Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    146s
  • max time network
    147s
  • platform
    android_x64
  • resource
    android-x64-arm64-20240624-en
  • resource tags

    androidarch:armarch:arm64arch:x64arch:x86image:android-x64-arm64-20240624-enlocale:en-usos:android-11-x64system
  • submitted
    04/12/2024, 19:11

General

  • Target

    c3fd36103f617324d4d2fa833989096c_JaffaCakes118.apk

  • Size

    4.9MB

  • MD5

    c3fd36103f617324d4d2fa833989096c

  • SHA1

    f12b9d0c224e0130e33af012b883c6405bb32503

  • SHA256

    0cc18aa0a58ac84d39ea0d681caa378f0c85e39fff230b85239fec5960068870

  • SHA512

    8d4b97982f18c67d90f074c518ea496ce2ba3add85529903108acfe266de02c9aa4c93b93e1fbba99a08658a78fb788450760a2d9c7983e65ed9a9eb195ea00e

  • SSDEEP

    98304:U7pojb8O89LBkmUVyt1CXzTAy6ndf8GDLPGNw9PSqflLO0iX:U7pTO89K/VOCXfm98GPuq5PS0iX

Malware Config

Signatures

  • SMSFactory

    SMSFactory is an Android SMS trojan malware first seen in Jun 2022.

  • Smsfactory family
  • Checks if the Android device is rooted. 1 TTPs 5 IoCs
  • Acquires the wake lock 2 IoCs
  • Queries information about active data network 1 TTPs 2 IoCs
  • Reads information about phone network operator. 1 TTPs
  • Schedules tasks to execute at a specified time 1 TTPs 2 IoCs

    Application may abuse the framework's APIs to perform task scheduling for initial or recurring execution of malicious code.

  • Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 2 IoCs
  • Checks memory information 2 TTPs 1 IoCs

Processes

  • com.contextlogic.wish.hack
    1⤵
    • Checks if the Android device is rooted.
    • Acquires the wake lock
    • Queries information about active data network
    • Schedules tasks to execute at a specified time
    • Uses Crypto APIs (Might try to encrypt user data)
    • Checks memory information
    PID:4450
  • com.contextlogic.wish.hack:Metrica
    1⤵
    • Checks if the Android device is rooted.
    • Acquires the wake lock
    • Queries information about active data network
    • Schedules tasks to execute at a specified time
    • Uses Crypto APIs (Might try to encrypt user data)
    PID:4497

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • /data/user/0/com.contextlogic.wish.hack/databases/OneSignal.db

    Filesize

    52KB

    MD5

    212a337771ab5b18e82e4d1b7acdea35

    SHA1

    092a996b96b0dc7006669f4a3dadc94357b25013

    SHA256

    802cb04095337d676e9516d13b9653adf3764637006c37162ac8df6f06f22417

    SHA512

    988f85500157d0359ae7f442dd42eaf0c7e991069cdc20f4783a0b208938f84e1c8b5cb8680df3dca525661b518bcde4626239a3a2bb8e41ec72ebc62ae88915

  • /data/user/0/com.contextlogic.wish.hack/databases/OneSignal.db-journal

    Filesize

    512B

    MD5

    2277ccd8a9192d6dd26700227429aea8

    SHA1

    38c86812b6c87f5dfbaa0b0372028dff748b8d5f

    SHA256

    281338bbdd46c51d4be044214209991162c766aee095a8fe32d6547352cf4ed1

    SHA512

    c9d63e0d65beea5cb5a63b87ba74e2a48b82fe0caa7146d30b385cf89fb40d72517ca1b6242f499eb7d396f1d12a1ce599ea7e0200dee5ff431148e395acb987

  • /data/user/0/com.contextlogic.wish.hack/databases/OneSignal.db-journal

    Filesize

    8KB

    MD5

    f2ee5f27d2d94e474b5bd21d6ab42cde

    SHA1

    3d51816ada134279d0e49d616ef1c3846316bdd0

    SHA256

    78968a72c714af38bac3fa14908d57a40e9e61cbc933b709f4d2c36254ce9241

    SHA512

    048f565d13de823e46836352f4aa68c23c9b1ebb3af479c6fb6a1a7a04f7a55808473f9f7b3187509540a5842cd5e13a6ecbac0eada269c53950a508405ab97d

