Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
25s -
max time network
131s -
platform
android_x86 -
resource
android-x86-arm-20240624-en -
resource tags
androidarch:armarch:x86image:android-x86-arm-20240624-enlocale:en-usos:android-9-x86system -
submitted
19/08/2024, 08:17
Static task
static1
Behavioral task
behavioral1
Sample
aa41f19eda147bc36fea1202db4c751e_JaffaCakes118.apk
Resource
android-x86-arm-20240624-en
Behavioral task
behavioral2
Sample
aa41f19eda147bc36fea1202db4c751e_JaffaCakes118.apk
Resource
android-33-x64-arm64-20240624-en
General
-
Target
aa41f19eda147bc36fea1202db4c751e_JaffaCakes118.apk
-
Size
2.3MB
-
MD5
aa41f19eda147bc36fea1202db4c751e
-
SHA1
e1715553edd59b9191bf90282acb3008b58a1ac9
-
SHA256
327d3e0bfaa097018e8a49efb0ee4e4ecea2804dbf9e3bfa49d7ff39a448237b
-
SHA512
1819cae3f63940ce5b1509e5f531f8e41b8a7e2808ee69c86ffc7d76ef145a59436121c7647bc359ec4783dae158571af8731dfa4be13e13424b6e4ecf2064e9
-
SSDEEP
49152:EOtGiUThW8nzSE6dOqBm4N7LPZUyjYUYdVBZMx81WtXf/8jHrCIwpN4o:wFW8nsoh4N/ZUyMUyJMWOXerCIwDP
Malware Config
Signatures
-
Checks if the Android device is rooted. 1 TTPs 2 IoCs
ioc Process /sbin/su /system/bin/sh -c type su /system/app/Superuser.apk com.qurong.qrmarket -
Loads dropped Dex/Jar 1 TTPs 3 IoCs
Runs executable file dropped to the device during analysis.
ioc pid Process /data/data/com.qurong.qrmarket/mix.dex 4222 com.qurong.qrmarket /data/data/com.qurong.qrmarket/mix.dex 4323 /system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/data/com.qurong.qrmarket/mix.dex --output-vdex-fd=56 --oat-fd=57 --oat-location=/data/data/com.qurong.qrmarket/oat/x86/mix.odex --compiler-filter=quicken --class-loader-context=& /data/data/com.qurong.qrmarket/mix.dex 4222 com.qurong.qrmarket -
Queries information about active data network 1 TTPs 1 IoCs
description ioc Process Framework service call android.net.IConnectivityManager.getActiveNetworkInfo com.qurong.qrmarket -
Queries the mobile country code (MCC) 1 TTPs 1 IoCs
description ioc Process Framework service call com.android.internal.telephony.ITelephony.getNetworkCountryIsoForPhone com.qurong.qrmarket -
Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs
description ioc Process Framework service call android.app.IActivityManager.registerReceiver com.qurong.qrmarket -
Checks CPU information 2 TTPs 1 IoCs
description ioc Process File opened for read /proc/cpuinfo com.qurong.qrmarket -
Checks memory information 2 TTPs 1 IoCs
description ioc Process File opened for read /proc/meminfo com.qurong.qrmarket
Processes
-
com.qurong.qrmarket1⤵
- Checks if the Android device is rooted.
- Loads dropped Dex/Jar
- Queries information about active data network
- Queries the mobile country code (MCC)
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Checks CPU information
- Checks memory information
PID:4222 -
sh -c getprop ro.yunos.version2⤵PID:4297
-
-
getprop ro.yunos.version2⤵PID:4297
-
-
/system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/data/com.qurong.qrmarket/mix.dex --output-vdex-fd=56 --oat-fd=57 --oat-location=/data/data/com.qurong.qrmarket/oat/x86/mix.odex --compiler-filter=quicken --class-loader-context=&2⤵
- Loads dropped Dex/Jar
PID:4323
-
-
logcat -d -v threadtime2⤵PID:4456
-
-
/system/bin/sh -c getprop ro.miui.ui.version.name2⤵PID:4477
-
-
getprop ro.miui.ui.version.name2⤵PID:4477
-
-
/system/bin/sh -c getprop ro.build.version.emui2⤵PID:4501
-
-
getprop ro.build.version.emui2⤵PID:4501
-
-
/system/bin/sh -c getprop ro.lenovo.series2⤵PID:4529
-
-
getprop ro.lenovo.series2⤵PID:4529
-
-
/system/bin/sh -c getprop ro.build.nubia.rom.name2⤵PID:4554
-
-
getprop ro.build.nubia.rom.name2⤵PID:4554
-
-
/system/bin/sh -c getprop ro.meizu.product.model2⤵PID:4579
-
-
getprop ro.meizu.product.model2⤵PID:4579
-
-
/system/bin/sh -c getprop ro.build.version.opporom2⤵PID:4604
-
-
getprop ro.build.version.opporom2⤵PID:4604
-
-
/system/bin/sh -c getprop ro.vivo.os.build.display.id2⤵PID:4635
-
-
getprop ro.vivo.os.build.display.id2⤵PID:4635
-
-
/system/bin/sh -c getprop ro.aa.romver2⤵PID:4660
-
-
getprop ro.aa.romver2⤵PID:4660
-
-
/system/bin/sh -c getprop ro.lewa.version2⤵PID:4685
-
-
getprop ro.lewa.version2⤵PID:4685
-
-
/system/bin/sh -c getprop ro.gn.gnromvernumber2⤵PID:4709
-
-
getprop ro.gn.gnromvernumber2⤵PID:4709
-
-
/system/bin/sh -c getprop ro.build.tyd.kbstyle_version2⤵PID:4733
-
-
getprop ro.build.tyd.kbstyle_version2⤵PID:4733
-
-
/system/bin/sh -c getprop ro.build.fingerprint2⤵PID:4758
-
-
getprop ro.build.fingerprint2⤵PID:4758
-
-
/system/bin/sh -c getprop ro.build.rom.id2⤵PID:4784
-
-
getprop ro.build.rom.id2⤵PID:4784
-
-
/system/bin/sh -c type su2⤵
- Checks if the Android device is rooted.
PID:4808
-
Network
MITRE ATT&CK Mobile v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
4KB
MD5f2b4b0190b9f384ca885f0c8c9b14700
SHA1934ff2646757b5b6e7f20f6a0aa76c7f995d9361
SHA2560a8ffb6b327963558716e87db8946016d143e39f895fa1b43e95ba7032ce2514
SHA512ec12685fc0d60526eed4d38820aad95611f3e93ae372be5a57142d8e8a1ba17e6e5dfe381a4e1365dddc0b363c9c40daaffdc1245bd515fddac69bf1abacd7f1
-
Filesize
512B
MD5afe535c38bd0e294b0571ce0945853ab
SHA184cd23ac1af62c4af2938e029d3f36aa26efe7a9
SHA25639c87a8ed53cc76889dfc6815eb6ebc976c870938fe263321fd2e7cd61c6a48b
SHA51292d1cf1b069c49188503fb74d3e6fd6e55ae520d1dce08d59a4ca9ad914d5f6827c498c21b6c141149247c4a5d8691b1dc939b51fc04a0fcb8f0894a7cf6a4ae
-
Filesize
32KB
MD5bb7df04e1b0a2570657527a7e108ae23
SHA15188431849b4613152fd7bdba6a3ff0a4fd6424b
SHA256c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479
SHA512768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012
-
Filesize
169KB
MD5b0f1c932eee6b7ac88817cbc879ea744
SHA195a531fd73ab1bfb8a03159d00edb165401d2564
SHA256593386d5d65f28a95cb50d3a4951c29beee17893517acc589e4424a78d0148d0
SHA5121b124301c40b5139981d14a007881b2544091d4bcf5a57799737ce3326a8fca797aaac5e1f90325826e52bec233bc14b47e4bf31f070db4306ca4bec03b63e89
-
Filesize
12KB
MD53fe30614d7e0d11db870b4624f6c50e0
SHA1053ff0fc621ab40f2afeddb3e7b4a73ee41ec533
SHA25667c532f0324228dd33b445cd399c1426e3a0e0cdc7b9358c66b402c5d40a838d
SHA512c7c09e97a408e88aacaf8099ad4d1fa604d58113393500a384eb3c2eb7c3c105af41314934b86eca2f088045cbab5a20d768bbb295448dc1ae6cb6c3f59821ae
-
Filesize
512B
MD53e9ea2038a11baebcbea749219be935f
SHA199c1efd6cc87dab6454c8e9cd75caa02914627dc
SHA2561d74e657bc4f683128851f39148e6cb8ce4c4c4eee0826e8faf29f6563c0d604
SHA5127ed1a73250be7eb16c82b7d68a999c752f648316ab204afe2cd951f0848c67b31865210054cd0757d1a74bf57b409b8e86dc1a2b794b9369a3e0982b6cd4896a
-
Filesize
16KB
MD51213b1d9fc502735940ee080c10ad4fd
SHA17533704aa09594b8f71134d4abb6e932088bc5a0
SHA2567b8cd20f6277f68c541cd4bf2d45fa3dc5f188d2248d0fbedc14bb462ae7c605
SHA5128203439d5970f813708f6ba41976f61d63d0b749a07a868b56b23bc37085135215cbde085ad96e675d867b6eb63e4de9d53dfc0d09891108fba62ad21687ead3
-
Filesize
4KB
MD57614784d8e0311e19f136682eb6aa1c4
SHA197aa27ec305ae7d4438567c9aa5468ece833ce05
SHA25616c7a0dbaea5f85b367c6ca93c0bba5b9ac5f7ed6477e2abc4d71dae475c4131
SHA51228857eeb666b3e2125c0e89e6aecde92ac0cb6e6676bd0f99acdcee9167d0250a4d7878e089aad55cf13a538ff851ca2382c8eb242cbf5af06e1b6ef2290a4b0
-
Filesize
292B
MD563f77f99bd2c2b772a479923bde11974
SHA1c7632e7d301e4463fafce85f84e9c3d7da3fdbbe
SHA2564c76a3af64cdd2f8713ffe2733dea50dbe714d0ca41c17d1847ee5b62a7ca615
SHA5123aae4a89d1ed51fdd911cb367eb10afe3c2264e4222085891b18a60d5412f85d10bf5c8f3c6642db70abb9aa42732bac5c42c42ee32d587100f53c21b5beb16c