Analysis

  • max time kernel
    163s
  • max time network
    187s
  • platform
    android_x86
  • resource
    android-x86-arm-20240514-en
  • resource tags

    androidarch:armarch:x86image:android-x86-arm-20240514-enlocale:en-usos:android-9-x86system
  • submitted
    22-05-2024 09:52

General

  • Target

    66dadc1d34d399725a6ef5105aa19ea7_JaffaCakes118.apk

  • Size

    15.6MB

  • MD5

    66dadc1d34d399725a6ef5105aa19ea7

  • SHA1

    b5fbdec2465c90e4677a647509ab2e00806b03cd

  • SHA256

    2ee5d631fba4f70586a7a95381af68048176f2f5f411d28ca459b1afcfc7eef0

  • SHA512

    eef4173eb2b75080b11bbfafd2aba48086c95ecfb27ac1129437467f69bd89c6fe4123413e86fc26720a9e48731e4ad8d1e7a5d55be7331be2f73cfc4cff252a

  • SSDEEP

    393216:pPS3K0hIuThmRaSoBBuVlXTxeTLxaB2p1REjWBWC:pEK+bmYS+UkcB2nRgJC

Malware Config

Signatures

  • Checks if the Android device is rooted. 1 TTPs 23 IoCs
  • Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
  • Checks CPU information 2 TTPs 1 IoCs

    Checks CPU information which indicate if the system is an emulator.

  • Checks memory information 2 TTPs 2 IoCs

    Checks memory information which indicate if the system is an emulator.

  • Loads dropped Dex/Jar 1 TTPs 3 IoCs

    Runs executable file dropped to the device during analysis.

  • Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs

    Application may abuse the framework's foreground service to continue running in the foreground.

  • Queries account information for other applications stored on the device 1 TTPs 3 IoCs

    Application may abuse the framework's APIs to collect account information stored on the device.

  • Queries information about running processes on the device 1 TTPs 8 IoCs

    Application may abuse the framework's APIs to collect information about running processes on the device.

  • Queries the mobile country code (MCC) 1 TTPs 8 IoCs
  • Queries the phone number (MSISDN for GSM devices) 1 TTPs
  • Reads the contacts stored on the device. 1 TTPs 4 IoCs
  • Reads the content of the call log. 1 TTPs 2 IoCs
  • Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 8 IoCs
  • Acquires the wake lock 2 IoCs
  • Checks if the internet connection is available 1 TTPs 4 IoCs
  • Reads information about phone network operator. 1 TTPs
  • Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs

Processes

  • com.jb.gosms
    1⤵
    • Checks if the Android device is rooted.
    • Checks CPU information
    • Checks memory information
    • Loads dropped Dex/Jar
    • Makes use of the framework's foreground persistence service
    • Queries account information for other applications stored on the device
    • Queries information about running processes on the device
    • Queries the mobile country code (MCC)
    • Reads the contacts stored on the device.
    • Reads the content of the call log.
    • Registers a broadcast receiver at runtime (usually for listening for system events)
    • Acquires the wake lock
    • Checks if the internet connection is available
    PID:4254
    • chmod 755 /data/user/0/com.jb.gosms/app_daemon/godaemon
      2⤵
        PID:4281
      • /system/bin/cat /sys/devices/system/cpu/cpu0/cpufreq/cpuinfo_max_freq
        2⤵
          PID:4440
        • sh
          2⤵
            PID:4882
            • dd if=/init.rc of=/data/local/tmp/init.rc
              3⤵
                PID:4933
            • /system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/storage/emulated/0/Android/framework/clrunpath/-936679160/meal.jar --output-vdex-fd=175 --oat-fd=176 --oat-location=/storage/emulated/0/Android/framework/clrunpath/-936679160/oat/x86/meal.odex --compiler-filter=quicken --class-loader-context=&
              2⤵
              • Loads dropped Dex/Jar
              PID:5002
          • com.jb.gosms:com.jb.newswidget
            1⤵
            • Checks if the Android device is rooted.
            • Queries information about running processes on the device
            • Queries the mobile country code (MCC)
            • Registers a broadcast receiver at runtime (usually for listening for system events)
            • Checks if the internet connection is available
            PID:4414
          • com.jb.gosms:com.commerce.chatplane
            1⤵
            • Queries account information for other applications stored on the device
            • Queries information about running processes on the device
            • Queries the mobile country code (MCC)
            • Registers a broadcast receiver at runtime (usually for listening for system events)
            • Checks if the internet connection is available
            PID:4477
          • com.jb.gosms:pushservice
            1⤵
            • Checks memory information
            • Queries account information for other applications stored on the device
            • Queries information about running processes on the device
            • Queries the mobile country code (MCC)
            • Reads the contacts stored on the device.
            • Reads the content of the call log.
            • Registers a broadcast receiver at runtime (usually for listening for system events)
            • Acquires the wake lock
            • Checks if the internet connection is available
            • Uses Crypto APIs (Might try to encrypt user data)
            PID:4527
          • com.jb.gosms:com.jiubang.commerce.service.IntelligentPreloadService
            1⤵
            • Checks if the Android device is rooted.
            • Queries information about running processes on the device
            • Queries the mobile country code (MCC)
            • Registers a broadcast receiver at runtime (usually for listening for system events)
            PID:4664
          • com.jb.gosms:com.jiubang.commerce.service.IntelligentPreloadService
            1⤵
            • Checks if the Android device is rooted.
            • Queries information about running processes on the device
            • Queries the mobile country code (MCC)
            • Registers a broadcast receiver at runtime (usually for listening for system events)
            PID:4797
          • com.jb.gosms:com.jiubang.commerce.chargelocker
            1⤵
            • Checks if the Android device is rooted.
            • Loads dropped Dex/Jar
            • Queries information about running processes on the device
            • Queries the mobile country code (MCC)
            • Registers a broadcast receiver at runtime (usually for listening for system events)
            PID:5054
          • com.jb.gosms:com.jiubang.commerce.service.IntelligentPreloadService
            1⤵
            • Checks if the Android device is rooted.
            • Queries information about running processes on the device
            • Queries the mobile country code (MCC)
            • Registers a broadcast receiver at runtime (usually for listening for system events)
            PID:5090

