Analysis

  • max time kernel
    63s
  • max time network
    133s
  • platform
    android_x64
  • resource
    android-x64-arm64-20240611.1-en
  • resource tags

    androidarch:armarch:arm64arch:x64arch:x86image:android-x64-arm64-20240611.1-enlocale:en-usos:android-11-x64system
  • submitted
    14-06-2024 00:08

General

  • Target

    a73f417a964c2fceaa713b41dfaece51_JaffaCakes118.apk

  • Size

    10.0MB

  • MD5

    a73f417a964c2fceaa713b41dfaece51

  • SHA1

    25748ec0376fa99bc189f5eee09b4bb4ac8e2cb3

  • SHA256

    fe76dfb323c58246c908e93e7879c2f1d7ce3febc18e8e60d811a90d24a9f18a

  • SHA512

    4fe57e41e251f6f924e841e001aca12604b853499312d1318940030f3e5955cd8775b57fdced78b50724ac8736adecbc2342b30a9c176809df2ecd253d7fd6b2

  • SSDEEP

    196608:i9RG0A1riUItUcUnohd3tGFDX799fn267NqxRoQgQU:wR7AYtUn6d3IV7vuQsgL

Malware Config

Signatures

  • Checks if the Android device is rooted. 1 TTPs 5 IoCs
  • Loads dropped Dex/Jar 1 TTPs 3 IoCs

    Runs executable file dropped to the device during analysis.

  • Queries information about running processes on the device 1 TTPs 1 IoCs

    Application may abuse the framework's APIs to collect information about running processes on the device.

  • Domain associated with commercial stalkerware software, includes indicators from echap.eu.org 2 IoCs
  • Queries information about active data network 1 TTPs 1 IoCs
  • Queries information about the current Wi-Fi connection 1 TTPs 1 IoCs

    Application may abuse the framework's APIs to collect information about the current Wi-Fi connection.

  • Reads information about phone network operator. 1 TTPs
  • Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs
  • Checks CPU information 2 TTPs 1 IoCs
  • Checks memory information 2 TTPs 1 IoCs

Processes

  • com.wsw.cospa
    1⤵
    • Checks if the Android device is rooted.
    • Loads dropped Dex/Jar
    • Queries information about running processes on the device
    • Queries information about active data network
    • Queries information about the current Wi-Fi connection
    • Uses Crypto APIs (Might try to encrypt user data)
    • Checks CPU information
    • Checks memory information
    PID:4664

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • /data/data/com.wsw.cospa/files/.jglogs/.jg.ac
    Filesize

    40B

    MD5

    d8b02bbbb5ccdcc6572471473959d175

    SHA1

    cd84a9a651db651572b636489f5e7dc1053326ca

    SHA256

    fb22e6451882db7885c8b8cd42afd6a0f18db24648a85a9ba791700cb70a53a2

    SHA512

    1f818b2b506e218e56f8a209fc76f83aba33e29241f977bd3e1833e5026123df1a45f7ec6010ad2a867cb8be0a28beddd874ee95381c6b01d53227913ff5db6f

  • /data/data/com.wsw.cospa/files/.jglogs/.jg.ac
    Filesize

    40B

    MD5

    20d83070d7a4036335059e003f52bf92

    SHA1

    19e1ddb4ba2c0f8560b63108bb98d718b6e1c502

    SHA256

    33694dc60e8959e16b242987e41a7eeaacb415c3b6aa200ef54421dffad26f0e

    SHA512

    fda6fd8b7bcab48433047319e89181a45b05d363d7d00fd77edb6afc3ab2d3c10319bcee123eb72a9395f4d09900fc605e26b45de3917236f7c9289cf752f55a

  • /data/data/com.wsw.cospa/files/.jglogs/.jg.di
    Filesize

    340B

    MD5

    321c761dbae2c3c47fea7e45ba8d6f7b

    SHA1

    a59e8b8c71012cd76a148005d07f5aa471b414ba

    SHA256

    3ae6a56d04167a8f23cba2bbc819ea91cb75aa677010e556ef498d0b7e538dd0

    SHA512

    b47fe1992bbffb08da69ddf93e413d3cfa3082255fe986e918404e1cec95c26ffd3c5ecd8726a87c6369abdce159ad1f76985ecf9cb8213b814341d55f6232d1

