0d29ccb109ed85b30ab4de6bbd8ab638402daf47a9ef120d7d9d047eaec30cb9

Analysis

max time kernel
178s
max time network
159s
platform
android_x64
resource
android-x64-20240514-en
resource tags

androidarch:x64arch:x86image:android-x64-20240514-enlocale:en-usos:android-10-x64system
submitted
28/05/2024, 12:36

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
7cf981402cb48a6be067ed72fa610e94_JaffaCakes118.apk
Size 2.2MB
Sample240528-psy4padf8x
SHA256 0d29ccb109ed85b30ab4de6bbd8ab638402daf47a9ef120d7d9d047eaec30cb9
MD5 7cf981402cb48a6be067ed72fa610e94
SHA1 c40716f3812483244bde61f843423b7956f3be75
SHA512 d28b8a191c8ef54f2479809ce5e98c1c33ec1f4f1aa39cef7aba3af51a75841e183515a00bbfe0969f21c48c2db0cd469053c8530cf5964da738f55bd5b1b355
SSDEEP 49152:IfYflGxxUAAi5hjXJRZecPvVM1oPkp6M7tGQjqzbkHU4ghHn7r:Ifo5An51McPgu8jXqzg04Qr
MD5 SHA1 SHA512 SSDEEP

Score

8^/10

banker collection credential_access discovery evasion impact persistence

Malware Config

Signatures

Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
banker discovery

Security Software Discovery
T1418.001

Checks CPU information 2 TTPs 2 IoCs

Checks CPU information which indicate if the system is an emulator.

evasion discovery

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/cpuinfo	com.wait.hero10
File opened for read	/proc/cpuinfo	com.wait.hero10:system

Checks memory information 2 TTPs 2 IoCs

Checks memory information which indicate if the system is an emulator.

evasion discovery

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/meminfo	com.wait.hero10:system
File opened for read	/proc/meminfo	com.wait.hero10

Makes use of the framework's foreground persistence service 1 TTPs 3 IoCs

Application may abuse the framework's foreground service to continue running in the foreground.

evasion persistence

Foreground Persistence

T1541

description	ioc	Process
Framework service call	android.app.IActivityManager.setServiceForeground	com.wait.hero10
Framework service call	android.app.IActivityManager.setServiceForeground	com.wait.hero10:system
Framework service call	android.app.IActivityManager.setServiceForeground	com.wait.hero10:system_inner

Obtains sensitive information copied to the device clipboard 2 TTPs 1 IoCs

Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.

collection credential_access impact

Clipboard Data

T1414

Transmitted Data Manipulation

T1641.001

description	ioc	Process
Framework service call	android.content.IClipboard.addPrimaryClipChangedListener	com.wait.hero10

Queries information about the current Wi-Fi connection 1 TTPs 3 IoCs

Application may abuse the framework's APIs to collect information about the current Wi-Fi connection.

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.wifi.IWifiManager.getConnectionInfo	com.wait.hero10
Framework service call	android.net.wifi.IWifiManager.getConnectionInfo	com.wait.hero10:system
Framework service call	android.net.wifi.IWifiManager.getConnectionInfo	com.wait.hero10:system_inner

Queries the mobile country code (MCC) 1 TTPs 2 IoCs

discovery

System Network Configuration Discovery

T1422

description	ioc	Process
Framework service call	com.android.internal.telephony.ITelephony.getNetworkCountryIsoForPhone	com.wait.hero10
Framework service call	com.android.internal.telephony.ITelephony.getNetworkCountryIsoForPhone	com.wait.hero10:system

Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 3 IoCs

persistence

Broadcast Receivers

T1624.001

description	ioc	Process
Framework service call	android.app.IActivityManager.registerReceiver	com.wait.hero10:system_inner
Framework service call	android.app.IActivityManager.registerReceiver	com.wait.hero10
Framework service call	android.app.IActivityManager.registerReceiver	com.wait.hero10:system

Checks if the internet connection is available 1 TTPs 2 IoCs

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.IConnectivityManager.getActiveNetworkInfo	com.wait.hero10
Framework service call	android.net.IConnectivityManager.getActiveNetworkInfo	com.wait.hero10:system

Domain associated with commercial stalkerware software, includes indicators from echap.eu.org 1 IoCs

flow	ioc
20	alog.umeng.com

Queries the unique device ID (IMEI, MEID, IMSI) 1 TTPs
discovery

System Network Configuration Discovery
T1422
Reads information about phone network operator. 1 TTPs
discovery