          Network

          MITRE ATT&CK Mobile v15

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          • /data/data/com.jb.gosms/app_daemon/godaemon

            Filesize

            9KB

            MD5

            4552c7c9430c1ed7bc43db1504909bd2

            SHA1

            64559abfc0156d97612b843ebd10abf6d991660c

            SHA256

            2fbb7428b15fb54440ba1f4938b8629ffa62818053827baa0bf51513768a6d5c

            SHA512

            291f06ab3187df51bc2e0e419ac465f70e91b677d3c77ec6d56f004900e292490f9a359755afdbc3a215b8810206be24bfa3b7a68b164afda63e8a2041986b40

          • /data/data/com.jb.gosms/databases/Account.db-journal

            Filesize

            512B

            MD5

            bd1087f22923cd67122acc458a99691e

            SHA1

            159b2cfae66a206b4acf7626818bcd88318a3bd7

            SHA256

            a5e1a3e5a48dc78967d1a661c359acc72e8211d35bcbfa7f0511b981921b16b3

            SHA512

            9da954deea49fbde451f31eede4d3d437258af82b571d03121ccc726a4cc5ff7e96f982792ea6d9d6e72d26b874578cda85553d6f1559c4894592f6e0d05c8cb

          • /data/data/com.jb.gosms/databases/Account.db-wal

            Filesize

            40KB

            MD5

            042099261d6b589fc5e6ff6f23adc37c

            SHA1

            de124f06d488d4768e5eb8d085131db1ac22ea7d

            SHA256

            f55429fcc9902b5cba91f235b89a5328319ab248cb9f9f4545b8e520a5428c2f

            SHA512

            7a49361d3c4cd0c0f2ccfd25fe1f3d8789227e0d0549c7832063b37fdec770bab9c8dc4b2dec0867fc2c72aad93a9f9f7067fe82e1dd73c06b3dfa77e3ededb0

          • /data/data/com.jb.gosms/databases/BgDataPro.db-journal

            Filesize

            512B

            MD5

            213b8022509e6654a2a3dcc1554af63b

            SHA1

            1629a240aef8fc85e7c275ab86543d2f0bb3d2b6

            SHA256

            47c88c8ae484a51d2f7d0685b75beb4a7f95a938b3f24044073cb3268d220db8

            SHA512

            e57ee23695fabc265037746c62b38b832ea77f97af8431cdda37d594d80fd8129c5c90c726a7383f5b4152238ac8849c19f24cb5c545e7fb0ae553e94494c767

          • /data/data/com.jb.gosms/databases/BgDataPro.db-wal

            Filesize

            92KB

            MD5

            9040f6488373de067e120b48e4782cf3

            SHA1

            1065fa8e13f9647ea6d22937b002d10b581b874c

            SHA256

            00ddcb66a558e8fbd8b5be672feec4deea4ae78dc1d17ed86350f54e5c148ea0

            SHA512

            3db03d40687fe692f2ddd7ad7f839f72297c16bc63cbac1f1fd3cb1f07659a59375bafa2bfeb7589705f7312acdc70a6852ae27338899d6175990e397b30ff35

          • /data/data/com.jb.gosms/databases/MessageBox.db-journal

            Filesize

            512B

            MD5

            5cd058144e4c213c8df55372296d4cc4

            SHA1

            65535817a6458f5725dfc44dfbdc5b62cf2b196e

            SHA256

            492ab7eae864f96310f44b6dd3ad7cbe7b4e0f9264bf195ca69c80bb83a1070b

            SHA512

            cda60a55e03dd0960beccc6d605dd770653f35b2857ec550736d52f965a2e6167c46e43736c217498553923a0984ac3818d27e18add5797d02e0d64961216d3f

          • /data/data/com.jb.gosms/databases/MessageBox.db-wal

            Filesize

            32KB

            MD5

            eb7b55ea6f072cac71ec424c046ce7fc

            SHA1

            a393fc605445cb13de8404d97cf24359ede85712

            SHA256

            58ddbd9ff804afb515dd5f49b5a5acebe44573b2b1484217da0e83a13798c93c

            SHA512

            b5bf477c83199cf14b0818b8ade507d7d73c3fb5936f4dd30e8b5f8c9038c0fc56bf76c2c2c13a59d0f748ef1657bbc158d90705bce6cd513f1cbc96dc96467f

          • /data/data/com.jb.gosms/databases/SyncHelper.db

            Filesize

            76KB

            MD5

            dced75f2a9a4a615575c50caabed6c3f

            SHA1

            ffa810bc65891cca29dd16056490bfe6ba84e9ed

            SHA256

            1f0c373dba48d08bc5f842039ee20f96802ebcd9a76a430c2754c90f4a5db74c

            SHA512

            2f9dc56261c0a066131fb190be9202e959be126ff2eb7ea52c7c104fb3cc92d7aeb23cdda2fa73da010ad80788f2ffc4ab24ab02394c461459808f7614f04e6e

