9f4ce3192bb6e51ebb7383aff18aacbf2cebe6c6cf66f381a6b7d952a31fd784

Analysis

max time kernel
146s
max time network
157s
platform
android_x86
resource
android-x86-arm-20240506-en
resource tags

androidarch:armarch:x86image:android-x86-arm-20240506-enlocale:en-usos:android-9-x86system
submitted
09/05/2024, 00:08

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

275d23f08da30d9729c21342bb520fdc_JaffaCakes118.apk
Size

12.0MB
MD5

275d23f08da30d9729c21342bb520fdc
SHA1

ae62e6e3d2e602fe26c97eeb4843e7ca6633438b
SHA256

9f4ce3192bb6e51ebb7383aff18aacbf2cebe6c6cf66f381a6b7d952a31fd784
SHA512

623dd6c4aa4640cfd2fcd6fd8e19c7a4e109a1bcdcf17b2bdc00d4454b97e353f02ec01b86f92fa6205c0e0f15723afcff23b5a358836031224ab9bd6302b813
SSDEEP

196608:v35tzRoOsFmcu8sHE4/sOoREeiH/NlHdfvcbPZOH2nYJ91sn/H+gT:v3LRkmcO8DREegHtiOWYJDKvT

Score

8^/10

banker discovery evasion impact persistence

Malware Config

Signatures

Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
banker discovery

Security Software Discovery
T1418.001

Checks CPU information 2 TTPs 1 IoCs

Checks CPU information which indicate if the system is an emulator.

evasion discovery

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/cpuinfo	cn.wejuan.reader

Checks memory information 2 TTPs 1 IoCs

Checks memory information which indicate if the system is an emulator.

evasion discovery

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/meminfo	cn.wejuan.reader

Loads dropped Dex/Jar 1 TTPs 13 IoCs

Runs executable file dropped to the device during analysis.

evasion

Download New Code at Runtime

T1407

ioc	pid	Process
/data/data/cn.wejuan.reader/.jiagu/classes.dex	4269	cn.wejuan.reader
/data/data/cn.wejuan.reader/.jiagu/classes.dex!classes2.dex	4269	cn.wejuan.reader
/data/data/cn.wejuan.reader/.jiagu/tmp.dex	4269	cn.wejuan.reader
/data/data/cn.wejuan.reader/.jiagu/tmp.dex	4302	/system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/data/cn.wejuan.reader/.jiagu/tmp.dex --output-vdex-fd=42 --oat-fd=43 --oat-location=/data/data/cn.wejuan.reader/.jiagu/oat/x86/tmp.odex --compiler-filter=quicken --class-loader-context=&
/data/data/cn.wejuan.reader/.jiagu/tmp.dex	4269	cn.wejuan.reader
/data/data/cn.wejuan.reader/.jiagu/classes.dex	4329	cn.wejuan.reader:GuardService
/data/data/cn.wejuan.reader/.jiagu/classes.dex!classes2.dex	4329	cn.wejuan.reader:GuardService
/data/data/cn.wejuan.reader/.jiagu/tmp.dex	4329	cn.wejuan.reader:GuardService
/data/data/cn.wejuan.reader/.jiagu/tmp.dex	4329	cn.wejuan.reader:GuardService
/data/data/cn.wejuan.reader/.jiagu/classes.dex	4411	cn.wejuan.reader:pushcore
/data/data/cn.wejuan.reader/.jiagu/classes.dex!classes2.dex	4411	cn.wejuan.reader:pushcore
/data/data/cn.wejuan.reader/.jiagu/tmp.dex	4411	cn.wejuan.reader:pushcore
/data/data/cn.wejuan.reader/.jiagu/tmp.dex	4411	cn.wejuan.reader:pushcore

Queries information about running processes on the device 1 TTPs 3 IoCs

Application may abuse the framework's APIs to collect information about running processes on the device.

discovery

Process Discovery

T1424

description	ioc	Process
Framework service call	android.app.IActivityManager.getRunningAppProcesses	cn.wejuan.reader:GuardService
Framework service call	android.app.IActivityManager.getRunningAppProcesses	cn.wejuan.reader
Framework service call	android.app.IActivityManager.getRunningAppProcesses	cn.wejuan.reader:pushcore

Queries information about the current Wi-Fi connection 1 TTPs 1 IoCs

Application may abuse the framework's APIs to collect information about the current Wi-Fi connection.

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.wifi.IWifiManager.getConnectionInfo	cn.wejuan.reader

Queries information about the current nearby Wi-Fi networks 1 TTPs 1 IoCs

Application may abuse the framework's APIs to collect information about the current nearby Wi-Fi networks.

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.wifi.IWifiManager.getScanResults	cn.wejuan.reader

Queries the phone number (MSISDN for GSM devices) 1 TTPs
discovery

System Network Configuration Discovery
T1422

Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 3 IoCs

persistence

Broadcast Receivers

T1624.001

description	ioc	Process
Framework service call	android.app.IActivityManager.registerReceiver	cn.wejuan.reader
Framework service call	android.app.IActivityManager.registerReceiver	cn.wejuan.reader:GuardService
Framework service call	android.app.IActivityManager.registerReceiver	cn.wejuan.reader:pushcore

Checks if the internet connection is available 1 TTPs 3 IoCs

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.IConnectivityManager.getActiveNetworkInfo	cn.wejuan.reader
Framework service call	android.net.IConnectivityManager.getActiveNetworkInfo	cn.wejuan.reader:GuardService
Framework service call	android.net.IConnectivityManager.getActiveNetworkInfo	cn.wejuan.reader:pushcore

Reads information about phone network operator. 1 TTPs
discovery

System Network Configuration Discovery
T1422

Requests dangerous framework permissions 6 IoCs

description	ioc
Allows read only access to phone state, including the current cellular network information, the status of any ongoing calls, and a list of any PhoneAccounts registered on the device.	android.permission.READ_PHONE_STATE
Allows an app to access approximate location.	android.permission.ACCESS_COARSE_LOCATION
Allows an application to send SMS messages.	android.permission.SEND_SMS
Allows an application to read SMS messages.	android.permission.READ_SMS
Allows an application to write to external storage.	android.permission.WRITE_EXTERNAL_STORAGE
Allows an app to access precise location.	android.permission.ACCESS_FINE_LOCATION

Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 2 IoCs

impact

Data Encrypted for Impact

T1471

description	ioc	Process
Framework API call	javax.crypto.Cipher.doFinal	cn.wejuan.reader
Framework API call	javax.crypto.Cipher.doFinal	cn.wejuan.reader:pushcore

cn.wejuan.reader
1⤵
- Checks CPU information
- Checks memory information
- Loads dropped Dex/Jar
- Queries information about running processes on the device
- Queries information about the current Wi-Fi connection
- Queries information about the current nearby Wi-Fi networks
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Checks if the internet connection is available
- Uses Crypto APIs (Might try to encrypt user data)
PID:4269
- /system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/data/cn.wejuan.reader/.jiagu/tmp.dex --output-vdex-fd=42 --oat-fd=43 --oat-location=/data/data/cn.wejuan.reader/.jiagu/oat/x86/tmp.odex --compiler-filter=quicken --class-loader-context=&
  2⤵
  - Loads dropped Dex/Jar
  PID:4302
- sh -c ps
  2⤵
  PID:4523
- ps
  2⤵
  PID:4523
- cat /sys/class/net/wlan0/address
  2⤵
  PID:4773

cn.wejuan.reader:GuardService
1⤵
- Loads dropped Dex/Jar
- Queries information about running processes on the device
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Checks if the internet connection is available
PID:4329

cn.wejuan.reader:pushcore
1⤵
- Loads dropped Dex/Jar
- Queries information about running processes on the device
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Checks if the internet connection is available
- Uses Crypto APIs (Might try to encrypt user data)
PID:4411

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Event Triggered Execution

T1624

Broadcast Receivers

T1624.001

Privilege Escalation

Defense Evasion

Download New Code at Runtime

T1407

Virtualization/Sandbox Evasion

T1633

System Checks

T1633.001

Credential Access

Discovery

Process Discovery

T1424

Software Discovery

T1418

Security Software Discovery

T1418.001

System Information Discovery

T1426

System Network Configuration Discovery

T1422

System Network Connections Discovery

T1421

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Data Encrypted for Impact

T1471

Replay Monitor

Loading Replay Monitor...

Downloads

/data/data/cn.wejuan.reader/.jiagu/classes.dex

Filesize
6.2MB

MD5
548eb000e9fd9b1855dd01b1dc0a04de

SHA1
686291e43c8ae1af6731f7754c19b127a6902693

SHA256
308db907a1dccd51ec7ff0cf4b3ea43f3076ac0bd2bdbe7f981f56550162fa99

SHA512
a8fba6f69d842a62fcb956195df60e7bc9d8a5e6751dae820d0520603912d0a7079c61e296729ce1523d42aa7dda3763f3aac9c00e8bb80a2b81cba5503271dc

Download Submit
/data/data/cn.wejuan.reader/.jiagu/classes.dex!classes2.dex

Filesize
5.1MB

MD5
1353c00682850b327cc61ec89f9515a2

SHA1
5a4a3f361210a4c61355294b08512b234126913d

SHA256
48d32901f07aecb2c62ccf442c9abdb28dd87f82850903f38bfe15aaf4a948e0

SHA512
c225a67191e7b70afacc9e54631f8fb5e7657252d9ec6f5e307dd4f67b63421f8dbd4f561db2ef32cb5698778304e6c17d435046e79faeca194a57eac0a91dd2

Download Submit
/data/data/cn.wejuan.reader/.jiagu/libjiagu.so

Filesize
497KB

MD5
e102893683a16d223c852ac584155d58

SHA1
5560d79d71fb1951d6ab0a464af87429a4933c2b

SHA256
41c76fbc6aabf843f22a1cf49a457bb99a7579b7260e46b2841c30afd82523c8

SHA512
3129498f917661361bc9a0eaba6b7b6490c2216e19dd7cc802b1f2f22fc16ae43b86a7ca97273cd2e2504a7e7e08a173daac34f5085a21ffd4ac1d84e76cb8ab

Download Submit
/data/data/cn.wejuan.reader/.jiagu/tmp.dex

Filesize
284B

MD5
53dfb8863fadf5a3d7ae56090ee74411

SHA1
8a7f18968f7d3195e7eb2f4899d98441097fb3b5

SHA256
149ab1bd0cae331f1cbba3632afea7c79dfa93c2c7bd9c2d96560b356e9875aa

SHA512
bfffc7206ba3cba10d7c8f78a75fa32bba9593da1c0460454ece1d34105103ae874b7201a9d023933c3fcd22474e88889766ef983588d35dd3bc51bc88b04ddd

Download Submit
/data/data/cn.wejuan.reader/.jiagu/tmp.dex

Filesize
284B

MD5
f1771b68f5f9b168b79ff59ae2daabe4

SHA1
0df6a835559f5c99670214a12700e7d8c28e5a42

SHA256
9f8898ce35a47aeafced99ea0d17c33e73037bb2307c7688e50819966f4ae939

SHA512
dae27d19727b89bec49398503baa6801640540355688dfabbe689c97545295c2c2d9b0f0dcd7cbc4cfbf701d0c0c3289e647a152f49ff242d1ecc741efe4145d

Download Submit
/data/data/cn.wejuan.reader/databases/btechainh.db

Filesize
4KB

MD5
f2b4b0190b9f384ca885f0c8c9b14700

SHA1
934ff2646757b5b6e7f20f6a0aa76c7f995d9361

SHA256
0a8ffb6b327963558716e87db8946016d143e39f895fa1b43e95ba7032ce2514

SHA512
ec12685fc0d60526eed4d38820aad95611f3e93ae372be5a57142d8e8a1ba17e6e5dfe381a4e1365dddc0b363c9c40daaffdc1245bd515fddac69bf1abacd7f1

