Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    25s
  • max time network
    131s
  • platform
    android_x86
  • resource
    android-x86-arm-20240624-en
  • resource tags

    androidarch:armarch:x86image:android-x86-arm-20240624-enlocale:en-usos:android-9-x86system
  • submitted
    19/08/2024, 08:17

General

  • Target

    aa41f19eda147bc36fea1202db4c751e_JaffaCakes118.apk

  • Size

    2.3MB

  • MD5

    aa41f19eda147bc36fea1202db4c751e

  • SHA1

    e1715553edd59b9191bf90282acb3008b58a1ac9

  • SHA256

    327d3e0bfaa097018e8a49efb0ee4e4ecea2804dbf9e3bfa49d7ff39a448237b

  • SHA512

    1819cae3f63940ce5b1509e5f531f8e41b8a7e2808ee69c86ffc7d76ef145a59436121c7647bc359ec4783dae158571af8731dfa4be13e13424b6e4ecf2064e9

  • SSDEEP

    49152:EOtGiUThW8nzSE6dOqBm4N7LPZUyjYUYdVBZMx81WtXf/8jHrCIwpN4o:wFW8nsoh4N/ZUyMUyJMWOXerCIwDP

Malware Config

Signatures

  • Checks if the Android device is rooted. 1 TTPs 2 IoCs
  • Loads dropped Dex/Jar 1 TTPs 3 IoCs

    Runs executable file dropped to the device during analysis.

  • Queries information about active data network 1 TTPs 1 IoCs
  • Queries the mobile country code (MCC) 1 TTPs 1 IoCs
  • Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs
  • Checks CPU information 2 TTPs 1 IoCs
  • Checks memory information 2 TTPs 1 IoCs

Processes

  • com.qurong.qrmarket
    1⤵
    • Checks if the Android device is rooted.
    • Loads dropped Dex/Jar
    • Queries information about active data network
    • Queries the mobile country code (MCC)
    • Registers a broadcast receiver at runtime (usually for listening for system events)
    • Checks CPU information
    • Checks memory information
    PID:4222
    • sh -c getprop ro.yunos.version
      2⤵
        PID:4297
      • getprop ro.yunos.version
        2⤵
          PID:4297
        • /system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/data/com.qurong.qrmarket/mix.dex --output-vdex-fd=56 --oat-fd=57 --oat-location=/data/data/com.qurong.qrmarket/oat/x86/mix.odex --compiler-filter=quicken --class-loader-context=&
          2⤵
          • Loads dropped Dex/Jar
          PID:4323
        • logcat -d -v threadtime
          2⤵
            PID:4456
          • /system/bin/sh -c getprop ro.miui.ui.version.name
            2⤵
              PID:4477
            • getprop ro.miui.ui.version.name
              2⤵
                PID:4477
              • /system/bin/sh -c getprop ro.build.version.emui
                2⤵
                  PID:4501
                • getprop ro.build.version.emui
                  2⤵
                    PID:4501
                  • /system/bin/sh -c getprop ro.lenovo.series
                    2⤵
                      PID:4529
                    • getprop ro.lenovo.series
                      2⤵
                        PID:4529
                      • /system/bin/sh -c getprop ro.build.nubia.rom.name
                        2⤵
                          PID:4554
                        • getprop ro.build.nubia.rom.name
                          2⤵
                            PID:4554
                          • /system/bin/sh -c getprop ro.meizu.product.model
                            2⤵
                              PID:4579
                            • getprop ro.meizu.product.model
                              2⤵
                                PID:4579
                              • /system/bin/sh -c getprop ro.build.version.opporom
                                2⤵
                                  PID:4604
                                • getprop ro.build.version.opporom
                                  2⤵
                                    PID:4604
                                  • /system/bin/sh -c getprop ro.vivo.os.build.display.id
                                    2⤵
                                      PID:4635
                                    • getprop ro.vivo.os.build.display.id
                                      2⤵
                                        PID:4635
                                      • /system/bin/sh -c getprop ro.aa.romver
                                        2⤵
                                          PID:4660
                                        • getprop ro.aa.romver
                                          2⤵
                                            PID:4660
                                          • /system/bin/sh -c getprop ro.lewa.version
                                            2⤵
                                              PID:4685
                                            • getprop ro.lewa.version
                                              2⤵
                                                PID:4685
                                              • /system/bin/sh -c getprop ro.gn.gnromvernumber
                                                2⤵
                                                  PID:4709
                                                • getprop ro.gn.gnromvernumber
                                                  2⤵
                                                    PID:4709
                                                  • /system/bin/sh -c getprop ro.build.tyd.kbstyle_version
                                                    2⤵
                                                      PID:4733
                                                    • getprop ro.build.tyd.kbstyle_version
                                                      2⤵
                                                        PID:4733
                                                      • /system/bin/sh -c getprop ro.build.fingerprint
                                                        2⤵
                                                          PID:4758
                                                        • getprop ro.build.fingerprint
                                                          2⤵
                                                            PID:4758
                                                          • /system/bin/sh -c getprop ro.build.rom.id
                                                            2⤵
                                                              PID:4784
                                                            • getprop ro.build.rom.id
                                                              2⤵
                                                                PID:4784
                                                              • /system/bin/sh -c type su
                                                                2⤵
                                                                • Checks if the Android device is rooted.
                                                                PID:4808