          • /data/data/com.jb.gosms/databases/SyncHelper.db-journal

            Filesize

            512B

            MD5

            bb587ca0ec362cf32f728bbe3dcf9224

            SHA1

            a1394bbefe6c1806a840eb48548b93ac828394d7

            SHA256

            35b2b2d09c7af75e5ddfde5e3692fe865c0da23810b2ce0c3fadfb2c71240b47

            SHA512

            a02628f8fd145835c363035b77a0da7175c46b8424ae395ab1f1ecdc00af041713a0242babae68d38862a410e86937aaac97d87e3fb18cc34bfd8b75db2e1e44

          • /data/data/com.jb.gosms/databases/SyncHelper.db-wal

            Filesize

            88KB

            MD5

            c4b271c50f919fae81af50ac3a1f8339

            SHA1

            926e108d730aed5c4583125258dce6bd8c90685d

            SHA256

            f6339b19bf61b1a26df9c7ceba18e33ca0d068486a0cc97342fe7f9311e2b8c0

            SHA512

            84bd16c9b2ae4073d56174291b87a61271446fac19d12b6dbdb4969f57516a38b790d6175853d1af6be46d82be24d73df318f872a47b66b8ee9072c4e8c5acb5

          • /data/data/com.jb.gosms/databases/chatplane.db-journal

            Filesize

            512B

            MD5

            3ee852d31784cf1fdc37cf8f77fb5f85

            SHA1

            f86b63b8a28a2fb215e9625a2b9bd464e81f4982

            SHA256

            0256d67bfab5539f9505c7a25de246055466c47f2b27be89d3541124c25de071

            SHA512

            8709705858b9ebf45ffd8432cfdb305968bdd95600018fa205e79150173c166883e561dcad069e46c80c8bed6331092a3c7a754f83671acceda17093b7e50dbc

          • /data/data/com.jb.gosms/databases/chatplane.db-wal

            Filesize

            52KB

            MD5

            9e77203e2048e479bcd24292dd93505e

            SHA1

            e1483caf4b95d2ad3d7d62de6b1fc49b20b7e4ac

            SHA256

            5728e62833476023faf1ba71d64e95ab8f9fa3ad10151b7b968ca18c79b15768

            SHA512

            9e47c4e261fa509c5deca009d95aa0588fb0fda76edf3f2099fed0b5cf789525f2d091a644f5a71dc702263d03cb8b2b608e1cb6e077a8c470f81dc9724d6c02

          • /data/data/com.jb.gosms/databases/dynamicload.db-journal

            Filesize

            512B

            MD5

            e2c300a7e236dcf398abc1d529131c10

            SHA1

            ce173d33205871d25c073861a34dddc29e54f7d0

            SHA256

            7c23cc1a673c010917d33a235e8d5f8e0aae60c962acc6ef0b41641cb9c1d4f9

            SHA512

            a0cbc705c71adeae4c920b08deab27b45ebe96521af8e4ff0af2778d24fceb9751dd56e4fbb2c2329dceec62492ac18a9c788451e88b1fe1efe784f92a242cc0

          • /data/data/com.jb.gosms/databases/dynamicload.db-wal

            Filesize

            48KB

            MD5

            782ffeabfc5d7dfe21e4579207c23d8f

            SHA1

            e54eecba572be7556d5ca261e9daa7b6e9b2a236

            SHA256

            85aeb3956220098e2006595b1980247a34f993c02b19dc84ad1771b1df75180b

            SHA512

            0611d372c59c22dfd5fa6c52f02129f0ed21d44b24f21d9fda862a1d8aa6e90e9ec76c6951bbd99be36e43cd8dae061aec19689c309fcfab87731e07313bd5f1

          • /data/data/com.jb.gosms/databases/feedback_switch_db-journal

            Filesize

            512B

            MD5

            af7ba298cac2d3d5e11df9cd7e968a7b

            SHA1

            876da89a2179f2a551ef6292bf68d9b008c0a2b0

            SHA256

            1a379369bdf1125babaebf427bad1d66240802c1558ed8e69bdd6f51401a0854

            SHA512

            3041fe7aa103b231f10a05f6a3ac8d75022bf83653b86dc015870bc3482702d5fbd94d42ad273af25b84726e5c0b759e75e4e2ab15dc6bd513ae59eeeb39e8b6

          • /data/data/com.jb.gosms/databases/feedback_switch_db-wal

            Filesize

            28KB

            MD5

            8da51a40b665f327fe2448b5e80d39b8

            SHA1

            11cd4e5715afab2e86615c06b54e38f34d134155

            SHA256

            c85e60ddfbfe4f8ddc2c275556283eafcf70e02f390d26f95eeb5f0dd71dcea9

            SHA512

            3b87582f5f25c0b7360419f51fecd835e9aec1296becbad2a5e4e91d88ee4cae549c6a8d6cc5ddfba3e7ea3a3d9e629670a807a5e9697fa1a2a869cb84c8701c