Download Submit
/data/data/cn.wejuan.reader/databases/btechainh.db-journal

Filesize
512B

MD5
5e4d109025c3bf7e6401dd040129d570

SHA1
c3e8dd7e7c184b3260a1447878fef4737671dcc3

SHA256
aaa84b98e1850fe1ec5e91d1fd7e66a8fc52dfb36a5fe4d216a29fa09762a9b8

SHA512
5c8780988d7ccbf239739acf762e41b928bf72d8f07f4c5b4448d1d4d8ffc5a4b7da5eba633a3f555b20a6cf86b3396d4c2066f6a5a3130ebefbc109d5701257

Download Submit
/data/data/cn.wejuan.reader/databases/btechainh.db-wal

Filesize
32KB

MD5
87f4261ac7d4f8b1982c29dac6c5dba3

SHA1
39a4b2a9bfaec5480d0f7e89027304dccb3d7979

SHA256
351af3d09b4153b5a7f5eb56bd3f6d06b435a2e98c917603ba9063ed813df088

SHA512
e18de371c0c7fdac0ae1bf8af453b794499132dcb3e5248896d367f68328ebfc8a15eda6e6e6384e6aad698c96cf0f15da6d3c52033075a999a873bb3e8de064

Download Submit
/data/data/cn.wejuan.reader/databases/easouBook.db

Filesize
36KB

MD5
ed5a7a63b573eae86d0b77e60a263626

SHA1
18fcd8d46d0d1ed2aaf402b8fe6b3e949f4aee4a

SHA256
574b34f8bd3f8fe2b2e1ce4f7dbc3f04e0ec96404bc9d64e236188d897ca77a7

SHA512
ae02380483581e44886b3a250c4a0718dfc73ed3922f1afe494cfd16b735b1e0a8e594fcc791d08175f9292dea1f0249face83807c5de3b13d2aace6ee6a6a79

Download Submit
/data/data/cn.wejuan.reader/databases/easouBook.db-journal

Filesize
512B

MD5
5162b205fbad66fdadde81a296c759d7

SHA1
d2b79ead9522f95b87f9bc674407a8ef4f3ad96e

SHA256
d168526d4bc53b8179d7ffa5a40c49db4c5a6270e650397ba5358c3cea49bd9c

SHA512
651b6bf9b89ac97413cf851073794f67bb6a9993c1c27a4e40c11be55fab27397075734b92fdbd2379b90f3d22c35fb25962b83f8f95c10fd2acf0553753de9b

Download Submit
/data/data/cn.wejuan.reader/databases/easouBook.db-shm

Filesize
32KB

MD5
bb7df04e1b0a2570657527a7e108ae23

SHA1
5188431849b4613152fd7bdba6a3ff0a4fd6424b

SHA256
c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479

SHA512
768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012

Download Submit
/data/data/cn.wejuan.reader/databases/easouBook.db-wal

Filesize
48KB

MD5
3e245cb7c5824cb1e02467bfa4d4debe

SHA1
3684281e8d31ea098b467be93f7e2c971159337a

SHA256
089a78ca6bfba6f6f8d02206e8b2064d44796e0d0fb24e33cfb74b5c707738f1

SHA512
326605ab238dbdb7f783d6df09d9d5c4011df9ed51e194dbdb00c28c67c8c1baaed88c93f257293bed79753744beaf74a9a1ff3c694de1dffe2cdb76422a3b5c

Download Submit
/data/data/cn.wejuan.reader/databases/es.db

Filesize
20KB

MD5
ea3aa6fb8d9973497ece1f2cb4bb7878

SHA1
a0578081d82c1e833a8d73d0ba90372cdfc7ac4f

SHA256
61d50595229cf66b791bbcc066ab175098f745c66700361957c8b974a194789f

SHA512
587da63d14dd7a4ce3992d92e2774d1b4e5e207bb4f51d095f1030d863a029e60ffcc6add7ed320291f009e75bd13334fbb075f3aa5352c5ba46cddf57fba315

Download Submit
/data/data/cn.wejuan.reader/databases/es.db-journal

Filesize
512B

MD5
87ae4d2bbc6ba95e98a7de1da5239e66

SHA1
f58d4c477271b8a03510697c3031c983c455e8ba

SHA256
6c13a598b26f0d4e4f72b27730e6face38a3cee832f76716e1368d7e73625ecb

SHA512
f93e6514a90fb925edab853ed2c87c3f572ca816b895323134a5a3d9d8c9f1bc2c18bc4abb5f6b990f85335df6b28638602ebe48d2134795e13a80bce5fdef61

Download Submit
/data/data/cn.wejuan.reader/databases/es.db-wal

Filesize
32KB

MD5
1fc4a54de9ada3b354498a06081b3da0

SHA1
3b95756e6477fe71cb7afc052f5c200fc549810e

SHA256
073dbb10c90aa60fc892ddd30137843eebb69c5d5abe2bc317182513453451cd

SHA512
0541207fdc4dda038003c5a24f88240a8fa116d71d9a45744907152d725a5487a0abb5bf567bd7e1454bb592768fb04ae9a294bfe9cde44bd9eb8ee680c35207

Download Submit
/data/data/cn.wejuan.reader/databases/local.db

Filesize
20KB

MD5
0886e1e4e9e13ad467fed5e6387bbc20

SHA1
a1ea02f457dfb31c0bd183092ab9ef53b860b848

SHA256
78d8f689718e894f087e56dffdf565f70587d96db83daf31e326698f4f463766

SHA512
d705041d9a8a7a8838330511bffc5d8523c5b0efa062d1f0034aa36887f7d34bb8d6270ee093fc03a274672dd961f70dd35e7d5cb2ae30c0414429b8ff837a14

Download Submit
/data/data/cn.wejuan.reader/databases/local.db-journal

Filesize
512B

MD5
e896898c3201c9652e3d13c8690aebb3

SHA1
c886be649c7dbed6da73801a43eaf3c892d2c6c5

SHA256
e9702b7796b6fc9c1213731b4fc64e3e43b4ee0cf73511f9d099af1bcee6c843

SHA512
0e0d9454266e8a8c60f8db7e2364153324e75a635afc7cfc2b752b53e4cb844273dce0c7bfb388eae9c6528e6c9ff9816a8da422ae0a4bc5179d1ce4f54b3951