  • /data/data/com.wsw.cospa/files/.jglogs/.jg.di
    Filesize

    340B

    MD5

    699c543c458b56c7016365eee1008c61

    SHA1

    de838cb750b6cb88bef5324b1cb442e8f7a9b0d8

    SHA256

    4375f7443c7bc0eef9de9086dc749f994ef291c527118ab77e175cfeae0a45ba

    SHA512

    5db5e443be73d03b913eee3581c8d84ee815b9c09c209830c61c31df2720e684525a13d1dfd485a0aef7aa0a9d59f9c9e4dba0029139d2b740bf8008b714330d

  • /data/data/com.wsw.cospa/files/.jglogs/.jg.ic
    Filesize

    40B

    MD5

    8761d66d316646eecaef5f2baf7554f1

    SHA1

    48e20c2d755957fefe12870be579fa3abd8b24e4

    SHA256

    dbccc8ab79e579286e86f31cff13d0ad3bf3594d61cdba4510052e4cde8bf75e

    SHA512

    004df6aa91197768a0722a4045b88aa433ddafda52da21eee36b9037d32afeeb6c72f4f1097083f7c1f982882c2028538bb2d6a84cc64b58cdcda8c0ae2da660

  • /data/data/com.wsw.cospa/files/.jglogs/.jg.rd
    Filesize

    32B

    MD5

    8cba015a2fcf12af673e136cb806afda

    SHA1

    a575a7bb7a95f634286e1a0f26956b45fca1d5bb

    SHA256

    9d765bfc91229670b774c84e045b1d32dd9d67365b11197716fcdf79541cb466

    SHA512

    b008415f45bb4bd1aea4baa80971e7491d5b53bd6fa4da2335cbd0b2152ede7e04a90217fea1d4fa4850371910d58339a24e873d87a130062bb41f7c4ce47b09

  • /data/data/com.wsw.cospa/files/.jglogs/.jg.ri
    Filesize

    314B

    MD5

    cafe98b4e6483cdacd58a9948a9f87f0

    SHA1

    2febae28b30797729c017e49d0b47549e25090a2

    SHA256

    d88041d683bb89ee536caa2b1340ac8e595c098f32ecac6d14e53879af491441

    SHA512

    648f2bda78bbf13c2b03fad82ec583c4c1ad703883fd6a2bfd93ff703596be3c4ea71afd4a99cbf8ba31736411c68af71d3b057aff9af738f8ace47e9354a9a5

  • /data/data/com.wsw.cospa/files/.jglogs/.jg.store
    Filesize

    127B

    MD5

    e59c60aedab6f3507857819f195531e3

    SHA1

    b52a8f794607d1a6b2f13a9568351158460368ce

    SHA256

    cf108828a136e2be9f9d217444e2269c743d398ab7b3490fe83bd943104b1950

    SHA512

    f29bb60c572e80958515c1ce0e7b340526dc7e439b1d96c2f022e4e0c770a52b3d6eb265187849782b2dac5529a9c01a2a1a6a24378132f6900fe3d8bfc03c97

  • /data/data/com.wsw.cospa/files/.jglogs/.jg.store
    Filesize

    32B

    MD5

    448e391c59eef34ee1defbe4dee4c41f

    SHA1

    df1f890987371d7d8e6963c68b787856e42bc146

    SHA256

    55612e17689f4bb05f27e18b4f6d06ffef92a6a8893a5cfdd3d5b99a6028b549

    SHA512

    ce336ce895ba861dda7da27e8869dea065eb3c3403cac55cdf1935409e5ebc95b495370f87ed7416af20af533b15615472e333ae9f2fd2713040f526835399b7

  • /data/data/com.wsw.cospa/files/.jiagu.lock
    Filesize

    27B

    MD5

    70cb6b47afd16bfc288b688159655713

    SHA1

    a75e3181e97d9630300f1d1e7a60186c635bc4a3

    SHA256

    f3d2524023a31e8db6a5426115f264b6d901045891c4b8172b144cbd754f4071

    SHA512

    499241e26e01859bfba673b7fe09fabc85aef66568c749d66fcfbf2a73055703e331bc480babb46aaffa1d6a30e02087ff17b214eb24e4fdbac73290acc79e2a

