Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    177s
  • max time network
    171s
  • platform
    android_x64
  • resource
    android-x64-arm64-20240624-en
  • resource tags

    androidarch:armarch:arm64arch:x64arch:x86image:android-x64-arm64-20240624-enlocale:en-usos:android-11-x64system
  • submitted
    29/07/2024, 22:23

General

  • Target

    642b3b062d5a71332e5a08c468a2457a_JaffaCakes118.apk

  • Size

    3.8MB

  • MD5

    642b3b062d5a71332e5a08c468a2457a

  • SHA1

    d4c20d9c5a89a730bdc2ef02df1c272425499aff

  • SHA256

    5c95001612ce83a25a7efd51db4f3aab4d17cacbc6392b088535787412a83370

  • SHA512

    63e2ced60f389cfc91f81636842fc41486584ec414a660e44161acb704f3770ce188e2530af2fc5af5d0e3706c0e4bca2f062d14ed873d1874affe60faaa216b

  • SSDEEP

    98304:LLOgD7AvOQENMDWWlIBwX9vbNGKy+GN5I4CtmMC:HFpaHbN3y+o55G2

Malware Config

Signatures

  • Checks if the Android device is rooted. 1 TTPs 5 IoCs
  • Queries information about running processes on the device 1 TTPs 2 IoCs

    Application may abuse the framework's APIs to collect information about running processes on the device.

  • Acquires the wake lock 2 IoCs
  • Queries information about active data network 1 TTPs 2 IoCs
  • Reads information about phone network operator. 1 TTPs
  • Schedules tasks to execute at a specified time 1 TTPs 2 IoCs

    Application may abuse the framework's APIs to perform task scheduling for initial or recurring execution of malicious code.

  • Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 2 IoCs
  • Checks memory information 2 TTPs 1 IoCs

Processes

  • com.jalkipalki.vika
    1⤵
    • Checks if the Android device is rooted.
    • Queries information about running processes on the device
    • Acquires the wake lock
    • Queries information about active data network
    • Schedules tasks to execute at a specified time
    • Uses Crypto APIs (Might try to encrypt user data)
    • Checks memory information
    PID:4497
  • com.jalkipalki.vika:Metrica
    1⤵
    • Checks if the Android device is rooted.
    • Queries information about running processes on the device
    • Acquires the wake lock
    • Queries information about active data network
    • Schedules tasks to execute at a specified time
    • Uses Crypto APIs (Might try to encrypt user data)
    PID:4545

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • /data/user/0/com.jalkipalki.vika/databases/OneSignal.db

    Filesize

    52KB

    MD5

    212a337771ab5b18e82e4d1b7acdea35

    SHA1

    092a996b96b0dc7006669f4a3dadc94357b25013

    SHA256

    802cb04095337d676e9516d13b9653adf3764637006c37162ac8df6f06f22417

    SHA512

    988f85500157d0359ae7f442dd42eaf0c7e991069cdc20f4783a0b208938f84e1c8b5cb8680df3dca525661b518bcde4626239a3a2bb8e41ec72ebc62ae88915

  • /data/user/0/com.jalkipalki.vika/databases/OneSignal.db-journal

    Filesize

    8KB

    MD5

    f87ea0dc438289bed93f6ea070e0be9d

    SHA1

    0aa57a307775b7e24200d5d2da04ee19d1332e27

    SHA256

    441192a2cc054d08c747340d689e43ff481a90b6c60e5ae286c73a65607dba5c

    SHA512

    60087d86f8f420429c590f2669d016b5fc71e4b7807a73a2e14e3dd6ce45a44878698790f9b124634dab9fb1ee204f5de9f0feb9a319b534d139443b3878f967