Download Submit
/data/data/cn.wejuan.reader/databases/local.db-wal

Filesize
32KB

MD5
7b40b38d18d81dd5efef880b460c83c8

SHA1
4dbd12a5f069a2546769b791905f71eb96f36a8f

SHA256
ac8ec155d02e7621ebb4f0ec5582759f6973cc6bf50e2cab47ef51acbe2552ee

SHA512
89333972492d62f640a6483531fe0c0bd1848689c881d1eda3ba377e2f76007351f5085794df453a93ac156be0f1cb6ca42bfb53977a2b7cec53235b4d9b5b46

Download Submit
/data/data/cn.wejuan.reader/databases/localEasouBook.db

Filesize
24KB

MD5
a2803d106194a082003b0f5d7038f9cd

SHA1
3940a183cff3bd6365f1c9f46802c07c89033ddd

SHA256
999154a4ad6c28534b577705b3d26bae32cddafc4f2e599c164e549bd4c1a8dd

SHA512
ea73b2f9cad170d7766a83be81f10763f494262ff5efadeccffa128bc7e4f49a56cb109d6808b534155475637dcf328aa24f89a8943461afd5046215215e3076

Download Submit
/data/data/cn.wejuan.reader/databases/localEasouBook.db-journal

Filesize
512B

MD5
062307cc825a517b6f1afc787ece5560

SHA1
8816a181e26a00fef5fca91fe95a50f660b96c87

SHA256
28ef7f1e9fa3f82bbf3b8bec02ace4f2d9935907d1a448a1b7028c83d51a76ef

SHA512
8493e4f4064bb826311ce4f3df68a0dcfb9282d03f009ee85967253972ec16a3395b42e51794628475139d365740fe1981713c8edcdbb0e91f59dfdf6515dc30

Download Submit
/data/data/cn.wejuan.reader/databases/localEasouBook.db-wal

Filesize
36KB

MD5
9fd979dfc5742ef298184170a7b21bda

SHA1
f4065eda7fd6b42598e993ce06390d77e2261600

SHA256
b8dd12cd9a2e1b953e01b9a2dd9a00fbac7083e7c3e1284b2da12c0856351e97

SHA512
1b3a46e962d71b560bc4789314b864435b1e89fcd038312c7c4228e50667b7d0621017197f3441cf8cb4c812d0036d3c0051b9484ecf606fcd3b753615059ad7

Download Submit
/data/data/cn.wejuan.reader/databases/techain_d.db-journal

Filesize
512B

MD5
8f63eff16da9fc1415092f3e99a1c7c9

SHA1
a7b58e91d732674c4fea1ca83d4586cea77860f1

SHA256
4539701591776c0cccc6c9efe07dd7213ab488f2d4aae8718b45cbb135a326f2

SHA512
5fe21f894fc03f1746d219b3c045a3a198022f47cefe4e1c642025f6ac8fcf948d861aaa232f872524a23540f34a100af313b9dfbdcedebffcb9c40206357fed

Download Submit
/data/data/cn.wejuan.reader/databases/techain_d.db-wal

Filesize
68KB

MD5
79c955a4ce4ed390b811282bd94bcd1f

SHA1
65137181caec983679305f90e6fa94f4020428f7

SHA256
56398e9f4f7311019bcc1cd38a5cd3a497df4e9fbbdf79e97bf4f81323cf759d

SHA512
18282d5a9740198e5a25c3312f3477f72b2f4819b7869e6318daace5c9456dddc571c52046a62d9bd57f31d72f4d081812d2c35367fcc8eb2c2a71ffe4b877f2

Download Submit
/data/data/cn.wejuan.reader/databases/u.dbv5

Filesize
52KB

MD5
3e6942fa2c38ced8ba0899c5b4d6b53f

SHA1
76cc1c167c245bd344de1a6b616d2a3b3f20f824

SHA256
ecaa35a43369ccf9898b54e346701c4e4add9a374f0d6f370a68833ec225d26a

SHA512
14e3f4e2e1c9633a3b14b0e2cb0bf2085bd3259087d7310577b886c960dcede74fd0031cf7ff5c057d6e604f6554f1708dc3a779088e24fa5bb1e3087b164243

Download Submit
/data/data/cn.wejuan.reader/databases/u.dbv5-journal

Filesize
512B

MD5
63f1ca66c1ef66c62a03951e51bf86c3

SHA1
224586b5cd35e0980822511eee07fdabf98718f5

SHA256
95c813acbe88e80ddbe8aa304effc9b691d1f884902f5b45931f32d45f278589

SHA512
5124bb882d73abd3caf9a794d56de3b35df655c8a33e873cc8a098cfe12481d0c816d4a242c52b7cbd77aa01229398b644dc79fb88dff3ce946792f44c5753e6

Download Submit
/data/data/cn.wejuan.reader/databases/u.dbv5-wal

Filesize
72KB

MD5
20190f03fa19f27d9f358385dada2901

SHA1
9094a436a5aae013c582bf722fe7f347fa9248cb

SHA256
17e93d64410446d3789c27082889b2fb13a3137bddb664d1924cdfc1cf7c7823

SHA512
0ed3caa609d99b8b3e718c2531a3445ede7a976f322be384495cc52ead54c34c15f1c834daea6f8a3c59422208031442dc3484105b1a83ec3319c5565a8edc03

Download Submit
/data/data/cn.wejuan.reader/files/.jglogs/.jg.ac

Filesize
40B

MD5
6e2b5ffcbdfa710a77f638d10ecda2a1

SHA1
a6ab21d5514d6c97419c427d39d76de50ac8fad6

SHA256
50db343d5e097902820d36efd667193aef52ca77d993d66baa4dd1f160818d9b

SHA512
8a5545fda1cc0110670bf67ef82bc6f20ea825fb7301db063383ef6fcbbf1b2bbb55bdde05a7f07ec03077c1e536ff0482d0da3e428d831f4eb3a9dfa4b9b006

