Analysis

  • max time kernel
    131s
  • max time network
    136s
  • platform
    android_x64
  • resource
    android-x64-20240624-en
  • resource tags

    androidarch:x64arch:x86image:android-x64-20240624-enlocale:en-usos:android-10-x64system
  • submitted
    04/12/2024, 19:11

General

  • Target
    c3fd36103f617324d4d2fa833989096c_JaffaCakes118.apk
  • Size 4.9MB
  • Sample241204-xwcc4askhq
  • SHA256 0cc18aa0a58ac84d39ea0d681caa378f0c85e39fff230b85239fec5960068870
  • MD5 SHA1 SHA512 SSDEEP

Malware Config

Signatures

  • Checks if the Android device is rooted. 1 TTPs 3 IoCs
  • Acquires the wake lock 2 IoCs
  • Queries information about active data network 1 TTPs 2 IoCs
  • Queries information about the current Wi-Fi connection 1 TTPs 1 IoCs

    Application may abuse the framework's APIs to collect information about the current Wi-Fi connection.

  • Reads information about phone network operator. 1 TTPs
  • Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 2 IoCs
  • Schedules tasks to execute at a specified time 1 TTPs 2 IoCs

    Application may abuse the framework's APIs to perform task scheduling for initial or recurring execution of malicious code.

  • Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 2 IoCs
  • Checks memory information 2 TTPs 1 IoCs

Processes

  • com.contextlogic.wish.hack
    1⤵
    • Checks if the Android device is rooted.
    • Acquires the wake lock
    • Queries information about active data network
    • Registers a broadcast receiver at runtime (usually for listening for system events)
    • Schedules tasks to execute at a specified time
    • Uses Crypto APIs (Might try to encrypt user data)
    • Checks memory information
    PID:4965
  • com.contextlogic.wish.hack:Metrica
    1⤵
    • Checks if the Android device is rooted.
    • Acquires the wake lock
    • Queries information about active data network
    • Queries information about the current Wi-Fi connection
    • Registers a broadcast receiver at runtime (usually for listening for system events)
    • Schedules tasks to execute at a specified time
    • Uses Crypto APIs (Might try to encrypt user data)
    PID:5010

Network

        MITRE ATT&CK Mobile v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        OneSignal.db

        • Path /data/data/com.contextlogic.wish.hack/databases/OneSignal.db
        • Size 52KB
        • SHA256 c17b0ff6f351266dfc375282c9ee02b8263348390207cec71835d7e0956419e3
        • MD5 SHA1 SHA512 SSDEEP

        OneSignal.db-journal

        • Path /data/data/com.contextlogic.wish.hack/databases/OneSignal.db-journal
        • Size 8KB
        • SHA256 acba756bdb821f03d5a5a24420719eca9e5f95b87f63e7444ec30add94b9f454
        • MD5 SHA1 SHA512 SSDEEP

        OneSignal.db-journal

        • Path /data/data/com.contextlogic.wish.hack/databases/OneSignal.db-journal
        • Size 512B
        • SHA256 84bbb87b0015f6dcade4fd5e0c7b84bbd58230130254b788ad7d307c17a6756a
        • MD5 SHA1 SHA512

        OneSignal.db-journal

        • Path /data/data/com.contextlogic.wish.hack/databases/OneSignal.db-journal
        • Size 8KB
        • SHA256 22a607c0eeffec794d00e3322ba79957402501da35edf4e4aa072c8f272af7a0
        • MD5 SHA1 SHA512 SSDEEP

        Mint-lastsavedfile

        • Path /data/data/com.contextlogic.wish.hack/files/Mint-lastsavedfile
        • Size 36KB
        • SHA256 ac30c1347adc80594e456d3504b4473742a217c2d5aa957861d5c08b1616b697
        • MD5 SHA1 SHA512 SSDEEP

        Mint-lastsavedfile

        • Path /data/data/com.contextlogic.wish.hack/files/Mint-lastsavedfile
        • Size 12KB
        • SHA256 63f8a18a0909cdd88a3232d318598f6bb0a88e42adc3c205e491116452713055
        • MD5 SHA1 SHA512 SSDEEP

        MintSavedData-1-1733339525752.json

        • Path /data/data/com.contextlogic.wish.hack/files/MintSavedData-1-1733339525752.json
        • Size 12KB
        • SHA256 4cc043439a64a166de9725c4e0a552a7ca69154116ccc268fe6302e3f621e1bf
        • MD5 SHA1 SHA512 SSDEEP

