Analysis
-
max time kernel
63s -
max time network
133s -
platform
android_x64 -
resource
android-x64-arm64-20240611.1-en -
resource tags
androidarch:armarch:arm64arch:x64arch:x86image:android-x64-arm64-20240611.1-enlocale:en-usos:android-11-x64system -
submitted
14-06-2024 00:08
Static task
static1
Behavioral task
behavioral1
Sample
a73f417a964c2fceaa713b41dfaece51_JaffaCakes118.apk
Resource
android-x86-arm-20240611.1-en
General
-
Target
a73f417a964c2fceaa713b41dfaece51_JaffaCakes118.apk
-
Size
10.0MB
-
MD5
a73f417a964c2fceaa713b41dfaece51
-
SHA1
25748ec0376fa99bc189f5eee09b4bb4ac8e2cb3
-
SHA256
fe76dfb323c58246c908e93e7879c2f1d7ce3febc18e8e60d811a90d24a9f18a
-
SHA512
4fe57e41e251f6f924e841e001aca12604b853499312d1318940030f3e5955cd8775b57fdced78b50724ac8736adecbc2342b30a9c176809df2ecd253d7fd6b2
-
SSDEEP
196608:i9RG0A1riUItUcUnohd3tGFDX799fn267NqxRoQgQU:wR7AYtUn6d3IV7vuQsgL
Malware Config
Signatures
-
Checks if the Android device is rooted. 1 TTPs 5 IoCs
Processes:
com.wsw.cospaioc process /data/local/su com.wsw.cospa /data/local/bin/su com.wsw.cospa /data/local/xbin/su com.wsw.cospa /sbin/su com.wsw.cospa /system/bin/su com.wsw.cospa -
Loads dropped Dex/Jar 1 TTPs 3 IoCs
Runs executable file dropped to the device during analysis.
Processes:
com.wsw.cospaioc pid process /data/user/0/com.wsw.cospa/[email protected] 4664 com.wsw.cospa /data/user/0/com.wsw.cospa/[email protected]!classes2.dex 4664 com.wsw.cospa /data/user/0/com.wsw.cospa/[email protected]!classes3.dex 4664 com.wsw.cospa -
Queries information about running processes on the device 1 TTPs 1 IoCs
Application may abuse the framework's APIs to collect information about running processes on the device.
Processes:
com.wsw.cospadescription ioc process Framework service call android.app.IActivityManager.getRunningAppProcesses com.wsw.cospa -
Domain associated with commercial stalkerware software, includes indicators from echap.eu.org 2 IoCs
Processes:
flow ioc 22 s.appjiagu.com 34 b.appjiagu.com -
Queries information about active data network 1 TTPs 1 IoCs
Processes:
com.wsw.cospadescription ioc process Framework service call android.net.IConnectivityManager.getActiveNetworkInfo com.wsw.cospa -
Queries information about the current Wi-Fi connection 1 TTPs 1 IoCs
Application may abuse the framework's APIs to collect information about the current Wi-Fi connection.
Processes:
com.wsw.cospadescription ioc process Framework service call android.net.wifi.IWifiManager.getConnectionInfo com.wsw.cospa -
Reads information about phone network operator. 1 TTPs
-
Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs
Processes:
com.wsw.cospadescription ioc process Framework API call javax.crypto.Cipher.doFinal com.wsw.cospa -
Checks CPU information 2 TTPs 1 IoCs
-
Checks memory information 2 TTPs 1 IoCs
Processes
-
com.wsw.cospa1⤵
- Checks if the Android device is rooted.