          • /data/data/com.jb.gosms/databases/gommssms.db-journal

            Filesize

            512B

            MD5

            85e6e8630943adb5a4b6e4889672fe4a

            SHA1

            0597876c3be242b16fee4961300f68111ef75956

            SHA256

            572186b9421add66c81583439c25647142a7e710e095b3a13a6cfbb62ce7b3c9

            SHA512

            2ba2e845e259ea91a1af24fd9fa66903645af0c6280054c37a15b4d972eb6f4eb06461782316a557f56e2c8fb215a5a062ebefe9dffaa026858c09de6a3d1d80

          • /data/data/com.jb.gosms/databases/gommssms.db-wal

            Filesize

            108KB

            MD5

            3eeb8064cb2db4d7ad0f95a4423b1e0b

            SHA1

            5516dc2b6fbc6a069ee8985d51646cfca12771bc

            SHA256

            d6db8cc3ad366bbdb5564412854016ba0c887dbb3ce06b22d96a547f7f78451b

            SHA512

            262782dd8b0db34c6e93e382caaa8dd37e3374c32cb5d6d851aa0f19851c7ea4d2ec4040e4507ac1029ebb9850dddcb6fc0c773adc5298d2061cf9922f586758

          • /data/data/com.jb.gosms/databases/google_analytics.db-journal

            Filesize

            512B

            MD5

            14704055bcb52dd81eebcfcccfe2b65e

            SHA1

            abfc0dff2023e7a6677d96a406874c42a0978a1f

            SHA256

            32565f020e1d724844a849e3788e2f494920ecd63b767fd1b4810f56efb628ae

            SHA512

            c50706b7a873a4293b195942990c5af770186ecc3c1b1b4356170d7454e28a686dd4e81c0c177dd500aac2dd94cac491681d3a0e836f7bcbb3279ba225f2f380

          • /data/data/com.jb.gosms/databases/google_analytics.db-wal

            Filesize

            88KB

            MD5

            c7afd3f533d28ec9a08f62eadf14386d

            SHA1

            bfcc1aba784eb16d25f0843dd574229d0c387384

            SHA256

            b0523959790a49071d3f1caf1083c92360bea534a870fa0c1199271a3656ab61

            SHA512

            35ba46c6322d4c8e34a709b4ca02d6bd01efa2abc9b52dffdbde77c8e31abb207ac2224c1ff44753f005ade874d7858a42a1b7e48d66326970e12546903c07d1

          • /data/data/com.jb.gosms/databases/gosms_subscription.db-journal

            Filesize

            512B

            MD5

            1c397ff649b6491c15b4458c653f9c82

            SHA1

            9387cd2606f243fef0d51ae90d1c8a6d202bc36b

            SHA256

            b616dce323e5549628cd19afbdf9abbbe8866b5553d149fe1ad528c77f14de61

            SHA512

            845fe05b6bdc1dfdd886fbb5fb0a405f35bdbe5db11786f3ac1bf15875f687e5028f015044f969ebf9884ec012906315f8fb49aba19bc300a15dc5fe61f7ff75

          • /data/data/com.jb.gosms/databases/gosms_subscription.db-wal

            Filesize

            32KB

            MD5

            03f2fc4b1892273c402407e1303bcbc4

            SHA1

            5bb792c168c52fc9d3e7b76f00b87815f06fc8bb

            SHA256

            2ff0fa79a6d388cd6f69b5ca139168cbf22783e77c82acecc02c699ccaa724ae

            SHA512

            f2cb93363ee2ef111ae7572377b130df329a3ecb8c4c135ac987a2aa534b9b5a39ebdf634202aa98b475bbb91bdfd0f9f0887decbef1d9c7129a16323f800017

          • /data/data/com.jb.gosms/databases/gostatistics_sdk.db

            Filesize

            4KB

            MD5

            f2b4b0190b9f384ca885f0c8c9b14700

            SHA1

            934ff2646757b5b6e7f20f6a0aa76c7f995d9361

            SHA256

            0a8ffb6b327963558716e87db8946016d143e39f895fa1b43e95ba7032ce2514

            SHA512

            ec12685fc0d60526eed4d38820aad95611f3e93ae372be5a57142d8e8a1ba17e6e5dfe381a4e1365dddc0b363c9c40daaffdc1245bd515fddac69bf1abacd7f1

          • /data/data/com.jb.gosms/databases/gostatistics_sdk.db-journal

            Filesize

            512B

            MD5

            1b76bd7fbb14952198df32f9448ffca4

            SHA1

            eaeae09e3bc2e3ad0787464a28a13355749a0bfa

            SHA256

            6cac90bd83fb0edaac6ce269dc57883b5ac23c22f202561e99ae55ff2582ce51

            SHA512

            5931a0420f9fd1af7611bee4a8b132a9169d91a023bebc5f30d41f2bc2e76cbdddac148182379f4dea9a7228f6df47aab742cbf59ae9c8c1f61e2418be249462

          • /data/data/com.jb.gosms/databases/gostatistics_sdk.db-wal

            Filesize

            40KB

            MD5

            5f7b93d19f3f1eda984b60e1f8a02efe

            SHA1

            c43d8a318952adf98d14813d4d4b4708e32929b4

            SHA256

            9900aae170f8f7d743eb4746cfc13a7387ee8fe42f44ec85f76c9a4d377ce6d3

            SHA512

            38df5f07c54d8d4e792c48931e044e86fd91ad5221ee5f639530b525d93e5ee06d9312cdd61728d32bf155b076fbda405763644fc073a35d448755b564dc32f3