  • /data/user/0/com.contextlogic.wish.hack/databases/OneSignal.db-journal

    Filesize

    44KB

    MD5

    b4c15b1f3f339c8edafb29f899bf00d8

    SHA1

    743db9d13bc24ff4fc320934d6ab2b1a7932ce0c

    SHA256

    94d4df622f2a950ce5abdb1bb5433a90dca5e2683b17a58d2ba7649dbf494a5f

    SHA512

    d9c816d57b22bd5da87a36755cfd0074237d03c4d2ff2619653277739faa24445d527a2715d6361fcd0042d29aca330604c6f0234d6e7c5a43a6fef00b4f92cb

  • /data/user/0/com.contextlogic.wish.hack/files/Mint-lastsavedfile

    Filesize

    512B

    MD5

    6573a859d3af2c2221b739fffcb8133d

    SHA1

    65f967a3ba93377a138a9cbe7f526a5d9de52486

    SHA256

    80f0cb1bef4c597a8ff92d173c783016bd8eb33b2e07c11cb9a30bdc090de95d

    SHA512

    f33682b2e12f39325b48357ffcbdc2e26cec4cfc37721d825e9d5f828efae73dd49d8809a35e8f35d5da99f719cad5f656da763623801042c5a1d42f25b25fca

  • /data/user/0/com.contextlogic.wish.hack/files/MintSavedData-1-1733339526107.json

    Filesize

    24KB

    MD5

    4dfbf103d751076f4366bd1700a121a0

    SHA1

    e3001b7758e7d5ccba2401a33c2f6aa67d1a5b09

    SHA256

    cceb170ffc8511f7e6a493e3bd6bed4e792b5b7acaf265198e3bd2bd3041fdbd

    SHA512

    71e186629b4348c0a26486b5382466ebbe88b32ee34aa2d4627f587f6da687e31ee62aa95a936ad07f74b31c462c1af281bb40959a101049b5f14b2e7998fd5b

  • /data/user/0/com.contextlogic.wish.hack/files/credentials.dat

    Filesize

    20KB

    MD5

    71cca92f937796c7ec8f55ba38fc120b

    SHA1

    1e529ffef7d08b5d0c3740431728f9f1f0457609

    SHA256

    97f680ef72e193f3f366e979ae34e167ab1f9e5e022852fcf44f07d68d108447

    SHA512

    82da9b9e6da0672e8e6bf1a701487d0547567635271969b9d7f9430cb689634e5ed4ae772d398ff0cac106bca7ed14596f3b20d667bcb7c6d54a120229ae7cda

  • /data/user/0/com.contextlogic.wish.hack/no_backup/androidx.work.workdb

    Filesize

    8KB

    MD5

    e007c12ff6c0aed7009a5bf35cfda97e

    SHA1

    bd5bdc4281255f194f090ebd9c6cd9528656ed80

    SHA256

    0720a204bcc90fbff5c86a0f1d8f63ba9a3592307483bb9f8182128217190534

    SHA512

    86abafcd31b9ecaf32c413181cd326b3eea686f8d93f81367479ad9310aa2ac76c056af613eb8e4cb1e3cc535d203d811d3e0fa6510fe2949025e09b72df1413

  • /data/user/0/com.contextlogic.wish.hack/no_backup/androidx.work.workdb-journal

    Filesize

    12KB

    MD5

    6941604358b09f84ca40698ab4352496

    SHA1

    1165f1baaebe64bd5903ca357601891ce691e197

    SHA256

    522e6aeec3897f2e272a44ef75daab3a6568b9b05c3774af38c39ac1888c7ae1

    SHA512

    996903706545720ef881bccb814151488513a9242a51aca2b5a9ad1682cada0ece09b8960d23fdb7dee25692928fa6819df90866b2fe024af2bb8fc300506c5c