System Network Configuration Discovery
T1422

Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs

impact

Data Encrypted for Impact

T1471

description	ioc	Process
Framework API call	javax.crypto.Cipher.doFinal	com.wait.hero10

com.wait.hero10
1⤵
- Checks CPU information
- Checks memory information
- Makes use of the framework's foreground persistence service
- Obtains sensitive information copied to the device clipboard
- Queries information about the current Wi-Fi connection
- Queries the mobile country code (MCC)
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Checks if the internet connection is available
- Uses Crypto APIs (Might try to encrypt user data)
PID:5144

com.wait.hero10:system
1⤵
- Checks CPU information
- Checks memory information
- Makes use of the framework's foreground persistence service
- Queries information about the current Wi-Fi connection
- Queries the mobile country code (MCC)
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Checks if the internet connection is available
PID:5338

com.wait.hero10:system_inner
1⤵
- Makes use of the framework's foreground persistence service
- Queries information about the current Wi-Fi connection
- Registers a broadcast receiver at runtime (usually for listening for system events)
PID:5450

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Event Triggered Execution

T1624

Broadcast Receivers

T1624.001

Foreground Persistence

T1541

Privilege Escalation

Defense Evasion

Foreground Persistence

T1541

Virtualization/Sandbox Evasion

T1633

System Checks

T1633.001

Credential Access

Clipboard Data

T1414

Discovery

Software Discovery

T1418

Security Software Discovery

T1418.001

System Information Discovery

T1426

System Network Configuration Discovery

T1422

System Network Connections Discovery

T1421

Lateral Movement

Collection

Clipboard Data

T1414

Command and Control

Exfiltration

Impact

Data Encrypted for Impact

T1471

Data Manipulation

T1641

Transmitted Data Manipulation

T1641.001

Replay Monitor

Loading Replay Monitor...

Downloads

1004

Path /data/data/com.wait.hero10/app_crashrecord/1004
Size 222B
SHA256 3f6e77e16f4366b99d90c3fee29b24d9338702de09126d48d992ccebd1864b81
MD5 35580f24a31f5594afa7a5b3d56599c7
SHA1 9fc2ff2d1d45f986d4275705204fb800a802639e
SHA512 0a24c2306e87c2e45051840ac8017020bdb030614e83f422b49b7915071e07029a59ed4ed861e00ef9432a9be9b1915fd1d771f370c0e5c51258c0528ec90b01
MD5 SHA1 SHA512

Submit Download

1004

Path /data/data/com.wait.hero10/app_crashrecord/1004
Size 58B
SHA256 988722c23d78a46021d0e7ca9deee7aa8bb83288269174ffacb7316f381cca1d
MD5 0d210bfb2a0e1f1b4c082a6a0f79de07
SHA1 bb8ed9e364db79d1d9f2fcde3f15091893222faa
SHA512 536e9867b0df29b15b789f8949be6ab37fcdeccb9d39ded981da7dc2052c9533d0ec0e6f9a5444132977605d372e1463d91bdde41b528ff2ca3f65ab152325c1
MD5 SHA1 SHA512

Submit Download

ua.db

Path /data/data/com.wait.hero10/databases/.ua/ua.db
Size 32KB
SHA256 bfd88353e3c1ac4040c0533b597a6f9549a8bd758f36f7d7695c904da8b02943
MD5 dd00858ad876ffe7d515f057257bc485
SHA1 1b119a5d2d77692831877573c04be05fe6c16f33
SHA512 3df6a10e1cad610142d7128b1b1a503e202e03902cbc9f01a2ba2368d430f5d3f52b88787bb2dd069ed262f766db615614d1a5d8877e764960853e5d167fa87f
SSDEEP 12:TLZEsuOIo4PPTN5PPJhBlTSF7VfqwtI7MJPRmBEyPbV/OwQo+7PXmVCbePXzPP:TL6K4PPvP/BlmqygGSZQoc2cWrP
MD5 SHA1 SHA512 SSDEEP

Submit Download

ua.db

Path /data/data/com.wait.hero10/databases/.ua/ua.db
Size 32KB
SHA256 1820a909a310bf7bc4ddaab6c8be3954dedd53612749f7bd08fefbef31670ec8
MD5 38564ad4c73e5619bc2264b0c44997a5
SHA1 e55f6fe1b20347ad4cd58d77af0b0feb149f63d0
SHA512 30d84731a3d8380e63bb73227623e86bd779476474269f252abe546028531c77658573874444e66b862ea049724e93a9344b1d4fd9f26c0fe02a79a4079a9a7d
SSDEEP 12:TLWXOJuOIo4PPTN5PPJhBlTSF7VfqwtI7MJPRmBEyPbP/WQ:TL/T4PPvP/BlmqygGSP/WQ
MD5 SHA1 SHA512 SSDEEP

Submit Download

ua.db-journal

Path /data/data/com.wait.hero10/databases/.ua/ua.db-journal
Size 512B
SHA256 c0c72dd1530256c05f7203a0b932d12d5bdc2fcf9d3a9080445039bca25ed6f8
MD5 659d62d6c73c283ac8c1affb8b69c7cf
SHA1 9fb7491159d1306b29d63ca0b2063ba7b0fd2458
SHA512 14016ad05024b1722fa9ee5e13d420f2290b15737d206641d953d53350fed0a7f94b861c0a266ec46ee5802c9342c58fe5d07e52434f622f600a6da68b573863
MD5 SHA1 SHA512

