Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    149s
  • max time network
    141s
  • platform
    android_x64
  • resource
    android-x64-arm64-20240624-en
  • resource tags

    androidarch:armarch:arm64arch:x64arch:x86image:android-x64-arm64-20240624-enlocale:en-usos:android-11-x64system
  • submitted
    03/01/2025, 22:23

General

  • Target

    JaffaCakes118_7185ff85ec43f1a42fe89725720975fb.apk

  • Size

    5.0MB

  • MD5

    7185ff85ec43f1a42fe89725720975fb

  • SHA1

    3f916ea5c07abb2308bb4e2f5391ac979998b4be

  • SHA256

    de032609bda6ab2da5ccf34923eccf0024f2342795a220f5e7ce8c14ebc87e34

  • SHA512

    fd184eedb6778943924b09f1f3e44fe8fd04ec15d9170144a0ae58066afbc8a075f0ff91c13e1bed1eb31aea407b20afa27cc1e543c0301b520f0cec88db34d1

  • SSDEEP

    98304:9cOAB+dOZB9G1MDBBmWqMQhNgWavgu33hiUlnpxF1BonsAOAZBoeSNUSqf8SbZfz:ypB+dOZB9BDBBmWXcQ933hiq3TonsAO0

Malware Config

Signatures

  • SMSFactory

    SMSFactory is an Android SMS trojan malware first seen in Jun 2022.

  • Smsfactory family
  • Checks if the Android device is rooted. 1 TTPs 5 IoCs
  • Acquires the wake lock 2 IoCs
  • Queries information about active data network 1 TTPs 2 IoCs
  • Reads information about phone network operator. 1 TTPs
  • Schedules tasks to execute at a specified time 1 TTPs 2 IoCs

    Application may abuse the framework's APIs to perform task scheduling for initial or recurring execution of malicious code.

  • Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs
  • Checks memory information 2 TTPs 1 IoCs

Processes

  • com.halfbrick.fruitninjafree.hack
    1⤵
    • Checks if the Android device is rooted.
    • Acquires the wake lock
    • Queries information about active data network
    • Schedules tasks to execute at a specified time
    • Checks memory information
    PID:4603
  • com.halfbrick.fruitninjafree.hack:Metrica
    1⤵
    • Checks if the Android device is rooted.
    • Acquires the wake lock
    • Queries information about active data network
    • Schedules tasks to execute at a specified time
    • Uses Crypto APIs (Might try to encrypt user data)
    PID:4649

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • /data/user/0/com.halfbrick.fruitninjafree.hack/databases/OneSignal.db

    Filesize

    52KB

    MD5

    212a337771ab5b18e82e4d1b7acdea35

    SHA1

    092a996b96b0dc7006669f4a3dadc94357b25013

    SHA256

    802cb04095337d676e9516d13b9653adf3764637006c37162ac8df6f06f22417

    SHA512

    988f85500157d0359ae7f442dd42eaf0c7e991069cdc20f4783a0b208938f84e1c8b5cb8680df3dca525661b518bcde4626239a3a2bb8e41ec72ebc62ae88915

  • /data/user/0/com.halfbrick.fruitninjafree.hack/databases/OneSignal.db-journal

    Filesize

    8KB

    MD5

    58b5d24b88164cdde8703c1cb1cb674a

    SHA1

    c01c1a61d5ea1abd284eb35290fa69ab3842e851

    SHA256

    fcf62e572536772c9f6f724012b4deba946c4f6c33d3a253393337b9ccb698fe

    SHA512

    07b601c61d05bf9777694abc4ba0efa8b5c8761cd25e576337c69fecfd43cd9522d96e9cdaf636fa0590e0693cc7bfe25bae458997a39f95c9464c397098eaeb

  • /data/user/0/com.halfbrick.fruitninjafree.hack/databases/OneSignal.db-journal

    Filesize

    512B

    MD5

    a715b931687f52f82f4db5813818d250

    SHA1

    ec963b079684206a741d7b2a529a9031e81dfff9

    SHA256

    a6961021ac18ebc94e982c6cbade3c49f232b8205c45a051b6f3527793511227

    SHA512

    54cdbf7c26740faa6f105790f50b00c54b8d3c8e16c05eb7f14623e2e64f6d9777008717b46381eb20c61e12e2d0d0a50a597edc2194427e8914ed09367ff819