  • /data/user/0/com.contextlogic.wish.hack/no_backup/androidx.work.workdb-shm

    Filesize

    32KB

    MD5

    eb8ee88f7bae50cd13f5ed31ea3447f0

    SHA1

    e12d0c818054c2dc3ca896fd3f08a884f053f580

    SHA256

    7946c59aef2481b30efc5a1b13447c819a1e144e0f18ec30d78a3c1f26f63ae2

    SHA512

    b7c40798c93ddcd6ba00922f833ebcc938ee3519bbc860481bd05f52ca65b49458b71647f6382b961747893f576d4e32e81496a8bb1d356c12d33f57b8718c88

  • /data/user/0/com.contextlogic.wish.hack/no_backup/androidx.work.workdb-wal

    Filesize

    116KB

    MD5

    af80a8971d0dbe0ac1c7de1faefb7501

    SHA1

    44c32dcbff8ed8922e6ec43c4f04d02658b29b25

    SHA256

    e98fedfe00d109bd9aa62bbf940e42ff7cf9ce5caf6963bfea258eda7edad79c

    SHA512

    2231c1487e4403fefd0664ab077b3a6ce301d044f354a7634499c15e2cc0e4bed4a83b539dc477c74e9fc85993f8bc92a583c4061d47d7393c297ad3d4dfd338

  • /data/user/0/com.contextlogic.wish.hack/no_backup/androidx.work.workdb-wal

    Filesize

    108KB

    MD5

    667140c6aa1395ecc95e34508888066d

    SHA1

    6ec7ce512263250b0cdfc7757ea5b3cdc2ca948d

    SHA256

    09c9a2a09f6105da04fa7563ca66aeec4232e3461f3c43657f9ed07d4463d839

    SHA512

    7180edf8b0a86864847bfc2638e0d4fc1a057d85b4009a3326ce9826245a636bcad889ef375c2cc5cdd311ba1faf38c86b81c58f3fe040ee9eaff8de1120a01d

  • /data/user/0/com.contextlogic.wish.hack/no_backup/androidx.work.workdb-wal

    Filesize

    358KB

    MD5

    9d729401c23f6f560568719303fa2347

    SHA1

    8ecb06dfdba39caaa2e69fb6e438932cbc4698aa

    SHA256

    214250e21d5794e18cdcae8dc92c444776d367bd42edde272b96d5ce8ec0985f

    SHA512

    b973e3ed7089bd0321c9b913ec262a950d1cad9164b1f9beb9b3ac57d76cdf5bf1f2e35743583d10023bf882f64eb45f007b042dc22190c293fe55b796c72bd9

  • /data/user/0/com.contextlogic.wish.hack/no_backup/androidx.work.workdb-wal

    Filesize

    309KB

    MD5

    8af7edc42dd5f3e2096d439b390453f6

    SHA1

    537e17dcae17a872f38e0d48a2161cf9f6866e04

    SHA256

    792637c48d68e8ef2bd466e583137555d2914a45e96bdacf955cc0dd66ebfa86

    SHA512

    e0eefbb35d0f36253ca1b658cc781f4a08fe4b636cd6e443455310640f5fa2e576edfe1b6444a3cd00064ccf69af2cf00012c73688b0e55e8a88cd36f5c4a564

  • /data/user/0/com.contextlogic.wish.hack/no_backup/com.google.InstanceId.properties

    Filesize

    8KB

    MD5

    b09d3c221fc3d03806611ca6e2318cc4

    SHA1

    70982bd4552d2dbe2809fe4f4937dfe62594e84c

    SHA256

    7d56d2e9e90a5de71172e4f1cd5855bed47c5dc5284cddb03d241c0cf7c4857d

    SHA512

    105526951ee8f0f7ae5eafed92e311aa0abdd8304c084b171fcfbdff66e62b5a761b644385a5e642a567bdd9461a791625bf1274cb0e9a93a306c196b70afbb6

  • /data/user/0/com.contextlogic.wish.hack/no_backup/credentials.dat

    Filesize

    20KB

    MD5

    3e428ee44512eebf24bde8470e6e86f8

    SHA1

    b8b3562cb1c6a7545b743f4b2ae867656f30c785

    SHA256

    4e3a183e730f0848bc918e7af509448c54db4db007f7b2f941d445c0664baa94

    SHA512

    26ee2e1185e29da36fe86706a143855a78a66eab4ca1b0d05eac3f0b9b512037888e692c3e911dc719469681adcfc7b841980776b87ce837ba3a7c6e34595594

