Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    30s
  • max time network
    132s
  • platform
    android_x86
  • resource
    android-x86-arm-20240603-en
  • resource tags

    androidarch:armarch:x86image:android-x86-arm-20240603-enlocale:en-usos:android-9-x86system
  • submitted
    04/06/2024, 16:25

General

  • Target

    9584331ccc4bf9639749b7445afd560c_JaffaCakes118.apk

  • Size

    29.2MB

  • MD5

    9584331ccc4bf9639749b7445afd560c

  • SHA1

    44554e9f0d18b918cfb95d8d0c4d0e4fe837fc39

  • SHA256

    5325b86b793c8823d24999038e5db28de534841547b6355142b8aee936bc3344

  • SHA512

    c5ef4353cc27e5d70b9324394c1cb0c237b7990e8d3307c2e2891d54f9f09df01739928bcfb5b84bf5576a02fe05640dbec158fa7e45666e2e6b8ab334cd3dcb

  • SSDEEP

    786432:hghrud8EcfXoegUOQ6yVKJbEz9atF7taF+rbI:Sh6qgJaKNyMIFz

Malware Config

Signatures

  • Loads dropped Dex/Jar 1 TTPs 2 IoCs

    Runs executable file dropped to the device during analysis.

  • Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
  • Queries information about running processes on the device 1 TTPs 1 IoCs

    Application may abuse the framework's APIs to collect information about running processes on the device.

  • Queries information about the current nearby Wi-Fi networks 1 TTPs 1 IoCs

    Application may abuse the framework's APIs to collect information about the current nearby Wi-Fi networks.

  • Requests cell location 2 TTPs 1 IoCs

    Uses Android APIs to to get current cell location.

  • Queries information about active data network 1 TTPs 1 IoCs
  • Queries information about the current Wi-Fi connection 1 TTPs 1 IoCs

    Application may abuse the framework's APIs to collect information about the current Wi-Fi connection.

  • Listens for changes in the sensor environment (might be used to detect emulation) 1 TTPs 1 IoCs
  • Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs

Processes

  • com.ketchapp.stack
    1⤵
    • Loads dropped Dex/Jar
    • Queries information about running processes on the device
    • Queries information about the current nearby Wi-Fi networks
    • Requests cell location
    • Queries information about active data network
    • Queries information about the current Wi-Fi connection
    • Listens for changes in the sensor environment (might be used to detect emulation)
    • Uses Crypto APIs (Might try to encrypt user data)
    PID:4281
    • /system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.ketchapp.stack/files/kuaiyouxi/datas/res/1253/dex.jar --output-vdex-fd=73 --oat-fd=76 --oat-location=/data/user/0/com.ketchapp.stack/files/kuaiyouxi/datas/res/1253/oat/x86/dex.odex --compiler-filter=quicken --class-loader-context=&
      2⤵
      • Loads dropped Dex/Jar
      PID:4327
    • getprop
      2⤵
        PID:4382

    Network

    MITRE ATT&CK Mobile v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • /data/data/com.ketchapp.stack/databases/kyx_sdk_downloads.db-journal

      Filesize

      512B

      MD5

      56e5c01bf103d081153fe724b2712341

      SHA1

      f93312d3c98b6355ff634a46303fe8114bba269a

      SHA256

      030d4f47ae69023ac346cb81534cd492e93592368d1f03a43217a4f6233a7709

      SHA512

      a59e53d51c720b5accf2fd9b8684f812a884c2405ac4ff4a67bb4f41ba54e282d59a941073186c7fd9bc0eb4a31c0a9668e7bbe54dafea13129630d95f83c6d9