Submit Download

ua.db-journal

Path /data/data/com.wait.hero10/databases/.ua/ua.db-journal
Size 8KB
SHA256 bbe6bc7ff113f5f7713f5f4ccf9e57574789f0c648693ba6d3f29347a8684e5e
MD5 026174e78e0637b7fa27a837436ddadf
SHA1 044c7e7f4862a81f9129a0ff43e4f406284506f9
SHA512 e6423d32068d3f3354eb69b5cd38634bb1c0478f02213a42f5b32c5cab7d6aecc4ba8e62bad922608aa86e2720a6a8ee17caee458e80ac1b0faf5418fc5378a6
SSDEEP 6:7+/l9nI8Hn1w+Wg9bNFlEuWdOlOERX4PBX4ogLugMBX4suuKR:7+t1mqLiuWdwRmBEyPb+
MD5 SHA1 SHA512 SSDEEP

Submit Download

ua.db-journal

Path /data/data/com.wait.hero10/databases/.ua/ua.db-journal
Size 8KB
SHA256 6d2aa862f7b611cb51961b8450197e60b4e511f7b89b2db635db0b5642f891f5
MD5 10d86b3a97a84e3abeb8eb28778e57d8
SHA1 a0e7b81f754b4ce56eb13a9b629608a887f7f47d
SHA512 5bc11f76a51f6ca48f2ff53c53d76ecf5532d21e0b620440e51ef7c0dd774c16cffe07f6d7926578eace51fd40b1e714e4602a5b8a80f8c7de3819bfa5fdca92
SSDEEP 6:7+/l9DM/qFPg9bNFlLdrlOERX4PBX4ogLugMBX4suuK8t/Y:7+thvqLJdTRmBEyPbx1Y
MD5 SHA1 SHA512 SSDEEP

Submit Download

ua.db-journal

Path /data/data/com.wait.hero10/databases/.ua/ua.db-journal
Size 16KB
SHA256 881243ea026bbdf0634db1b5a726981d8233064781044260a89d7a48033fc854
MD5 b4d44211380918c4c0a4f6e83e0570b8
SHA1 39c920ab09eab3bf8107fe5060871356852fd656
SHA512 7f2bbbef29371e571c67f811f494fe869914e38f97b9c3146fca26a53bd5b03ce33dc38d35dccdd0b321e6d758fd6b01383597e8e678858b1f5f1c1609ea38a2
SSDEEP 12:7+t7hLGqLseuOIo4PPTN5PPJhBlTSF7VfqwtI7MJPRmBEyPbL2n:7+tVGqLb4PPvP/BlmqygGSS
MD5 SHA1 SHA512 SSDEEP

Submit Download

ua.db-journal

Path /data/data/com.wait.hero10/databases/.ua/ua.db-journal
Size 12KB
SHA256 d61845a0b785f74ca197f566297857556be97934c6ba9f01f820c97a37dc1d47
MD5 35c62da95429aa3a1874dce5b2b9102a
SHA1 fd405ea16cf4e7c5c40f1a58a11949ee2a373a29
SHA512 988d39e8f8938077cde365c2c41628e47f6b68d3c40a20d1382cc1ecdeac9b1f950c5eab485fc78a08752eba5ccd26f5859346dd63fa620df3489f0d095d51d9
SSDEEP 12:7+tbY2KqLZEsuOIo4PPTN5PPJhBlTSF7VfqwtI7MJPRmBEyPba:7+tbYqL6K4PPvP/BlmqygGSa
MD5 SHA1 SHA512 SSDEEP

Submit Download

ZIRCO

Path /data/data/com.wait.hero10/databases/ZIRCO
Size 24KB
SHA256 a7cb874d8a37b8b146ef4adc534c816327d583c5380be9dfe640ce3e60d91358
MD5 5157e49a68e7a39cb3a034d265b66799
SHA1 df70635912001b0de4714ee71968680d3827ffb6
SHA512 8028d474eafe306ad3f9060606554b916b980d02115e3915eaec64b71ead752bdb490a488e0c8d67389d42c081c39861284a0185cb751d4997edc11ef45d8f8c
SSDEEP 12:TLKgq4Xa1U9Q6LTSFbyYAyO9eFu/9Q6DfRmBEyPbD3Owzkaq:TLKtO7qAT91Fz0GSzz7q
MD5 SHA1 SHA512 SSDEEP

Submit Download

ZIRCO-journal

Path /data/data/com.wait.hero10/databases/ZIRCO-journal
Size 512B
SHA256 e85f0716b006dfa0ee55fcac9fa2317aa0cfaaeee5eff6190feb73e62935f968
MD5 d1fe3998e7e152bbd461e67d6aabac9c
SHA1 d566b8c21c49e3587355de40c46991e706c1dbf6
SHA512 8c268dcd44149e232c386e786f1d14abec833e37cc3138b6d5adfedeb5321b27b78bb8022f965e67a4d69cb9c4fac70e4086c2bd0a7b79519a7cf22434dab9c1
MD5 SHA1 SHA512

