Analysis

  • max time kernel
    146s
  • max time network
    147s
  • platform
    android_x64
  • resource
    android-x64-arm64-20240624-en
  • resource tags

    androidarch:armarch:arm64arch:x64arch:x86image:android-x64-arm64-20240624-enlocale:en-usos:android-11-x64system
  • submitted
    04/12/2024, 19:11

General

  • Target
    c3fd36103f617324d4d2fa833989096c_JaffaCakes118.apk
  • Size 4.9MB
  • Sample241204-xwcc4askhq
  • SHA256 0cc18aa0a58ac84d39ea0d681caa378f0c85e39fff230b85239fec5960068870
  • MD5 SHA1 SHA512 SSDEEP

Malware Config

Signatures

  • SMSFactory

    SMSFactory is an Android SMS trojan malware first seen in Jun 2022.

  • Smsfactory family
  • Checks if the Android device is rooted. 1 TTPs 5 IoCs
  • Acquires the wake lock 2 IoCs
  • Queries information about active data network 1 TTPs 2 IoCs
  • Reads information about phone network operator. 1 TTPs
  • Schedules tasks to execute at a specified time 1 TTPs 2 IoCs

    Application may abuse the framework's APIs to perform task scheduling for initial or recurring execution of malicious code.

  • Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 2 IoCs
  • Checks memory information 2 TTPs 1 IoCs

Processes

  • com.contextlogic.wish.hack
    1⤵
    • Checks if the Android device is rooted.
    • Acquires the wake lock
    • Queries information about active data network
    • Schedules tasks to execute at a specified time
    • Uses Crypto APIs (Might try to encrypt user data)
    • Checks memory information
    PID:4450
  • com.contextlogic.wish.hack:Metrica
    1⤵
    • Checks if the Android device is rooted.
    • Acquires the wake lock
    • Queries information about active data network
    • Schedules tasks to execute at a specified time
    • Uses Crypto APIs (Might try to encrypt user data)
    PID:4497

Network

        MITRE ATT&CK Mobile v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        OneSignal.db

        • Path /data/user/0/com.contextlogic.wish.hack/databases/OneSignal.db
        • Size 52KB
        • SHA256 802cb04095337d676e9516d13b9653adf3764637006c37162ac8df6f06f22417
        • MD5 SHA1 SHA512 SSDEEP

        OneSignal.db-journal

        • Path /data/user/0/com.contextlogic.wish.hack/databases/OneSignal.db-journal
        • Size 512B
        • SHA256 281338bbdd46c51d4be044214209991162c766aee095a8fe32d6547352cf4ed1
        • MD5 SHA1 SHA512

        OneSignal.db-journal

        • Path /data/user/0/com.contextlogic.wish.hack/databases/OneSignal.db-journal
        • Size 8KB
        • SHA256 78968a72c714af38bac3fa14908d57a40e9e61cbc933b709f4d2c36254ce9241
        • MD5 SHA1 SHA512 SSDEEP

        OneSignal.db-journal

        • Path /data/user/0/com.contextlogic.wish.hack/databases/OneSignal.db-journal
        • Size 44KB
        • SHA256 94d4df622f2a950ce5abdb1bb5433a90dca5e2683b17a58d2ba7649dbf494a5f
        • MD5 SHA1 SHA512 SSDEEP

        Mint-lastsavedfile

        • Path /data/user/0/com.contextlogic.wish.hack/files/Mint-lastsavedfile
        • Size 512B
        • SHA256 80f0cb1bef4c597a8ff92d173c783016bd8eb33b2e07c11cb9a30bdc090de95d
        • MD5 SHA1 SHA512

        MintSavedData-1-1733339526107.json

        • Path /data/user/0/com.contextlogic.wish.hack/files/MintSavedData-1-1733339526107.json
        • Size 24KB
        • SHA256 cceb170ffc8511f7e6a493e3bd6bed4e792b5b7acaf265198e3bd2bd3041fdbd
        • MD5 SHA1 SHA512 SSDEEP

        credentials.dat

        • Path /data/user/0/com.contextlogic.wish.hack/files/credentials.dat
        • Size 20KB
        • SHA256 97f680ef72e193f3f366e979ae34e167ab1f9e5e022852fcf44f07d68d108447
        • MD5 SHA1 SHA512 SSDEEP

        androidx.work.workdb

        • Path /data/user/0/com.contextlogic.wish.hack/no_backup/androidx.work.workdb
        • Size 8KB
        • SHA256 0720a204bcc90fbff5c86a0f1d8f63ba9a3592307483bb9f8182128217190534
        • MD5 SHA1 SHA512 SSDEEP

        androidx.work.workdb-journal

        • Path /data/user/0/com.contextlogic.wish.hack/no_backup/androidx.work.workdb-journal
        • Size 12KB
        • SHA256 522e6aeec3897f2e272a44ef75daab3a6568b9b05c3774af38c39ac1888c7ae1
        • MD5 SHA1 SHA512 SSDEEP