  • /data/user/0/com.halfbrick.fruitninjafree.hack/databases/OneSignal.db-journal

    Filesize

    44KB

    MD5

    9c3dd6d376e5eb509f8fd4fcf16c0c74

    SHA1

    ab43799922176bdd3cc2d1936d14d415d3036a15

    SHA256

    b95dab6ac85e3d8c9c588ccf0ff15d15e5b1d401df6d0874fe35e158dd3d2418

    SHA512

    06cda85a92372e792e1846de45ed638c7aa437330f11b83d780db862315c17309cb7d76ee2e2a1270e5a6c76a731e4a1e5b6fb0a70647e87188febd65076763f

  • /data/user/0/com.halfbrick.fruitninjafree.hack/no_backup/androidx.work.workdb

    Filesize

    116KB

    MD5

    8e8a7dcbb63a0575575702fd9088d9d2

    SHA1

    9b5fa8280beb58904e4b207fefb101a789b8b8a2

    SHA256

    ca6aa197f24ee9db53c098702a239e037c545e43f28e42bb782cd21693119c41

    SHA512

    9dc2b18ba704f746f235f059001fc422bbf4b2c795521025de676041ead81e8e85a128a6ed131bc6db08dc5542fb6392d2a99b5b47269c11255e8e3ad8acf72c

  • /data/user/0/com.halfbrick.fruitninjafree.hack/no_backup/androidx.work.workdb-journal

    Filesize

    12KB

    MD5

    c8c7c683da18ef41d3dde4d7f3dca87e

    SHA1

    cd7396136b2a732ee08af9982f976ddca7a04fab

    SHA256

    99c267b5738848c5305bff8c116c823539ad919f7dd888e6eda67f42190f9c6d

    SHA512

    9c439ece4e91be7d550283d0109d1ed4303634fc6409e6b5786aa0cd747486f0266b1135baeaca352a73cb3abbcc19c4c62d33ab26fb6ad1ee4dbe1aa03394d9

  • /data/user/0/com.halfbrick.fruitninjafree.hack/no_backup/androidx.work.workdb-shm

    Filesize

    48KB

    MD5

    7f6dcf649d42ab2736f373b44b87ed06

    SHA1

    d8fb7844a1f80195b10253052ca71ab23846130f

    SHA256

    558738fe43e20a58b804a7c31658b368b880c47489b38d8f76b16e5b45a968bd

    SHA512

    a3a522626942b29b61e92af4a34d8cd2f6d55cf6971d86ab02bd5826ca1fa739cb16e810dd2726130d4b1a828ffbecacade4b27285e19657339c5f687c02b893

  • /data/user/0/com.halfbrick.fruitninjafree.hack/no_backup/androidx.work.workdb-wal

    Filesize

    16KB

    MD5

    0da5ecc7b01e950b87091d6e39b013bb

    SHA1

    4cc3e1e7042cdcb405404c4bcb0faa9a7b89ef90

    SHA256

    91afd81c18b1517e7859a1fea3e33e9562b6a751802be8ef364561adb7351406

    SHA512

    bc6818a25323a8f45477d0a3598baffd16dfea05242ad44db51dfaab3bea025f46778660f05a13e9f9fe145b66f7279c5aeaa2e28da627aa3b27d37cb92de8d4

  • /data/user/0/com.halfbrick.fruitninjafree.hack/no_backup/androidx.work.workdb-wal

    Filesize

    108KB

    MD5

    775697135d249c1f14bcdf04c58d9453

    SHA1

    f88c1c0e00f36dfc041c5a0b4ac0df6f170498d0

    SHA256

    36a76b944281c51d8fe1a2c50b31500f3c0d27a2a91344fe07703dba7135329d

    SHA512

    da03de477928928fa61d19f06f50eb3f61a2bfe9ba2a4a86ac25a80c3ea0621d9cc1bce0f92c373c2fbd0b5a7300c5dea8dcb60515c6d341365758d39c840cb6

  • /data/user/0/com.halfbrick.fruitninjafree.hack/no_backup/androidx.work.workdb-wal