  • /data/user/0/com.jalkipalki.vika/databases/OneSignal.db-journal

    Filesize

    8KB

    MD5

    fb6dbb40eda008133e1185e9eeda139f

    SHA1

    5164d42ea1149d287aa0d10bc8aeba45ab12762f

    SHA256

    0bca8e13f9a23dd4600a87029551658adc5287ac783fe97dfe479463544fe0ae

    SHA512

    855314176e23f6e8e6257b4515371739d327e1bf17edfedb1f9543e376179c7aee586c484aab653202eb336b189ea02f34c7940ad00757da5327289c8930789d

  • /data/user/0/com.jalkipalki.vika/databases/OneSignal.db-journal

    Filesize

    512B

    MD5

    8926c034d89f0349f290607e0267e5b6

    SHA1

    134537b5830bb4c9512fef7a1fa430397f9e59f5

    SHA256

    1f3a57f9170c5f895f7d3430bb2f11d3483546ffae07089d252d4e60f303ce2a

    SHA512

    dd2de033dc63c1935ad737ff989da21d6343003d3d7b31ddf195b9ccd07c89a7fe980c67fc6c2855a8c6b14bda01c910d2559923871cd9687b16e562f71e2ce9

  • /data/user/0/com.jalkipalki.vika/files/Mint-lastsavedfile

    Filesize

    512B

    MD5

    8f8de01569e521ecda1a5856b6479fe9

    SHA1

    1967aeb12049b2aca5a9a751cd90943db3f8b81f

    SHA256

    c19641da0f31a181800ad48e1a544f249ae355040d697ddb79a174a0a0075a39

    SHA512

    87763b906675b9a5c3348410845ffdb89c8d3939ab91bddfa37a876b431ba38d24d0178f2330881eaeb76f6fca74b3d0d2313365ec7c49925860ece148167d11

  • /data/user/0/com.jalkipalki.vika/files/MintSavedData-1-1722293869626.json

    Filesize

    12KB

    MD5

    30aa8ad28ed455b977756fce7fbfa48b

    SHA1

    c8867d61d529991742fc2ea04279bff593c152c7

    SHA256

    dc96ad49bfd80c6b94802597956796d2ae6c40b69ccf040687a94655507e0790

    SHA512

    ad3ce5ba236ff7f9610b97d1fa0a1c5932851355fdd060e03e164abeab1b831476002a0e4d5cb1d0decf2887da6f3c1d9a7ecc6f1962a075f5f3bd48f93f17a2

  • /data/user/0/com.jalkipalki.vika/no_backup/androidx.work.workdb

    Filesize

    12KB

    MD5

    68e6bab2e9b214c92f31bc3f7e9f7c28

    SHA1

    3edc062045af2362e70d839ec62b8d578eb1e908

    SHA256

    4c65e59b684b9d7a55b86fa4aa75ba40c7d73bab4ad7cd6dc7cbd161957697f5

    SHA512

    199c9fdc1336fdf4a140f2a73d18dd3898a4c8fc2898d29f3bda78abc768eabc89c5e075a062535676e3e10dd4fc50d0fdc226b28cd9fad21548bc2e1f9ace02

  • /data/user/0/com.jalkipalki.vika/no_backup/androidx.work.workdb-journal

    Filesize

    116KB

    MD5

    3a9d7da4d0845ba258a5125232ed9f47

    SHA1

    99c93989ace2b9128cbd4ace2c3f5036e6605d6f

    SHA256

    005f38b62cb912901c5eff7e3d493a3e83f8bbcaa92f07d82280ed3793d56fe9

    SHA512

    dc3edf069dfadbf750cc6dca68c20766a761714a1900d3e3416e175bb2b46f5f4d226ac312d0baee0553f0bbee3c1b61c2be1789eed7df29a595fe4629ad57e8

  • /data/user/0/com.jalkipalki.vika/no_backup/androidx.work.workdb-shm

    Filesize

    36KB

    MD5

    5c1207ee75bdc872f02dcade82f9e88b

    SHA1

    87df85cc7b759e57c33f9af77736e6196e0aaf93

    SHA256

    ae0c7f73454d94f1f9ca30f39b89c479fe705c2744864aeff5bbae6be06a41c2

    SHA512

    bcacadf3c333412529331d180d6889e9e20be0233092d77a102350f56426a48cee89f93e671dd1b8b05f85fc2170c4f90b381975ed4a353ce7dcf4a271d97ccc