        androidx.work.workdb-shm

        • Path /data/user/0/com.contextlogic.wish.hack/no_backup/androidx.work.workdb-shm
        • Size 32KB
        • SHA256 7946c59aef2481b30efc5a1b13447c819a1e144e0f18ec30d78a3c1f26f63ae2
        • MD5 SHA1 SHA512 SSDEEP

        androidx.work.workdb-wal

        • Path /data/user/0/com.contextlogic.wish.hack/no_backup/androidx.work.workdb-wal
        • Size 116KB
        • SHA256 e98fedfe00d109bd9aa62bbf940e42ff7cf9ce5caf6963bfea258eda7edad79c
        • MD5 SHA1 SHA512 SSDEEP

        androidx.work.workdb-wal

        • Path /data/user/0/com.contextlogic.wish.hack/no_backup/androidx.work.workdb-wal
        • Size 108KB
        • SHA256 09c9a2a09f6105da04fa7563ca66aeec4232e3461f3c43657f9ed07d4463d839
        • MD5 SHA1 SHA512 SSDEEP

        androidx.work.workdb-wal

        • Path /data/user/0/com.contextlogic.wish.hack/no_backup/androidx.work.workdb-wal
        • Size 358KB
        • SHA256 214250e21d5794e18cdcae8dc92c444776d367bd42edde272b96d5ce8ec0985f
        • MD5 SHA1 SHA512 SSDEEP

        androidx.work.workdb-wal

        • Path /data/user/0/com.contextlogic.wish.hack/no_backup/androidx.work.workdb-wal
        • Size 309KB
        • SHA256 792637c48d68e8ef2bd466e583137555d2914a45e96bdacf955cc0dd66ebfa86
        • MD5 SHA1 SHA512 SSDEEP

        com.google.InstanceId.properties

        • Path /data/user/0/com.contextlogic.wish.hack/no_backup/com.google.InstanceId.properties
        • Size 8KB
        • SHA256 7d56d2e9e90a5de71172e4f1cd5855bed47c5dc5284cddb03d241c0cf7c4857d
        • MD5 SHA1 SHA512 SSDEEP

        credentials.dat

        • Path /data/user/0/com.contextlogic.wish.hack/no_backup/credentials.dat
        • Size 20KB
        • SHA256 4e3a183e730f0848bc918e7af509448c54db4db007f7b2f941d445c0664baa94
        • MD5 SHA1 SHA512 SSDEEP

        db_metrica_com.contextlogic.wish.hack

        • Path /data/user/0/com.contextlogic.wish.hack/no_backup/db_metrica_com.contextlogic.wish.hack
        • Size 48KB
        • SHA256 bd6e919d71fe67638c2f9911c0f7604d05aa53cf8a3b05be3604b2c009e5dbc7
        • MD5 SHA1 SHA512 SSDEEP

        db_metrica_com.contextlogic.wish.hack-journal

        • Path /data/user/0/com.contextlogic.wish.hack/no_backup/db_metrica_com.contextlogic.wish.hack-journal
        • Size 512B
        • SHA256 f46173a808fd72ac9ecd0eb5554ade54e481663f2c6a98c6558e7b7f365f3deb
        • MD5 SHA1 SHA512

        db_metrica_com.contextlogic.wish.hack-journal

        • Path /data/user/0/com.contextlogic.wish.hack/no_backup/db_metrica_com.contextlogic.wish.hack-journal
        • Size 12KB
        • SHA256 262f565fcef23020e5d946cc37f4030a178d6d8427a90f2c8bc42b22269288c1
        • MD5 SHA1 SHA512 SSDEEP

        db_metrica_com.contextlogic.wish.hack_20799a27-fa80-4b36-b2db-0f8141f24180

        • Path /data/user/0/com.contextlogic.wish.hack/no_backup/db_metrica_com.contextlogic.wish.hack_20799a27-fa80-4b36-b2db-0f8141f24180
        • Size 36KB
        • SHA256 9420ab9e88fdf6091fcb42f0795f61182454b0a7367d7e41f773c6979b2e46b4
        • MD5 SHA1 SHA512 SSDEEP

        db_metrica_com.contextlogic.wish.hack_20799a27-fa80-4b36-b2db-0f8141f24180-journal

        • Path /data/user/0/com.contextlogic.wish.hack/no_backup/db_metrica_com.contextlogic.wish.hack_20799a27-fa80-4b36-b2db-0f8141f24180-journal
        • Size 12KB
        • SHA256 15659803d88c88a13c5f42f7bac32b08f10e4cae23d54e9097ccbb3235871c96
        • MD5 SHA1 SHA512 SSDEEP

        db_metrica_com.contextlogic.wish.hack_20799a27-fa80-4b36-b2db-0f8141f24180-journal