    Filesize

    309KB

    MD5

    6666ae6b3585cdfb21a76a16d8e01dac

    SHA1

    9f93fc1a63d05db0d9a72583e475d86dd97f0cd0

    SHA256

    155b48214882915f0e7b1466bfaa85333a269fda31c58c0f4a7500adb4a22a3b

    SHA512

    5886307229aabf31a2b5d694c5ab7da30385853eb5d46e4f768d94d96cecd8fa3efb3d6a8700d10f70c5e569b0fab1e7702e9670efe73129a2e2483ff28945c4

  • /data/user/0/com.halfbrick.fruitninjafree.hack/no_backup/com.google.InstanceId.properties

    Filesize

    2KB

    MD5

    6b595691648b9655393a6bddad0815bd

    SHA1

    1db97b386a98e91f92bf87cd2a0d999f085f5e6a

    SHA256

    6f91620b12da3f0172f05dbfcf9573521f39be09e13009c2f677bc99a3c8de72

    SHA512

    4b59fcfbe869d4dfbbef50e35172bf2102ffa6da27398276473a5820352861b20b6047c22fa138563acccd5a448f77f0a52f3eab6816f740cec62afd55e1b79e

  • /data/user/0/com.halfbrick.fruitninjafree.hack/no_backup/credentials.dat

    Filesize

    226B

    MD5

    179786ea2a92d2c0b60387df633e361f

    SHA1

    dcebd0439f504eb6629d6a4a15a18d27f30504ff

    SHA256

    a77b89539686ed1398ae67badcb888b1591f9f2344de524f020d81a9713deb05

    SHA512

    edabc1552a977b1632e1e29fba23019ffc068d4b3c025ba54473ad7bcf3fc41809bf07f4ff7a48e2d09b045e1e38bb1c8c0a72fa228032090bc1203fbeb3f31b

  • /data/user/0/com.halfbrick.fruitninjafree.hack/no_backup/db_metrica_com.halfbrick.fruitninjafree.hack-journal

    Filesize

    333KB

    MD5

    57d4f5bae7df291c80e6486c85ed7908

    SHA1

    ad7234dcac465593378da8403ee6de66b6ea5119

    SHA256

    4d850862a7554feed9038886316ff84bf8ddfa50c7d75229a1fa09ea3dbbf592

    SHA512

    59d377e9117a08aa7d62d2c11ba3b41ad16b26a3af9264be976ab15b7591bace78d6096b0ccf88b5a06b818fa346ba9e10c22322801eaf722bb501c35b84ab31

  • /data/user/0/com.halfbrick.fruitninjafree.hack/no_backup/db_metrica_com.halfbrick.fruitninjafree.hack-journal

    Filesize

    12KB

    MD5

    74380aab0079f7b477f7f4ce62570cb9

    SHA1

    c2acd2a2056ebeca58898ba3cc17e40065596034

    SHA256

    1ad4945f2ba621cf328cfe3378858458837503fb3ac4399e71d4994001c2f815

    SHA512

    47c7550762b117bedbad36110f1ea13e42d10ec7affafd422b362348bb151033ce1615c13df9d76e04445d56ee177d9084bc68d8a9c76ff963877155e398e95a

  • /data/user/0/com.halfbrick.fruitninjafree.hack/no_backup/db_metrica_com.halfbrick.fruitninjafree.hack-journal

    Filesize

    20KB

    MD5

    b9072351a26392bbd6da00027c076782

    SHA1

    ebba14eda45ccfeb361974acc33f9368adfba0b3

    SHA256

    6a7b1d402f8149b49108db261411ec97e638d019a55e99f6ff400155e9f79187

    SHA512

    1ec1a09eb3a385cb04152d32796cfa6cde1161b2001415a2d5e3d3b77352d7856b7e1242cba4771d6b117a9c79b77b1dc62cf9fe49d4af22ae0926c566e61bf7

  • /data/user/0/com.halfbrick.fruitninjafree.hack/no_backup/db_metrica_com.halfbrick.fruitninjafree.hack-journal

    Filesize

    20KB

    MD5

    1e249c3ce02d22ef243a53c31ac081e8

    SHA1

    d446f890462e2e5d49fd63c21d0cb17ad6bb7963

    SHA256

    b3b038ab4fef530161f084aad744db43f28675d0e681d15dad141a65e32bc9a2

    SHA512

    bca214034ed6651739322b661bdd012c17f21ab3962c01d685b51b9fd2a76e765137b3ebd1c410d32493c0105430899167cab7e2fa96514774b1e7bf7d560fee