  • /data/user/0/com.jalkipalki.vika/no_backup/androidx.work.workdb-wal

    Filesize

    16KB

    MD5

    0d4e5b38537849cb930a66aec9b846d8

    SHA1

    cb5802f69866f4114449f9667492f33f8088c9ea

    SHA256

    0bc428f8f09794503300ce552fd8e5f0ca9402ef21642de611e865a109a093ea

    SHA512

    daa1c1de3519ea5ef7a0729e15de8a62fba57071c80e7ca71e6ebbb6a26a3237d5dc1f501c61d716505d5bbcaf2ae9d0cad16704901e4b909550586edaa2c076

  • /data/user/0/com.jalkipalki.vika/no_backup/androidx.work.workdb-wal

    Filesize

    108KB

    MD5

    8e34032acec0e731558f5dafbc1bc33e

    SHA1

    773ce990e1cfc3a1e3620b9a96d6d33313a03f63

    SHA256

    ba5d6f270b627cf666514c21b4a02f777d67b8df293531502dbcb94f6da1f7ee

    SHA512

    0caa4e33a6e6467b3134e587c59aa502f8f92235bbdc5c5e4a962850ac9f41aa52e4752742c188eb0a26d32e5c4e5394b8f863920d60dfab3d41694eb87d4a7b

  • /data/user/0/com.jalkipalki.vika/no_backup/androidx.work.workdb-wal

    Filesize

    277KB

    MD5

    2e55cdacee104ccaeb3b6d043cad4a5b

    SHA1

    e61b4ce38d67c8da1c8d34ea7b54e44e834792d7

    SHA256

    66e4daeb85bc9efea159029185f743b5e2db509afb46e12bd964ec89685d1de2

    SHA512

    f504101d7c9d3e364246a85afbc307173085d2c85ecd2d0c562fb8d89c3c7c73aea7760ba733b4a349aaca7167b8a9fb3a9aba1e28c7f4e73f67023654c110be

  • /data/user/0/com.jalkipalki.vika/no_backup/androidx.work.workdb-wal

    Filesize

    253KB

    MD5

    88081766a0f9fbd86ab573d27f83fd14

    SHA1

    93d618427c84ea783eb3f625ad5651060c13fa48

    SHA256

    12fe5ce346e145575b67f2dd43c540ab3921faa30d56fa49569ddf5bc49778c2

    SHA512

    a5ab8133d5686fc8458ee6559364e633dd26ab8dd6a1d9f3246ec7dd933fb5483e0a3342f6512025ce3cd4f12d287d529fded9ee841fcaf5813828a6c8946468

  • /data/user/0/com.jalkipalki.vika/no_backup/com.google.InstanceId.properties

    Filesize

    12KB

    MD5

    78d440b9b418f0a54706ba11fe99db43

    SHA1

    59f39f1852d2cb9341399b49d834df4460710d3e

    SHA256

    1841be0e95315975cd2e4085b646466482f2f2747503d84bca86e16084719b8d

    SHA512

    1342853b543e1fe8c1e2e42dda90e5663759b61226276912b0f603f3381e6986fc38c3fc9071a72fba989e56b00bf6394fa318b1cbfafbe907e7525586731104

  • /data/user/0/com.jalkipalki.vika/no_backup/credentials.dat

    Filesize

    226B

    MD5

    5a5ba91bc79e128e13983ff355825a74

    SHA1

    5614c48c41c683e78c07cd59c31fcca9197f4515

    SHA256

    f3b0f293e43745c5bba4dfb35245c80fc7d4c30101965a1988653076c61369fd

    SHA512

    3fc39ad170bacc24c216c0d1d2bc80017c9f385a52e29de22efa64404d80b93d94da16efb25bc8700c7471ffd7c90117d6b1b5ef92535b11018ae59ae113d7bf