  • /data/user/0/com.contextlogic.wish.hack/no_backup/db_metrica_com.contextlogic.wish.hack

    Filesize

    48KB

    MD5

    d2383b45dc29de4c0b78142ff4cc3317

    SHA1

    2ba33d6d7a0c7264ae075f3d773d75cc93cc9b55

    SHA256

    bd6e919d71fe67638c2f9911c0f7604d05aa53cf8a3b05be3604b2c009e5dbc7

    SHA512

    cf8acab7b4554cbfefb5aff1d7a01e4ca871a63dba8aa8ba408c564a699076b02eab1a6a5cdbef0764a2f50ca17166121baab6190255373c00cb6a9369b1cebe

  • /data/user/0/com.contextlogic.wish.hack/no_backup/db_metrica_com.contextlogic.wish.hack-journal

    Filesize

    512B

    MD5

    9ff1e752dd057586fd3011dbd52534ce

    SHA1

    0fdbee5b2486ebcf6b7b9ead0da3437e784e0b85

    SHA256

    f46173a808fd72ac9ecd0eb5554ade54e481663f2c6a98c6558e7b7f365f3deb

    SHA512

    1bc3d17181e0e288188999f694ecea5347402fa95507fa31a754a72d9e147475c96c0750cc30fa01cc1954c694f487e22f4931c5d08256b667476db01f6dc71e

  • /data/user/0/com.contextlogic.wish.hack/no_backup/db_metrica_com.contextlogic.wish.hack-journal

    Filesize

    12KB

    MD5

    a63a2952c3b4a8dcd38ae284d02d791e

    SHA1

    a45770016cca8990d7c9b7c657b838a18c2eef75

    SHA256

    262f565fcef23020e5d946cc37f4030a178d6d8427a90f2c8bc42b22269288c1

    SHA512

    4ab209b5fa0e2b9ada2b0e448b0446a3467657c9511566cb31ffaf8838872a72782bf224e83a9fbac8119af892e4f760785ed18e5b922bf1aafd76f45f534d37

  • /data/user/0/com.contextlogic.wish.hack/no_backup/db_metrica_com.contextlogic.wish.hack_20799a27-fa80-4b36-b2db-0f8141f24180

    Filesize

    36KB

    MD5

    f430c418d120bb3e2fbd0baf37fbca7f

    SHA1

    8d7853d74f859720651e9e3147e0aceca8b24e03

    SHA256

    9420ab9e88fdf6091fcb42f0795f61182454b0a7367d7e41f773c6979b2e46b4

    SHA512

    1bc621b73d545706216501fbe6851801cc1108eb8b30ecd367ca48b430c9eb835766e224394ae3ab746e8e37dfc6a004fa5e08524657782317d9edd9aef59ccc

  • /data/user/0/com.contextlogic.wish.hack/no_backup/db_metrica_com.contextlogic.wish.hack_20799a27-fa80-4b36-b2db-0f8141f24180-journal

    Filesize

    12KB

    MD5

    fb6c0068bdfa947c66fa2d1fec6a3012

    SHA1

    1c3dd21a6b0aafd9d31eb456a9707d2657a57c49

    SHA256

    15659803d88c88a13c5f42f7bac32b08f10e4cae23d54e9097ccbb3235871c96

    SHA512

    22da378d9937c9a5aa5a9e2ecdde44653bf42460e1c96144c8542ddd634ac9933f07e76d06f2546cfb76001e3b904d8b05c6893c9625f3a3e5bda609261bec29

  • /data/user/0/com.contextlogic.wish.hack/no_backup/db_metrica_com.contextlogic.wish.hack_20799a27-fa80-4b36-b2db-0f8141f24180-journal