    • /data/data/com.ketchapp.stack/databases/kyx_sdk_downloads.db-shm

      Filesize

      28KB

      MD5

      cf845a781c107ec1346e849c9dd1b7e8

      SHA1

      b44ccc7f7d519352422e59ee8b0bdbac881768a7

      SHA256

      18619b678a5c207a971a0aa931604f48162e307c57ecdec450d5f095fe9f32c7

      SHA512

      4802861ea06dc7fb85229a3c8f04e707a084f1ba516510c6f269821b33c8ee4ebf495258fe5bee4850668a5aac1a45f0edf51580da13b7ee160a29d067c67612

    • /data/data/com.ketchapp.stack/databases/kyx_sdk_downloads.db-wal

      Filesize

      32KB

      MD5

      f08d3a342ac4a75624805c5ee19e8ed3

      SHA1

      ffc28fe68dea55a71751f7efe3d4e325c9cb7b86

      SHA256

      2f9ae9baef4a7adf83b8c2411d39cd881335616dfbfcdb288ad46e811e715a46

      SHA512

      474bc1357a18d85c863e0d171e9e2bf8ce09010f1efc6dbca0e7e4e03a95cb62a19ee378d3a71c3b2f6d043e879962a3b7696ebbd464615962c54eadbf17fb0a

    • /data/data/com.ketchapp.stack/databases/mpush_app.db

      Filesize

      4KB

      MD5

      f2b4b0190b9f384ca885f0c8c9b14700

      SHA1

      934ff2646757b5b6e7f20f6a0aa76c7f995d9361

      SHA256

      0a8ffb6b327963558716e87db8946016d143e39f895fa1b43e95ba7032ce2514

      SHA512

      ec12685fc0d60526eed4d38820aad95611f3e93ae372be5a57142d8e8a1ba17e6e5dfe381a4e1365dddc0b363c9c40daaffdc1245bd515fddac69bf1abacd7f1

    • /data/data/com.ketchapp.stack/databases/mpush_app.db-journal

      Filesize

      512B

      MD5

      cd01661db8f21a74f0d61149ff5b4800

      SHA1

      b3e0c25529fb7ca37171557a134fe1020b157445

      SHA256

      fb917b70ed9ad5fe0c1a194836e97def0664266f6dfbf4d3b3fbdfb7cd9f7e5e

      SHA512

      f288d41d9ec890fb479072dde134206343d15d3c05b5c74388139fe3ada293dd9e2fcacae52cb8fd0682ad89d5f1fa5809369028f7c8eb10d85602f342070029

    • /data/data/com.ketchapp.stack/databases/mpush_app.db-shm

      Filesize

      32KB

      MD5

      bb7df04e1b0a2570657527a7e108ae23

      SHA1

      5188431849b4613152fd7bdba6a3ff0a4fd6424b

      SHA256

      c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479

      SHA512

      768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012

    • /data/data/com.ketchapp.stack/databases/mpush_app.db-wal

      Filesize

      48KB

      MD5

      972ebd3190b1779acf409cac73b9f6a5

      SHA1

      5770bf2623141fdbd2edd39debf96fb37475b95b

      SHA256

      b8b4a4d4607d38e8208d19a6be0d809c3f5141fbf46129b2884d4d9b225ac366

      SHA512

      f95b0f8974e9048d92f620f64e56c2de1439cde356267be0822b781c0be95f9334a54f5f778b1ede8f9fe35781cb46bc79d403c16935e8b53bdfb9146e5b02d5

    • /data/data/com.ketchapp.stack/files/TDtcagent.db

      Filesize

      32KB

      MD5

      a64ed0db240d3914f2690223fd92d8ad

      SHA1

      05611a85274356de18c74747de7f30df7f286ba1

      SHA256

      a0a6b263087fa8fb9d8d85ace11c0391b7cf399da8b4471c62c8b05cab975813

      SHA512

      2ea50db3f02da45df15f983b0edc5ff060468f250293d09bd1bd9cb5ea37cf282a57cb69cbb6638dfbf5a161dcb002438895449364b636fa7849e5cfc883da13