Submit Download

ZIRCO-journal

Path /data/data/com.wait.hero10/databases/ZIRCO-journal
Size 8KB
SHA256 4c7f12b978d3f1f7dea1fddf539d4a66d0fb77555d9d0b76c29f43a5206e7c6e
MD5 af62f81c0d730dcd87960e0d2c2aaa91
SHA1 3569ee8c8c42e608ae2ae999ebae6d4423e50466
SHA512 7436831049bc10d49226c37b42e42dce96556cfc1ae81100762da556f24eb44d307f8cf6700e8587909153a4f789affa3714d859c2dd5bc3f6392a9ce11771d2
SSDEEP 6:7+/l9eD/0Fn1GRg9bNFlEuWdOlOERX4PBX4ogLugMBX4suuKPn:7+tQD/0yRqLiuWdwRmBEyPbgn
MD5 SHA1 SHA512 SSDEEP

Submit Download

ZIRCO-journal

Path /data/data/com.wait.hero10/databases/ZIRCO-journal
Size 8KB
SHA256 9c4cf163be66ffaf090db7f45f591a1a5a92a756e5fb62e72394485fdef0d3b7
MD5 e5796f0ab5cfd62216b37e962b42253d
SHA1 5a3d6e5923cccc36f77a4fe2dc2cad03c5596b89
SHA512 4a371b43485362300d63621d9c59b22667b7860fe96152711080d324a426986de3405da6be65780e93919ed97b1fb400c64ce5f3733c3e9279d11729a40c10f7
SSDEEP 6:7+/l9w4Pg9bNFlLdrlOERX4PBX4ogLugMBX4suuKE//Y:7+tGwqLJdTRmBEyPb7XY
MD5 SHA1 SHA512 SSDEEP

Submit Download

ZIRCO-journal

Path /data/data/com.wait.hero10/databases/ZIRCO-journal
Size 12KB
SHA256 f583f430a4ceb4132366d5a8ce123ca425f71e4c00f9dbe275d0330c721ac54d
MD5 0e93f1f0eee97c2cb1cb44b60af7af8a
SHA1 694a7acd65f5a6fccb5309db6f001740d697e43c
SHA512 3b69ce4df4bf33cf197b641c00df9e992d9a84b1e31fe73df5a6236377015012346434bec504f4d30e03351f1b1ea6dcc3b08cf6941cdfbfba3f0bdf0e64921b
SSDEEP 12:7+t/kqLbq4Xa1U9Q6LTSFbyYAyO9eFu/9Q6DfRmBEyPby:7+tcqLsO7qAT91Fz0GSy
MD5 SHA1 SHA512 SSDEEP

Submit Download

bookmarks.db

Path /data/data/com.wait.hero10/databases/bookmarks.db
Size 20KB
SHA256 b4663bfb5b18ce5581b346737fe142b8cbd6c559f1c5fc5a7ddd37c2db30f3ec
MD5 310170946d4a8bcbc72d92a6a1cfb4fb
SHA1 aacc2a2d5edc16dc355202c25b24ded3430f19a5
SHA512 b3f53d77080a2438102d7ce44219ed43e50c243afcb1aae6e30862c744552498f704c458a329222d21bae58b62a68cc8cb602fc0b4a8b8aaa9a507f11487e96c
SSDEEP 12:yTyTViuZROyNTSFbyAERo0K+S8oJVl9T5PbkHO+q3dfRmBEyPbAVOwG:6yJiubT7EWozOHOvt0GSEG
MD5 SHA1 SHA512 SSDEEP

Submit Download

bookmarks.db-journal

Path /data/data/com.wait.hero10/databases/bookmarks.db-journal
Size 512B
SHA256 1a8dbcb7aeafbb3ab113e4010259140b13f2fd034e18a2191e3ec53ee71deb71
MD5 702e4ba78b8afc0772a2a241c6ed3808
SHA1 f195c9605cd817ae3cc18a3ee34386ba69a801fc
SHA512 92d2c4d3a5c27727b0f19b908a33cd1731153d350e98572a0fd194d04f29eea87b964a87f732c42e3d6b5c24174180465679bdf52ffb94c87c99222a720cb85a
MD5 SHA1 SHA512

Submit Download

bookmarks.db-journal

Path /data/data/com.wait.hero10/databases/bookmarks.db-journal
Size 8KB
SHA256 9c880abad6be8e41a68eb2104020288093fc0c642cfece3a837c620674fd6e21
MD5 0408d1bd3591a6bdda21b531c2471fe6
SHA1 f77586cf66bf7ca04ba5c91d2e772c612a9a76a6
SHA512 2a39c14ccffa6a0058a4f0207361646895fd6c0379108f834e169885aeede62bbdb6d5baaf305efcda88fb372df23cea7a410a45f83734031d3231b25514c2f2
SSDEEP 6:7+/l9PCsOn1Jg9bNFlEuWdOlOERX4PBX4ogLugMBX4suuKSn:7+ttCsyqLiuWdwRmBEyPbtn
MD5 SHA1 SHA512 SSDEEP