- Loads dropped Dex/Jar
- Queries information about running processes on the device
- Queries information about active data network
- Queries information about the current Wi-Fi connection
- Uses Crypto APIs (Might try to encrypt user data)
- Checks CPU information
- Checks memory information
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
/data/data/com.wsw.cospa/files/.jglogs/.jg.acFilesize
40B
MD5d8b02bbbb5ccdcc6572471473959d175
SHA1cd84a9a651db651572b636489f5e7dc1053326ca
SHA256fb22e6451882db7885c8b8cd42afd6a0f18db24648a85a9ba791700cb70a53a2
SHA5121f818b2b506e218e56f8a209fc76f83aba33e29241f977bd3e1833e5026123df1a45f7ec6010ad2a867cb8be0a28beddd874ee95381c6b01d53227913ff5db6f
-
/data/data/com.wsw.cospa/files/.jglogs/.jg.acFilesize
40B
MD520d83070d7a4036335059e003f52bf92
SHA119e1ddb4ba2c0f8560b63108bb98d718b6e1c502
SHA25633694dc60e8959e16b242987e41a7eeaacb415c3b6aa200ef54421dffad26f0e
SHA512fda6fd8b7bcab48433047319e89181a45b05d363d7d00fd77edb6afc3ab2d3c10319bcee123eb72a9395f4d09900fc605e26b45de3917236f7c9289cf752f55a
-
/data/data/com.wsw.cospa/files/.jglogs/.jg.diFilesize
340B
MD5321c761dbae2c3c47fea7e45ba8d6f7b
SHA1a59e8b8c71012cd76a148005d07f5aa471b414ba
SHA2563ae6a56d04167a8f23cba2bbc819ea91cb75aa677010e556ef498d0b7e538dd0
SHA512b47fe1992bbffb08da69ddf93e413d3cfa3082255fe986e918404e1cec95c26ffd3c5ecd8726a87c6369abdce159ad1f76985ecf9cb8213b814341d55f6232d1
-
/data/data/com.wsw.cospa/files/.jglogs/.jg.diFilesize
340B
MD5699c543c458b56c7016365eee1008c61
SHA1de838cb750b6cb88bef5324b1cb442e8f7a9b0d8
SHA2564375f7443c7bc0eef9de9086dc749f994ef291c527118ab77e175cfeae0a45ba
SHA5125db5e443be73d03b913eee3581c8d84ee815b9c09c209830c61c31df2720e684525a13d1dfd485a0aef7aa0a9d59f9c9e4dba0029139d2b740bf8008b714330d
-
/data/data/com.wsw.cospa/files/.jglogs/.jg.icFilesize
40B
MD58761d66d316646eecaef5f2baf7554f1
SHA148e20c2d755957fefe12870be579fa3abd8b24e4
SHA256dbccc8ab79e579286e86f31cff13d0ad3bf3594d61cdba4510052e4cde8bf75e
SHA512004df6aa91197768a0722a4045b88aa433ddafda52da21eee36b9037d32afeeb6c72f4f1097083f7c1f982882c2028538bb2d6a84cc64b58cdcda8c0ae2da660
-
/data/data/com.wsw.cospa/files/.jglogs/.jg.rdFilesize
32B
MD58cba015a2fcf12af673e136cb806afda
SHA1a575a7bb7a95f634286e1a0f26956b45fca1d5bb
SHA2569d765bfc91229670b774c84e045b1d32dd9d67365b11197716fcdf79541cb466
SHA512b008415f45bb4bd1aea4baa80971e7491d5b53bd6fa4da2335cbd0b2152ede7e04a90217fea1d4fa4850371910d58339a24e873d87a130062bb41f7c4ce47b09
-
/data/data/com.wsw.cospa/files/.jglogs/.jg.riFilesize
314B
