Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
30s -
max time network
132s -
platform
android_x86 -
resource
android-x86-arm-20240603-en -
resource tags
androidarch:armarch:x86image:android-x86-arm-20240603-enlocale:en-usos:android-9-x86system -
submitted
04/06/2024, 16:25
Static task
static1
Behavioral task
behavioral1
Sample
9584331ccc4bf9639749b7445afd560c_JaffaCakes118.apk
Resource
android-x86-arm-20240603-en
Behavioral task
behavioral2
Sample
9584331ccc4bf9639749b7445afd560c_JaffaCakes118.apk
Resource
android-x64-arm64-20240603-en
Behavioral task
behavioral3
Sample
kyx_data.apk
Resource
android-x86-arm-20240603-en
Behavioral task
behavioral4
Sample
kyx_data.apk
Resource
android-x64-20240603-en
Behavioral task
behavioral5
Sample
kyx_data.apk
Resource
android-x64-arm64-20240603-en
General
-
Target
9584331ccc4bf9639749b7445afd560c_JaffaCakes118.apk
-
Size
29.2MB
-
MD5
9584331ccc4bf9639749b7445afd560c
-
SHA1
44554e9f0d18b918cfb95d8d0c4d0e4fe837fc39
-
SHA256
5325b86b793c8823d24999038e5db28de534841547b6355142b8aee936bc3344
-
SHA512
c5ef4353cc27e5d70b9324394c1cb0c237b7990e8d3307c2e2891d54f9f09df01739928bcfb5b84bf5576a02fe05640dbec158fa7e45666e2e6b8ab334cd3dcb
-
SSDEEP
786432:hghrud8EcfXoegUOQ6yVKJbEz9atF7taF+rbI:Sh6qgJaKNyMIFz
Malware Config
Signatures
-
Loads dropped Dex/Jar 1 TTPs 2 IoCs
Runs executable file dropped to the device during analysis.
ioc pid Process /data/user/0/com.ketchapp.stack/files/kuaiyouxi/datas/res/1253/dex.jar 4327 /system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.ketchapp.stack/files/kuaiyouxi/datas/res/1253/dex.jar --output-vdex-fd=73 --oat-fd=76 --oat-location=/data/user/0/com.ketchapp.stack/files/kuaiyouxi/datas/res/1253/oat/x86/dex.odex --compiler-filter=quicken --class-loader-context=& /data/user/0/com.ketchapp.stack/files/kuaiyouxi/datas/res/1253/dex.jar 4281 com.ketchapp.stack -
Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
-
Queries information about running processes on the device 1 TTPs 1 IoCs
Application may abuse the framework's APIs to collect information about running processes on the device.
description ioc Process Framework service call android.app.IActivityManager.getRunningAppProcesses com.ketchapp.stack -
Queries information about the current nearby Wi-Fi networks 1 TTPs 1 IoCs
Application may abuse the framework's APIs to collect information about the current nearby Wi-Fi networks.
description ioc Process Framework service call android.net.wifi.IWifiManager.getScanResults com.ketchapp.stack -
Requests cell location 2 TTPs 1 IoCs
Uses Android APIs to to get current cell location.
description ioc Process Framework service call com.android.internal.telephony.ITelephony.getCellLocation com.ketchapp.stack -
Queries information about active data network 1 TTPs 1 IoCs
description ioc Process Framework service call android.net.IConnectivityManager.getActiveNetworkInfo com.ketchapp.stack -
Queries information about the current Wi-Fi connection 1 TTPs 1 IoCs
Application may abuse the framework's APIs to collect information about the current Wi-Fi connection.
description ioc Process Framework service call android.net.wifi.IWifiManager.getConnectionInfo com.ketchapp.stack -
Listens for changes in the sensor environment (might be used to detect emulation) 1 TTPs 1 IoCs
description ioc Process Framework API call android.hardware.SensorManager.registerListener com.ketchapp.stack -
Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs
description ioc Process Framework API call javax.crypto.Cipher.doFinal com.ketchapp.stack
Processes
-
com.ketchapp.stack1⤵
- Loads dropped Dex/Jar
- Queries information about running processes on the device
- Queries information about the current nearby Wi-Fi networks
- Requests cell location
- Queries information about active data network
- Queries information about the current Wi-Fi connection
- Listens for changes in the sensor environment (might be used to detect emulation)
- Uses Crypto APIs (Might try to encrypt user data)
PID:4281 -
/system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.ketchapp.stack/files/kuaiyouxi/datas/res/1253/dex.jar --output-vdex-fd=73 --oat-fd=76 --oat-location=/data/user/0/com.ketchapp.stack/files/kuaiyouxi/datas/res/1253/oat/x86/dex.odex --compiler-filter=quicken --class-loader-context=&2⤵
- Loads dropped Dex/Jar
PID:4327
-
-
getprop2⤵PID:4382
-
Network
MITRE ATT&CK Mobile v15
Defense Evasion
Download New Code at Runtime
1Execution Guardrails
1Geofencing
1Hide Artifacts
1User Evasion
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
512B
MD556e5c01bf103d081153fe724b2712341
SHA1f93312d3c98b6355ff634a46303fe8114bba269a
SHA256030d4f47ae69023ac346cb81534cd492e93592368d1f03a43217a4f6233a7709
SHA512a59e53d51c720b5accf2fd9b8684f812a884c2405ac4ff4a67bb4f41ba54e282d59a941073186c7fd9bc0eb4a31c0a9668e7bbe54dafea13129630d95f83c6d9
-
Filesize
28KB
MD5cf845a781c107ec1346e849c9dd1b7e8
SHA1b44ccc7f7d519352422e59ee8b0bdbac881768a7
SHA25618619b678a5c207a971a0aa931604f48162e307c57ecdec450d5f095fe9f32c7
SHA5124802861ea06dc7fb85229a3c8f04e707a084f1ba516510c6f269821b33c8ee4ebf495258fe5bee4850668a5aac1a45f0edf51580da13b7ee160a29d067c67612
-
Filesize
32KB
MD5f08d3a342ac4a75624805c5ee19e8ed3
SHA1ffc28fe68dea55a71751f7efe3d4e325c9cb7b86
SHA2562f9ae9baef4a7adf83b8c2411d39cd881335616dfbfcdb288ad46e811e715a46
SHA512474bc1357a18d85c863e0d171e9e2bf8ce09010f1efc6dbca0e7e4e03a95cb62a19ee378d3a71c3b2f6d043e879962a3b7696ebbd464615962c54eadbf17fb0a
-
Filesize
4KB
MD5f2b4b0190b9f384ca885f0c8c9b14700
SHA1934ff2646757b5b6e7f20f6a0aa76c7f995d9361
SHA2560a8ffb6b327963558716e87db8946016d143e39f895fa1b43e95ba7032ce2514
SHA512ec12685fc0d60526eed4d38820aad95611f3e93ae372be5a57142d8e8a1ba17e6e5dfe381a4e1365dddc0b363c9c40daaffdc1245bd515fddac69bf1abacd7f1
-
Filesize
512B
MD5cd01661db8f21a74f0d61149ff5b4800
SHA1b3e0c25529fb7ca37171557a134fe1020b157445
SHA256fb917b70ed9ad5fe0c1a194836e97def0664266f6dfbf4d3b3fbdfb7cd9f7e5e