        • Path /data/user/0/com.contextlogic.wish.hack/no_backup/db_metrica_com.contextlogic.wish.hack_20799a27-fa80-4b36-b2db-0f8141f24180-journal
        • Size 12KB
        • SHA256 7d2518b9668d77d79cce35281c90641426718f255fe02213c1ab5c824e3e30b5
        • MD5 SHA1 SHA512 SSDEEP

        db_metrica_com.contextlogic.wish.hack_20799a27-fa80-4b36-b2db-0f8141f24180-journal

        • Path /data/user/0/com.contextlogic.wish.hack/no_backup/db_metrica_com.contextlogic.wish.hack_20799a27-fa80-4b36-b2db-0f8141f24180-journal
        • Size 12KB
        • SHA256 ba2722e0656bcd0f18791ac5cbd02a994e91f24d7b5eb8c36d0dd3092cd0437e
        • MD5 SHA1 SHA512 SSDEEP

        db_metrica_com.contextlogic.wish.hack_20799a27-fa80-4b36-b2db-0f8141f24180-journal

        • Path /data/user/0/com.contextlogic.wish.hack/no_backup/db_metrica_com.contextlogic.wish.hack_20799a27-fa80-4b36-b2db-0f8141f24180-journal
        • Size 12KB
        • SHA256 4b3e794688603e9b7609c2326ae905a6ba1d6a4b05cf6fdc100d832e34bb2fea
        • MD5 SHA1 SHA512 SSDEEP

        metrica_client_data.db

        • Path /data/user/0/com.contextlogic.wish.hack/no_backup/metrica_client_data.db
        • Size 20KB
        • SHA256 738d8fc8ea4cdd012107ec626e6253ea2a08093546171caf443dc5ebada6bd5b
        • MD5 SHA1 SHA512 SSDEEP

        metrica_client_data.db

        • Path /data/user/0/com.contextlogic.wish.hack/no_backup/metrica_client_data.db
        • Size 20KB
        • SHA256 d6d65421dac425ed42a96af8b94a1d708f6e23b556f0bc80011eb4970304b7f9
        • MD5 SHA1 SHA512 SSDEEP

        metrica_client_data.db

        • Path /data/user/0/com.contextlogic.wish.hack/no_backup/metrica_client_data.db
        • Size 20KB
        • SHA256 32c0797a130a1ed974b7b178155154a9821e902bf8b8025c14180bc1566e0422
        • MD5 SHA1 SHA512 SSDEEP

        metrica_client_data.db

        • Path /data/user/0/com.contextlogic.wish.hack/no_backup/metrica_client_data.db
        • Size 20KB
        • SHA256 25485c885cbe24bf1f731384d33bedbc22c3b0dd279ef7208106d60412f4687c
        • MD5 SHA1 SHA512 SSDEEP

        metrica_client_data.db-journal

        • Path /data/user/0/com.contextlogic.wish.hack/no_backup/metrica_client_data.db-journal
        • Size 12KB
        • SHA256 a6c3adab8ff82a1494a570fa62c0e88c806515c67c5e66ffafff8fd9d49a2fce
        • MD5 SHA1 SHA512 SSDEEP

        metrica_client_data.db-journal

        • Path /data/user/0/com.contextlogic.wish.hack/no_backup/metrica_client_data.db-journal
        • Size 12KB
        • SHA256 e49340814d7b3b88d865d0037568d70b2665673f3bbea02a67e031afbc1b56d1
        • MD5 SHA1 SHA512 SSDEEP

        metrica_client_data.db-journal

        • Path /data/user/0/com.contextlogic.wish.hack/no_backup/metrica_client_data.db-journal
        • Size 512B
        • SHA256 e09ebdede853b747b874c4c3afe2b15514378357fc993fabf550151c45034a3f
        • MD5 SHA1 SHA512

        metrica_client_data.db-journal

        • Path /data/user/0/com.contextlogic.wish.hack/no_backup/metrica_client_data.db-journal
        • Size 12KB
        • SHA256 f3e4af76f5f1b3a316c15473419abe363427c385566af959dd0eb74440841b28
        • MD5 SHA1 SHA512 SSDEEP

        metrica_client_data.db-journal

        • Path /data/user/0/com.contextlogic.wish.hack/no_backup/metrica_client_data.db-journal
        • Size 12KB
        • SHA256 2a909c2cbbd5526118c37aafbde45777386e9f22673984abec116b592791a311
        • MD5 SHA1 SHA512 SSDEEP

        metrica_client_data.db-journal

        • Path /data/user/0/com.contextlogic.wish.hack/no_backup/metrica_client_data.db-journal
        • Size 20KB
        • SHA256 97ad2f4749fb5503e26ddc25981a78b03acf9a88759736147dc12dc6c37393dc
        • MD5 SHA1 SHA512 SSDEEP