        MintSavedData-1-1733339525752.json

        • Path /data/data/com.contextlogic.wish.hack/files/MintSavedData-1-1733339525752.json
        • Size 12KB
        • SHA256 72c6c441841162d97b93e19430382dc1828d9193c6f7da700357fae76b375474
        • MD5 SHA1 SHA512 SSDEEP

        crashCounter

        • Path /data/data/com.contextlogic.wish.hack/files/crashCounter
        • Size 226B
        • SHA256 f7e1e2ed87b0c85048eadf92ccf149927b026ab4439568ea121d3f0260fcd297
        • MD5 SHA1 SHA512

        lastCrashID

        • Path /data/data/com.contextlogic.wish.hack/files/lastCrashID
        • Size 8KB
        • SHA256 0b669e0569f9907a6e815c2b874eb80bd80ca9cc63b1337ae91ce639e0a5a12b
        • MD5 SHA1 SHA512 SSDEEP

        androidx.work.workdb

        • Path /data/data/com.contextlogic.wish.hack/no_backup/androidx.work.workdb
        • Size 4KB
        • SHA256 0a8ffb6b327963558716e87db8946016d143e39f895fa1b43e95ba7032ce2514
        • MD5 SHA1 SHA512

        androidx.work.workdb-journal

        • Path /data/data/com.contextlogic.wish.hack/no_backup/androidx.work.workdb-journal
        • Size 12KB
        • SHA256 e9ffa8928517ae44ac806714bc405a3ecd7de346debc4d1b8c848db627350d27
        • MD5 SHA1 SHA512 SSDEEP

        androidx.work.workdb-shm

        • Path /data/data/com.contextlogic.wish.hack/no_backup/androidx.work.workdb-shm
        • Size 80KB
        • SHA256 4dbea7766871d76828fb5091044fb1d00387ccf85edf652b4da97c369d2f8d94
        • MD5 SHA1 SHA512 SSDEEP

        androidx.work.workdb-wal

        • Path /data/data/com.contextlogic.wish.hack/no_backup/androidx.work.workdb-wal
        • Size 16KB
        • SHA256 19718a62ae4fce453685535bc0f1b2a05a6c78b30b6de1ab4e8ee922d55e5c3c
        • MD5 SHA1 SHA512 SSDEEP

        androidx.work.workdb-wal

        • Path /data/data/com.contextlogic.wish.hack/no_backup/androidx.work.workdb-wal
        • Size 108KB
        • SHA256 372376fa9790bf957c581dd6090365fabfb5ad6b898629ed355b42545a909836
        • MD5 SHA1 SHA512 SSDEEP

        androidx.work.workdb-wal

        • Path /data/data/com.contextlogic.wish.hack/no_backup/androidx.work.workdb-wal
        • Size 265KB
        • SHA256 c42256687d0ee8d65c9f22ecb30d4bb165890ff93968e3e05699014ae0e8e288
        • MD5 SHA1 SHA512 SSDEEP

        com.google.InstanceId.properties

        • Path /data/data/com.contextlogic.wish.hack/no_backup/com.google.InstanceId.properties
        • Size 116KB
        • SHA256 02747eec1156fcb461d5bab12cede728fa5000928e64014868d5f464883195ee
        • MD5 SHA1 SHA512 SSDEEP

        db_metrica_com.contextlogic.wish.hack-journal

        • Path /data/data/com.contextlogic.wish.hack/no_backup/db_metrica_com.contextlogic.wish.hack-journal
        • Size 512B
        • SHA256 4b86c5473aa0c3f8a4cadd72acf7dd5563eab1180e730f0d3dd1db2c92779e02
        • MD5 SHA1 SHA512

        db_metrica_com.contextlogic.wish.hack-journal

        • Path /data/data/com.contextlogic.wish.hack/no_backup/db_metrica_com.contextlogic.wish.hack-journal
        • Size 8KB
        • SHA256 6d48bcdd68374a36b53cbc4fbb586218d3dc0b7f698fdc5a305f5b64fadbdb39
        • MD5 SHA1 SHA512 SSDEEP

        db_metrica_com.contextlogic.wish.hack-journal

        • Path /data/data/com.contextlogic.wish.hack/no_backup/db_metrica_com.contextlogic.wish.hack-journal
        • Size 12KB
        • SHA256 568b8dc73b14ce5cc650e36f4ebacd01f2f9c1f3922adc511956440b8d09ac5e
        • MD5 SHA1 SHA512 SSDEEP

        db_metrica_com.contextlogic.wish.hack-journal

        • Path /data/data/com.contextlogic.wish.hack/no_backup/db_metrica_com.contextlogic.wish.hack-journal
        • Size 56KB
        • SHA256 0b6e9531fe9e686d69cbedef80324c7464264a07f951c2de6f7cf201c12268b6
        • MD5 SHA1 SHA512 SSDEEP

        db_metrica_com.contextlogic.wish.hack_20799a27-fa80-4b36-b2db-0f8141f24180-journal