  • /data/user/0/com.jalkipalki.vika/no_backup/db_metrica_com.jalkipalki.vika-journal

    Filesize

    8KB

    MD5

    3008031339e1aecefc44bf31b6986a34

    SHA1

    13a67ad1b78b6e52f89712127830f8e0e40ff8bd

    SHA256

    175683c0951c95b8b062484295ac851cb5e5c2cea3bb82d84c258429e3c009ca

    SHA512

    407ac2898401273802f7004495b1670804925b73948c9965b95dff57e15c6364f431a51d0a5b10f4615dd49a15f8c74fa1a6d11c82486b9b1c900a4dbc6252c5

  • /data/user/0/com.jalkipalki.vika/no_backup/db_metrica_com.jalkipalki.vika-journal

    Filesize

    8KB

    MD5

    1ecda4f9c5f0853da060ad03701579d5

    SHA1

    d0ff23dc3b7fde0d939a08754640f4b385cc96cf

    SHA256

    f91e047f51f2c7f92b01e5ef3b9ed4d0794fedce28b586bff266ae719c0bc2b5

    SHA512

    4ccc764db596ce282b82dc7fb26dd5d3db626629f7051f0b1386ae31203d80ddf4e388e0760d3764d8b17ba428a9562e23c83ee1a4474eda772c7ab513c341d0

  • /data/user/0/com.jalkipalki.vika/no_backup/db_metrica_com.jalkipalki.vika-journal

    Filesize

    12KB

    MD5

    dcc66949e02f423c9fd5e67fc8f44e68

    SHA1

    5497044bd776883b57f5daca164eac4018bcfd3d

    SHA256

    9f48e1ee982862e14ebdfac850b7670e30eceefd58a0701724d46e6af7c87ca9

    SHA512

    9ff9cf9a1b10078a63c79781e390390f9444b78a26393ec2a4bf54bf2ab524bf7c225a3a91e1ef0ed6d47c3567bdf7d58c48c0d81b7a60822b32b3cb5c03ce2d

  • /data/user/0/com.jalkipalki.vika/no_backup/db_metrica_com.jalkipalki.vika_20799a27-fa80-4b36-b2db-0f8141f24180

    Filesize

    36KB

    MD5

    e3adb643adb25bd8ae03fa1ba7874794

    SHA1

    0674bca5c40e921ae386843734a57c55dcc800d8

    SHA256

    2e6ad1ba837494a77a5c536b7a7c65320f8c6fb68d8aa469d7f8e576a9a6872e

    SHA512

    2b9bec7ec26f76a509a898e76c7d542f3f213fda531a0e4e7043dd69def039a243fa7e5c327b8ca71fb146024406da9c430f9c87be1593a2c74d4a82553b5630

  • /data/user/0/com.jalkipalki.vika/no_backup/db_metrica_com.jalkipalki.vika_20799a27-fa80-4b36-b2db-0f8141f24180-journal

    Filesize

    12KB

    MD5

    9d9f58a4779360f1a1b4e0ee7da4fe3d

    SHA1

    ff0ac77101d853794c323280a95ed22dd6d981ae

    SHA256

    e128ac4cd4eafa8b230ed8abc1ab59896e33a8ea5b7877b4dd89227644165677

    SHA512

    783fd1b83086cb31a6d218324bb5f549f4ad30edfa72c9045637e9de031eccb1e008792526412cbc68147d864e42c45d9bc919b63dad9379cd45d02a642c8edc

  • /data/user/0/com.jalkipalki.vika/no_backup/db_metrica_com.jalkipalki.vika_20799a27-fa80-4b36-b2db-0f8141f24180-journal

    Filesize

    20KB

    MD5

    441aca41f3f61dd056202a648dd4448d

    SHA1

    2f981cb5dcecf2e2fe7ecbdd345e7fd4d5ee74a2

    SHA256

    34eeb88b2183ca5eab7b3c7ac39afed57063bbff0ec98a54d4d8d411846988dd

    SHA512

    2d6f1903372cbb877661597da9b4e45928566e938592bd75e1bf60de7520b14a6515db9204e10703baebbb0d0041c7dfb4c2e52cf3373f4de3e47011a57668ca