Submit Download

bookmarks.db-journal

Path /data/data/com.wait.hero10/databases/bookmarks.db-journal
Size 8KB
SHA256 ea5d556f64b121c8cedd0f1c394fdd1a8425246931efdd223fe6e54c6ec322f0
MD5 346c970f7b7872c9e08a23f4e337bbdb
SHA1 95a3a740b6409ebad4d037981079c6f69e58fdc1
SHA512 d3c076c4219e8dc11cb37cc59b85eb04c45718ed93cced97c208eabf07826b6a7132edd17ab6a5e25e06ba950da5c5f1808f32ba7cff17c9653ba8ca6415e753
SSDEEP 6:7+/l9+vPg9bNFlLdrlOERX4PBX4ogLugMBX4suuKN/5:7+tAXqLJdTRmBEyPbu5
MD5 SHA1 SHA512 SSDEEP

Submit Download

bugly_db_

Path /data/data/com.wait.hero10/databases/bugly_db_
Size 52KB
SHA256 31040b95c64e635b0529c3245fb04b3f3bddf6f4744facd2582991ed053311ff
MD5 bbc10b1399f6a6b1654d813affb2165e
SHA1 0d6ca722b20890a0d9e1d7597ff8f67016476ccd
SHA512 9e17201c089a34c0b6af32963951b0f2d9756a09914dca8aead88b6eb8e37370f03a70bb58f38e5dcadd58e4ae0e18d664234d9f21bdf68aefc11495ca57f11f
SSDEEP 48:Tk85WuAriStwwuMN5meposSwx1aXEaI5C98JCiQK:r53AzwIMvI5b3QK
MD5 SHA1 SHA512 SSDEEP

Submit Download

bugly_db_-journal

Path /data/data/com.wait.hero10/databases/bugly_db_-journal
Size 512B
SHA256 6b9fcd16ad9c774904a7a69fcdab8f163466dee17534dc2a78c480f13342d9b9
MD5 01e476b67545c480cf389b638f752ce5
SHA1 067c25c39f59590c69bb2241364278f630556075
SHA512 68d9127bba17d780ae9ab611d5d570c4a22196bfe071cd9cfa2b1de50b780cfc69dfafa6d5808dd29b2343bc25cf693650bf0d902fe700e0d0eaa43ce39dfefb
MD5 SHA1 SHA512

Submit Download

bugly_db_-journal

Path /data/data/com.wait.hero10/databases/bugly_db_-journal
Size 8KB
SHA256 92bf79b4d74746269a6402255be1ca7d58c90140877b36e1390aa72d58ed1474
MD5 f96c5f8f781a4d5c367cd2dfedccdad0
SHA1 4c7e05e4223d1956faff47884a5a5ee82bfe3bca
SHA512 09412961cdd73fa378cfa7eeae6b74239ba3d1926ac1967613a61d10fdc86c2f53f785796e1624da186ff8910153d7e17f964f7906e284452127b0d3575d5655
SSDEEP 6:7+/l9FGn1ffg9bNFlEuWdOlOERX4PBX4ogLugMBX4suuKsN:7+tIfqLiuWdwRmBEyPbD
MD5 SHA1 SHA512 SSDEEP

Submit Download

bugly_db_-journal

Path /data/data/com.wait.hero10/databases/bugly_db_-journal
Size 8KB
SHA256 c3743f272c22370b7eb33885be6cafad6edb2487573d0aee23692bd77211091b
MD5 cc0dad083edd4391673d81537d476e1a
SHA1 4e13a22454d31f37021f4dd03de48a053638277b
SHA512 e35372e6a81cec9eb38cce6c0a2916bd63c29113acc80f883b85bbbbbbf3e5b1fc28f5fadedba799ad76ef1f0701bc647b5ae6638b1bcd8c115e8873fd7aef9c
SSDEEP 6:7+/l9JQLGPg9bNFlLdrlOERX4PBX4ogLugMBX4suuK6kC/GT:7+tEmqLJdTRmBEyPbkSi
MD5 SHA1 SHA512 SSDEEP

Submit Download

bugly_db_-journal

Path /data/data/com.wait.hero10/databases/bugly_db_-journal
Size 8KB
SHA256 1b082b82217116c05925b44947f12f7af5b2bc373e3d642b588a470bf7c89734
MD5 a4a0d7853f283c74ff35720cc5f90db5
SHA1 6207a0801f7ce5ef8a258a2c3306bc5efb31279b
SHA512 d1b514d07e09577f1f9679d9f80b5c4f14fcd45e0c3cedda2bdddc51075a947d35ebdba0551be8d9eb671bfb37fa1f69eb1c321334b26f771944b35102769e6f
SSDEEP 24:7+tDqLLQLBq5JQfs6y2nriS3dVi6fXX+McEnKwm/mpLwBpGSw:7MDqE85WuAriStwwuMN5meposSw
MD5 SHA1 SHA512 SSDEEP