          • /data/data/com.jb.gosms/databases/holidays.db-journal

            Filesize

            512B

            MD5

            c3a44ef3c18e929fad5b9535d16bf5cf

            SHA1

            e173694f982c28adff493bb25c290a68cb1ce42e

            SHA256

            31cd2db21f3ce6369b1efd27bd0d6dc3d45f35870d40b22bbb3001d9cea0cf7c

            SHA512

            93a53ab31e1ca346b519cf0ac3d0a2e230ebc04d213493518101b0367b79fd53271435e080c589f080023e5f773cf6cd71eb200e28b1d510dc90b2e452506e45

          • /data/data/com.jb.gosms/databases/holidays.db-wal

            Filesize

            40KB

            MD5

            a4d11ec74b5aefb92f4f4166fa9206e5

            SHA1

            3673bfcaddcd38a886c11df9215b7a27d4fdccb0

            SHA256

            b03e6f3ff849f8b0fc0c248ad761ed9c297c4ae5c4cae72cb497ee867dbc321d

            SHA512

            576b502299f39990800b8a8bbd59e73767d782baa331802135dec74362df3c68db32128387e7693b3a66d6c0f8820a8b5860da6ba56868320887f8afd48b464a

          • /data/data/com.jb.gosms/databases/integralwall.db

            Filesize

            60KB

            MD5

            7e4189412c0dbafcd4e25cabadb5ccb0

            SHA1

            a5ed140e60641f569ec04208d63be12a283d00d0

            SHA256

            f3b81221dafdd3bfd06641b6759f15a8708ce67b71d5ad1733b8bf9d1c61b710

            SHA512

            d56fc6d5d7e5e709f9a40e1d26e3b5cc70d1bb53955b640590e152429daf1c480de59f1d24b766bdb02ed12546f4d8f4a186869ccde3b0df16f2c9c8d553fbb1

          • /data/data/com.jb.gosms/databases/integralwall.db-journal

            Filesize

            32KB

            MD5

            5edb9e893b2d84d0b4c5db60ee4e5aef

            SHA1

            158b5d5b9b8d3e167620540b0726f15f20e1d5dd

            SHA256

            435062cd98d1257b5664d5719953d6cc70e01e209929144a2fb09f3017b0594e

            SHA512

            dca17efcb50c9ea52c9f4ccd69ec8aa083e23cdad3bf981f308f20287bdd55d8a66d8371d8444928357b775ce84359be5fff7767836cfe8512fb88252dae1a2b

          • /data/data/com.jb.gosms/databases/integralwall.db-shm

            Filesize

            32KB

            MD5

            bb7df04e1b0a2570657527a7e108ae23

            SHA1

            5188431849b4613152fd7bdba6a3ff0a4fd6424b

            SHA256

            c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479

            SHA512

            768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012

          • /data/data/com.jb.gosms/databases/integralwall.db-wal

            Filesize

            40KB

            MD5

            2f6adc3ec51344b2e1dd006393707aaa

            SHA1

            e50885f1fe38a6ae6710d77209e48b83526c32e5

            SHA256

            9ef6dc2ee4c7027d27074d327fb2f2ece76a8ba5fd499ae592fdf8df5df54d1a

            SHA512

            6dee1fb20a3cf7063b3d5ae3518b8cecca67b0aaa5f950a7d9741cafa7cce29b4aa63b4ed6a67cc0616f950908a18f72ebeef0cf28eacf1a2926355db3cae3ec

          • /data/data/com.jb.gosms/databases/messaging.db

            Filesize

            44KB

            MD5

            60a940769dcf40259f3c36434a86313c

            SHA1

            1b77065b244c5389611c49861c1f3de72172dc73

            SHA256

            42f77eb99ef7c69ab562766de8b7690fc8745dc5f9ffea1f220d8db2a3ae6b56

            SHA512

            036f096d6a6b50b0a25ead1a2a6d28ef4aa8d68137827027b307464f6fc8f08a41af403770401cec8f37faee08723ac46aa7fb83bdc69ba01d38b40c1d6c2f46

          • /data/data/com.jb.gosms/databases/messaging.db-journal

            Filesize

            512B

            MD5

            3f8c2cb3666fec9ac9de608d6a97b8f2

            SHA1

            5bc33f7ec3f9837fb40c1374cd2b25aa069a9fc5

            SHA256

            3ad51f1bb9009b905e61529dc650d72bd3a53e88f5dd49eaa00572ab83549c59

            SHA512

            21bc74609bb9d645df5c99ee7b2207769e9cc0fc76aa9a2c644fc6e7453e3a01c39098a8980eef31a4799ecb899535cca7eec208b519322465f3e9d85d4c12b0

          • /data/data/com.jb.gosms/databases/messaging.db-wal

            Filesize

            56KB

            MD5

            4aee50c7da66f60092a93c1ec7615bc1

            SHA1

            6dae786465c2d3de81157e453330d71049bf0697

            SHA256

            f766a5bdda088f0b6759ec1ec2ae22ff71da7bb85e6616f02a75d46b7bc79394

            SHA512

            62c2b727b13eed1d152a87d9db7bf358ad6394d7e055212e4d6ec758b817f4ee0cca6737e55f5ce57c10e6f662b39aff5038c3d7f699d2dace9f4903e46ba85d