    Filesize

    12KB

    MD5

    70f93d70c50c45f4955dd5297c6d24a1

    SHA1

    c05bb2699afe3d84a944bd728326c026584b6b02

    SHA256

    7d2518b9668d77d79cce35281c90641426718f255fe02213c1ab5c824e3e30b5

    SHA512

    b3c3e758b5005a9241d7b6d88cb80dea16f6880af327b32d342a78e9aa3efacb1523124bada2cfb11ea94bd3692679e07c1aab530775cbdd08282bb92631efff

  • /data/user/0/com.contextlogic.wish.hack/no_backup/db_metrica_com.contextlogic.wish.hack_20799a27-fa80-4b36-b2db-0f8141f24180-journal

    Filesize

    12KB

    MD5

    dcb5fafc5e84eb468bfcd42674d45004

    SHA1

    b7cdb2b4595a9efb1f51c2721fe281866fe25340

    SHA256

    ba2722e0656bcd0f18791ac5cbd02a994e91f24d7b5eb8c36d0dd3092cd0437e

    SHA512

    3177e38a4f618ba058dfb0fc346672f8f1aaf4f13f2fc7efc0ab92d071b381ef116dbdd7f4fe4fc97a980b7b26317338ddc8a57f18fc07e991081509132baf37

  • /data/user/0/com.contextlogic.wish.hack/no_backup/db_metrica_com.contextlogic.wish.hack_20799a27-fa80-4b36-b2db-0f8141f24180-journal

    Filesize

    12KB

    MD5

    a6f9508f53a79dc6a191232687a9b851

    SHA1

    251f877eefb11bce1d6eb1551656d8cef564aa97

    SHA256

    4b3e794688603e9b7609c2326ae905a6ba1d6a4b05cf6fdc100d832e34bb2fea

    SHA512

    0fb293e9ee3bbd2bb6f1307ec02c893ffa5fe76974946d1db802d8d025c8ac919ed46128c9b8dc4ce2fac7ed0e067f017146b46acfc0be6dcb9c0e2f2fc8e59f

  • /data/user/0/com.contextlogic.wish.hack/no_backup/metrica_client_data.db

    Filesize

    20KB

    MD5

    656b4f55396fd4dcacfcadaa64b065f3

    SHA1

    7e1ae798525aba8d40539cf509e93d335a3319bf

    SHA256

    738d8fc8ea4cdd012107ec626e6253ea2a08093546171caf443dc5ebada6bd5b

    SHA512

    6dd92480e5faec0d155182866a142c9d41927c41d50b7735f6422d8877a7125947cfa5ecb049a9266e63e9f5b20ef1ea0eb9bcb907051728a70d4a50063b3ef7

  • /data/user/0/com.contextlogic.wish.hack/no_backup/metrica_client_data.db

    Filesize

    20KB

    MD5

    fc318483a677c71a725dbbe6e9516df9

    SHA1

    8ac3af9cbfb464e53b709028d1f64a4d019bb2f4

    SHA256

    d6d65421dac425ed42a96af8b94a1d708f6e23b556f0bc80011eb4970304b7f9

    SHA512

    0e3a0d7629cbfdcaa59e415c4ba982355f249b9595d234c0de6fda993c65c121435c442945766017cd78533fbd059d7edfe2eda0185ec6e4d076499536a63140

  • /data/user/0/com.contextlogic.wish.hack/no_backup/metrica_client_data.db

    Filesize

    20KB

    MD5

    8fce0542ae05ccecdfc74c41ffad031d

    SHA1

    08495284ec8400136f5026aff6aa6b1517f6ed1a

    SHA256

    32c0797a130a1ed974b7b178155154a9821e902bf8b8025c14180bc1566e0422

    SHA512

    a26a97c171cfaa9befd415b74b09085ed2b70beaab55cd3872a4f13382ecd9b704f5b73c3d7de7271ca3dd543d0d27db361f87ec057894dbff0b9c3cda131384

  • /data/user/0/com.contextlogic.wish.hack/no_backup/metrica_client_data.db

    Filesize

    20KB

    MD5

    f963babca565edf0538168ec9c36fef3

    SHA1

    ce4cf6540a570bd1fe4f5d763ef5d201bb9e2a2b

    SHA256

    25485c885cbe24bf1f731384d33bedbc22c3b0dd279ef7208106d60412f4687c

    SHA512

    4254d82fc6ae4be748306b93c2079eacbbd855b7f49f7d9719c0c40f4c31fe47c31ca8087a602a0934d5e58ceaa7199575de1b2232de74b9ace7fb54f9065a60