  • /data/user/0/com.halfbrick.fruitninjafree.hack/no_backup/db_metrica_com.halfbrick.fruitninjafree.hack-journal

    Filesize

    24KB

    MD5

    e59697880ccc7984eab65260fc63c411

    SHA1

    3f5a42256e0e2abee61a39210616d4bf1a6422e9

    SHA256

    c4a9bfe7e35a1c106e579426d9f0147ee58f748844b477c621da2d2039c69fd6

    SHA512

    4e08caee9582114766b4526971bd255fa7c6f6566827caff55e3d15aa63c8370ce1f9c1c51b8337d9fe474b3edf980fd3fb872255dfcddb4dab23dcd59d3941d

  • /data/user/0/com.halfbrick.fruitninjafree.hack/no_backup/db_metrica_com.halfbrick.fruitninjafree.hack_20799a27-fa80-4b36-b2db-0f8141f24180

    Filesize

    36KB

    MD5

    3c08f1e806c8f7e35680641f986f8587

    SHA1

    28d49b191f43f690aa60c7303b411081cee7f95a

    SHA256

    00b9daf75134d36f172ed9761e0c4a6b269ba42f041b31fa2048bad79785a68c

    SHA512

    2d4e49dc4ddeef3526cee4dea771b8a1786036d591d1e2873ee1676813556e4e39f3bca8c983b92599e2e31ac8292d232ed76aeac2d10df90442619e9d373c43

  • /data/user/0/com.halfbrick.fruitninjafree.hack/no_backup/db_metrica_com.halfbrick.fruitninjafree.hack_20799a27-fa80-4b36-b2db-0f8141f24180-journal

    Filesize

    512B

    MD5

    71b4de0780467234a8c384c6c7f0541d

    SHA1

    f1913ef1610fe29b7dd7323a98ad76b1ad945766

    SHA256

    fe5bb55c97a0013e621d224a0a423af286ed0629632c7f1070d2e8c1142580d4

    SHA512

    825e288d5d4ab21cf505ef3726c2c2bb406d15f4ab922c82560e2fc115d893312108db82ea616498e585e68ad58d59c88f1ef427dbad6c311f5644a5bd73af87

  • /data/user/0/com.halfbrick.fruitninjafree.hack/no_backup/db_metrica_com.halfbrick.fruitninjafree.hack_20799a27-fa80-4b36-b2db-0f8141f24180-journal

    Filesize

    8KB

    MD5

    40d0aefba523719865b110b04fc57ce7

    SHA1

    cabce3884efd1b29a82444a9c673ae1cfbc97670

    SHA256

    510c81b3af663d94326e89485100d884858682d2f2146f927fdf02b26b862c33

    SHA512

    4892bf058ff5c4ad1e663c5e2eccbca4720ff4d0662bf23d361a34541810e56b12b439d1f31b30ec805b7738a6ca893416a426dcd0672c62136ce0df4247346e

  • /data/user/0/com.halfbrick.fruitninjafree.hack/no_backup/db_metrica_com.halfbrick.fruitninjafree.hack_20799a27-fa80-4b36-b2db-0f8141f24180-journal

    Filesize

    8KB

    MD5

    0d8cb7f6d4cc570d398e6db2143a569e

    SHA1

    3e3068b459ba8bfb1e55d96b9253f40eb9b4e248

    SHA256

    32bada13a23c65d7a2fa3879498fd4dc11a93df7189564a27d4dfb3a7eb87a5c

    SHA512

    b0a309e21c3106626bc85e5cb507db2b9fc558a3a50b79c8dd4c96dd62ca6e14618e45ff36417abf962391174b16fa9ed5266a3ee75b218fd41f625606e76572

  • /data/user/0/com.halfbrick.fruitninjafree.hack/no_backup/db_metrica_com.halfbrick.fruitninjafree.hack_20799a27-fa80-4b36-b2db-0f8141f24180-journal