  • /data/user/0/com.jalkipalki.vika/no_backup/db_metrica_com.jalkipalki.vika_20799a27-fa80-4b36-b2db-0f8141f24180-journal

    Filesize

    12KB

    MD5

    b64908e90d8c2acf77e172ff29607b81

    SHA1

    cae65777e668a7b23bff4c963d557091a4716a3b

    SHA256

    7376810616e0c8caa277c8f749456601e7030424e99ff12774db5b646717f675

    SHA512

    a95227d35f2a1b2fbe2200a9eb7fa41b8f677633357c92bfffa88aabe57f33571771a706fc671be261bd77ea8eaea18466021808f008660fb7b8494205b3750a

  • /data/user/0/com.jalkipalki.vika/no_backup/db_metrica_com.jalkipalki.vika_20799a27-fa80-4b36-b2db-0f8141f24180-journal

    Filesize

    12KB

    MD5

    651aebd5e3fdf3a6381fed2b85976cfd

    SHA1

    20a7a142c7d47e9c17347aa88c3ecec209d2a765

    SHA256

    fcf41e7e5699f8257355288b5a4aa603fdb39183e882598eaedb34b02c7986f0

    SHA512

    c66b3a95e4b4d2debc192e8fe01ec93fef106b660fd1d3bed7ece311d23c93314175b9bfb1389e9242a43040d18de95fd958a270eac1605723d256d93b8967b8

  • /data/user/0/com.jalkipalki.vika/no_backup/metrica_client_data.db

    Filesize

    20KB

    MD5

    b1dfde9a2d857e6694fd594a77967441

    SHA1

    5d68a66c7123dc6b56783892a90e9f01e935c834

    SHA256

    08ccd9f47cd9146d7391eacf96d0c49ffde764bb685e2f69b2797b42d7fcd753

    SHA512

    68ae8dcd49ffe6772939c4a6b3306422d94877ac4e5d7b1a20f510edc93d745c07fecefcc0196803c6acf6a998c0df1d8aee044f36bea166d6a7f6ccaaecd86f

  • /data/user/0/com.jalkipalki.vika/no_backup/metrica_client_data.db

    Filesize

    20KB

    MD5

    fc318483a677c71a725dbbe6e9516df9

    SHA1

    8ac3af9cbfb464e53b709028d1f64a4d019bb2f4

    SHA256

    d6d65421dac425ed42a96af8b94a1d708f6e23b556f0bc80011eb4970304b7f9

    SHA512

    0e3a0d7629cbfdcaa59e415c4ba982355f249b9595d234c0de6fda993c65c121435c442945766017cd78533fbd059d7edfe2eda0185ec6e4d076499536a63140

  • /data/user/0/com.jalkipalki.vika/no_backup/metrica_client_data.db

    Filesize

    20KB

    MD5

    7854c75bde5b73115740f8c8182b45dc

    SHA1

    b4888dc556610a186bca12ed6bb9e6c915fd658f

    SHA256

    9aa1c0eaf38d5dc9d215341497e35faf02e676638e10e335666259b3f4815afb

    SHA512

    413637e30ffe1560bcbe1a54aa9142d5dfe072dc9e9da91e24d2bc1d8d8d0000e0fe13cff43701bd0f6c2301d97aeb495dd5e56f3efce7c4edcc6f574fe815c8

  • /data/user/0/com.jalkipalki.vika/no_backup/metrica_client_data.db

    Filesize

    44KB

    MD5

    b138257d811b0a25c5c9a95ca320816b

    SHA1

    8255347b7ecaad7af0695776644ba643cc392322

    SHA256

    3e4d7584b312d5c355589113e86d43b89b923abc49b6a522555b12e4f30b13b9

    SHA512

    984f4a25cf9f95a1b3f450b81b64c1fe37c0141396d748ccb0a39b01be42d783d3bb6bc81aec1807c2575a421b0c55a10616f6d45f549cba95cb8cdf9956d9c6