                                                            Network

                                                            MITRE ATT&CK Mobile v15

                                                            Replay Monitor

                                                            Loading Replay Monitor...

                                                            Downloads

                                                            • /data/data/com.qurong.qrmarket/databases/bugly_db_legu

                                                              Filesize

                                                              4KB

                                                              MD5

                                                              f2b4b0190b9f384ca885f0c8c9b14700

                                                              SHA1

                                                              934ff2646757b5b6e7f20f6a0aa76c7f995d9361

                                                              SHA256

                                                              0a8ffb6b327963558716e87db8946016d143e39f895fa1b43e95ba7032ce2514

                                                              SHA512

                                                              ec12685fc0d60526eed4d38820aad95611f3e93ae372be5a57142d8e8a1ba17e6e5dfe381a4e1365dddc0b363c9c40daaffdc1245bd515fddac69bf1abacd7f1

                                                            • /data/data/com.qurong.qrmarket/databases/bugly_db_legu-journal

                                                              Filesize

                                                              512B

                                                              MD5

                                                              afe535c38bd0e294b0571ce0945853ab

                                                              SHA1

                                                              84cd23ac1af62c4af2938e029d3f36aa26efe7a9

                                                              SHA256

                                                              39c87a8ed53cc76889dfc6815eb6ebc976c870938fe263321fd2e7cd61c6a48b

                                                              SHA512

                                                              92d1cf1b069c49188503fb74d3e6fd6e55ae520d1dce08d59a4ca9ad914d5f6827c498c21b6c141149247c4a5d8691b1dc939b51fc04a0fcb8f0894a7cf6a4ae

                                                            • /data/data/com.qurong.qrmarket/databases/bugly_db_legu-shm

                                                              Filesize

                                                              32KB

                                                              MD5

                                                              bb7df04e1b0a2570657527a7e108ae23

                                                              SHA1

                                                              5188431849b4613152fd7bdba6a3ff0a4fd6424b

                                                              SHA256

                                                              c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479

                                                              SHA512

                                                              768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012

                                                            • /data/data/com.qurong.qrmarket/databases/bugly_db_legu-wal

                                                              Filesize

                                                              169KB

                                                              MD5

                                                              b0f1c932eee6b7ac88817cbc879ea744

                                                              SHA1

                                                              95a531fd73ab1bfb8a03159d00edb165401d2564

                                                              SHA256

                                                              593386d5d65f28a95cb50d3a4951c29beee17893517acc589e4424a78d0148d0

                                                              SHA512

                                                              1b124301c40b5139981d14a007881b2544091d4bcf5a57799737ce3326a8fca797aaac5e1f90325826e52bec233bc14b47e4bf31f070db4306ca4bec03b63e89