Submit Download

bugly_db_-journal

Path /data/data/com.wait.hero10/databases/bugly_db_-journal
Size 8KB
SHA256 a2fd181be3e5f4f8f30188fdabf5e47612f2709fb9f8106d67148490a559697d
MD5 380f254811a0a7b50ca4ff29faad57af
SHA1 0701c31da0b60565654984eabca9d1883144241a
SHA512 0cbe0138db521653bf308a73e3708dae905583609801015e64516dd63d760737ac2d27a7a6ddd7c6b1aa0ca0c56d7a698db5139ccb70546c43b453d178cf6cc1
SSDEEP 48:7MXBC98JCiQKJqOJ85WuAriStwwuMN5meposSL:72Bb3QKJr653AzwL
MD5 SHA1 SHA512 SSDEEP

Submit Download

cc.db

Path /data/data/com.wait.hero10/databases/cc/cc.db
Size 36KB
SHA256 38f8548795ca7470b449dd1de9598c07a247ba59883c0764c9c96ff0b7d31d7f
MD5 0908e924aa236931dc7166fef6e00862
SHA1 7782648d6d8f6e835bd47058d4852932c096a467
SHA512 3c16fbc5172aed04cd206e776c46d26e911732c6e3631536410a71f1d217449475727ac9b3175e827c5ce645a1da9e05900258ee6ca27c936a9060f241361dee
SSDEEP 12:TL/sP2yMHdqVcV7p5WUYUW5LfpBKKyBGtbDrNTSFbycKrHBGtb5RmBEyPb8FOwGQ:TLd7sL7yot3BVrHotGGSgGQQQ
MD5 SHA1 SHA512 SSDEEP

Submit Download

cc.db

Path /data/data/com.wait.hero10/databases/cc/cc.db
Size 36KB
SHA256 abda5dd4cc2e7dbb951637c4b49d6990f9f34411fab4dee1a387dbcc8e7eed40
MD5 67c12933d1e0e63d9801a6aa43092ce7
SHA1 b6936908554e4a1986b8eb08289e2d3545e8ff74
SHA512 db8b818daa3ff4ec7678645f84bf8b45c809bcbb758ea78b28982d071572655bba2d20e6f1ca4f0d057ab34fa655c5bc40457dc65050180351a2fc04a47175dd
SSDEEP 12:TLgRP2yMHdqVcV7p5WUYUW5LfpBKKyBGtbDrNTSFbycKrHBGtb5RmBEyPbP/WQQ:TLt7sL7yot3BVrHotGGSP/WQQ
MD5 SHA1 SHA512 SSDEEP

Submit Download

cc.db-journal

Path /data/data/com.wait.hero10/databases/cc/cc.db-journal
Size 512B
SHA256 b750a4c756961817c1c2cc1b66a392af511a8ec7ec090dbe1afc1ce02893b05c
MD5 6702a6359d8340ed0050c77ef22fbd46
SHA1 8006b03ddd3f4a1ec676ff648580c955d8682f61
SHA512 942862f917f7d75eebce352ab179925bcf5818d9ba03a08bf4c962c5c906f1ec4f48f9f6397cf35dfaf2d5034526607f903b5ccf251383f1e25dc18c6cb604f1
MD5 SHA1 SHA512

Submit Download

cc.db-journal

Path /data/data/com.wait.hero10/databases/cc/cc.db-journal
Size 8KB
SHA256 8bb70e4a0761beb797d2d3de248c760a4b852ba9f2b144b486054a64ac4e9133
MD5 a18f557e060f906d67c47a327ae3b9e6
SHA1 57a1236232fc88d977c3cc00ebaa16fea7ad2442
SHA512 0816feaf3fe49e362bf3c1322b4fc4cb53fc664af466f66703c57974597847e0502c878cefed475d52757831b0099bac84ea562873b63a0697afef9c080b6c9e
SSDEEP 6:7+/l9UUn1mg9bNFlEuWdOlOERX4PBX4ogLugMBX4suuK2g:7+tEqLiuWdwRmBEyPbHg
MD5 SHA1 SHA512 SSDEEP

Submit Download

cc.db-journal

Path /data/data/com.wait.hero10/databases/cc/cc.db-journal
Size 8KB
SHA256 b8830c057708b22ea9435b93b51f61e28696d71dc3995f8fba8d623770fa324e
MD5 40ba6db99e3780bbf52b6a3bdf04523a
SHA1 09f805dd69eff99b50115e270936a811c95bba48
SHA512 ce8ded2b69120139f75fe0aa7696f6149c4381dd70e9d2069f2e60bcdc105eaf9146e3b7c2d377ed618a16fc50fa52e50a970ce6f5058a7dbbbe6b1e95a3699f
SSDEEP 6:7+/l9y8FPg9bNFlLdrlOERX4PBX4ogLugMBX4suuKe9t/qn:7+t3qLJdTRmBEyPbD1q
MD5 SHA1 SHA512 SSDEEP