MD5cafe98b4e6483cdacd58a9948a9f87f0
SHA12febae28b30797729c017e49d0b47549e25090a2
SHA256d88041d683bb89ee536caa2b1340ac8e595c098f32ecac6d14e53879af491441
SHA512648f2bda78bbf13c2b03fad82ec583c4c1ad703883fd6a2bfd93ff703596be3c4ea71afd4a99cbf8ba31736411c68af71d3b057aff9af738f8ace47e9354a9a5
-
/data/data/com.wsw.cospa/files/.jglogs/.jg.storeFilesize
127B
MD5e59c60aedab6f3507857819f195531e3
SHA1b52a8f794607d1a6b2f13a9568351158460368ce
SHA256cf108828a136e2be9f9d217444e2269c743d398ab7b3490fe83bd943104b1950
SHA512f29bb60c572e80958515c1ce0e7b340526dc7e439b1d96c2f022e4e0c770a52b3d6eb265187849782b2dac5529a9c01a2a1a6a24378132f6900fe3d8bfc03c97
-
/data/data/com.wsw.cospa/files/.jglogs/.jg.storeFilesize
32B
MD5448e391c59eef34ee1defbe4dee4c41f
SHA1df1f890987371d7d8e6963c68b787856e42bc146
SHA25655612e17689f4bb05f27e18b4f6d06ffef92a6a8893a5cfdd3d5b99a6028b549
SHA512ce336ce895ba861dda7da27e8869dea065eb3c3403cac55cdf1935409e5ebc95b495370f87ed7416af20af533b15615472e333ae9f2fd2713040f526835399b7
-
/data/data/com.wsw.cospa/files/.jiagu.lockFilesize
27B
MD570cb6b47afd16bfc288b688159655713
SHA1a75e3181e97d9630300f1d1e7a60186c635bc4a3
SHA256f3d2524023a31e8db6a5426115f264b6d901045891c4b8172b144cbd754f4071
SHA512499241e26e01859bfba673b7fe09fabc85aef66568c749d66fcfbf2a73055703e331bc480babb46aaffa1d6a30e02087ff17b214eb24e4fdbac73290acc79e2a
-
/data/user/0/com.wsw.cospa/.jiagu/libjiagu.soFilesize
480KB
MD56e8ea47d2d8500b7fb8855394fdf0526
SHA1d3c719bda605cd787c4acf30507edb76b7fb6070
SHA256cc3b55086867ed7136d474a21b1359f49e6afed3b74fbb4ba5f11b36ce1f4d46
SHA512385241f905c46ead517e4e0bcaf2fe00160ba0f7f40c6926ba288bf41d46e77a8bd63ec0a97d57a5b65cf6fb1f93b5f86f51d9cb24809ae934ebdb2fd49c0b70
-
/data/user/0/com.wsw.cospa/[email protected]Filesize
6.6MB
MD558843986370e2224c6fe1609460954e0
SHA18078d39fbee7c795c0db64389e28fb0122d9305c
SHA2561042e13c5b24dac5632de33ff442790bfaed3627bd3e3dbcd24f0e9e1c44307b
SHA512a033c27245feec1da660ed6c2beb4392f9e6710754b67561b0959c26ad5005f661e2829c523f9af7ea4e860c88cd0dc7f3d17f6ffb087d52eddf9b69c42d9b4d
-
/data/user/0/com.wsw.cospa/[email protected]!classes2.dexFilesize
6.6MB
MD5f7fe0d25833ce464eb127a8ca669e628
SHA1dd7ea1b57eb771cf00ac50217734158795599ea5
SHA25646defe0ca7a20ccdf33bb816ed28021cc85c5e2fd43c0773a4d30273e7e0ae43
SHA512dfd8e75c9b20617e9672c99d38fa6f1b38764e067396f4d0117193be3d91c605929daa4dc31780541ec65a2d31112ff3536bcefc95f0104058c6d49c5ed920e1
-
/data/user/0/com.wsw.cospa/[email protected]!classes3.dexFilesize
213KB
MD50483cef51b4a123f7bf73379e3fe1df9
SHA1efecdfb1978a36354856690fb371529055be35c6
SHA256ef666613fa7923c563c61424cb2ab23f89ad6a9c9671eef796148f54fc54fa31
SHA51211c620e4b772f92ee0722a4c7acff1834fd59a1c375a3bd67ce978cc0403b5180de242fab3548a76723335dcb3661504dc2643c7bd159a5053c1f0fac9f2d7f3
-
/data/user/0/com.wsw.cospa/databases/comic-dbFilesize
96KB
MD57a972343b6ad5275e4498f5e8ff3f261
SHA135967380f3591183c16887f5c782140315a50446
SHA2560bd490eaa56da3d0807aae83e32098a557e74871b768d9285c6d12b5fac7a368
SHA51262c220b33a740a05bb39c744324b4400f6bb8abdd361b153ad48c52db27c3e03bd1b03430cafceb5a3163b737167850f69ea70834bf095e391471b0ef6235bff
-
/data/user/0/com.wsw.cospa/databases/comic-db-journalFilesize
512B
MD585ea4154e7577e99c32b60cac71448cb
SHA169043bd61a52a7dce737df8f94779f691ff6376f
SHA256e0955ce04ae756035e28dedf68d5a520674638cbb59a4a7eb98a2c6e5b54d5b5
SHA512de3fce16edc574ae7af6fbf102ebd8725af86ea77a1343d49fbe4948ac87092396eb1ba45b705d897752500e158f1528577c611387c7a52ffac2499ed38ffbb0
-
/data/user/0/com.wsw.cospa/databases/comic-db-journalFilesize
8KB
MD54d910432e7a41ba6b08b3b3e3da01e0a
SHA1b6e673d6548717b1e96f38ee1643602ff5b3c2bf
SHA256dc8811ca1dffec58d9f7ae6cf09569256df6c67c30ead46b208b02b2add86ab2
SHA5122282621ba90ff10a366239108a8a0484f76e9b6fa11f8b6b2a77cbf93dc82381d8aefa98c09755626d879516213d441e07411c2935f293d5220b66d4b41780f6
-
/data/user/0/com.wsw.cospa/databases/comic-db-journalFilesize
8KB
MD5c49d33795ae65669c44dbd93a48d553a
SHA17398a37a25f92a4dbede133577d0acae16e8a442
SHA2568de74f450cb36e3d05659427be2d3d967ef1a80f40350e433b30f81a63bec62c
SHA5127b1f321dc36919065cdd9ec0efe0129ca71d8559d516d48326453de28bd6f5f35f651dc48270cb47c1317525e21bd7b5e1716d6b5f394ec4bf588bccbe903bdd
-
/data/user/0/com.wsw.cospa/databases/pri_tencent_analysis.db_com.wsw.cospaFilesize
40KB
MD545176c3d17a8fdc95589913768ba3156
SHA18522ebe8e827b1468d1d6759b870f59c3c5691a2
SHA256f66593ea341b34f023b4afe8c5b65726d05c721cbab7099c7239081a522ff1ab
SHA5121e3efc725c736fb1c063d8714f3067a703be164f946e8d7fab0de42ea3234b34adca20dcc4da2f4bc8522e35e52ca42d4a48ef015bbce387bfd6a34e0b0af0ed
-
/data/user/0/com.wsw.cospa/databases/pri_tencent_analysis.db_com.wsw.cospa-journalFilesize
512B
MD550f8d3f658897156e6d0800ff7f0941c
SHA1288ec4396860aa092a7a3c3e63de7465e1bf15b2
SHA256cdb0d439a55863826c3746c45bd83581dedb6d5bd04f53874cef0d92862a85d5
SHA5122039d59a2438c35921be20fe63e1c4932f2f719c54c33944d9e1c7fa002b95cf9d988ece424180e4d3f4beb68e8a9443f0867bf96a6bae0e2feec4ef857151d7
-
/data/user/0/com.wsw.cospa/databases/pri_tencent_analysis.db_com.wsw.cospa-journalFilesize
8KB
MD5b6435dfccd19ff05474a3b64b43cb215
SHA167f53ad6ccd0d9bedf7ec49915a9e6a627a662c4
SHA25680960fe161c63719a2c64124aaf4561fb1017dda009e101c7a9841496711ea26
SHA51249d663ba55b06c5eafd3a9653b9b6c228af32300913e12f2fb8c2e91af389ff148215f53888bde4112362baa67383326a0778ed14d7952bb27e2e5983336e84c
-
/data/user/0/com.wsw.cospa/databases/pri_tencent_analysis.db_com.wsw.cospa-journalFilesize
8KB
MD5323c473dc82bf41d11b2f4544c9c9d6c
SHA112862c7beb1c6f67253db203371ea7ab8c90267d
SHA256ea82058024ec0c0f0481875e6b532a7bdd87ff7cdcdce8e079aaa906b9fbe972
SHA5125a2bd797914f0c90fa3cda070d29ff7e9e29ec2fa96004e6f39604cdbf5de035cfdd4a0d018adc191b595c55ae4c513521f9ba53368a5f79384ddf0d47454996
-
/data/user/0/com.wsw.cospa/databases/pri_tencent_analysis.db_com.wsw.cospa-journalFilesize
12KB
MD52246055a78d204a62d53c5317d23668b
SHA1b1933c459d7775170028a2e47120adfcbfce6906
SHA25604dfe3ebd048729307a41251a30919fa15bd84106270f71d8e9edf78f284a6ce
SHA5122c69b587a66270db74fe2c4043a094c4249b7737696ae2edf30a966551ba1d7397f6c5ee22565f998a7c47080be5b9561e31779c148d7c51086b24e525f79440
-
/data/user/0/com.wsw.cospa/databases/pri_tencent_analysis.db_com.wsw.cospa-journalFilesize
8KB
MD56f6e866e69e10dea6ec305665e9fc22f
SHA1cf1faffcaf3c5f29dfe5e9631a7a35b26fd454f8
SHA25635c7a901551da85c32ebec492f33633cba8be9244dd373ade99200a482766ff0
SHA5122cc2db3e8723d2979a78738b8350f7e7883313c54bc49ab56363a8c2fc87c1183e7ce60fe563aa1ac13e2ba0165449af037dd53fdb5c138d7a2db0244a0630c1
-
/data/user/0/com.wsw.cospa/databases/tencent_analysis.db_com.wsw.cospaFilesize
40KB
MD5ea3aaf2e58436cec1cff6bfd244aa65d
SHA167755cd1f3fdb1011993ddc9379a4eb923b5ba0e
SHA256bcd8bf55121227b922a38fb775521b9bfe0de068399816fb8133a1147621da18
SHA512e77f18278ae9be9f7b8c8f82d62aca37e2aecd8289ebf6e0b020e6d5ffbafb6045db500cc76cf8b6f0a078d74eb7adec69302bff8ecd16a2e345a5fba0ae1d51
-
/data/user/0/com.wsw.cospa/databases/tencent_analysis.db_com.wsw.cospa-journalFilesize
512B
MD58f1453dc9334dfc93f33fcbb272b3741
SHA11d71f3501cd029478eff8132f85b1bd47edf0116
SHA256b166adc54a3cc80d87da95ddd65fc13136c10df876bb9064e0c2b5ea0496ff23
SHA5128d0837472b6bc48ffe491d25153678be319777ff254becafa265c3148d5ec12e19691ffa996568be9768849f6378ae6d09dbb220bf6064ade157b3ddb9661001
-
/data/user/0/com.wsw.cospa/databases/tencent_analysis.db_com.wsw.cospa-journalFilesize
8KB
MD50472e2c3b87761baaa7efdf082c042d5
SHA1890d6947f8c26ada3e83c7dc6569173716d8532d
SHA256c2ee61120f2305dba1772266da7e814eaf14e215c23ed2e245cb0d5b8705204c