  • /data/user/0/com.wsw.cospa/.jiagu/libjiagu.so
    Filesize

    480KB

    MD5

    6e8ea47d2d8500b7fb8855394fdf0526

    SHA1

    d3c719bda605cd787c4acf30507edb76b7fb6070

    SHA256

    cc3b55086867ed7136d474a21b1359f49e6afed3b74fbb4ba5f11b36ce1f4d46

    SHA512

    385241f905c46ead517e4e0bcaf2fe00160ba0f7f40c6926ba288bf41d46e77a8bd63ec0a97d57a5b65cf6fb1f93b5f86f51d9cb24809ae934ebdb2fd49c0b70

  • /data/user/0/com.wsw.cospa/[email protected]
    Filesize

    6.6MB

    MD5

    58843986370e2224c6fe1609460954e0

    SHA1

    8078d39fbee7c795c0db64389e28fb0122d9305c

    SHA256

    1042e13c5b24dac5632de33ff442790bfaed3627bd3e3dbcd24f0e9e1c44307b

    SHA512

    a033c27245feec1da660ed6c2beb4392f9e6710754b67561b0959c26ad5005f661e2829c523f9af7ea4e860c88cd0dc7f3d17f6ffb087d52eddf9b69c42d9b4d

  • /data/user/0/com.wsw.cospa/[email protected]!classes2.dex
    Filesize

    6.6MB

    MD5

    f7fe0d25833ce464eb127a8ca669e628

    SHA1

    dd7ea1b57eb771cf00ac50217734158795599ea5

    SHA256

    46defe0ca7a20ccdf33bb816ed28021cc85c5e2fd43c0773a4d30273e7e0ae43

    SHA512

    dfd8e75c9b20617e9672c99d38fa6f1b38764e067396f4d0117193be3d91c605929daa4dc31780541ec65a2d31112ff3536bcefc95f0104058c6d49c5ed920e1

  • /data/user/0/com.wsw.cospa/[email protected]!classes3.dex
    Filesize

    213KB

    MD5

    0483cef51b4a123f7bf73379e3fe1df9

    SHA1

    efecdfb1978a36354856690fb371529055be35c6

    SHA256

    ef666613fa7923c563c61424cb2ab23f89ad6a9c9671eef796148f54fc54fa31

    SHA512

    11c620e4b772f92ee0722a4c7acff1834fd59a1c375a3bd67ce978cc0403b5180de242fab3548a76723335dcb3661504dc2643c7bd159a5053c1f0fac9f2d7f3

  • /data/user/0/com.wsw.cospa/databases/comic-db
    Filesize

    96KB

    MD5

    7a972343b6ad5275e4498f5e8ff3f261

    SHA1

    35967380f3591183c16887f5c782140315a50446

    SHA256

    0bd490eaa56da3d0807aae83e32098a557e74871b768d9285c6d12b5fac7a368

    SHA512

    62c220b33a740a05bb39c744324b4400f6bb8abdd361b153ad48c52db27c3e03bd1b03430cafceb5a3163b737167850f69ea70834bf095e391471b0ef6235bff

  • /data/user/0/com.wsw.cospa/databases/comic-db-journal
    Filesize

    512B

    MD5

    85ea4154e7577e99c32b60cac71448cb

    SHA1

    69043bd61a52a7dce737df8f94779f691ff6376f

    SHA256

    e0955ce04ae756035e28dedf68d5a520674638cbb59a4a7eb98a2c6e5b54d5b5

    SHA512

    de3fce16edc574ae7af6fbf102ebd8725af86ea77a1343d49fbe4948ac87092396eb1ba45b705d897752500e158f1528577c611387c7a52ffac2499ed38ffbb0

  • /data/user/0/com.wsw.cospa/databases/comic-db-journal
    Filesize

    8KB

    MD5

    4d910432e7a41ba6b08b3b3e3da01e0a

    SHA1

    b6e673d6548717b1e96f38ee1643602ff5b3c2bf

    SHA256

    dc8811ca1dffec58d9f7ae6cf09569256df6c67c30ead46b208b02b2add86ab2

    SHA512

    2282621ba90ff10a366239108a8a0484f76e9b6fa11f8b6b2a77cbf93dc82381d8aefa98c09755626d879516213d441e07411c2935f293d5220b66d4b41780f6