Submit Download

cc.db-journal

Path /data/data/com.wait.hero10/databases/cc/cc.db-journal
Size 8KB
SHA256 367b10a0262b9136125b71ec396e394c0dececa7edf9fed2cb3874ef18044a1f
MD5 c51e8ed37021679cefcca23fe1c35ec3
SHA1 fab920c3080f804d373bfc953819626d9f9571ca
SHA512 5d9041d2d121ac715b8f8c28a45092aea96a9f65e5a0cd5cbfa6ef35600828de888f8cc8b7aaca42685db96304d2f491c81cb2e65472ddb2746474c75f7017c7
SSDEEP 12:7+tgS+PqL/sP2yMHdqVcV7p5WUYUW5LfpBKKyBGtbDrNTSFbycKrHBGtb5RmBEyw:7+tb+PqLd7sL7yot3BVrHotGGS8
MD5 SHA1 SHA512 SSDEEP

Submit Download

cc.db-journal

Path /data/data/com.wait.hero10/databases/cc/cc.db-journal
Size 8KB
SHA256 466d99a59d2a3556657c4f963446a04255ae1bf0da9a812d7a7d4136371457ac
MD5 d26f3896a064e6d09de2478757ab9e30
SHA1 6cbffa5b4b2045373255b920600a0bedc30bba5f
SHA512 385b63d2fd24cdc5a8a51507c995c0c3296064af7fd5e5fd6433e74eb3d5aba1acce24379d0663838d05f73438de2360e4334e6b20e0a1396784c04ad2e3eb1a
SSDEEP 12:7+tPrQqfqL+/E6P2yMHdqVcV7p5WUYUW5LfpBKKyBGtbDrNTSFbycKrHBGtb5RmZ:7+tPEOqLpr7sL7yot3BVrHotGGSt
MD5 SHA1 SHA512 SSDEEP

Submit Download

cc.db-journal

Path /data/data/com.wait.hero10/databases/cc/cc.db-journal
Size 12KB
SHA256 f725d6096c17cdd9a6e06cab980592360f2cd04cb82d1ffaa365f2eb4da831e7
MD5 26c7081d992fd134743e46f496965894
SHA1 b3c0aa17f5b5ccea059f8c5ba577e23b0e1b454d
SHA512 c68fbd82770e77dfa870107911d7deb58c93e4cc788ef16465d6066ef03b1491ce149dbbe3b9ab8939b03472fc5eb0b829ea79acc0400cc3159b4c41a5344865
SSDEEP 12:7+trmC9qLWEOVP2yMHdqVcV7p5WUYUW5LfpBKKyBGtbDrNTSFbycKrHBGtb5RmBC:7+tr3qLEe7sL7yot3BVrHotGGSU
MD5 SHA1 SHA512 SSDEEP

Submit Download

weave.db

Path /data/data/com.wait.hero10/databases/weave.db
Size 20KB
SHA256 2272f0e5d3886a98eb2b51defc53b83f2751cbc7b908c0b56778d5d096a2bcf8
MD5 23737e468bde4d38933670b51c0d71bd
SHA1 0ff3b54e71fbcec3d38730057fe799cc8030932a
SHA512 56d966daaff3132780ad8025c2d263cee12f6290c5eff71037bf73eb82c9bc6e7c7d294f9bc97beb43aa14348e3f0b36cf344639f89924a6afc8fd048a8c9c37
SSDEEP 12:yTyTViuZnyNTSFby+0qznu7AurAuC59CB5PbcaGRmBEyPbAVOwG:6yJiugs0qK7L30CMadGSEG
MD5 SHA1 SHA512 SSDEEP

Submit Download

weave.db-journal

Path /data/data/com.wait.hero10/databases/weave.db-journal
Size 16KB
SHA256 2ba330ad48a5184f5b78b908a94e6a91cc6e076409ea0c1ee986c876c7a82cd0
MD5 8d0ea718b79fcfa605c1ea0512d93090
SHA1 00e4b4f3de1acb5f425be0a9657da69d8b2064e3
SHA512 d7abd6a23a48f16619e3e3bb69a3bef5f8db867fde3a6aaecabe05f9ff5c5742ce77d13a9abf14fab289feef181f9de1b03a59eff1a55c41c5af172d5b95c15b
SSDEEP 48:TE85WuAriStwwuMN5meposSP/ZorF01CiQKAKFesCiQKax1aXEaI5C98JCiQKC:L53AzwPBor213QKtFx3QKaMvI5b3QKC
MD5 SHA1 SHA512 SSDEEP