          • /data/data/com.jb.gosms/databases/schedule.db

            Filesize

            20KB

            MD5

            166791b75f1a03a45886bd100bc30ccc

            SHA1

            af3cba25a9c684904f8791f942374472d283e61f

            SHA256

            58190a2b0dba3b7321a9397374ab3aa6be88c6d758088c1d421251090cee425b

            SHA512

            c88ddfaabde079eac636d4cf3a2a87a77a319a65ac9c528d93310be82c473410edc762e342685fbe1d4469ef563fce3666bf8fabdd1d23edf0a92c716039491c

          • /data/data/com.jb.gosms/databases/schedule.db-journal

            Filesize

            512B

            MD5

            b60bd47f3ec25d7ec15ba5daa407cb6c

            SHA1

            9e9293114c032de099c5d52d3f93d94a3058720b

            SHA256

            6eec11e203db89e62e9a1154f22f4a6dcf9a478bd1d5f10ddf13588afb9291b1

            SHA512

            fb97264231b638bde1178b4497d9e631e1eafb81e70aa8c6090660639cb8fcd049ec7a43a2699a2fceea218c587d11764286a1bff584dd8b870d233cf0fb702c

          • /data/data/com.jb.gosms/databases/schedule.db-wal

            Filesize

            32KB

            MD5

            c26768de20d8a3e4746d027b753ed1e0

            SHA1

            20db3e5d93a29b4ea4899da490d0ec9bc12a7966

            SHA256

            3352b08b2b6c5cbdadd30cb32bdf70a422d0eaa52f88396de70c7b9d2856f0ff

            SHA512

            feaea48d898576dda7299603926ee6cccb3806f3a361c836337c0c8e4a64da33df7b0d50c87a38b52587721bc432819a904f6c5d4e84e009183be53ea5153bfb

          • /data/data/com.jb.gosms/databases/sms_interception.db-journal

            Filesize

            512B

            MD5

            9decc6115b1369b6de35688a74224613

            SHA1

            078c110bf49a4bb86a25162ff45be923aa73102e

            SHA256

            1dc499b0904898b98186cb5db498f9b430749f0ced34ba9f914482f340855c08

            SHA512

            19e9ac2bac9bd3c267cf4551bdbf4ed407c75921439d9b6e78542f989fbb82093b751c63baba159e9362a0bb5c17494183d9d2a38850f61433cde9924fc7de39

          • /data/data/com.jb.gosms/databases/sms_interception.db-wal

            Filesize

            52KB

            MD5

            ccd96fae847ee94281640af1b2a1c410

            SHA1

            49aa14032db0d1e0905e3e9e4029aa265838abc6

            SHA256

            366721a0f01f794548d4c7ff72016d23e722e8bb9c483f16c9c7bcd46b38207c

            SHA512

            22f0168831e4e416bee8f57fb435ee2f1649d8801346b636b8ea1456af8448a15c39a77609fb30bf30a1e2dd2643d7c34068833c0d33d7007323619bd88584fe

          • /data/data/com.jb.gosms/files/custom_preference.xml

            Filesize

            573B

            MD5

            d6a69d89672ed269adb4c58f8270c9cf

            SHA1

            f2d47c0e6279e0c4a241793af4ae04f85d10af48

            SHA256

            30c291ade219241fba34c13e2e8b835e1dba4c51817c24290ed7f1a51a7fdb92

            SHA512

            a411371a0ae0e1c5e62dfd884e6b874ffabdb53ca46336e9b9d1f0554293433807b1db19d242f272978105cdb7dd738d08a1c58f08538255b7d7dfd41d46cbc4

          • /data/data/com.jb.gosms/files/custom_preference.xml

            Filesize

            682B

            MD5

            51e207df2f80519a6924faf147571c17

            SHA1

            028bbe0de3534e6eee553d56223f60f5e8a3d0da

            SHA256

            409871e58ed102f977e2cd9035163c12742ff506fa9ab7819f1f7434e9f0f396

            SHA512

            3a9d850a88fb26b74f8932ac0a7cc014d4b41941240f76bae9df91fd43dffea975aed3bc4929f0ac840da113c8843214cef377ef3ba4cbe8988b08c69d5ed22b

          • /data/data/com.jb.gosms/files/custom_preference.xml

            Filesize

            731B

            MD5

            96c71d9ce18a19503f272df7b95b3e1a

            SHA1

            db9587d63ca328e5d4d3183b9f5496507149d4f2

            SHA256

            1877f7566e855ed45ceac7e3f5488d4ef91ab153db228c7ea4968492ba9932b2

            SHA512

            edcaf6c91009db5ad7766b1ae6016d49210919191a7de00a8d6674e6d3db1101979e0099425fdc7a8b7f281cc65c551d1b0ef72ce9cbaea223e5408125efa99a

          • /data/data/com.jb.gosms/files/custom_preference.xml

            Filesize

            814B

            MD5

            f0ce898a4c8957e697e6435ffc8a2ffe

            SHA1

            52a2fffc6dc54c12a04497dae426b3e5c6957f93

            SHA256

            1cf46e875fd19742e0759dae16b6ea48122c050399c5f79d5459c34d37a33e8d

            SHA512

            8fba126f85b7d6d5448280b62259573272d9e6d03cd68e44e70d71a55f1cdb9a4a206e1686acde8c9048f458242c24f4cb0387a12ba720802e82c0d206b4b0ca