SHA512f288d41d9ec890fb479072dde134206343d15d3c05b5c74388139fe3ada293dd9e2fcacae52cb8fd0682ad89d5f1fa5809369028f7c8eb10d85602f342070029
-
Filesize
32KB
MD5bb7df04e1b0a2570657527a7e108ae23
SHA15188431849b4613152fd7bdba6a3ff0a4fd6424b
SHA256c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479
SHA512768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012
-
Filesize
48KB
MD5972ebd3190b1779acf409cac73b9f6a5
SHA15770bf2623141fdbd2edd39debf96fb37475b95b
SHA256b8b4a4d4607d38e8208d19a6be0d809c3f5141fbf46129b2884d4d9b225ac366
SHA512f95b0f8974e9048d92f620f64e56c2de1439cde356267be0822b781c0be95f9334a54f5f778b1ede8f9fe35781cb46bc79d403c16935e8b53bdfb9146e5b02d5
-
Filesize
32KB
MD5a64ed0db240d3914f2690223fd92d8ad
SHA105611a85274356de18c74747de7f30df7f286ba1
SHA256a0a6b263087fa8fb9d8d85ace11c0391b7cf399da8b4471c62c8b05cab975813
SHA5122ea50db3f02da45df15f983b0edc5ff060468f250293d09bd1bd9cb5ea37cf282a57cb69cbb6638dfbf5a161dcb002438895449364b636fa7849e5cfc883da13
-
Filesize
24KB
MD568fce579bfbc44cd1a8fe81ecb36f720
SHA175420f06a3ef91c8aac48264d8c08f73453b373f
SHA2566e30e4ef197c82b11bf61c91c7a0608add20147c72327da031932f915fd4c2af
SHA512668f6aa353498c35a3b80e936974900a4989aff292256bcb719a12e52725e1e9a45e4a8e0c459e84016763adbe62570405d11fe87cfa691541e671bf459ad85b
-
Filesize
20KB
MD5263222e1f068fdafbb78a3d8adae515c
SHA152e656b6a58dbe69903e954dff6e4c7829be52fd
SHA256c15401826654f941d3f533382e3d3b84875b968233e81d6683d294429eb31f2f
SHA512007532bfacbf1dfac22a79f7c7b44bb44f47d281556c350cde14c9f31aca75904f2ac2bebeb4ae20f025b59abc1c262bb3f70cd092c3c40bd68bea15d3d8ec3b
-
Filesize
28KB
MD5202f91b53f73d2bc127b9d6dc4fa06cc
SHA1a7c66a74a28e196888c0ded0f9a637ddd28df905
SHA256e8a02e594f55d9728eedef3cadbbd6cf7a4ea57c4100e63be725aaf4a4b0585b
SHA51230ace3c1a36960fd1809909eaa370736788d002ef8372acc740a7e5abb116ed9341cc0988c647d7a264ea3968371f986324ed9e7c18e62848fff8fa34ef320a4
-
Filesize
28KB
MD5d730c4f5233f02de0749b24c69514193
SHA160795171996dd1dcba382d3d675c40c384cc1fdb
SHA256a4435927522d133b0ed0b9d7106198b957284b743a78682085aefbe90703c6ec
SHA5125364150f20017812a1f7c8b23be1605cd8cbea502c39e71c960681d6c241c3a7fb5ab5aa4601c6cbf1945ee692e43494fb3b5319716c2281dc8abbe86b132a61
-
Filesize
28KB
MD52fb68f1e761b71e5399b3ed8a1167a7c
SHA14971d93b0f050f71d39985779fd3dc215b40ae22
SHA256c9c90923e6b4e0a2a6773d88de7ab17a96b0ef3f7a4eacc8df5581aa44a80de1
SHA512cb8d476b3cf96341cb4867525ece1b5c1e540866533a9d98d6c7e2c771e439ac4f35f772bb496cc6a7e057cddebda2c5ca9178a9c06cf99047153c5d14ad3af4
-
Filesize
512B
MD54194be45859fdfa42475802b942def96
SHA181f3d6ad9315ce6e0eaac087161809b82c98ec13
SHA2569c9fff46557537d4fd4dc0b11b092e0e3ca58a30786b43c2a2949b3dc64c3e4d
SHA512be8860534e12575363692295b8de10855c1eceb79558e9e9e7fb5c3bc803f2d6700a74c37a82722f4253e34ea353d009fec505843f9d7d71d94bcd09bb391aff
-
Filesize
72KB
MD5f2d178cc4bc58d52e46a03a83afc4a4d
SHA114c7bc20ff4aaf63db3e7c8bd6d56f38b7600dde
SHA256c669a6f83ecc57897a0fe6506c643276b0dcf4b47a4cfbba37b21576671575df
SHA512f1800f7600dcf1301de375d821ce8994c0ea0b516d6e3949c86ccd40ad18ee4609467286c0420931ed69a47b6c1680575cbff936024dfcf64ee3e57c76fd7804
-
Filesize
8KB
MD54be9833a2ac077240cc0b08df7793d80
SHA18e0b4d9952a98cc0a80bae94a88a24a891b916bf
SHA25641b0f5fd360994b9c99ca2b6a40ec83cdf21772e2ee20c5683df38d36b90b40d
SHA512fffe46f50f5fa72c5098fac2c2dda8c595cf93b5dcbd071214330f5b129383abe792497ffebe82685001534fb5d73b1317a6147841abd65fb8795ba2b4f4bb1f
-
Filesize
8KB
MD5571bf461ade744cf5cdc9207842959f1
SHA16addc04aa161606a3a317abf0d39c209e46045b8
SHA256a21aee9f9d3ba0181554a626bc6727f286442ffa1bd526082bd76a1bf619b9cc
SHA512cad5b3088ac726993b8d46ddaba8e6f1cfe961974df66fa32bb973e4a4449c7cdd8aeabf725111193751bf4e87a70fada2196f2915614b58b4229e9dc55eb131
-
Filesize
8KB
MD589e0bcba6cb07bb18569e68f9bfc3836
SHA159f5cf414b4ead3ad11ad131920540ca78d8e978
SHA2563ab9a02776ea797340c0dc81cff04d7f082fc5bd9761b4a8775b845b78ce71a1
SHA512e23ade1e93425992c1cd0b9bbd8f0fbb2ae3e836daf1f36a90d308a678a5fb0cbea2e5000b597bb79c998b981ca19210b00eab438e471e1a44238ac386e1de77
-
Filesize
8KB
MD5bc9336ece74589eda5f762aecf041677
SHA1a19c83dc0f3ea88520019778a5f7eefe0cedee0a
SHA256e636e188e871ee2302ba73efc1df74cea39f76321a65ac49b13ac9d23020ac20
SHA5121fef67c5d80f4dd38b1f3cb854f884afb798ba68cef70ba363ef25a1e6cc1f5a9f9e50ef37d3daaf621ee5969ad1d14f3546c93b4d96e664e2426903f353da32
-
Filesize
8KB
MD5b37ac235233c6e71f494885f1dac3c06
SHA1efb6697ad64cadc15bc54cf222fbb4386f2f30ad
SHA256d4799135aadc76cb624697da73e4d9960692aecab8d8b0bc1f5e4bee5d26c81f
SHA51216976ca58b62e2e4126d8ac8c0216e99421fa1123325112bead1f55a1695f3fcb18f75bbb47bf05a0ef45c85314fed146eb9f8197dba1b7c6a10679a75424e29
-
Filesize
8B
MD52c7634fee242a6fdcedf7c63ae6b1823
SHA17abf90300779a7c94aea8d0293531a5544755d47
SHA2567f649b0d5232fa1081337bc0bfe2dbb801d6f0280315cf8a17922d6260c0b56e
SHA5129f86ac2de9bf6ae8c5813fe3f46f375937a4638fc5ed66a78e1ab63c8b5e331cae4eb1f08d2ac135575b2ec6b49db2fbbf62d052d05021662a95837a7c7b5e7d
-
Filesize
32B
MD5fc142147c11505bf6b3ad00a3fe2b8d8
SHA1fe0c8952fd5458df2fca5e9abf22de6b0e4047f5
SHA25658b5fd06661d9c2d8b407a7266cf32e98bec8acb5d0ec05247568b933beadd8c
SHA5127cd5be89b97e75a7cb83c8b18c4abfe5374974565142a542d112048d8e1037024da6236328804d3fd889a259f1f73849a735596e44bdafd80217c42ae1ff63e8
-
Filesize
10B
MD56efc47af51a6c196672a37318681ac00
SHA13e94de6dff871569e1c6acf27e168c4d7747ff1e
SHA25645bcc3ee642f8f5aed5af558d56981fc0510d0f046c8dfbbede6a242ce4ae959
SHA512e5918b62560c7801b2c3bdfd1b6b7dd8fa75c7536cff3426100891badab604a73f5d03d3cec3a813979b83c9124efca2687af10e09788c4614cf3dd08cb1b460
-
Filesize
891KB
MD557a720eeff8002e022528f5a44ed56f0
SHA1788ed2bc2d4e927106e5a89186a25ea6f05a0e09
SHA256e7a4deabb755c39b662fd303f130b2deaf8aa5aafc4e0fb5d10197ae872ea759
SHA512bb34784b4c4eb0565929ad742ade5a4b459ba5db21683a036fe1c465d97bbeaaa5f95e5e84ae5366dee623c1c2c05dbb79dcb0a27f92ad055da9ff84e97cd89f
-
Filesize
2.7MB
MD50e1bc470f855d8260ce860a79bc87048
SHA18e4cc20431c6ceef080eb165e25a49027b38161e
SHA256ced99e4674b6646b5c06ae4e45368e9d6f2c6f01bb8a8d98a64ca64face6b1ba
SHA512050f3d979c77dfcec41c71b259a10f12e41caee635b108b81e1883708eed2a95fad8f9d0b4bd3c8fffec7609104534e992215e2ddc72e27915226cd45dd1b76f
-
Filesize
18B
MD55b783a723321f384ea8a021d20ba4280
SHA18a53b72a13e69184d8d0ae99568e7d3b95fed07c
SHA256f79b6c0ba6379e405153ae0536b49ce9ab8a64e8585cbcc4b7ee10a357b723a9
SHA512bbce3c6ae766581622fcf53a41cfc47aedaa2050caa3fcefad2e5238470067d5e3b1a7f586d57318d74e0c3725bf0970fa9a1c02a3d0139e1f8444f2310c56a1
-
Filesize
2B
MD537693cfc748049e45d87b8c7d8b9aacd
SHA1d435a6cdd786300dff204ee7c2ef942d3e9034e2
SHA256535fa30d7e25dd8a49f1536779734ec8286108d115da5045d77f3b4185d8f790
SHA5126ff334e1051a09e90127ba4e309e026bb830163a2ce3a355af2ce2310ff6e7e9830d20196a3472bfc8632fd3b60cb56102a84fae70ab1a32942055eb40022225
-
Filesize
2.0MB
MD56b2f3ae8d9b5b4c24b4591f5f70f1883
SHA1dff398e2dcbc8729d987b404709d3400ba13bd22
SHA256d582d048f903081fc675a7ec2c5228950c284bba195a557edfc312ac716f86a1
SHA51214eeaf3b4a27cb95c8760b1e7c81beeca6e9d484ea5f62520c9a80a1618d473ede3f30c5dcf4359087cce3b7257005e91099915b6f38d2dacde9f98258cb220b
-
Filesize
2.0MB
MD5628e57b99afd5c70c7a3f7ec0b85fba7
SHA1727032676b78742da147829d74079a046f719338
SHA256411e6ae4d9731a39cde6b6d71f671af597addb40ccfa490928ceaec600110feb
SHA51280ff31ddfb2fb61829900ca9798b6250e6cbb9ef177aafd491dab69113849ae409296ea96263a91c27176a701ef9fbb948682bd3efbfcd7650b58e817cfbf350
-
Filesize
1B
MD513c8ffd977013703a701cf8e11deac65
SHA1067d5096f219c64b53bb1c7d5e3754285b565a47
SHA256e7cf46a078fed4fafd0b5e3aff144802b853f8ae459a4f0c14add3314b7cc3a6
SHA512527cff2b6fdfbc0f54fe092b17d6d8c7e22500242635fa56981e85a64da6ce8a12a3a66cf69fd48f588bcba9bad141b8e351a0cdd4925ae57289933eec1fc153
-
Filesize
2.7MB
MD5c04e13d1ede48f576cb693593c821423
SHA109294c1103534a8da544980d810ea278b30f7a90
SHA256d3581f5eab894f06e6cda1267a464949efade31f9f81a15420e931c7a1566b48
SHA5122dd57f60b12f31acfffea4bca8c13e3f53a159ba05cf2c889d16bbf9268a63832b6b50d8a0a1100928679aa90426601e71fea1ed9777ed2690ac792b58e9bb93
-
Filesize
512B
MD5ae4b245340c1ed3f8cf93902b21e7617
SHA12a07f960009824d4428043c33481fae65f8af4b8
SHA256e58d03c7a907a3a9fef40cd52bef8a2a61cf1d7569fbbd97ede7825bef81005b
SHA5126bad5f21772201d41e783b2ec82a2aaa32834197eff840af4c11e785bd5bb034263d9031617d8e4f49bca20f748550063e4cde3d40483fb8279c77883d6caf8b
-
Filesize
32KB
MD5c2b435f4ef6962c593b83e717c7e647e
SHA1fa55e6288aee1ef4e05827999e8561b6508449eb
SHA2569a8ad50f28d501f095ae69bc56a8204e5404871453aa09dfa26da0b346b7b5a6
SHA512b3c0fdfea8137bf3a3b279d85fbde353ec41951cc9f391337a2663d7990e8a3eb33db6147561eedc16e684e030431ef21690af45af161cce451d196cf6bbfc7c