  • /data/user/0/com.contextlogic.wish.hack/no_backup/metrica_client_data.db-journal

    Filesize

    12KB

    MD5

    1a5b99ea2086b95d3838f4d0e699bf47

    SHA1

    924ffdf87497994ab7e35c5e3a8939b617607c6a

    SHA256

    a6c3adab8ff82a1494a570fa62c0e88c806515c67c5e66ffafff8fd9d49a2fce

    SHA512

    8475510388a3f819b466a0b8b7b77d04a41a9b15cf2559935f5a71029d242bcc3b8313c2d8f30448e7cbe3bdc5b82f4b5c27b0075bed1f05536db55de5bea781

  • /data/user/0/com.contextlogic.wish.hack/no_backup/metrica_client_data.db-journal

    Filesize

    12KB

    MD5

    0462b42b6bb001466169c40a955805f3

    SHA1

    7884a0d4db5f236cdfe800ee4738538579c4faeb

    SHA256

    e49340814d7b3b88d865d0037568d70b2665673f3bbea02a67e031afbc1b56d1

    SHA512

    de756165ce310af4199d5d3d47ecb2ca5eff45400fe303880b17b5524b41af5a731eec22bc3c2655d1ca8675665db0f0c276e7817af5a0c9c58937f2d1deb7c3

  • /data/user/0/com.contextlogic.wish.hack/no_backup/metrica_client_data.db-journal

    Filesize

    512B

    MD5

    4580c9a7eaef6fe23ad356d645e8ab73

    SHA1

    d4db0c195efe8fa29a4fd8a6066ba1c00b6024ab

    SHA256

    e09ebdede853b747b874c4c3afe2b15514378357fc993fabf550151c45034a3f

    SHA512

    c36a4d6f549bb673befeab548c40b0074f93336e1c14261a109a0a2c13b1e7aa667c794daafe280aa103db42d46373014fdaf2b37f7c95874b15f88976531eeb

  • /data/user/0/com.contextlogic.wish.hack/no_backup/metrica_client_data.db-journal

    Filesize

    12KB

    MD5

    d1ade4e2bc31e9058022ee312b0d758b

    SHA1

    a87144ddd1fe4402bde9cb88f997ab8c6e798de3

    SHA256

    f3e4af76f5f1b3a316c15473419abe363427c385566af959dd0eb74440841b28

    SHA512

    c667e1d44ef0f94ade6393cc630b3f75a4bfa1ab421190a24bcda3f27b903fce2ce1aa9dc31776fc20272a33b6130c2331b53a61edd25944bc9f57bdf6e05170

  • /data/user/0/com.contextlogic.wish.hack/no_backup/metrica_client_data.db-journal

    Filesize

    12KB

    MD5

    cbf6be3b1947d7492d01f5ac0f79d0e8

    SHA1

    d9a1ad22c349e6d1a7b9298c4cdc3dc5b80cbbe8

    SHA256

    2a909c2cbbd5526118c37aafbde45777386e9f22673984abec116b592791a311

    SHA512

    1473a82a298e90439049095b8437019826903ff84be65ce3f322c3c714efc8dbc7beac90ca06926353a6c2f134403ef56eecee9015220dc5609934018b962a1d

  • /data/user/0/com.contextlogic.wish.hack/no_backup/metrica_client_data.db-journal

    Filesize

    20KB

    MD5

    462ecc0e9922ebcd7db528b726047026

    SHA1

    f008e96a5f64556d7a0461719cf651fefed2b99c

    SHA256

    97ad2f4749fb5503e26ddc25981a78b03acf9a88759736147dc12dc6c37393dc

    SHA512

    93d4ee847b61a287837de413244d26da9c47f81461ddf4af86df39be9ee83cffc91a174e2dd288986c0681a5b27a6ce2dddb7e2933b3240de67879acc18b0591