          • /data/data/com.jb.gosms/files/custom_preference.xml

            Filesize

            880B

            MD5

            409cbc6c2abc1b7b345e04e1c6b7dd71

            SHA1

            ec3b26aefa80cf384de07c96a4242af556712163

            SHA256

            d5811cfccabce499d723b35b8335bdc60fa56a6c3892a1c8adb2a0df04de2ad2

            SHA512

            76e91e2b0a98f3b006c937e0ceff4f2c34ab1049fd47998f48218088cc8105c7a1b8272a58ef9c03ff2cfe6a068fca036a142ac5519cd53b6f0b04948f86fd1c

          • /data/data/com.jb.gosms/files/custom_preference.xml

            Filesize

            1KB

            MD5

            34ed87bb5a9296edd31123c7b5f023c2

            SHA1

            95026f6e288b3404074660097d18a4e46c7eaea6

            SHA256

            715f2c7b68ce52a57d9980bf0fdaf68549c8105b31b72a50e0caa18ab8f65db6

            SHA512

            871790b6ff20ddba563b03e4d9aa25127ce3d5e07a3bedd953dcdb0ca08b0c04fe79370bcf663fee3f2a8352979f44840f82567cf7cf3caff6c5974558fc1891

          • /storage/emulated/0/.goproduct/goid

            Filesize

            29B

            MD5

            7324e0f223b3f9a55ba3ef22333025bb

            SHA1

            f84812d7f59def35dfd111b0550d0746360dbc86

            SHA256

            51ed56be74808594fc32c49cb35d9d61cdb2646db99903bb98c3b6673de4c835

            SHA512

            cbc2896805393a093a3c70a37c6b9faa3520b554d0f4b13a330f43360ffdbb12a95ca6abbc46936adbdde917795925132a37ba3fac1e631f68447b47bd31d692

          • /storage/emulated/0/.goproduct/goid

            Filesize

            29B

            MD5

            e4dcf4e9f131c7249a35a2f3f231c30f

            SHA1

            4a7ca80372add437dcc7819f126e59857a2bf870

            SHA256

            e2d1f00f80c97bdbbb86d91dd7227ee75220de4f434aca5de95d7fb308205f6b

            SHA512

            e2231144d551484d9b308ce36f834370cceecf3431e683b8beaf4349cb991ecbe9a76b50989123cb1edd2975c5c3391070d772736097c0cbdd7d7b33d153de27

          • /storage/emulated/0/Android/data/com.jiubang.commerce.notification/evasion

            Filesize

            55B

            MD5

            01394c2ee6ba00687ee40a3c80a21b61

            SHA1

            58c194ae193e49b47318877ce52e182b57f92b3f

            SHA256

            d157877c190628783fa99f30d89de1653ba6e9be9cf24b135824d133d1a35c4b

            SHA512

            18076b7657ef034c6996aa21511782f1d55a05f50b8e0c9334c9a4cc9d533831574a348587c72f232552b3ed063b204362867458c563b234f67fde5484d7bcf8

          • /storage/emulated/0/Android/data/com.jiubang.gochargelockor/hodler.cfg

            Filesize

            18B

            MD5

            44ada8809c99b28706800bfd7c4ab311

            SHA1

            e81ede5c4681febf1dc7abb4edb1178c957b4596

            SHA256

            80efbd587e6577eb60448edc104bd02b363b895d0f3c171eb9609ea5c4843339

            SHA512

            de6d70c0d84ccaa4cfc57baf8fd0967940a013a18175cd2ff039f80f26cd74f31429ae0546b40ad0332611319101e7e9fada088ad032e3c2c7a0468b488cbf65

          • /storage/emulated/0/Android/framework/clrunpath/-936679160/meal.jar

            Filesize

            1.1MB

            MD5

            704b581ff928e7a1c998fa6c98c0b3ae

            SHA1

            c862400ae30e318ae3028f3dee5f7b52c19e23ff

            SHA256

            123398dbbe734a4a602e5f2172eba1c7ad3a015260620acc812bbbd10915ed6c

            SHA512

            fddaa3356b23f7a6353ed2e55418143fb2412ea4b825d0d2ab9d6a15d50fab446332991fb3b2fa04542f8962ade82714708381dbfb612f44ccd109458b81ea49

          • /storage/emulated/0/Android/framework/clrunpath/-936679160/meal.jar

            Filesize

            2.6MB

            MD5

            c81984dd8784ff0ec3244f1880cf6242

            SHA1

            f374e9e7b273feb657305de1f9dcc85d1f22750f

            SHA256

            74ea0b606e5d608859d886d92d34b766eaab03f15fd4aaa0a513005be13ad0f3

            SHA512

            375ecf4d637bfbdfb7c1ec7288331706ed46b6c51f2f42b1fecd54b3e568f7a1f1e4b25afb74b31b3709ebe39885f9b8c9d2107d4fbe87b87073bf59115b518e

          • /storage/emulated/0/Android/framework/clrunpath/-936679160/meal.jar

            Filesize

            2.6MB

            MD5

            7ec711050cfc0bf2e0bacea44b5aeefb

            SHA1

            def6ba686b06c854fe6290f6d1e29becaffe7dd2

            SHA256

            03e61f7d7f0960666cde25b0952e1db32fcaf94f151b61da388ea40d54270395

            SHA512

            d652c916dfbcaed6adc8a510b3a5d4161beda4d2fb592ab8b7882a40fd3057be81c5b87c1a4ab77c3517aedccebe53ecb971d4e8c4bba97614252388234da69b