    Filesize

    12KB

    MD5

    27cbdd0111bb50deba57774a86bc963c

    SHA1

    2368a60d45d1882b1dced9ef004a54fdf77d77c2

    SHA256

    a3295c105178d53c6df88e9b0c86d4619f3a5820409bdb5a9c9c7dc647dbde50

    SHA512

    3ed42b2932d26152c01840dce58e264d78d247852301338f3b4736e02ce68c22d50aa57e9a62e5f1f058611f540dfe62e5ece5dd82b23c258542eb9f29a4a879

  • /data/user/0/com.halfbrick.fruitninjafree.hack/no_backup/db_metrica_com.halfbrick.fruitninjafree.hack_20799a27-fa80-4b36-b2db-0f8141f24180-journal

    Filesize

    12KB

    MD5

    22f725f2cf4b7c08e5008fc14f43e1ce

    SHA1

    1521ea3bb333b4127293f91d97b4733a378a2a38

    SHA256

    46318a116a64c671477ae7de270b3d2795b559ca5c5c7b52e66d748de101487d

    SHA512

    1d385190fd56c6ac1a7a6fa1674c3b3188653dfbbe323a716bff6c3a611c41482f5f5ea5b4b7744adf1753a6e996df5616d3072a1baed6add2967c4044ed2b77

  • /data/user/0/com.halfbrick.fruitninjafree.hack/no_backup/db_metrica_com.halfbrick.fruitninjafree.hack_20799a27-fa80-4b36-b2db-0f8141f24180-journal

    Filesize

    12KB

    MD5

    097526bd95d59558742be227efdff0a3

    SHA1

    111658eae0474861baa45f3ff70aa5de7049084b

    SHA256

    06c41f0aa0224d8bd39ca9d1aa5aeaaffffe470a3481ac86035a2659e865ef0e

    SHA512

    2f8c0628547c1a2b7d0b88c0975093ef29226e33cb281eca0986b857f89c9c0888981a03128ba4a3b6ab8e0c3301fe40d30b3a50a4a05b123c2299ced7345f30

  • /data/user/0/com.halfbrick.fruitninjafree.hack/no_backup/metrica_client_data.db

    Filesize

    20KB

    MD5

    98e99bf22267d0db231365b8b818c1cb

    SHA1

    363124b1055325bf8e6598a7532e4ac1a6ae6f9d

    SHA256

    c08a9715f070e320f54e2a5d24c271948803d77303ac0265ec8a3c6941f4bd95

    SHA512

    0c5cc48343477e0e57a3dd5e2b617d4caa3f684345d034d63ad60a3da717fb928e24f81c5d33769dd9a84ce638c37b9cae65bab15ab846fd6ee9ea9bf71d37c1

  • /data/user/0/com.halfbrick.fruitninjafree.hack/no_backup/metrica_client_data.db

    Filesize

    20KB

    MD5

    777d567c359bd05e8c0e9a37ce583b05

    SHA1

    17ed643d8d34d2797699fe7e53e8abc5f78498a1

    SHA256

    29d61d6a8460615358640106479161993c06fe3248cbefa53a34a7b1bd6ce555

    SHA512

    d87d8ec00820ba35146dd0d95e80c52d500c1d32591a12959f16854244ecf4d6e67a5c64aaa051446edeb11dd3ffb07e3e4b31bc3e9038efedbe6cabe5f7dad3

  • /data/user/0/com.halfbrick.fruitninjafree.hack/no_backup/metrica_client_data.db

    Filesize

    20KB

    MD5

    fc318483a677c71a725dbbe6e9516df9

    SHA1

    8ac3af9cbfb464e53b709028d1f64a4d019bb2f4

    SHA256

    d6d65421dac425ed42a96af8b94a1d708f6e23b556f0bc80011eb4970304b7f9

    SHA512

    0e3a0d7629cbfdcaa59e415c4ba982355f249b9595d234c0de6fda993c65c121435c442945766017cd78533fbd059d7edfe2eda0185ec6e4d076499536a63140

  • /data/user/0/com.halfbrick.fruitninjafree.hack/no_backup/metrica_client_data.db

    Filesize

    20KB

    MD5

    9f3b392c3cf8c217c3ed09595a0b959b

    SHA1

    c795f7153f79ccb9ee06283d6c315320bb574cd0

    SHA256

    103eb48fe30c6c688267b674dc68ad01e0eba662cb007388860bc17c7067faca

    SHA512

    63287d03d576c150c825b61b587f982ed041cccae152f54bd650ef720a8c88b756e66668474727be6452c24867fec4199849210435a85f7ec79039f5d4a909f4

  • /data/user/0/com.halfbrick.fruitninjafree.hack/no_backup/metrica_client_data.db-journal

    Filesize

    12KB

    MD5

    21076dc4a1121142e5d3401c58d66ed6

    SHA1

    0214d001670746e9787ae3fbe8328a919c3a56c6

    SHA256

    5895c847f8016d677e87b2e34e6f31994e63c97495f65abc50e73ca5ed1a5f1e

    SHA512

    9ba76e56cfb79e0f9f3c45eb0c5ed5223548a882d79c14928211ef90f03eacff5e226a561006f38ed88ec9a91696209dd1f6cd8f5da88f554eb6551b00e7ec49

  • /data/user/0/com.halfbrick.fruitninjafree.hack/no_backup/metrica_client_data.db-journal

    Filesize

    512B

    MD5

    024ebe536ca9541043d9921aecaaf06f

    SHA1

    b2efb405048f13433d19b05aff3d27dd954ef797

    SHA256

    7f2e566ddfd1def4203e37b057e6df0cecde7747263ec50ab1a4a9caa882d4df

    SHA512

    8c50844f60904cf9a83defb3ab9658e208f58ec5dc195eceffe8062c256fda9f588453cce1444bde1f53c4980306c387e1d721d618a3e740568a5bf4aa2b4cb3

  • /data/user/0/com.halfbrick.fruitninjafree.hack/no_backup/metrica_client_data.db-journal

    Filesize

    12KB

    MD5

    3ba481ed8690625e1a3b6887e3fc7e43

    SHA1

    8f970c34a8526e4170df0295e4142e05ead30c59

    SHA256

    b28dc1bd4b05ed6da554e6b55578ee42c1ba6ae741d0df9ad939de9ca99c1bca

    SHA512

    fbae7d54ed12b67e6f284654c34339dfe8e679a2c2c4f6a42ab87d38052a2bc3a151e46faea38c4f344021e36faf8a9b980d391fbe0cb5913a0850c4b1c4724a

  • /data/user/0/com.halfbrick.fruitninjafree.hack/no_backup/metrica_client_data.db-journal

    Filesize

    12KB

    MD5

    2a3a3820e9a0774d4a89783f87b9b660

    SHA1

    52d81853077af0cc309e22ab14db50bfea4502b7

    SHA256

    9191b53f4e5f52db1b3f182a8a7522a92fbccae01e39c3c8d62855a63e49a3b6

    SHA512

    84350b598a59ddcada317364fa465f388d446fdf5c9411feac5091eeb80489c3cfd48c343c3c807dd2db38b47add53428abf509f9f21cf7d04d0a7c0c1b1aa1c

  • /data/user/0/com.halfbrick.fruitninjafree.hack/no_backup/metrica_client_data.db-journal

    Filesize

    20KB

    MD5

    eae4a5a47c3184795546306715e2d349

    SHA1

    83a275fed9c06ff05dc6d003260025c57f109181

    SHA256

    1f7cefa1ffb8b2ef900b7f9891966d7a3dcd303d45aee4a7c6cf9292f340df0b

    SHA512

    c94b86b20c8d25f048f4fd7eab6478798c3b8599ba1c93f6588cde3f5e09b280b51b49d02c54ce3d0de4eb6032ed618495af57bebc71b41b31b13fbc19b70ed1

  • /data/user/0/com.halfbrick.fruitninjafree.hack/no_backup/metrica_client_data.db-journal

    Filesize

    12KB

    MD5

    1fe2b8e7b20e76a96ed6e3f6cb130eff

    SHA1

    146ab9e35af27bbe22ed990ba4fa33bcdd436adf

    SHA256

    27ecde42349f9e126167df10530599ed0458835fdc32c13825cb42fb2ea8224f

    SHA512

    3a3a80a3c1abfc7ffae1d159355d762f4dcdba5502c551747348c42e896654bc3e521b8f96fd11e21c06d3ee7f50e7e142375cb065addd8e51ba03b5b3c26adc