Analysis

  • max time kernel
    29s
  • max time network
    133s
  • platform
    android_x64
  • resource
    android-x64-arm64-20240603-en
  • resource tags

    androidarch:armarch:arm64arch:x64arch:x86image:android-x64-arm64-20240603-enlocale:en-usos:android-11-x64system
  • submitted
    04/06/2024, 16:25

General

  • Target
    9584331ccc4bf9639749b7445afd560c_JaffaCakes118.apk
  • Size 29.2MB
  • Sample240604-txctgadc87
  • SHA256 5325b86b793c8823d24999038e5db28de534841547b6355142b8aee936bc3344
  • MD5 SHA1 SHA512 SSDEEP

Malware Config

Signatures

  • Loads dropped Dex/Jar 1 TTPs 1 IoCs

    Runs executable file dropped to the device during analysis.

  • Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
  • Queries information about running processes on the device 1 TTPs 1 IoCs

    Application may abuse the framework's APIs to collect information about running processes on the device.

  • Requests cell location 2 TTPs 1 IoCs

    Uses Android APIs to to get current cell location.

  • Queries information about active data network 1 TTPs 1 IoCs
  • Queries information about the current Wi-Fi connection 1 TTPs 1 IoCs

    Application may abuse the framework's APIs to collect information about the current Wi-Fi connection.

  • Listens for changes in the sensor environment (might be used to detect emulation) 1 TTPs 1 IoCs
  • Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs

Processes

  • com.ketchapp.stack
    1⤵
    • Loads dropped Dex/Jar
    • Queries information about running processes on the device
    • Requests cell location
    • Queries information about active data network
    • Queries information about the current Wi-Fi connection
    • Listens for changes in the sensor environment (might be used to detect emulation)
    • Uses Crypto APIs (Might try to encrypt user data)
    PID:4557

Network

        MITRE ATT&CK Mobile v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        kyx_sdk_downloads.db

        • Path /data/user/0/com.ketchapp.stack/databases/kyx_sdk_downloads.db
        • Size 20KB
        • SHA256 e0dbe4fd6825385865b746810cf5f92b7dcdf9251235ed369e431731c635e046
        • MD5 SHA1 SHA512 SSDEEP

        kyx_sdk_downloads.db-journal

        • Path /data/user/0/com.ketchapp.stack/databases/kyx_sdk_downloads.db-journal
        • Size 512B
        • SHA256 0950888ef1203d393016f03600ef6db889a6715b465948540add75b68216c441
        • MD5 SHA1 SHA512

        kyx_sdk_downloads.db-journal

        • Path /data/user/0/com.ketchapp.stack/databases/kyx_sdk_downloads.db-journal
        • Size 8KB
        • SHA256 ede7b53959479bde18e3a799b30761ed1214155d1538915ca495c9f1b9d14709
        • MD5 SHA1 SHA512 SSDEEP

        kyx_sdk_downloads.db-journal

        • Path /data/user/0/com.ketchapp.stack/databases/kyx_sdk_downloads.db-journal
        • Size 8KB
        • SHA256 9534ddb3bb3cf14227f64da1e66693c80c9b242b76758b14dcb1fc1c61422676
        • MD5 SHA1 SHA512 SSDEEP

        mpush_app.db

        • Path /data/user/0/com.ketchapp.stack/databases/mpush_app.db
        • Size 28KB
        • SHA256 e560f6d31089b2d40837abe002899d43d4f8b71a413436597e21ef608213ac7e
        • MD5 SHA1 SHA512 SSDEEP

        mpush_app.db-journal

        • Path /data/user/0/com.ketchapp.stack/databases/mpush_app.db-journal
        • Size 512B
        • SHA256 864ba8a0937d49224633bac704379087d24052cd21c20bfe3fb1aa51db2427ed
        • MD5 SHA1 SHA512

        mpush_app.db-journal

        • Path /data/user/0/com.ketchapp.stack/databases/mpush_app.db-journal
        • Size 8KB
        • SHA256 78b97a46e548dbe4b3b427c87b4a7d728fa1f71b0f5116ee1c6d72b8cad27929
        • MD5 SHA1 SHA512 SSDEEP

        mpush_app.db-journal

        • Path /data/user/0/com.ketchapp.stack/databases/mpush_app.db-journal
        • Size 8KB
        • SHA256 78c9ccb098f5e22ff06314e21f337029e7e0ca6a8a1e111fb42a1454eb286ead
        • MD5 SHA1 SHA512 SSDEEP

        mpush_app.db-journal

        • Path /data/user/0/com.ketchapp.stack/databases/mpush_app.db-journal
        • Size 12KB
        • SHA256 bac6becf5d6c1e98fedd46439fea686f381968dcb81475b03e9233f2e38c5a46
        • MD5 SHA1 SHA512 SSDEEP

        TDtcagent.db

        • Path /data/user/0/com.ketchapp.stack/files/TDtcagent.db
        • Size 32KB
        • SHA256 978e10b07e91ca29ede5c387dfd9e501a19cc5a02675196d716962e7697de695
        • MD5 SHA1 SHA512 SSDEEP

        TDtcagent.db

        • Path /data/user/0/com.ketchapp.stack/files/TDtcagent.db
        • Size 24KB
        • SHA256 ae4ab3e4fe764b818dad60b63a409e71d88bfd2d9fa5b2adce4156371d2e3816
        • MD5 SHA1 SHA512 SSDEEP

        TDtcagent.db

        • Path /data/user/0/com.ketchapp.stack/files/TDtcagent.db
        • Size 20KB
        • SHA256 70975531feb5aac43448171ff3a77a83232717059ffb3ecab085fdf64d96a828
        • MD5 SHA1 SHA512 SSDEEP

        TDtcagent.db

        • Path /data/user/0/com.ketchapp.stack/files/TDtcagent.db
        • Size 28KB
        • SHA256 1bb36fc0c1b97fd658380c53e93b4c72cd5d3a19c63bb59d17a17c1c81353f28
        • MD5 SHA1 SHA512 SSDEEP

        TDtcagent.db

        • Path /data/user/0/com.ketchapp.stack/files/TDtcagent.db
        • Size 28KB
        • SHA256 d28d39eed1a17fe205a3439a7f2e9a4807750c7c64ec051e0861e1cb52fdca5e
        • MD5 SHA1 SHA512 SSDEEP

        TDtcagent.db

        • Path /data/user/0/com.ketchapp.stack/files/TDtcagent.db
        • Size 28KB
        • SHA256 e193eec26c4dfe8848512bfe6cb22d2747bf303f7fa9a413ba745921272d44b1
        • MD5 SHA1 SHA512 SSDEEP

        TDtcagent.db-journal

        • Path /data/user/0/com.ketchapp.stack/files/TDtcagent.db-journal
        • Size 512B
        • SHA256 bbe7bc7fb81502237fbad14d66de87943b859fdf09dd2a37ccd7380266d2ff1f
        • MD5 SHA1 SHA512

        TDtcagent.db-journal

        • Path /data/user/0/com.ketchapp.stack/files/TDtcagent.db-journal
        • Size 8KB
        • SHA256 f26b5ab51112a325a8474201ebdbed76623eb115b20f2894aaa4272c13c6aecd
        • MD5 SHA1 SHA512 SSDEEP

        TDtcagent.db-journal

        • Path /data/user/0/com.ketchapp.stack/files/TDtcagent.db-journal
        • Size 4KB
        • SHA256 388893e9eb28f0651d47a0554abedb59d9b4ea292de41533740d70f7af97d114
        • MD5 SHA1 SHA512 SSDEEP

        TDtcagent.db-journal

        • Path /data/user/0/com.ketchapp.stack/files/TDtcagent.db-journal
        • Size 8KB
        • SHA256 b90005a2ca3261425d2105e1336f96b3b25fff6b4a89db4f627d64bd89ea3fbe
        • MD5 SHA1 SHA512 SSDEEP

        TDtcagent.db-journal

        • Path /data/user/0/com.ketchapp.stack/files/TDtcagent.db-journal
        • Size 8KB
        • SHA256 ef2bb3d13b3ff28fb83512bd460ad80648bcd0aca37b8e78e920bc8befceb2b9
        • MD5 SHA1 SHA512 SSDEEP

        TDtcagent.db-journal

        • Path /data/user/0/com.ketchapp.stack/files/TDtcagent.db-journal
        • Size 12KB
        • SHA256 d1f13b868a600959aa4c36c86849ae16bf13efa9c066280007417405e2bfa169
        • MD5 SHA1 SHA512 SSDEEP

        checkupdate

        • Path /data/user/0/com.ketchapp.stack/files/kuaiyouxi/datas/config/checkupdate
        • Size 8B
        • SHA256 4f87f6c2be097041a87e79e1cf34005267a9efae44272cf98d5b85695e1f23ad
        • MD5 SHA1 SHA512

        md5

        • Path /data/user/0/com.ketchapp.stack/files/kuaiyouxi/datas/config/md5
        • Size 32B
        • SHA256 58b5fd06661d9c2d8b407a7266cf32e98bec8acb5d0ec05247568b933beadd8c
        • MD5 SHA1 SHA512

        version

        • Path /data/user/0/com.ketchapp.stack/files/kuaiyouxi/datas/config/version
        • Size 10B
        • SHA256 45bcc3ee642f8f5aed5af558d56981fc0510d0f046c8dfbbede6a242ce4ae959
        • MD5 SHA1 SHA512

        dex.jar

        • Path /data/user/0/com.ketchapp.stack/files/kuaiyouxi/datas/res/1253/dex.jar
        • Size 891KB
        • SHA256 e7a4deabb755c39b662fd303f130b2deaf8aa5aafc4e0fb5d10197ae872ea759
        • MD5 SHA1 SHA512 SSDEEP

        dex.jar

        • Path /data/user/0/com.ketchapp.stack/files/kuaiyouxi/datas/res/1253/dex.jar
        • Size 2.0MB
        • SHA256 411e6ae4d9731a39cde6b6d71f671af597addb40ccfa490928ceaec600110feb
        • MD5 SHA1 SHA512 SSDEEP

        pack

        • Path /data/user/0/com.ketchapp.stack/files/kuaiyouxi/datas/res/1253/pack
        • Size 2.7MB
        • SHA256 ced99e4674b6646b5c06ae4e45368e9d6f2c6f01bb8a8d98a64ca64face6b1ba
        • MD5 SHA1 SHA512 SSDEEP

        mpush_gateway_preferences_file

        • Path /data/user/0/com.ketchapp.stack/files/mpush_gateway_preferences_file
        • Size 18B
        • SHA256 f79b6c0ba6379e405153ae0536b49ce9ab8a64e8585cbcc4b7ee10a357b723a9
        • MD5 SHA1 SHA512

        mpush_version_preferences_file

        • Path /data/user/0/com.ketchapp.stack/files/mpush_version_preferences_file
        • Size 2B
        • SHA256 535fa30d7e25dd8a49f1536779734ec8286108d115da5045d77f3b4185d8f790
        • MD5 SHA1 SHA512

        .rwtest

        • Path /storage/emulated/0/.rwtest
        • Size 1B
        • SHA256 e7cf46a078fed4fafd0b5e3aff144802b853f8ae459a4f0c14add3314b7cc3a6
        • MD5 SHA1 SHA512

        update

        • Path /storage/emulated/0/kuaiyouxi/datas/res/kyx_videosdk_mzw1_ad/1253/update
        • Size 2.7MB
        • SHA256 d3581f5eab894f06e6cda1267a464949efade31f9f81a15420e931c7a1566b48
        • MD5 SHA1 SHA512 SSDEEP

        kyx_sdk_downloads.db-journal

        • Path /storage/emulated/0/kuaiyouxi/datas/sdk/downloads/kyx_sdk_downloads.db-journal
        • Size 512B
        • SHA256 06cdfb1583d981fa1541ced39833a39d569f61cace70ce25483f923e0abd581e
        • MD5 SHA1 SHA512

        kyx_sdk_downloads.db-journal

        • Path /storage/emulated/0/kuaiyouxi/datas/sdk/downloads/kyx_sdk_downloads.db-journal
        • Size 8KB
        • SHA256 c84ad02832b21ee6db730bf06b3ffb2ae780cd7970c8bff31aacca854d6537b5
        • MD5 SHA1 SHA512 SSDEEP

        kyx_sdk_downloads.db-journal

        • Path /storage/emulated/0/kuaiyouxi/datas/sdk/downloads/kyx_sdk_downloads.db-journal
        • Size 8KB
        • SHA256 6a5f329efcbc302ed158b2ae42b1d71bde59a85d715ebe390fd54bf4a2e9b743
        • MD5 SHA1 SHA512 SSDEEP