    • /data/data/com.ketchapp.stack/files/TDtcagent.db

      Filesize

      24KB

      MD5

      68fce579bfbc44cd1a8fe81ecb36f720

      SHA1

      75420f06a3ef91c8aac48264d8c08f73453b373f

      SHA256

      6e30e4ef197c82b11bf61c91c7a0608add20147c72327da031932f915fd4c2af

      SHA512

      668f6aa353498c35a3b80e936974900a4989aff292256bcb719a12e52725e1e9a45e4a8e0c459e84016763adbe62570405d11fe87cfa691541e671bf459ad85b

    • /data/data/com.ketchapp.stack/files/TDtcagent.db

      Filesize

      20KB

      MD5

      263222e1f068fdafbb78a3d8adae515c

      SHA1

      52e656b6a58dbe69903e954dff6e4c7829be52fd

      SHA256

      c15401826654f941d3f533382e3d3b84875b968233e81d6683d294429eb31f2f

      SHA512

      007532bfacbf1dfac22a79f7c7b44bb44f47d281556c350cde14c9f31aca75904f2ac2bebeb4ae20f025b59abc1c262bb3f70cd092c3c40bd68bea15d3d8ec3b

    • /data/data/com.ketchapp.stack/files/TDtcagent.db

      Filesize

      28KB

      MD5

      202f91b53f73d2bc127b9d6dc4fa06cc

      SHA1

      a7c66a74a28e196888c0ded0f9a637ddd28df905

      SHA256

      e8a02e594f55d9728eedef3cadbbd6cf7a4ea57c4100e63be725aaf4a4b0585b

      SHA512

      30ace3c1a36960fd1809909eaa370736788d002ef8372acc740a7e5abb116ed9341cc0988c647d7a264ea3968371f986324ed9e7c18e62848fff8fa34ef320a4

    • /data/data/com.ketchapp.stack/files/TDtcagent.db

      Filesize

      28KB

      MD5

      d730c4f5233f02de0749b24c69514193

      SHA1

      60795171996dd1dcba382d3d675c40c384cc1fdb

      SHA256

      a4435927522d133b0ed0b9d7106198b957284b743a78682085aefbe90703c6ec

      SHA512

      5364150f20017812a1f7c8b23be1605cd8cbea502c39e71c960681d6c241c3a7fb5ab5aa4601c6cbf1945ee692e43494fb3b5319716c2281dc8abbe86b132a61

    • /data/data/com.ketchapp.stack/files/TDtcagent.db

      Filesize

      28KB

      MD5

      2fb68f1e761b71e5399b3ed8a1167a7c

      SHA1

      4971d93b0f050f71d39985779fd3dc215b40ae22

      SHA256

      c9c90923e6b4e0a2a6773d88de7ab17a96b0ef3f7a4eacc8df5581aa44a80de1

      SHA512

      cb8d476b3cf96341cb4867525ece1b5c1e540866533a9d98d6c7e2c771e439ac4f35f772bb496cc6a7e057cddebda2c5ca9178a9c06cf99047153c5d14ad3af4

    • /data/data/com.ketchapp.stack/files/TDtcagent.db-journal

      Filesize

      512B

      MD5

      4194be45859fdfa42475802b942def96

      SHA1

      81f3d6ad9315ce6e0eaac087161809b82c98ec13

      SHA256

      9c9fff46557537d4fd4dc0b11b092e0e3ca58a30786b43c2a2949b3dc64c3e4d

      SHA512

      be8860534e12575363692295b8de10855c1eceb79558e9e9e7fb5c3bc803f2d6700a74c37a82722f4253e34ea353d009fec505843f9d7d71d94bcd09bb391aff

    • /data/data/com.ketchapp.stack/files/TDtcagent.db-wal

      Filesize

      72KB

      MD5

      f2d178cc4bc58d52e46a03a83afc4a4d

      SHA1

      14c7bc20ff4aaf63db3e7c8bd6d56f38b7600dde

      SHA256

      c669a6f83ecc57897a0fe6506c643276b0dcf4b47a4cfbba37b21576671575df

      SHA512

      f1800f7600dcf1301de375d821ce8994c0ea0b516d6e3949c86ccd40ad18ee4609467286c0420931ed69a47b6c1680575cbff936024dfcf64ee3e57c76fd7804

    • /data/data/com.ketchapp.stack/files/TDtcagent.db-wal

      Filesize

      8KB

      MD5

      4be9833a2ac077240cc0b08df7793d80

      SHA1

      8e0b4d9952a98cc0a80bae94a88a24a891b916bf

      SHA256

      41b0f5fd360994b9c99ca2b6a40ec83cdf21772e2ee20c5683df38d36b90b40d

      SHA512

      fffe46f50f5fa72c5098fac2c2dda8c595cf93b5dcbd071214330f5b129383abe792497ffebe82685001534fb5d73b1317a6147841abd65fb8795ba2b4f4bb1f

    • /data/data/com.ketchapp.stack/files/TDtcagent.db-wal

      Filesize

      8KB

      MD5

      571bf461ade744cf5cdc9207842959f1

      SHA1

      6addc04aa161606a3a317abf0d39c209e46045b8

      SHA256

      a21aee9f9d3ba0181554a626bc6727f286442ffa1bd526082bd76a1bf619b9cc

      SHA512

      cad5b3088ac726993b8d46ddaba8e6f1cfe961974df66fa32bb973e4a4449c7cdd8aeabf725111193751bf4e87a70fada2196f2915614b58b4229e9dc55eb131

    • /data/data/com.ketchapp.stack/files/TDtcagent.db-wal

      Filesize

      8KB

      MD5

      89e0bcba6cb07bb18569e68f9bfc3836

      SHA1

      59f5cf414b4ead3ad11ad131920540ca78d8e978

      SHA256

      3ab9a02776ea797340c0dc81cff04d7f082fc5bd9761b4a8775b845b78ce71a1

      SHA512

      e23ade1e93425992c1cd0b9bbd8f0fbb2ae3e836daf1f36a90d308a678a5fb0cbea2e5000b597bb79c998b981ca19210b00eab438e471e1a44238ac386e1de77

    • /data/data/com.ketchapp.stack/files/TDtcagent.db-wal

      Filesize

      8KB

      MD5

      bc9336ece74589eda5f762aecf041677

      SHA1

      a19c83dc0f3ea88520019778a5f7eefe0cedee0a

      SHA256

      e636e188e871ee2302ba73efc1df74cea39f76321a65ac49b13ac9d23020ac20

      SHA512

      1fef67c5d80f4dd38b1f3cb854f884afb798ba68cef70ba363ef25a1e6cc1f5a9f9e50ef37d3daaf621ee5969ad1d14f3546c93b4d96e664e2426903f353da32

    • /data/data/com.ketchapp.stack/files/TDtcagent.db-wal

      Filesize

      8KB

      MD5

      b37ac235233c6e71f494885f1dac3c06

      SHA1

      efb6697ad64cadc15bc54cf222fbb4386f2f30ad

      SHA256

      d4799135aadc76cb624697da73e4d9960692aecab8d8b0bc1f5e4bee5d26c81f

      SHA512

      16976ca58b62e2e4126d8ac8c0216e99421fa1123325112bead1f55a1695f3fcb18f75bbb47bf05a0ef45c85314fed146eb9f8197dba1b7c6a10679a75424e29

    • /data/data/com.ketchapp.stack/files/kuaiyouxi/datas/config/checkupdate

      Filesize

      8B

      MD5

      2c7634fee242a6fdcedf7c63ae6b1823

      SHA1

      7abf90300779a7c94aea8d0293531a5544755d47

      SHA256

      7f649b0d5232fa1081337bc0bfe2dbb801d6f0280315cf8a17922d6260c0b56e

      SHA512

      9f86ac2de9bf6ae8c5813fe3f46f375937a4638fc5ed66a78e1ab63c8b5e331cae4eb1f08d2ac135575b2ec6b49db2fbbf62d052d05021662a95837a7c7b5e7d

    • /data/data/com.ketchapp.stack/files/kuaiyouxi/datas/config/md5

      Filesize

      32B

      MD5

      fc142147c11505bf6b3ad00a3fe2b8d8

      SHA1

      fe0c8952fd5458df2fca5e9abf22de6b0e4047f5

      SHA256

      58b5fd06661d9c2d8b407a7266cf32e98bec8acb5d0ec05247568b933beadd8c

      SHA512

      7cd5be89b97e75a7cb83c8b18c4abfe5374974565142a542d112048d8e1037024da6236328804d3fd889a259f1f73849a735596e44bdafd80217c42ae1ff63e8

    • /data/data/com.ketchapp.stack/files/kuaiyouxi/datas/config/version

      Filesize

      10B

      MD5

      6efc47af51a6c196672a37318681ac00

      SHA1

      3e94de6dff871569e1c6acf27e168c4d7747ff1e

      SHA256

      45bcc3ee642f8f5aed5af558d56981fc0510d0f046c8dfbbede6a242ce4ae959

      SHA512

      e5918b62560c7801b2c3bdfd1b6b7dd8fa75c7536cff3426100891badab604a73f5d03d3cec3a813979b83c9124efca2687af10e09788c4614cf3dd08cb1b460

    • /data/data/com.ketchapp.stack/files/kuaiyouxi/datas/res/1253/dex.jar

      Filesize

      891KB

      MD5

      57a720eeff8002e022528f5a44ed56f0

      SHA1

      788ed2bc2d4e927106e5a89186a25ea6f05a0e09

      SHA256

      e7a4deabb755c39b662fd303f130b2deaf8aa5aafc4e0fb5d10197ae872ea759

      SHA512

      bb34784b4c4eb0565929ad742ade5a4b459ba5db21683a036fe1c465d97bbeaaa5f95e5e84ae5366dee623c1c2c05dbb79dcb0a27f92ad055da9ff84e97cd89f

    • /data/data/com.ketchapp.stack/files/kuaiyouxi/datas/res/1253/pack

      Filesize

      2.7MB

      MD5

      0e1bc470f855d8260ce860a79bc87048

      SHA1

      8e4cc20431c6ceef080eb165e25a49027b38161e

      SHA256

      ced99e4674b6646b5c06ae4e45368e9d6f2c6f01bb8a8d98a64ca64face6b1ba

      SHA512

      050f3d979c77dfcec41c71b259a10f12e41caee635b108b81e1883708eed2a95fad8f9d0b4bd3c8fffec7609104534e992215e2ddc72e27915226cd45dd1b76f

    • /data/data/com.ketchapp.stack/files/mpush_gateway_preferences_file

      Filesize

      18B

      MD5

      5b783a723321f384ea8a021d20ba4280

      SHA1

      8a53b72a13e69184d8d0ae99568e7d3b95fed07c

      SHA256

      f79b6c0ba6379e405153ae0536b49ce9ab8a64e8585cbcc4b7ee10a357b723a9

      SHA512

      bbce3c6ae766581622fcf53a41cfc47aedaa2050caa3fcefad2e5238470067d5e3b1a7f586d57318d74e0c3725bf0970fa9a1c02a3d0139e1f8444f2310c56a1

    • /data/data/com.ketchapp.stack/files/mpush_version_preferences_file

      Filesize

      2B

      MD5

      37693cfc748049e45d87b8c7d8b9aacd

      SHA1

      d435a6cdd786300dff204ee7c2ef942d3e9034e2

      SHA256

      535fa30d7e25dd8a49f1536779734ec8286108d115da5045d77f3b4185d8f790

      SHA512

      6ff334e1051a09e90127ba4e309e026bb830163a2ce3a355af2ce2310ff6e7e9830d20196a3472bfc8632fd3b60cb56102a84fae70ab1a32942055eb40022225

    • /data/user/0/com.ketchapp.stack/files/kuaiyouxi/datas/res/1253/dex.jar

      Filesize

      2.0MB

      MD5

      6b2f3ae8d9b5b4c24b4591f5f70f1883

      SHA1

      dff398e2dcbc8729d987b404709d3400ba13bd22

      SHA256

      d582d048f903081fc675a7ec2c5228950c284bba195a557edfc312ac716f86a1

      SHA512

      14eeaf3b4a27cb95c8760b1e7c81beeca6e9d484ea5f62520c9a80a1618d473ede3f30c5dcf4359087cce3b7257005e91099915b6f38d2dacde9f98258cb220b

    • /data/user/0/com.ketchapp.stack/files/kuaiyouxi/datas/res/1253/dex.jar

      Filesize

      2.0MB

      MD5

      628e57b99afd5c70c7a3f7ec0b85fba7

      SHA1

      727032676b78742da147829d74079a046f719338

      SHA256

      411e6ae4d9731a39cde6b6d71f671af597addb40ccfa490928ceaec600110feb

      SHA512

      80ff31ddfb2fb61829900ca9798b6250e6cbb9ef177aafd491dab69113849ae409296ea96263a91c27176a701ef9fbb948682bd3efbfcd7650b58e817cfbf350

    • /storage/emulated/0/.rwtest

      Filesize

      1B

      MD5

      13c8ffd977013703a701cf8e11deac65

      SHA1

      067d5096f219c64b53bb1c7d5e3754285b565a47

      SHA256

      e7cf46a078fed4fafd0b5e3aff144802b853f8ae459a4f0c14add3314b7cc3a6

      SHA512

      527cff2b6fdfbc0f54fe092b17d6d8c7e22500242635fa56981e85a64da6ce8a12a3a66cf69fd48f588bcba9bad141b8e351a0cdd4925ae57289933eec1fc153

    • /storage/emulated/0/kuaiyouxi/datas/res/kyx_videosdk_mzw1_ad/1253/update

      Filesize

      2.7MB

      MD5

      c04e13d1ede48f576cb693593c821423

      SHA1

      09294c1103534a8da544980d810ea278b30f7a90

      SHA256

      d3581f5eab894f06e6cda1267a464949efade31f9f81a15420e931c7a1566b48

      SHA512

      2dd57f60b12f31acfffea4bca8c13e3f53a159ba05cf2c889d16bbf9268a63832b6b50d8a0a1100928679aa90426601e71fea1ed9777ed2690ac792b58e9bb93

    • /storage/emulated/0/kuaiyouxi/datas/sdk/downloads/kyx_sdk_downloads.db-journal

      Filesize

      512B

      MD5

      ae4b245340c1ed3f8cf93902b21e7617

      SHA1

      2a07f960009824d4428043c33481fae65f8af4b8

      SHA256

      e58d03c7a907a3a9fef40cd52bef8a2a61cf1d7569fbbd97ede7825bef81005b

      SHA512

      6bad5f21772201d41e783b2ec82a2aaa32834197eff840af4c11e785bd5bb034263d9031617d8e4f49bca20f748550063e4cde3d40483fb8279c77883d6caf8b

    • /storage/emulated/0/kuaiyouxi/datas/sdk/downloads/kyx_sdk_downloads.db-wal

      Filesize

      32KB

      MD5

      c2b435f4ef6962c593b83e717c7e647e

      SHA1

      fa55e6288aee1ef4e05827999e8561b6508449eb

      SHA256

      9a8ad50f28d501f095ae69bc56a8204e5404871453aa09dfa26da0b346b7b5a6

      SHA512

      b3c0fdfea8137bf3a3b279d85fbde353ec41951cc9f391337a2663d7990e8a3eb33db6147561eedc16e684e030431ef21690af45af161cce451d196cf6bbfc7c