Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

7

Static

static

6

2f041762fd...18.apk

android-9-x86

7

2f041762fd...18.apk

android-11-x64

7

plugin-deploy.apk

android-9-x86

plugin-deploy.apk

android-10-x64

plugin-deploy.apk

android-11-x64

Analysis

  • max time kernel
    64s
  • max time network
    131s
  • platform
    android_x86
  • resource
    android-x86-arm-20240624-en
  • resource tags

    androidarch:armarch:x86image:android-x86-arm-20240624-enlocale:en-usos:android-9-x86system
  • submitted
    09/07/2024, 04:37

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    2f041762fdb91537415151d0ce3683c5_JaffaCakes118.apk

  • Size

    12.9MB

  • MD5

    2f041762fdb91537415151d0ce3683c5

  • SHA1

    1f49ecbb2e7cd116e113bcf36e9b327f59612264

  • SHA256

    7e25def81d58562012ca14747eb3357b414cec44bdfdfc1edb2027838b05620f

  • SHA512

    256c53cb8fc285e5e94ab29bb75ae706dc309527128b4b92d2ad804143a74b0c3998015ca01ab0a22c02e45e053d70729c3bc9fd152fa35643438c7aa7e222c2

  • SSDEEP

    393216:JlC3Y3paiZIRjd1mZVEu4PNBfumsW1sL5F8:JlC3YZaMIr1gOzNpsWEy

Score
7/10
discoveryevasionimpact

Malware Config

Signatures

  • Loads dropped Dex/Jar 1 TTPs 2 IoCs

    Runs executable file dropped to the device during analysis.

    evasion
  • Domain associated with commercial stalkerware software, includes indicators from echap.eu.org 1 IoCs
  • Queries information about active data network 1 TTPs 1 IoCs
    discovery
  • Queries information about the current Wi-Fi connection 1 TTPs 1 IoCs

    Application may abuse the framework's APIs to collect information about the current Wi-Fi connection.

    discovery
  • Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs
    impact
  • Checks CPU information 2 TTPs 1 IoCs

Processes

  • com.xiaoma.ieltstone
    1⤵
    • Loads dropped Dex/Jar
    • Queries information about active data network
    • Queries information about the current Wi-Fi connection
    • Uses Crypto APIs (Might try to encrypt user data)
    • Checks CPU information
    PID:4307
    • /system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.xiaoma.ieltstone/app_push_lib/plugin-deploy.jar --output-vdex-fd=41 --oat-fd=42 --oat-location=/data/user/0/com.xiaoma.ieltstone/app_push_lib/oat/x86/plugin-deploy.odex --compiler-filter=quicken --class-loader-context=&
      2⤵
      • Loads dropped Dex/Jar
      PID:4332

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • /data/data/com.xiaoma.ieltstone/app_push_lib/plugin-deploy.jar
    Filesize

    213KB

    MD5

    e70723b8f6c4c7c09a6019733022cf53

    SHA1

    e3ca32166c65e4dc73c21347ab22d54a7b5a9a83

    SHA256

    32d35cd80b0302e3fcdd7349b4ff9a7b689ce080435109607ff79a834ff710d5

    SHA512

    461c0499193c5ef5aa4e2e5d358031e7d28c98c8e1e38d22b710271bf3b561c28232bfaadbc2c275357e31b7b0ad6bca798008328ac3cff3701c1c9cca2ddddd

    Download Submit

  • /data/data/com.xiaoma.ieltstone/app_push_lib/plugin-deploy.key
    Filesize

    174B

    MD5

    1ea8459a688352c3573a8e80727c2644

    SHA1

    9b47864e96eed98798a6da2b8860c8f8a68f089e

    SHA256

    be2c0f9e472138a78d35f29013fc43dfeae991806dfebbc5be5c8dc86b8a1093

    SHA512

    99a26c03e760fdac91546a47e18e58851996b7e38e93812a6be23f1eee64370323ac492c4c224bd419d91566356fcb8eca3989ff4f2ce41db3d16301fa9dd75f

    Download Submit

  • /data/data/com.xiaoma.ieltstone/files/mobclick_agent_sealed_com.xiaoma.ieltstone
    Filesize

    562B

    MD5

    b35012f8bd43c87582904f603aed2dd6

    SHA1

    6968af4b637213ac0fe2f20ccaba85dfa7ac1022

    SHA256

    2188a7a12b9f33496bc27286e2a08920ba640f9e08d7e78883f1452c681d7cff

    SHA512

    2e42d1a8b4336f5652781a55506aa6df253891b90001db1af278a557f042dee9f957f132eb00111f7794f3f2cc97c6b8a863319deb8771c5c4b6308e6e3b514f

    Download Submit

  • /data/data/com.xiaoma.ieltstone/files/umeng_it.cache
    Filesize

    211B

    MD5

    ec273a47809d0156f89852fc9bda5ad7

    SHA1

    1149f798d9e443d8c73bb313daefd0c304ca07f0

    SHA256

    925e1313b1b8e3aa6af62b594ff1175c3e4f01e9b1629cad03f0daf4ce9c5636

    SHA512

    590d9557120cf67697331591fb3bdd8aa30e3ac6e1fe46e0b7b9e1e3d3917e6447ec3f6791943a8fdc01d00a69770c34141ec740352e30200df9f92e3e451b92

    Download Submit

  • /data/user/0/com.xiaoma.ieltstone/app_push_lib/plugin-deploy.jar
    Filesize

    530KB

    MD5

    5597a541eabd3fb792c581587550dc4a

    SHA1

    6500b0ff20c75717e1cb67dcee76b4641a4e8a35

    SHA256

    473b02216f8d2b5ffb26571e51ff322e3ce04ba45418408452bea103576ee8e2

    SHA512

    39b4acd82f67f11140cd1b0b4291e656a4a46ba63064509977f3f1de24a931dce83964f031e16ccab95cf0540ac5f613ca87d7665ce99f1c1ee4a0778e2c19e2

    Download Submit

  • /data/user/0/com.xiaoma.ieltstone/app_push_lib/plugin-deploy.jar
    Filesize

    530KB

    MD5

    bdfa71feb08b80b649fddcd7488b03b4

    SHA1

    bcacf11199fd2c353034a7271b5dbfe2dd4cbddb

    SHA256

    f8bd07a7afce2d102976afaadd33dc70336a0b06682ac8d6fe9544a08d086d1d

    SHA512

    37dc848b995def498d0c832a76ed0ad429db18f26a5e9659c2b77a63bff555560160b6be4d22387eb529b2291bb27ae21718ddadb315bd1aa4c092d6330f049a

    Download Submit