Submit Download

weave.db-journal

Path /data/data/com.wait.hero10/databases/weave.db-journal
Size 8KB
SHA256 6a80ec77a041aac586b2ac96cc9d4b1747f742de8c974d8ba42663c6168d4a5b
MD5 5884acd96ecef1bb1427a5b2fe7d4a14
SHA1 321fa66236c5cd6c20a071c6a06fcb3fcfe38a47
SHA512 f8ac0ff3305165eddf43d1ddb70fc28e61d97badf9f871b38d4f3019425616f0bd41148af88f44cf82d33ccbab7249d19dec72cde8eff285ed36817b643c1526
SSDEEP 6:GlTyTVxkYwWWIAHHShL9oXMMBCkFg90R1uRg9bNFlEuWdOlOERX4PBX4ogLugMB8:yTyTViiWIASh4M1MgqLiuWdwRmBEyPbY
MD5 SHA1 SHA512 SSDEEP

Submit Download

weave.db-journal

Path /data/data/com.wait.hero10/databases/weave.db-journal
Size 8KB
SHA256 fdfa7806710eae300f364694a1b883ed51bf9a8c2a23262cd7f7f60383c951b7
MD5 3892f2ef18809fc719659cbceba4fe93
SHA1 9228382a895b0bdb77ed1fd442406de39a2372eb
SHA512 5bcce5c9cdc5e951359f7351800b5e65da7d1428c52f4929ce732be68602a3b2eb61caf8c24deae9a396d82e30d427f3860ed47437ea7accdc691281705748db
SSDEEP 48:7MCKFesCiQKax1aXEaI5C98JCiQKvqU85WuAriStwwuMN5meposSq:72Fx3QKaMvI5b3QKv+53Azwq
MD5 SHA1 SHA512 SSDEEP

Submit Download

.imprint

Path /data/data/com.wait.hero10/files/.imprint
Size 941B
SHA256 75bf9ffc5f3120b27b78a66fd67abc5de20494343732f948054ff884dff95087
MD5 cfbca42545dd05832735fb5aa9a8ff1c
SHA1 4079d8cf97464c67ecbcaa3dded011b25ff36ea4
SHA512 e5c8528b49fbba225158c12589cced541e02a26a7e6d32f9495e86e10219c18189766c32fffab22fa70b073cb19785a1d4e53eec5f7607073df413cbb8a8ba6d
MD5 SHA1 SHA512

Submit Download

exchangeIdentity.json

Path /data/data/com.wait.hero10/files/.umeng/exchangeIdentity.json
Size 162B
SHA256 ea38c65a85dcf085f0cc40e58ed78572580f546936bd18ad8d4b194cca5dec5d
MD5 325c5f7027299bed41a6a49a7dd9e6ce
SHA1 6f477f168a25c4afc8e45b03add95b466b427a7d
SHA512 58c14a7113ad71490cbd2d14c12b91da0109f4eae57205e843fdc3c0f7a03cf9d7af9d1a49b96f67d6657c2416ead47719b9c03988e9bae87a6084fe3c0dcf37
MD5 SHA1 SHA512

Submit Download

exid.dat

Path /data/data/com.wait.hero10/files/exid.dat
Size 64B
SHA256 7ac1b960f0453da8b39a94411540f7cf93128fcc60af01bd06b5f0bd2eb99afa
MD5 68b1bda9af2316b8a50369ddd8fb06da
SHA1 0cc78e671311981fea8bb8c613cd0fabe3ca42c5
SHA512 14488872c5fb27c28ad80a70781f6785135a75f5b54d051ada197e0e0f32839f7e747780682adf4f9399e1dabf1633ec5b6f5581a6c4168e80abf95b015af38d
MD5 SHA1 SHA512

Submit Download

umeng_it.cache

Path /data/data/com.wait.hero10/files/umeng_it.cache
Size 350B
SHA256 9b22b1798a5047ab26667ad60e4c35b87f118f4efe9248cdc7a5759d60102a68
MD5 88e033e9d4fd2d7608214b57171a7eb7
SHA1 0e9524eb08b3b84d11f024eccd062eb7758294c5
SHA512 31f4ac94eb7bafb48209e59765a6eb854e2857eaf462811a06cdac40f83c71e8dd021a3adc6b11d8fb2bd4b4fd5aafbb27dc155fdda33bba5e99557ab1efc91e
MD5 SHA1 SHA512

Submit Download

umeng_it.cache

Path /data/data/com.wait.hero10/files/umeng_it.cache
Size 178B
SHA256 42c785e16ef02227165b0f853d878d7ea7af2ad14a5650abc1c09e3524874f2f
MD5 b1f3f6ab82363c199480cb01e69fe90c
SHA1 4e62e8affdab94e92c89429d49a7d781f83e02bb
SHA512 3463376a58270c2a1894a7078cce58aa42138621545570a7ce7e0f48b67d409d9ade5c9f3e3fef1ea5b1a6f1bacb5fe0335d89fabd59b248bdd550d6f14e0d30
MD5 SHA1 SHA512

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads