Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
147s -
max time network
154s -
platform
android_x64 -
resource
android-x64-20240624-en -
resource tags
androidarch:x64arch:x86image:android-x64-20240624-enlocale:en-usos:android-10-x64system -
submitted
14/10/2024, 20:09
Static task
static1
Behavioral task
behavioral1
Sample
43f8e613910e21ad26fad0150fca523f_JaffaCakes118.apk
Resource
android-x86-arm-20240624-en
Behavioral task
behavioral2
Sample
43f8e613910e21ad26fad0150fca523f_JaffaCakes118.apk
Resource
android-x64-20240624-en
General
-
Target
43f8e613910e21ad26fad0150fca523f_JaffaCakes118.apk
-
Size
1.3MB
-
MD5
43f8e613910e21ad26fad0150fca523f
-
SHA1
7a17643a10e6dc0f4d3d58da8475d1fbee4eda3b
-
SHA256
01b1c40231c994f14457a65db196ffedbbd1312c8b685e5ac282f6bb6ba646ac
-
SHA512
8c1ddaece0eefdbb2cff5a89ffebb1d2fef50c02b7ba9f5993c550f683e1b328771b839c83d10145e86dbad95f034161bd30f2358c37ae3516065f32f948d9f7
-
SSDEEP
24576:moL0otaYtXMjG0dJZXs+bS8oaPnDAUCxFMyjTo+38jTmhq/13tdHbZKm51Ob83F:1Q7YtsdJZJboaPDAUcFRj/MjTmhq/1X5
Malware Config
Signatures
-
pid Process 4969 com.xsfg.nwfo.cszd -
Loads dropped Dex/Jar 1 TTPs 2 IoCs
Runs executable file dropped to the device during analysis.
ioc pid Process /data/user/0/com.xsfg.nwfo.cszd/app_mjf/dz.jar 4969 com.xsfg.nwfo.cszd /data/user/0/com.xsfg.nwfo.cszd/app_mjf/dz.jar 5028 com.xsfg.nwfo.cszd:daemon -
Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
-
Queries account information for other applications stored on the device 1 TTPs 1 IoCs
Application may abuse the framework's APIs to collect account information stored on the device.
description ioc Process Framework service call android.accounts.IAccountManager.getAccountsAsUser com.xsfg.nwfo.cszd -
Queries information about running processes on the device 1 TTPs 1 IoCs
Application may abuse the framework's APIs to collect information about running processes on the device.
description ioc Process Framework service call android.app.IActivityManager.getRunningAppProcesses com.xsfg.nwfo.cszd -
Domain associated with commercial stalkerware software, includes indicators from echap.eu.org 1 IoCs
flow ioc 26 alog.umeng.com -
Queries information about active data network 1 TTPs 1 IoCs
description ioc Process Framework service call android.net.IConnectivityManager.getActiveNetworkInfo com.xsfg.nwfo.cszd -
Queries information about the current Wi-Fi connection 1 TTPs 1 IoCs
Application may abuse the framework's APIs to collect information about the current Wi-Fi connection.
description ioc Process Framework service call android.net.wifi.IWifiManager.getConnectionInfo com.xsfg.nwfo.cszd -
Queries the unique device ID (IMEI, MEID, IMSI) 1 TTPs
-
Reads information about phone network operator. 1 TTPs
-
Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs
description ioc Process Framework service call android.app.IActivityManager.registerReceiver com.xsfg.nwfo.cszd -
Checks CPU information 2 TTPs 1 IoCs
description ioc Process File opened for read /proc/cpuinfo com.xsfg.nwfo.cszd
Processes
-
com.xsfg.nwfo.cszd1⤵
- Removes its main activity from the application launcher
- Loads dropped Dex/Jar
- Queries account information for other applications stored on the device
- Queries information about running processes on the device
- Queries information about active data network
- Queries information about the current Wi-Fi connection
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Checks CPU information
PID:4969
-
com.xsfg.nwfo.cszd:daemon1⤵
- Loads dropped Dex/Jar
PID:5028
Network
MITRE ATT&CK Mobile v15
Defense Evasion
Download New Code at Runtime
1Hide Artifacts
1Suppress Application Icon
1Virtualization/Sandbox Evasion
1System Checks
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
105KB
MD523ba0b249042b7ba33e92c0199b0ea4a
SHA199b13ee9f7307316c2337953fceed87e9942b794
SHA2561ed0751a141b17c80a921f5e8ba90c66a56b8e73156f5cbe133b57d550ca4ef2
SHA5120cc88e2b7c2ffa4db274d690e3bf12098ec804b9fcd9e92b57d2fa0c4161031d2e84c91d86ba8e2b6e8b4837852defa099333f76bcd454c67b31632d0cdd4861
-
Filesize
724B
MD5df1ff980a354417d0c471130c49de84a
SHA1ec6f5a0c8501b74abb9b35ee5e72cc245be59a6f
SHA2568628b7439382f5cf1d2ffc743a19cfb34ab6444186c21755c919b23586967cad
SHA5124b1761a91eb352dcafad7e33405e9416028ad859e975a16d8a72cda68e9f6a10ba09de0e77e9a6d7518dc747d33546d31f9aa63803b319676bf0fa092e19e889
-
Filesize
105KB
MD5293ea5f01e27975bed5179ba79d80eac
SHA1c5b0806a537fd1cb753e11f1a9684933317716b8
SHA2568d86de68978e859c8262c0d0e932d3a1d57457b57ce88940620befab1bcead5b
SHA512c7cd2881367fdf95ec4151449b359decdae1adf136388edbaaa9880c7ebd14fb3579e7a15600a856988c55d207f7ba1fd7d938f4d9168aba8a7ff1c3029d6b53
-
Filesize
28KB
MD5dae68dcffc3d522a79f98ebbc3b6d457
SHA16df5dce9a50f12044a2d20b8d1742ae47b82ee03
SHA25656cf91ca198812e0ef9ba4af0e96c08a32e24c917bcf2250bdebdfd7fd6f5286
SHA51223b76f988399e9c9e4f5a7e8d19ecb765abdb115b0beee35f8ca9d221bbc5ee79f0152fac4261cc91eb9e7f874b5c6e9bff2dbb1812d31412d506cf83c16adcd
-
Filesize
8KB
MD5d7d3bddb22a3622d4f4f41d08d7cb44b
SHA10880b09b276dcce4f9ec7b9b6d60a974ed85a302
SHA256c9b91911e1732c2fbd7789fcdbd6ee2965ae30ef3dd122db7ae5431793d37786
SHA51247971b4890e798df3996ecf1706f6fee9b6c9996202359eaf5d238c87120fcaa06fef67fe10d7d576ae517038498b37d90414ae220ab88d3d9b238876fbf8cb6
-
Filesize
512B
MD5f21c1df73204c81d01dfcdf313488de1
SHA1c37e0717269454ee1dd701846132cc1e9d39c663
SHA2562e627df1b67ad1df61ece0fce73a9fa6bdf3c8c26b7d7cd15b223af86e7a3e9f
SHA51266170f8fa1e16ee959592f0dc82ec4321c82a20ac0f2c7b337b90149d65832e53db81e1fcee04fee5ffd189f35c3787bf21ae83105e034367224cd19fd990d73
-
Filesize
8KB
MD5474d46d4d1976570928d9eed97aad4e9
SHA1c71d2e2dd4f7cc72e66466f24225161191693e4d
SHA256721da1f4d369580db082c0ca79416ec518b533359cb88f9e79343ade1752d780
SHA5126aebaa2237bc648ff87dcb1f76629f03aae2fd920d34cc0e49fde917d9ad440ecf0ac4171f45d1ebac8e72dc0498b5905d21e14520f78ae04e8cdfece6836e2a
-
Filesize
4KB
MD58e22efb943e25e64c59d53976cf78751
SHA1d8a350a475c5757b9d31a37dece6978cf53249a4
SHA256cbcca7fa5f784516af44f04933407232641ee361edac20fb476f285a041048b4
SHA512db88734c5ce054ad550063dbfc3e1489e5cbd3c3c364223ec2e2573ae2555777f38e74e1551b07aad93d15f28b54f352c66146420213550a9e29c313039af0dc
-
Filesize
8KB
MD5303dacc32040e2dd4a42f002f69e0e58
SHA15a6fc6cbd9873405bce66600fb42bb1fe8ff52cb
SHA256bbadb054e61d21fa7cb3af4279de2686570cbe0d8e6c2c77a4713163de3f2e1e
SHA5128fcbc8a87dc1ebff1cc56588ad36014e582be10bff8840ac6a53b211d08ccb5c04c0d912a00270c8b09db8847c91b4ff1c79ea2e828198e0c4b2e4fa45a46d36
-
Filesize
8KB
MD54fb7ad0dc0e9fb98270e61bf87fa5a0a
SHA11ea6d329cbd1d59a954cb429654eef42bac43d65
SHA2569fdb78b07bda94af783cb14ee5a82b245b177f016c30bae7f5b58ebfb1857fbf
SHA51216b5c9f95dbf9b457f2a5bed71f0f0ad22f6b37143bcdfc461e060e5c3f432e1bffb984614c2abeb8cca0da4209917811d95546b7c795160309f27c04d3668cd
-
Filesize
659B
MD55d9c8deb6e6b68b33583b961d714716a
SHA1a8abd3661fc76b5c7ce7b0774e1c40ed2c83ad3c
SHA2560985ad75c9e33b901fdb1941fa2ed380046e3ee9944ee9b2afbead7ae94add58
SHA512ef060b1b762edc3966c42d206d4c231f984bd5af03f65f91be329919fcb4d0c3e65a1e0794c1a8965ae0b9ff5b9b0fe0ce9a46bf65da05123251472e6c66808c
-
Filesize
162B
MD548ebb1003022d85c43643b52d35c1688
SHA1d0f4d64f67c00c734afa7bd8c133fe592cf68f12
SHA25628fe8021513fe8568b464548cfd23f6aa72ae3d7334af09bfc496780fd01ad23
SHA5129f015536c67e6f39ee74d540dd4696f1ff52470f6e03eb34ccda96849c77e2d74a96489ea2259412b6fa90a3e906cae2c0a8c31249b94fe52f78e4a310ec1634
-
Filesize
352B
MD55056e0129b9163b881bf3f3cc43ef955
SHA1824ecb0eecd69416322c90c87a624d4efb205e56
SHA256ba0dfed91260dfecdc963d37faa00a4b460a95fd6fc55ce17c579c71dff5e8c5
SHA5129fd06d1c6194a9b6bb1e689f78c503d6d642d9a49c509022f65e70cc7eec3ce7bc816da3d676ac4bd05ad4a0e911e845ab9978adda9fdf38d59c2218071a15e1
-
Filesize
248KB
MD5a54a18b58c6720991c021f433dfb2a46
SHA1d2ffa07919f92b6e04914e39843f08fdb2a75b68
SHA2563dd88e4418bd4271af728fc6436c873a55e6b6f5c8ed241ee2cb0ee24fe3f7f3
SHA512e4a51b2462b247b1e5fbd947d06a2eba334f18398daadacbabcb4185f4255f05c22d656a8837a6088ffbdcaedfbdfbd8281c5dad4880c4e5021571e3fefc88cc