Download Submit
/data/data/cn.wejuan.reader/files/.jglogs/.jg.ac

Filesize
40B

MD5
fa0722bd7ea40b51ac62a05a349fe354

SHA1
d3b7371590b4884ccb544236f0566b3bc07dcd8d

SHA256
7f3524361cb1cf04cf2fd9de4d00b09449859616051fb05db1b11b782018e2e3

SHA512
a6ecaa39687b9281d43fe258f1e1419cac17b74940969766ad1b356913ee811c61706274a8ba6aa509b98ed6de4fd4f4fcac6d2885376ec6c46cb33f308ec934

Download Submit
/data/data/cn.wejuan.reader/files/.jglogs/.jg.di

Filesize
340B

MD5
d83bd4b895f7a6f96bbbe45ab51e7a40

SHA1
21d9f517c63a945f4242e2b16193ec4a80cae2a1

SHA256
3397f2a9015fa7f43d0c6e9b72f88f69514b4adc4a783ef8058d234cda2f91a8

SHA512
28304ea579fccf4e3813d5ede90ddd590f4be7b264158139423e1755abb88f6af8eca1b5402713cfe366b8c8346d52c0b511632b078217101cd8f650aaebf123

Download Submit
/data/data/cn.wejuan.reader/files/.jglogs/.jg.di

Filesize
340B

MD5
07f2781a8f4d895b02e92e9c084e83f2

SHA1
c479b6053504edc8fe33f9f72da4223339a9ad51

SHA256
ccbcf874e5c6253c14e8afa3d38aab38c2236e926b65a0e06836ae1f53b770e8

SHA512
c6745ef736608d7c4006a341bfd8eee9f52b1c92f6dac5c2e913f64c656c42e91f9dc5e41668a3ad895ae8e3322144ed9300739d3e19d8e84d0e305f20a3c4c2

Download Submit
/data/data/cn.wejuan.reader/files/.jglogs/.jg.ic

Filesize
40B

MD5
e175133382581cca36ce0900cec44f49

SHA1
f69f92e67802525c3adcf85e867b81f3417c1bc0

SHA256
19410d35ccf596b30eede8dcd8130d344850f15e07cf6ab69aa012ff386821b6

SHA512
ee171dc27fab23996ff7242add097ee11f6a6c514fba6e57bb34a0a80f0c90413b3c50e4b610c6ded487f5ed29186ac6a9424372b71122e49fbe8c5a1552c1bf

Download Submit
/data/data/cn.wejuan.reader/files/.jglogs/.jg.rd

Filesize
73B

MD5
c714dc8cd76f9c0db2cbef3f58bd0b69

SHA1
89c578ac6d3b56cc80ac381b1e06f4ed100a128a

SHA256
c14c68347ad41e76ad4a1701110b9f2ced028b45216fc28da642c2d67feb4ad3

SHA512
943dc2d3c823acb3e67dd2aa43b4b8f9f9f893f1ee377948c2a22c6e0d236d987913a25c0f622ef3ff4fe3a5dbfdbf368f4f93cbede0e7abcf2bbb3864617683

Download Submit
/data/data/cn.wejuan.reader/files/.jglogs/.jg.ri

Filesize
314B

MD5
0263ba1fca2e6bc67355b347cf3303cb

SHA1
f4aeaf1307c72f156e097b772f67ab4596586d1e

SHA256
6c4b4baa55484872eef9b53ed53ac90c40844bdc91484d313cf77bbe5d87b009

SHA512
1b946f5ee591840e53245db5f635d1f6fb117371f9aea496259c471f00b68147217453db6adc3233e950a4970738fdb97431698fa5ca2b82ee2ea7cbf38e404f

Download Submit
/data/data/cn.wejuan.reader/files/.jiagu.lock

Filesize
27B

MD5
50809e250def0b6837afc15d4f2bb13c

SHA1
aa2a9361a8e8959b9c22735f1e8eabb43864f449

SHA256
622b193245274f38c516dee02aebb838db738315a2763a6998cb2a659d34f577

SHA512
ab80911bc1a2fc22396df1069daa843133b7112394f34d45f8119233f543927d75d14af17c536796a9fd29325e160d6287ca62f1b3bc65e54c608e90a9dc19a7

Download Submit
/data/data/cn.wejuan.reader/files/__local_ap_info_cache.json

Filesize
2B

MD5
d751713988987e9331980363e24189ce

SHA1
97d170e1550eee4afc0af065b78cda302a97674c

SHA256
4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

SHA512
b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af

Download Submit
/data/data/cn.wejuan.reader/files/__local_last_session.json

Filesize
132B

MD5
ae7051b7f9b336ab253b5112fb341530

SHA1
3528c9f427b29429e8bf4c6b71217ce28380ab8b

SHA256
7c3d873a8e0b567959a0f6554dec959a129085aaa65d807a568fdff789182274

SHA512
3148067095e227ef40817bb295c302ef89f038c5d2e882426925bd9c167209d6c7dbd5adec8347090bd119f7aa3836cfe91a23edff13d76506ca6f3010771ce1

Download Submit
/data/data/cn.wejuan.reader/files/__local_stat_cache.json

Filesize
521B

MD5
c0165ae6386c7682df02b6f24d1f34c6

SHA1
eb3a5328add4ccb82b58713bbd41799ffc59ebad

SHA256
21d8d26ae1660175184253bb9c735afec8fc6513f26f9d12d2fc9c63f8756346

SHA512
91967173557de54eb3f63d8a75751f1df885e33019981b231df713a6748c24984e5a069de2798cc28ec7a31472a6630a9c3d1c3a83e0e1a9576d22d18945cc34

Download Submit
/data/data/cn.wejuan.reader/files/__send_data_1715213371974

Filesize
557B

MD5
f9705b864cdc871a74938039644bc047

SHA1
6a925f0b1a1ce29b2bb5c8a2d552a5eb3efd785f

SHA256
788aa3d222b34bfb0ffc21b9b5f6944bef597e354d7dc0a4432e02954e45ad7e

SHA512
51ae3388ffe7bfbaa4c7f093d63fab74befa7a6418e2ec377df014244b0eaf679020d23193cd5ef26ece6954562453cd7105a636bd19dd3f823f50b967774207

Download Submit
/data/data/cn.wejuan.reader/files/jpush_stat_cache.json

Filesize
119B

MD5
383ef5b6a77d4e4a0422dde92a1bc107

SHA1
306eb4dffe8a0dfed764e5854b8f61799add9aaa

SHA256
c69d8c96980f5a68c96601b0dd7a36543a51edf1b02e6d64ac7bdcfff9b48bfc

SHA512
a79c054e3dfc9739dad61f1f44fc5568d312a65dca427e068e1988bba364f11b7f2e6f8e2d9f85169163a45bf235fee8f5feae22e79ddbd2f68a3642a0cf07cb

Download Submit
/data/data/cn.wejuan.reader/files/jpush_stat_history/active_user/nowrap/23a93c88-1449-42ef-9c0f-a5bc45bf5c22

Filesize
159B

MD5
c92da10a281e06ef700020b96affeaae

SHA1
b4c8ded43ce31b623615f9a72f669a6e5d7b100e

SHA256
641768727ca1de03074640f41a3395c6c121f999cd773f44b3e84b1c8ff87087

SHA512
7a3fcfbff36c85a1d334d0d98610fc080f99253b8f2126de55de39227ebffed3bebdd6bab4a1164e07e6ada190fd1b364fb44195cfb5642eb203983ddabfdaaa

Download Submit
/data/data/cn.wejuan.reader/files/jpush_stat_history_pushcore/normal/nowrap/7b2f77e3-85a5-4feb-a5c3-6c1ba79f30be

Filesize
202B

MD5
f1b9a97f39ed12c908fec9125c8d8b7e

SHA1
6ce5536182a65f42476ab53030092f434b4d1598

SHA256
700dec5a288cc999c9feb85bee558d1dbd0c1a8658e05637910ab2b52647730d

SHA512
c5412af5da0328153049beacb18489c0fba15bc7d31973f0ed5c58157f2a91caacda7747cdace10ffdec06e4885dc5653b9c2ad60c5fb08aa55b5768fa1df5fa

Download Submit
/data/data/cn.wejuan.reader/files/libcuid.so

Filesize
129B

MD5
adde3f12727f5afeca9e2dc89cd66675

SHA1
3c08c9529bc842e4ab652cdd196cae2ff311db50

SHA256
2d4335807ee8f98c02503e3f40c386e2a7e53ee08f759e73094afc3c6d9ffb9e

SHA512
603853a4f63953b3625930a0cd8c4b99898705b3898d45349c46d6b40574b4aba940678809bcfca4364fd1facb3a1f9718480b6cbbbbe05783adc44d716213e5

Download Submit
/data/data/cn.wejuan.reader/files/user_log_0_d026c_1715213499065

Filesize
460B

MD5
739b220cfabea414bd8a5715abd13ea2

SHA1
efb74935fb46866e3c54d8cffe585db5e3a38ae3

SHA256
e185674e4b4e5a436da5864535c073c2054571cca38f140669d5210e6b367cdb

SHA512
0cba1c2975b1d90f30c122c9cc48203bc026e5ee0db2cbb21ea24da36535e1c310d71b927bc740573ea4b4f8d69bf47b1b3a46ddb5abba19d19293303750bf6c

Download Submit
/storage/emulated/0/.zp/.icosc

Filesize
34B

MD5
a7444e7210592c425fafa4e62963916f

SHA1
60bd9bfa7dd0b2570e6e7838cba59913f5210eed

SHA256
74a8456c68522199acceed18bf69ef8934d04b6f6389344113e5679eaae7cfd9

SHA512
a3b4ee7f0901d4b4860e6cff80b64b96d8660c27c1b498efef975a8ee981f9fbf760967fbbfdff2a28d3e2a2c774388109790d7fec3702ad60ac1e73576ed326

Download Submit
/storage/emulated/0/360/.deviceId

Filesize
48B

MD5
1d8d16c4e3b19ebf18988530d9b9a757

SHA1
bc94c1cce05cd848a53271ecb9c5311e27ffebf5

SHA256
abd87140da8de3d0aa39a24a8d52bfe7b2eb28f7a3d505f205471c7e8f4964d7

SHA512
4562d1eedbc5c2dd7f25cd1c70343053fd451026403585182b142a64f17016c1bd0bf6ad51667b439b220e425640e55fbbda08517e7106376cdc220a4555da82

Download Submit
/storage/emulated/0/360/.iddata

Filesize
32B

MD5
d2384fe9aaf5aebd712374c9aec9a3eb

SHA1
bb48d3254fbc975969c58f7d3388532e5079d51b

SHA256
34711707a98b6148f26c179b05090d8a2c0a748d4cfd22c538464d3fc379d708

SHA512
9cf9d601fbd7b09ef73330750864c8d3e95460e9a6d5c7432a66ccaecc56d2dbeb6d339e326d75ee3df535a81fbf68f1b0728ea99955d5f366c6beb6365f379d

Download Submit
/storage/emulated/0/backups/.SystemConfig/.cuid

Filesize
89B

MD5
86cafb188003bb120e5d92d9d0e71f99

SHA1
22f4eece583bcbdcb465d324d7b1acd401fde169

SHA256
7b04f9d29bc6765349afb6544f6432318cd3981d07a33d332786ab2dd8b3b56e

SHA512
274cd694813d19503fea90c8a5a7c4091798e41418d857d478282ac0ba429a37f6e401ae09e8e7afe2be150ad493f501b2eb03b82cfddf23accef3aeb28183d0

Download Submit
/storage/emulated/0/backups/system/.confd

Filesize
20KB

MD5
048c73f536f234f0ad0d2fa8bdbda899

SHA1
dba2e666721e0b0988807b8bb3ce0452dad3448c

SHA256
f1a64586ce75e770e2f36a7ef6f7419e26ebb9e9e786df3c5adce50a196d2d07

SHA512
6ae398c682724f0008ce47cfc790a7ad3dd7cc801fb3a8a692d28da5533ea7ed830ea36933bd3e3219fc8cbade90f073c2c418611921bc7d6877d94b6745c4f0

Download Submit
/storage/emulated/0/backups/system/.confd

Filesize
24KB

MD5
20b4c5a4e7944c6575524b67929456e8

SHA1
8c00624e72d53734b11bbd36d92523e4d80ed5b1

SHA256
269e0fdb977c639320baa5a0f88db814d17c1058fe5aaffdfb723764e5029f69

SHA512
c4d54bdd070a8c6b8e8be330700b75c278cbebe6f2325337dbd958b2604b81f9d23e27a537352abf1c628e35a88818efa0c37b6b796b16619754db62f9481cfa

Download Submit
/storage/emulated/0/backups/system/.confd

Filesize
24KB

MD5
2de17a68633c118a81e3edae9cdd1451

SHA1
06021d3dc9d6697b10af71260ba9089811e2af52

SHA256
ca89508be5169c9e74cb5d895ba2303dc68dc081bd060866e4d4cd31283cf1b2

SHA512
9a4f6f2e409516424365ed6c9b04772118edc9a1a7e05bca80f0905df2f3f65ebcf6302aaaf5ff6853df0dd8ca977f9aa530de9b6ed5e1b5dbc55448aa216b79

Download Submit
/storage/emulated/0/backups/system/.confd

Filesize
28KB

MD5
94f3d3dcd36948b9ec08c1d59b97685d

SHA1
e7258d00b582fb942c3d15676f74958a0aaf7aae

SHA256
178cf13f26a56e6d6755b4d66f99488c8b84f48352185c2838d90bf52993470a

SHA512
bc949b7ba61a563cda0e6f2d3a4d7f0ed488ccbe56039cd9270885f2029eddc39f358a322a28d6dcb8414a2252bad4f00724d5c0a082b1855cce77d880365a68

Download Submit
/storage/emulated/0/backups/system/.confd

Filesize
36KB

MD5
9b471a7c256db9e4cda8f1403c167d45

SHA1
d7b7b7dd09124cc0e53eaf5e856e7071e6f281c1

SHA256
2c430b64dfda98f52908d7fc4e971d0afd71f9395f5555a737829fa9ecb69a09

SHA512
fe4e16c349dcaed2d41f6adf7f5b9024df5b987e8f1be4d9e473537bc0385ef35dbc3859bfd0ac1bddf41107d89f9518268c3d639930e6d4fce2a08023770d5d

Download Submit
/storage/emulated/0/backups/system/.confd-journal

Filesize
512B

MD5
410f873ee6441ec3d507ba6e9db83dc6

SHA1
d9a6b802b0e7b013545d77856e60304359a88737

SHA256
70aecbb10aa4d54ea7e53a13549dc7374fd3cf791c2c505d05537a32c09cc401

SHA512
d05d82e4ecfa82bae195f2b149bf1c52df61859645fda96965bf8019e6bb35516b80d602a4d3bb3d5b6edfd6c656c9de713e5c853842968e242d4686ec9a049b

Download Submit
/storage/emulated/0/backups/system/.confd-wal

Filesize
36KB

MD5
bc7cd3bb5a67d4695353e8ceee0b23ba

SHA1
b519a8632445ef28829e7cf32a6a72475e00dccb

SHA256
12369546fbf37016a480ebba33511b8527aa77ad54dedb12ead3d6fc33d93f77

SHA512
599a824de131bc1bcb592f674263cfde7ee6dc4c3d60812f4c06625973b9fecbb44c18dfba917718c7a8c47b84b905df7f0fbdde04c37e616a4fc2b70360b616

Download Submit
/storage/emulated/0/backups/system/.confd-wal

Filesize
12KB

MD5
193da66549e2ff290b78e0824ff889ca

SHA1
31afb7cfcabc8a79b5e62e92d7dd506edf176fa8

SHA256
078ca4a53778d796752503a1a23d03706b7c6f5c41feba88de5c50f9e267cb64

SHA512
e9a0936c210a56a3ab701e4e6a1acb8ec7c05b2c52184a1030dea48df809a57afd639f4fc06e15a2237de0f7d6fd38efde1cf0383add638ac3a6a875e4cc35e8

Download Submit
/storage/emulated/0/backups/system/.confd-wal

Filesize
8KB

MD5
f6b962ffe0f8f6aa54cf3232d14013d7

SHA1
e9e4c572dc3946fe35980645e05d680fc487a52f

SHA256
4338a7520fbe34188f0c22caf2e73c6a19ac2c94e0262dac477fdf76343dbe2b

SHA512
7eb0cf58ad6316ea8c1bef4d00c403e79eee8afeb33f9cf10914b5a120de8e19ce3e86c95daf9edce1df1603a4701b693f906ce69be3b5fdd803ed60bc6a1794

Download Submit
/storage/emulated/0/backups/system/.confd-wal

Filesize
20KB

MD5
7aa465fc0ab7b00ae1cf95b12e41db97

SHA1
a18b0d3fa5a82b64dff1f1d99b46cbbfb31de1ce

SHA256
31ffbf4206198e371c4869c2e44a22a810484caa187d4983acf7cad5f51bfd76

SHA512
89ab8f95e38299276d518be4fa85264c04120c90c28dd396561d70453d7e35bf633a30026d3702d3758eae097a95adc87b57729bccc704c77aa8b9d0303bd2cb

Download Submit
/storage/emulated/0/backups/system/.confd-wal

Filesize
20KB

MD5
59d5b814e819b16e5c0f5854618aa528

SHA1
1b507464fcf7324116449fc7225237462107a524

SHA256
d6e4a164a09576fe77bb66130d536db39817076cb95426aaf760ad2876e7305e

SHA512
61eaad148efa151c93dc5709fa58340bcb08b8c95f5a8ca8ea6192206d2861caff8eb5d8035b665814303eeb340f345346f3b805d1eb9cccbbffe7d4440c9d27

Download Submit
/storage/emulated/0/backups/system/.confd-wal

Filesize
8KB

MD5
51506697a20ec6335980ae7cf7c4d2ba

SHA1
3f9cc825bda86108169219f91d00bf3a6871f9f9

SHA256
c0a93c3edbc77dcdb57a9c0f37263e009d2a1a6fc0d0c6624368e2fab8ac3f73

SHA512
f3d003e35f0c23d7700af1b0ad8fe6b72bb5afcdc6265d3e1c16217af88e4daa2fdfb68268fd21c8ba163b71d47121e50a7082700ad0d3a03802eb60f898d5c1

Download Submit
/storage/emulated/0/backups/system/.confd-wal

Filesize
20KB

MD5
c348a75647dc9635515249d1e3a7c4ff

SHA1
9b082a823d5f00fe8cb7de05849ad4cdb45984cc

SHA256
943f6422900de58dcaf6a740754a1cedb12f1aedafa6d53264b54fd7313a873c

SHA512
f6166efc1f585b96172a3e1378272ecf3bf88be7e0ab691586b7aad8ee1d8b1650a87da065db396babf2aa8babdf27312560de5a4dfc66fd20cb661815e8c154

Download Submit
/storage/emulated/0/backups/system/.confd-wal

Filesize
8KB

MD5
01bd21d71ec87aa4647d11e8b1a9567f

SHA1
9c25c66cf7e3a48cb12f90dd559176bcc84c5ca9

SHA256
e46148a099d87a0d31cadd65b4c65640cd055722b642546f2cee16e7502cb368

SHA512
8ae5a6916577b39bf35575565b6705d62ac3f1baaa5e7ab921dd1516cec11af69042e1975eb659793129d31477af01d25023847277ed0e19c33e2ecfa1ce8d6f

Download Submit
/storage/emulated/0/backups/system/.timestamp

Filesize
25B

MD5
eea7bae5bb70928d983d75b8ad764ff9

SHA1
77340bfd33988737ed8fa2602d283fb938d08a36

SHA256
67658f851c4d2981333ed4bc437681f420ecf70a6f3ef8baa02f30f638650efe

SHA512
f52924faa5f9118860129a05952eac0b96346a92b64b2511ab7e937c955c59ea1848d263b68bdfe68e32666fe6423159f9402a390b29f625cff61c606e55bf70

Download Submit
/storage/emulated/0/backups/system/.timestamp

Filesize
55B

MD5
1cb6532bd76fc461e837661395fbfa0a

SHA1
52dd5588f453e89a28de949e85378502f112f149

SHA256
d5e91e3073035bb1e604ad681744669cd20bca4f1631ef8166fccb03803e5e40

SHA512
32bb58dcb9cb97409f987d6b4a67c63aa10d49843ba34d3a60e2149e24962e427dc6fe23c2747a14cb31fccb051e69d03c10d00250bb4b4cb893aa26e7d0561c

Download Submit
/storage/emulated/0/backups/system/.timestamp

Filesize
84B

MD5
40b932073d8a39c94b885477e381e2ea

SHA1
d410524d7f779dbe457ac853cad6cbabe5f858c0

SHA256
a3354a6954e3f571aa9dd6ea598d3eb4e2dde852b485df3dfc2ff8118721f873

SHA512
6847b0908ac4d0dcbdd28091f655361ccd113999e4568c3f12708e41ef6bd2e23eb4c00bc5e66781b769b25fdf7420922c8db35fe9a2d904d448ac68fc9aff27

Download Submit
/storage/emulated/0/backups/system/.timestamp

Filesize
114B

MD5
b818586f15acde5cb8975f72d34e94d7

SHA1
90570ce110414e8fcc093ff0414f8e4b6a4d8545

SHA256
2314725d9000c5b2a27373839b5dd806526f36507f4751fa96a3d3e10bce704f

SHA512
dda2621c5cb3d5cd69e33ab5de0a08e09b090fb9fd04ff52b2ef6cbe675496d6c0f86682b14493f2b606fb1332915608f8bb26c4b4a7d8695f5ebbed4141c0c0

Download Submit
/storage/emulated/0/backups/system/.timestamp

Filesize
138B

MD5
614cffed65f30edede58ff609189e37d

SHA1
6c8149c250aaa8b5a28fda2627ad4003a4e2e77d

SHA256
4d4e991b0025b25157480645465a5b80163b77fab95f2f33fa3bde3359e5a12f

SHA512
193ed5edd5cb060df880b2eebbfe46244330063a4884ef32f56dc4ef59500ea9c105408b4191b7d5cedf8e945e02ddf35cb41a2e4c0662708e761d906ad2b8b3

Download Submit
/storage/emulated/0/data/.push_deviceid

Filesize
32B

MD5
6f76be42bc535b43eb066e91442c5f7c

SHA1
3f69bc0facd363746637e261501877f5fc1bb03e

SHA256
beb9e0cc0dc09636e8e693af23f95a5928b3f9e519bd8c11b98760d715d0d768

SHA512
0ccd4e0985d956767f572a2f916895b506aa7d137206660d07517fd135355495e791f7c9d47b887c677a6130b6382bfdcac4d8269112293ccbe232b95183e78b

Download Submit
/storage/emulated/0/weijuan/cache/alipay_msp.apk

Filesize
748KB

MD5
d06ea38e4210a87d6b96f8b0491df677

SHA1
3ba573396398757088e559a9d372049a377eb05a

SHA256
76a24f83ad15586ff9a2081e420a707be9ddb0b5047e5b6de5974c41624ff2c1

SHA512
3d43e5bfad2b703a804a53048b6a88228a11fb80ac641d6594f774cc07f6c7367e0ee80b29966d02c9206542f467f55b0f1ddbbfef0ec372256314a7d1071f30

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads