd906613937ddf8
-
Filesize
32KB
MD5bb7df04e1b0a2570657527a7e108ae23
SHA15188431849b4613152fd7bdba6a3ff0a4fd6424b
SHA256c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479
SHA512768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012
-
Filesize
36KB
MD5874bab35823bfa3955fbe25a842a1f26
SHA17dd4802745ddfef7ad5c96a1fe91f85eee4e43b5
SHA2569fddeab53b47bef31734b30016351657ce0e5efbf18e9a2096a4bab99d9bc183
SHA51234f8560b2341790694266a0d3b6afb2e3a2f7af6ffbf939945a4d717e35f84d34d89973a51a646ede249222a7c26ea4ff6dfc67b5b4fbbe6df2b12fa2779158a
-
Filesize
206B
MD5fd30c02bfcda87fc7eda1954ba876543
SHA1bf9ddd3529fce961dba269fe749a9be7a9bcfef7
SHA256736cf40c0201cc740ccb5436e55adb95f0b6435594c4b88a261fb1cdca0d59b1
SHA51267cf5fb8556a6a8e994dac9954cef21af2b94b608df8831341c502d806ea10180263bec9166156780a764a0e39b480a5e7461cff437ed65d781253f4d49802eb
-
Filesize
801B
MD59b47b143873fd098da466d38f5ea6177
SHA1c121c84792ae58ec79c2dbfd2334298506d069e1
SHA2564a740b2c89bd3c8468e2095405ee4d53cdb074bb57c4c8e542319bb3e4aff63d
SHA512f532e901e221ffd2ef25d94f69999e7393f614c2339500e7b3f967f7079af86c7362b10a14563f339d27f19e5019ca49c8e258dc824fc5b46d7d2985e07a9393
-
Filesize
129B
MD5833a2623e6b92875a8bb715600d41c6a
SHA1401d76b93e940c30c2b85d4a070d9f3e0862ab2c
SHA256ce572dd92c0e7bc4e01bbc14e2172e5cd26afb559bebed877bf9abe2a600c686
SHA512a9a9145446b073c265f78778736cdea70d858d22fa3b5a56f72f1b9a98eea46435e78c21a7cf24ba446fc82e3737446c2805ca686c3e606abc1bc587efdb5a41
-
Filesize
512B
MD50684417d74717db528aa9a09fd6ebad4
SHA10bb477b0c93cb21921bb7f4f8f31449bca0ee5b7
SHA256c7101c690c0f4876d656e9f402f18980910c61a315174560507ddbc85f2ff468
SHA512a79736cf7e525adac483a31cab23d455dd6db5130feb470fdd149657955fa4928dad13041a1005925f664d200b31dc4124ebd1f4f2c7942e198c79d11a92c69e