        • Path /data/data/com.contextlogic.wish.hack/no_backup/db_metrica_com.contextlogic.wish.hack_20799a27-fa80-4b36-b2db-0f8141f24180-journal
        • Size 512B
        • SHA256 a282084aefcc1200427466222137aea74238b082fafcf9eef3a1a60b32f009f1
        • MD5 SHA1 SHA512

        db_metrica_com.contextlogic.wish.hack_20799a27-fa80-4b36-b2db-0f8141f24180-journal

        • Path /data/data/com.contextlogic.wish.hack/no_backup/db_metrica_com.contextlogic.wish.hack_20799a27-fa80-4b36-b2db-0f8141f24180-journal
        • Size 8KB
        • SHA256 80c5a1bd5d2b4b33ec8787ab197f7cf154a7176ef872513cbe8a87ff72b05a54
        • MD5 SHA1 SHA512 SSDEEP

        db_metrica_com.contextlogic.wish.hack_20799a27-fa80-4b36-b2db-0f8141f24180-journal

        • Path /data/data/com.contextlogic.wish.hack/no_backup/db_metrica_com.contextlogic.wish.hack_20799a27-fa80-4b36-b2db-0f8141f24180-journal
        • Size 12KB
        • SHA256 40b99911cd5feeebe03a9f9f16d98fb410c7f6e3fba9606d84f8a227743cff54
        • MD5 SHA1 SHA512 SSDEEP

        db_metrica_com.contextlogic.wish.hack_20799a27-fa80-4b36-b2db-0f8141f24180-journal

        • Path /data/data/com.contextlogic.wish.hack/no_backup/db_metrica_com.contextlogic.wish.hack_20799a27-fa80-4b36-b2db-0f8141f24180-journal
        • Size 12KB
        • SHA256 b486e8b80509c44d76b5f5210c2b34f4d7b5c01374f8d196265ebd3f53edfe6d
        • MD5 SHA1 SHA512 SSDEEP

        metrica_client_data.db

        • Path /data/data/com.contextlogic.wish.hack/no_backup/metrica_client_data.db
        • Size 20KB
        • SHA256 219dc259e365b154083f15a9726f3c742e4008231bfcbe65e21840a5ab1bd9cb
        • MD5 SHA1 SHA512 SSDEEP

        metrica_client_data.db

        • Path /data/data/com.contextlogic.wish.hack/no_backup/metrica_client_data.db
        • Size 20KB
        • SHA256 ea3ab3eb5f71ad7a901500ebac256bdb6bc0fad0f49afe35d34d01130e4e3707
        • MD5 SHA1 SHA512 SSDEEP

        metrica_client_data.db

        • Path /data/data/com.contextlogic.wish.hack/no_backup/metrica_client_data.db
        • Size 20KB
        • SHA256 4564ec31a51694e8349f462d5ada137b3f37b7c42515a7fe34ea8ef33b5063c5
        • MD5 SHA1 SHA512 SSDEEP

        metrica_client_data.db

        • Path /data/data/com.contextlogic.wish.hack/no_backup/metrica_client_data.db
        • Size 20KB
        • SHA256 d192ba7b94a98afbd2d3628ea95707485d33908fd133e554e82efdb5e09d9a12
        • MD5 SHA1 SHA512 SSDEEP

        metrica_client_data.db-journal

        • Path /data/data/com.contextlogic.wish.hack/no_backup/metrica_client_data.db-journal
        • Size 12KB
        • SHA256 ea713e80cc902d7062f86c08b1f0078c934d80c8141e4be62f77b3e292758d9d
        • MD5 SHA1 SHA512 SSDEEP

        metrica_client_data.db-journal

        • Path /data/data/com.contextlogic.wish.hack/no_backup/metrica_client_data.db-journal
        • Size 512B
        • SHA256 5bcec88ee69b2d25dc9d21be07caaf06264680c0a52caa183eb677a3724b14b5
        • MD5 SHA1 SHA512

        metrica_client_data.db-journal

        • Path /data/data/com.contextlogic.wish.hack/no_backup/metrica_client_data.db-journal
        • Size 12KB
        • SHA256 f1e2f754aac874c7183b8017834308088e4d492a60dac60cec2461d20b8a6430
        • MD5 SHA1 SHA512 SSDEEP

        metrica_client_data.db-journal

        • Path /data/data/com.contextlogic.wish.hack/no_backup/metrica_client_data.db-journal
        • Size 20KB
        • SHA256 891faee0baf2647ec8279d811caed90c4d51b4345fd803c4704367fd43adb11e
        • MD5 SHA1 SHA512 SSDEEP

        metrica_client_data.db-journal

        • Path /data/data/com.contextlogic.wish.hack/no_backup/metrica_client_data.db-journal
        • Size 44KB
        • SHA256 ebbb01958a5c02ad5fda95c6cbd351c4efec8382f64e3c2d9635c090a5baaa0f
        • MD5 SHA1 SHA512 SSDEEP