  • /data/user/0/com.wsw.cospa/databases/comic-db-journal
    Filesize

    8KB

    MD5

    c49d33795ae65669c44dbd93a48d553a

    SHA1

    7398a37a25f92a4dbede133577d0acae16e8a442

    SHA256

    8de74f450cb36e3d05659427be2d3d967ef1a80f40350e433b30f81a63bec62c

    SHA512

    7b1f321dc36919065cdd9ec0efe0129ca71d8559d516d48326453de28bd6f5f35f651dc48270cb47c1317525e21bd7b5e1716d6b5f394ec4bf588bccbe903bdd

  • /data/user/0/com.wsw.cospa/databases/pri_tencent_analysis.db_com.wsw.cospa
    Filesize

    40KB

    MD5

    45176c3d17a8fdc95589913768ba3156

    SHA1

    8522ebe8e827b1468d1d6759b870f59c3c5691a2

    SHA256

    f66593ea341b34f023b4afe8c5b65726d05c721cbab7099c7239081a522ff1ab

    SHA512

    1e3efc725c736fb1c063d8714f3067a703be164f946e8d7fab0de42ea3234b34adca20dcc4da2f4bc8522e35e52ca42d4a48ef015bbce387bfd6a34e0b0af0ed

  • /data/user/0/com.wsw.cospa/databases/pri_tencent_analysis.db_com.wsw.cospa-journal
    Filesize

    512B

    MD5

    50f8d3f658897156e6d0800ff7f0941c

    SHA1

    288ec4396860aa092a7a3c3e63de7465e1bf15b2

    SHA256

    cdb0d439a55863826c3746c45bd83581dedb6d5bd04f53874cef0d92862a85d5

    SHA512

    2039d59a2438c35921be20fe63e1c4932f2f719c54c33944d9e1c7fa002b95cf9d988ece424180e4d3f4beb68e8a9443f0867bf96a6bae0e2feec4ef857151d7

  • /data/user/0/com.wsw.cospa/databases/pri_tencent_analysis.db_com.wsw.cospa-journal
    Filesize

    8KB

    MD5

    b6435dfccd19ff05474a3b64b43cb215

    SHA1

    67f53ad6ccd0d9bedf7ec49915a9e6a627a662c4

    SHA256

    80960fe161c63719a2c64124aaf4561fb1017dda009e101c7a9841496711ea26

    SHA512

    49d663ba55b06c5eafd3a9653b9b6c228af32300913e12f2fb8c2e91af389ff148215f53888bde4112362baa67383326a0778ed14d7952bb27e2e5983336e84c

  • /data/user/0/com.wsw.cospa/databases/pri_tencent_analysis.db_com.wsw.cospa-journal
    Filesize

    8KB

    MD5

    323c473dc82bf41d11b2f4544c9c9d6c

    SHA1

    12862c7beb1c6f67253db203371ea7ab8c90267d

    SHA256

    ea82058024ec0c0f0481875e6b532a7bdd87ff7cdcdce8e079aaa906b9fbe972

    SHA512

    5a2bd797914f0c90fa3cda070d29ff7e9e29ec2fa96004e6f39604cdbf5de035cfdd4a0d018adc191b595c55ae4c513521f9ba53368a5f79384ddf0d47454996

  • /data/user/0/com.wsw.cospa/databases/pri_tencent_analysis.db_com.wsw.cospa-journal
    Filesize

    12KB

    MD5

    2246055a78d204a62d53c5317d23668b

    SHA1

    b1933c459d7775170028a2e47120adfcbfce6906

    SHA256

    04dfe3ebd048729307a41251a30919fa15bd84106270f71d8e9edf78f284a6ce

    SHA512

    2c69b587a66270db74fe2c4043a094c4249b7737696ae2edf30a966551ba1d7397f6c5ee22565f998a7c47080be5b9561e31779c148d7c51086b24e525f79440

  • /data/user/0/com.wsw.cospa/databases/pri_tencent_analysis.db_com.wsw.cospa-journal
    Filesize