                                                            • /data/data/com.qurong.qrmarket/databases/xUtils_http_cookie.db

                                                              Filesize

                                                              12KB

                                                              MD5

                                                              3fe30614d7e0d11db870b4624f6c50e0

                                                              SHA1

                                                              053ff0fc621ab40f2afeddb3e7b4a73ee41ec533

                                                              SHA256

                                                              67c532f0324228dd33b445cd399c1426e3a0e0cdc7b9358c66b402c5d40a838d

                                                              SHA512

                                                              c7c09e97a408e88aacaf8099ad4d1fa604d58113393500a384eb3c2eb7c3c105af41314934b86eca2f088045cbab5a20d768bbb295448dc1ae6cb6c3f59821ae

                                                            • /data/data/com.qurong.qrmarket/databases/xUtils_http_cookie.db-journal

                                                              Filesize

                                                              512B

                                                              MD5

                                                              3e9ea2038a11baebcbea749219be935f

                                                              SHA1

                                                              99c1efd6cc87dab6454c8e9cd75caa02914627dc

                                                              SHA256

                                                              1d74e657bc4f683128851f39148e6cb8ce4c4c4eee0826e8faf29f6563c0d604

                                                              SHA512

                                                              7ed1a73250be7eb16c82b7d68a999c752f648316ab204afe2cd951f0848c67b31865210054cd0757d1a74bf57b409b8e86dc1a2b794b9369a3e0982b6cd4896a

                                                            • /data/data/com.qurong.qrmarket/databases/xUtils_http_cookie.db-wal

                                                              Filesize

                                                              16KB

                                                              MD5

                                                              1213b1d9fc502735940ee080c10ad4fd

                                                              SHA1

                                                              7533704aa09594b8f71134d4abb6e932088bc5a0

                                                              SHA256

                                                              7b8cd20f6277f68c541cd4bf2d45fa3dc5f188d2248d0fbedc14bb462ae7c605

                                                              SHA512

                                                              8203439d5970f813708f6ba41976f61d63d0b749a07a868b56b23bc37085135215cbde085ad96e675d867b6eb63e4de9d53dfc0d09891108fba62ad21687ead3

                                                            • /data/data/com.qurong.qrmarket/databases/xUtils_http_cookie.db-wal

                                                              Filesize

                                                              4KB

                                                              MD5

                                                              7614784d8e0311e19f136682eb6aa1c4

                                                              SHA1

                                                              97aa27ec305ae7d4438567c9aa5468ece833ce05

                                                              SHA256

                                                              16c7a0dbaea5f85b367c6ca93c0bba5b9ac5f7ed6477e2abc4d71dae475c4131

                                                              SHA512

                                                              28857eeb666b3e2125c0e89e6aecde92ac0cb6e6676bd0f99acdcee9167d0250a4d7878e089aad55cf13a538ff851ca2382c8eb242cbf5af06e1b6ef2290a4b0

                                                            • /data/data/com.qurong.qrmarket/mix.dex

                                                              Filesize

                                                              292B

                                                              MD5

                                                              63f77f99bd2c2b772a479923bde11974

                                                              SHA1

                                                              c7632e7d301e4463fafce85f84e9c3d7da3fdbbe

                                                              SHA256

                                                              4c76a3af64cdd2f8713ffe2733dea50dbe714d0ca41c17d1847ee5b62a7ca615

                                                              SHA512

                                                              3aae4a89d1ed51fdd911cb367eb10afe3c2264e4222085891b18a60d5412f85d10bf5c8f3c6642db70abb9aa42732bac5c42c42ee32d587100f53c21b5beb16c