          • /storage/emulated/0/GoAdSdk/advert/cacheFile/524

            Filesize

            7KB

            MD5

            2c015fc322042fd4d827468ef0e41761

            SHA1

            cf3c676788545c0909466ba542cb0cc540e898af

            SHA256

            7d12a71ba3f46da6ae4008bc297e2a4f0b71e60869fbf7f697979c2edd7be7a8

            SHA512

            154caf5c6d7469ad61d125b160b078acd3bb1f6f0bf8a6bc580752d8d93fa3015031ababb243d34ddfc3d792ef9ab1c2c7a0c20f804f5427359a75a4d09b07d8

          • /storage/emulated/0/GoAdSdk/advert/cacheFile/BaseResponseBean-1844

            Filesize

            144B

            MD5

            d012bbe1965d705c90b7ff6786455653

            SHA1

            f8f30d068c72585ba63cd52e9827b9dcde2c4a47

            SHA256

            6d345e3b598653dfca8f032c69549650898f03df407615b6180241372a1bdbd8

            SHA512

            85571fadf2beb23293de267b05ff30710fede5c77817c6f049141af713d14948a528737b546f8d9d07868b89f1795ef90c6df56531faa1604594bd356d5dbba5

          • /storage/emulated/0/GoAdSdk/advert/cacheFile/BaseResponseBean-2072

            Filesize

            144B

            MD5

            707be52671bdb9f56c27c1513abde44a

            SHA1

            a97708477b54318ca609db84d0e188fc80940419

            SHA256

            f5a36f157e0997acfc3d2e690268eeeabaf4c90406fb3cb6468ee23aa81293e4

            SHA512

            68ea233889e6f2507cd15cf85709fe88bbd3ed3a4c01eab16e332246deda39fbad5b7ca361314d6f2a05ddf0c2947e6762c73e1382c30605dcf643751ad86f9c

          • /storage/emulated/0/GoAdSdk/advert/cacheFile/BaseResponseBean-520

            Filesize

            144B

            MD5

            3a59ffd5cd31b529878e8f0e73ea339f

            SHA1

            0d79d9dce81dae9168427383bcb4918d0ba49086

            SHA256

            e0010a60a20005312c8a531be225691afaf31adcfcaa27202132ef96914a5162

            SHA512

            45dff4346a4a14bcbf7253e5cf9d887aea14b590f82d5a3d05086a3d793cbe64d83edc92abcbfbc6a9a05712a835145a5e7bc839172e87d236d9458ad60bc914

          • /storage/emulated/0/GoAdSdk/advert/cacheFile/BaseResponseBean-524

            Filesize

            144B

            MD5

            4e152dd6a9ede2c7fd07e23662ab334d

            SHA1

            82fdb3405507aa1eccc65f895e20a0f05e8fa35b

            SHA256

            1b81bee329794d8a489bca5b96ce01ac5eda460c4e43c3ba3863adbd2dbf1e49

            SHA512

            226c4e757c842bb458c202e0c4d388f33b2fef3b4b1102fc8449621b8a31e6ee44622c844e9634fa4ce6da14c5318e86af56b0e53aa672d70327cace9fc75865

          • /storage/emulated/0/GoAdSdk/advert/cacheFile/BaseResponseBean-562

            Filesize

            144B

            MD5

            99279d34e5db1e6585234972e30e07d4

            SHA1

            2f9659be5da3b178ae2125aeeaded4e4fc612d98

            SHA256

            e0ea9f692c79168c4a3d2caee9e8b8108f6b53a2f42bea9a1f640c216f79afc4

            SHA512

            c4522a30ebff1b9068d60511b2f21a0b018a87f15abf8d793f3fff64545951e8cb6f6a6ec2fca714a2aef35f1cb7c821ca0d6ba615e99157ca1decc74211409e

          • /storage/emulated/0/GoAdSdk/advert/cacheFile/BaseResponseBean-692

            Filesize

            144B

            MD5

            2e5b457af3a6c8352d276cff10aa5ecd

            SHA1

            478854a2b4a090ad2375ec8df8068bb385e1f868

            SHA256

            21fd895c68fde25684d95976a417d834d7ae845317d542274656551faeb2dba5

            SHA512

            b014e407dcae96fb2097550ba76967ba6257304f479679f12966ea75e1be980345e35c2ac007570aabdf57cb4054b46d0eaeb06d22ece424771798ab82ad4352

          • /storage/emulated/0/air/as/statistics/deviceId.txt

            Filesize

            19B

            MD5

            2ab0b1b4d7d163ccd26c2677e89b3962

            SHA1

            94435072dfe71445a52cafa29c8a8451708410fc

            SHA256

            cb8e0979900b043d40dade94134f4cf50af46b77b9eb1e9abf43495d76bff036

            SHA512

            77838314e3ae0e089ff8cb80a5a6067f2deb0f953907a332f7864d33e16f02804e4a0b5e2cfe20a2c0edff326210502a3ad570c9c6147615de9bb322fc599602

          • /storage/emulated/0/commerce/statistics/deviceId.txt

            Filesize

            19B

            MD5

            9ce68fee17af4ebff224677379a85711

            SHA1

            7689a9106ee27e226d50987c0d7648c349c16a0f

            SHA256

            e1b5bce1e8e638901235e7760ee37a862c56d10bbcca1af3da3a1f160f7d5f5b

            SHA512

            3ca93eff3b0b7c4137edb57f86c4140be7c027921f15b5f2b69b17816cc6d9da5063a6edcadcbab2e67c6e0e446f3666877b77c4e3cf503798b9b3178424800a