    8KB

    MD5

    6f6e866e69e10dea6ec305665e9fc22f

    SHA1

    cf1faffcaf3c5f29dfe5e9631a7a35b26fd454f8

    SHA256

    35c7a901551da85c32ebec492f33633cba8be9244dd373ade99200a482766ff0

    SHA512

    2cc2db3e8723d2979a78738b8350f7e7883313c54bc49ab56363a8c2fc87c1183e7ce60fe563aa1ac13e2ba0165449af037dd53fdb5c138d7a2db0244a0630c1

  • /data/user/0/com.wsw.cospa/databases/tencent_analysis.db_com.wsw.cospa
    Filesize

    40KB

    MD5

    ea3aaf2e58436cec1cff6bfd244aa65d

    SHA1

    67755cd1f3fdb1011993ddc9379a4eb923b5ba0e

    SHA256

    bcd8bf55121227b922a38fb775521b9bfe0de068399816fb8133a1147621da18

    SHA512

    e77f18278ae9be9f7b8c8f82d62aca37e2aecd8289ebf6e0b020e6d5ffbafb6045db500cc76cf8b6f0a078d74eb7adec69302bff8ecd16a2e345a5fba0ae1d51

  • /data/user/0/com.wsw.cospa/databases/tencent_analysis.db_com.wsw.cospa-journal
    Filesize

    512B

    MD5

    8f1453dc9334dfc93f33fcbb272b3741

    SHA1

    1d71f3501cd029478eff8132f85b1bd47edf0116

    SHA256

    b166adc54a3cc80d87da95ddd65fc13136c10df876bb9064e0c2b5ea0496ff23

    SHA512

    8d0837472b6bc48ffe491d25153678be319777ff254becafa265c3148d5ec12e19691ffa996568be9768849f6378ae6d09dbb220bf6064ade157b3ddb9661001

  • /data/user/0/com.wsw.cospa/databases/tencent_analysis.db_com.wsw.cospa-journal
    Filesize

    8KB

    MD5

    0472e2c3b87761baaa7efdf082c042d5

    SHA1

    890d6947f8c26ada3e83c7dc6569173716d8532d

    SHA256

    c2ee61120f2305dba1772266da7e814eaf14e215c23ed2e245cb0d5b8705204c

    SHA512

    ad03f3b73885dab23719e86a1678576e442d6dbea09364ce1bc36a4e66af904a894823cb6dff80615ee70ad2d7654a7f06ac6098c08cd367f7e964e054104174

  • /data/user/0/com.wsw.cospa/databases/tencent_analysis.db_com.wsw.cospa-journal
    Filesize

    8KB

    MD5

    d5b15c45ca0c51e8dd912394693fa449

    SHA1

    9b29412486587b0473834c3956b320c1e5bf9e21

    SHA256

    e94e8b3eae1762c782ff12ada535ccd7551bb5779a94f938f73ac9676ca7177a

    SHA512

    953c24c37acfaa5680ef8b015a4902830a32d03873b8560e63d6d1257982540c73df488dd69bae772279d0b03ddb3a0f85aec8c5998e58098a8dfb513def5e4e

  • /data/user/0/com.wsw.cospa/databases/tencent_analysis.db_com.wsw.cospa-journal
    Filesize

    12KB

    MD5

    894124363aa33a944ac9e118fea68f6a

    SHA1

    ce14a4f39fab450edc5d7c1ad8f9f81870f236f8

    SHA256

    b85075b132222f9f713fdf3a4ef8e81fc60e36c86d48ecbdaa0c1df7a3c37a52

    SHA512

    dbf08f7b664eaeb4d9f933b86e1c136738936062ed085732bbbaa77b6c8898ebbe412ec8f1fae1b18abe3c8eb9475e572f1c50e09d21f12e52a56e63edf48d0d

  • /data/user/0/com.wsw.cospa/databases/tencent_analysis.db_com.wsw.cospa-journal
    Filesize

    8KB

    MD5

    c586a1e91405d3809f929d308d14a2bb

    SHA1

    12f298cbe0142f76bd5ea2e9e07ef976108bc490

    SHA256

    55bc598c6e753db49cdf1f65a23a209f41c829ef60249b66dafae1535ebb6415

    SHA512

    427b7f475a5124d477c6b209ab8c05f6891cc2aa812ee1b158d39428b1ab39db616ed78a627edf168382d7abd1a891ee91cb7555578ca4fa3f6cd0ffda477603