  • /data/user/0/com.jalkipalki.vika/no_backup/metrica_client_data.db-journal

    Filesize

    12KB

    MD5

    25afe3ab45d7f439c3454581296e9ccc

    SHA1

    49b76005f5de910c2af567138da6419ff3a5067c

    SHA256

    d9d3d82ef09574275f75a4ed58ebe56ad73075ad7bfa1efb60dc719d0b524b7c

    SHA512

    e3a8b80cdb3773f358a9ab1732149ee83f71e4da9a07fc956755bbb646e43f67ce41c7c897a778d09a6aa6ba99fe9a721f5221889c2452bae19e003ec2d4619f

  • /data/user/0/com.jalkipalki.vika/no_backup/metrica_client_data.db-journal

    Filesize

    512B

    MD5

    a5ec6bec25fc01336c7c3af516e2fa13

    SHA1

    63fac46f7c14c517544d28a2ad5b5a6a898ec9ac

    SHA256

    f578353dabf3d14d853ded345743c2bd18da8a2c2097b25cdccb008003380591

    SHA512

    229df4f845451ede1de9922ecb3da905a644d4fbf89083e80306b777585706bc5b72e9bee15a582c5dc5c0f90253801da4791ff636378d94012a1010c58745fb

  • /data/user/0/com.jalkipalki.vika/no_backup/metrica_client_data.db-journal

    Filesize

    12KB

    MD5

    3db7425729084f96df08edea9299e0f9

    SHA1

    fd52d2565feddaf172d0f69021a23d156f4ab55f

    SHA256

    20ce234efb4254b93aebe6667e288f9374a9fa019b3de2469f9bb26161484aa2

    SHA512

    a340ad24cd90bad7c5951af1cc59c3a4a2b2fd6e52ad0986bd22532a902ee15d199a7a0e015114b17f000314dda17a4e9a103dcaccee5534ed270fe141374414

  • /data/user/0/com.jalkipalki.vika/no_backup/metrica_client_data.db-journal

    Filesize

    12KB

    MD5

    1817d0106b8b010ab9a8206d03dd6d03

    SHA1

    e4c59aa263f7778f698941048c2b2b3986afad89

    SHA256

    4c4515043b39bd930588a9c4727d87167a4edf2d9df5249f0320faca3b446e61

    SHA512

    1d4ccf50746b6c4c3b112d2e44880dd1f62f53f81572adf3f64d00c9861814ad944d51da2fe32db1ef151cfa5313dd487902b16c5cc30c76fb740b54713026dc

  • /data/user/0/com.jalkipalki.vika/no_backup/metrica_client_data.db-journal

    Filesize

    20KB

    MD5

    47154ed57bd5295ca4efda2ddf4a7a87

    SHA1

    e096c1980d9afb527b640a252eb6cd4e539cfd5d

    SHA256

    09d1ae2f03b87c57bc06a35292978da25aa18752ff8407cd3f194973ccca3d2a

    SHA512

    93c65c7137c418f447dff67c0cf84d132a0e9604c64311e32a97f69e23bd23882a03d8ae588244e977e662f42b263ed6b87597a8ad2a322fce457fc396214839

  • /data/user/0/com.jalkipalki.vika/no_backup/metrica_client_data.db-journal

    Filesize

    12KB

    MD5

    a2c1eb1dee097a693ee4f8bffdb703f6

    SHA1

    04744e926d78d9d699b4e79c99ceef2280bf39de

    SHA256

    538f328c92df9a5b07dda675b1564c3c214fe8456a43af51469b5fc441a2322d

    SHA512

    5fe431bbb44e57312707ba18cd20d602517265b282bf79f0bfb5f2601de902ffaea35ba97301b5fe7a68d4a742655319618118582f08021cf562d387c44ebb98