Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

General

  • Target

    43f8e613910e21ad26fad0150fca523f_JaffaCakes118

  • Size

    1.3MB

  • Sample

    241014-yxgjwaxhjj

  • MD5

    43f8e613910e21ad26fad0150fca523f

  • SHA1

    7a17643a10e6dc0f4d3d58da8475d1fbee4eda3b

  • SHA256

    01b1c40231c994f14457a65db196ffedbbd1312c8b685e5ac282f6bb6ba646ac

  • SHA512

    8c1ddaece0eefdbb2cff5a89ffebb1d2fef50c02b7ba9f5993c550f683e1b328771b839c83d10145e86dbad95f034161bd30f2358c37ae3516065f32f948d9f7

  • SSDEEP

    24576:moL0otaYtXMjG0dJZXs+bS8oaPnDAUCxFMyjTo+38jTmhq/13tdHbZKm51Ob83F:1Q7YtsdJZJboaPDAUcFRj/MjTmhq/1X5

Malware Config

Targets

    • Target

      43f8e613910e21ad26fad0150fca523f_JaffaCakes118

    • Size

      1.3MB

    • MD5

      43f8e613910e21ad26fad0150fca523f

    • SHA1

      7a17643a10e6dc0f4d3d58da8475d1fbee4eda3b

    • SHA256

      01b1c40231c994f14457a65db196ffedbbd1312c8b685e5ac282f6bb6ba646ac

    • SHA512

      8c1ddaece0eefdbb2cff5a89ffebb1d2fef50c02b7ba9f5993c550f683e1b328771b839c83d10145e86dbad95f034161bd30f2358c37ae3516065f32f948d9f7

    • SSDEEP

      24576:moL0otaYtXMjG0dJZXs+bS8oaPnDAUCxFMyjTo+38jTmhq/13tdHbZKm51Ob83F:1Q7YtsdJZJboaPDAUcFRj/MjTmhq/1X5

    • Removes its main activity from the application launcher

    • Loads dropped Dex/Jar

      Runs executable file dropped to the device during analysis.

    • Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps)

    • Queries account information for other applications stored on the device

      Application may abuse the framework's APIs to collect account information stored on the device.

    • Queries information about running processes on the device

      Application may abuse the framework's APIs to collect information about running processes on the device.

    • Domain associated with commercial stalkerware software, includes indicators from echap.eu.org

    • Queries information about active data network

    • Queries information about the current Wi-Fi connection

      Application may abuse the framework's APIs to collect information about the current Wi-Fi connection.

    • Queries the unique device ID (IMEI, MEID, IMSI)

    • Reads information about phone network operator.

MITRE ATT&CK Mobile v15

Tasks