  • /data/user/0/com.wsw.cospa/databases/tencent_analysis.db_com.wsw.cospa-journal
    Filesize

    12KB

    MD5

    83b3066af95ebbc9755befd9fa33a4db

    SHA1

    779456157018244dd92eaeec373cd5441eb6b428

    SHA256

    606b25fb2db7a07a9752c5dc155279f1478e88575ebce211d977c027ac78bca6

    SHA512

    e207c2a86f2a62054d1c1bc1662d56157ec7f73c597b6bc5f190bd5e4b9ce20a8af2f286ecfa00f995e763ef390ee22d1c16d048351a66ece289835e0ca025d3

  • /data/user/0/com.wsw.cospa/lib-main/dso_deps
    Filesize

    376B

    MD5

    8b0efd58fc62415dbdb202d1662989a2

    SHA1

    30ce1d9dbcd6a33bc0794158c5e625adcd076986

    SHA256

    bd0f28512c1e4d40eb7814defc768f02dc0c842fae8c5c635e1974c80f05bc7f

    SHA512

    3f2815db5c814ac0f9b8635dbee90c525de054e1c88b4a79ffd7a5dc586495ca6cdfc81a13ccd20a7f3bf34cc523c96a392fe5ed67d8cb3f840fcd91194a91b0

  • /data/user/0/com.wsw.cospa/lib-main/dso_manifest
    Filesize

    5B

    MD5

    c06857e9ea338f3f3a24bb78f8fbdf6f

    SHA1

    c5a0a2529d2deb60fec041b4fbd722a2ebe31702

    SHA256

    957b88b12730e646e0f33d3618b77dfa579e8231e3c59c7104be7165611c8027

    SHA512

    29f61516876c25379a7bf4faa2b3ca6f6b53eac90e7de47671fec4a818d51441b4025cd7909f7c0a0d113ab6c5ff00cb3700c286bac7319185b77905feec4fb1

  • /data/user/0/com.wsw.cospa/lib-main/dso_state
    Filesize

    1B

    MD5

    93b885adfe0da089cdf634904fd59f71

    SHA1

    5ba93c9db0cff93f52b521d7420e43f6eda2784f

    SHA256

    6e340b9cffb37a989ca544e6bb780a2c78901d3fb33738768511a30617afa01d

    SHA512

    b8244d028981d693af7b456af8efa4cad63d282e19ff14942c246e50d9351d22704a802a71c3580b6370de4ceb293c324a8423342557d4e5c38438f0e36910ee

  • /data/user/0/com.wsw.cospa/lib-main/dso_state
    Filesize

    1B

    MD5

    55a54008ad1ba589aa210d2629c1df41

    SHA1

    bf8b4530d8d246dd74ac53a13471bba17941dff7

    SHA256

    4bf5122f344554c53bde2ebb8cd2b7e3d1600ad631c385a5d7cce23c7785459a

    SHA512

    7b54b66836c1fbdd13d2441d9e1434dc62ca677fb68f5fe66a464baadecdbd00576f8d6b5ac3bcc80844b7d50b1cc6603444bbe7cfcf8fc0aa1ee3c636d9e339

  • /storage/emulated/0/360/.deviceId
    Filesize

    48B

    MD5

    4c4c5285293d5141f582aefa4e038669

    SHA1

    e01852a72e5a8e6f7d63a21426b515118196047b

    SHA256

    36c5c63f39ddf7a6a9c01946e4f78b95790aa734176802e793e95724a1b5b731

    SHA512

    097aa673273e307f7bfb7c08861ad389d4b5f7fae55d972a5c1636aa66d0b8d23b5eb9b696cefe0e5b942f23969dabf0147397aeca85fb9a4d75e0473104e399

  • /storage/emulated/0/360/.iddata
    Filesize

    32B

    MD5

    6d70dd8546530f73843b729b1461283a

    SHA1

    278cc6c2dc4b6348fdcc8cdec2a1ca70858c8638

    SHA256

    9002fe8e7ce21e8e85b1ae694a14e611fd47abe88c36c90c28110e59f6165eb0

    SHA512

    8c87cbf9ad4c5fb728d291a9a7e9b627387c409e0d4cd26a8014e3bce042a1eae45b1e893447bf3b09599b44e706ff5cb088bbeec4cb5a884e53c07095ae494f