SHA512ad03f3b73885dab23719e86a1678576e442d6dbea09364ce1bc36a4e66af904a894823cb6dff80615ee70ad2d7654a7f06ac6098c08cd367f7e964e054104174
-
/data/user/0/com.wsw.cospa/databases/tencent_analysis.db_com.wsw.cospa-journalFilesize
8KB
MD5d5b15c45ca0c51e8dd912394693fa449
SHA19b29412486587b0473834c3956b320c1e5bf9e21
SHA256e94e8b3eae1762c782ff12ada535ccd7551bb5779a94f938f73ac9676ca7177a
SHA512953c24c37acfaa5680ef8b015a4902830a32d03873b8560e63d6d1257982540c73df488dd69bae772279d0b03ddb3a0f85aec8c5998e58098a8dfb513def5e4e
-
/data/user/0/com.wsw.cospa/databases/tencent_analysis.db_com.wsw.cospa-journalFilesize
12KB
MD5894124363aa33a944ac9e118fea68f6a
SHA1ce14a4f39fab450edc5d7c1ad8f9f81870f236f8
SHA256b85075b132222f9f713fdf3a4ef8e81fc60e36c86d48ecbdaa0c1df7a3c37a52
SHA512dbf08f7b664eaeb4d9f933b86e1c136738936062ed085732bbbaa77b6c8898ebbe412ec8f1fae1b18abe3c8eb9475e572f1c50e09d21f12e52a56e63edf48d0d
-
/data/user/0/com.wsw.cospa/databases/tencent_analysis.db_com.wsw.cospa-journalFilesize
8KB
MD5c586a1e91405d3809f929d308d14a2bb
SHA112f298cbe0142f76bd5ea2e9e07ef976108bc490
SHA25655bc598c6e753db49cdf1f65a23a209f41c829ef60249b66dafae1535ebb6415
SHA512427b7f475a5124d477c6b209ab8c05f6891cc2aa812ee1b158d39428b1ab39db616ed78a627edf168382d7abd1a891ee91cb7555578ca4fa3f6cd0ffda477603
-
/data/user/0/com.wsw.cospa/databases/tencent_analysis.db_com.wsw.cospa-journalFilesize
12KB
MD583b3066af95ebbc9755befd9fa33a4db
SHA1779456157018244dd92eaeec373cd5441eb6b428
SHA256606b25fb2db7a07a9752c5dc155279f1478e88575ebce211d977c027ac78bca6
SHA512e207c2a86f2a62054d1c1bc1662d56157ec7f73c597b6bc5f190bd5e4b9ce20a8af2f286ecfa00f995e763ef390ee22d1c16d048351a66ece289835e0ca025d3
-
/data/user/0/com.wsw.cospa/lib-main/dso_depsFilesize
376B
MD58b0efd58fc62415dbdb202d1662989a2
SHA130ce1d9dbcd6a33bc0794158c5e625adcd076986
SHA256bd0f28512c1e4d40eb7814defc768f02dc0c842fae8c5c635e1974c80f05bc7f
SHA5123f2815db5c814ac0f9b8635dbee90c525de054e1c88b4a79ffd7a5dc586495ca6cdfc81a13ccd20a7f3bf34cc523c96a392fe5ed67d8cb3f840fcd91194a91b0
-
/data/user/0/com.wsw.cospa/lib-main/dso_manifestFilesize
5B
MD5c06857e9ea338f3f3a24bb78f8fbdf6f
SHA1c5a0a2529d2deb60fec041b4fbd722a2ebe31702
SHA256957b88b12730e646e0f33d3618b77dfa579e8231e3c59c7104be7165611c8027
SHA51229f61516876c25379a7bf4faa2b3ca6f6b53eac90e7de47671fec4a818d51441b4025cd7909f7c0a0d113ab6c5ff00cb3700c286bac7319185b77905feec4fb1
-
/data/user/0/com.wsw.cospa/lib-main/dso_stateFilesize
1B
MD593b885adfe0da089cdf634904fd59f71
SHA15ba93c9db0cff93f52b521d7420e43f6eda2784f
SHA2566e340b9cffb37a989ca544e6bb780a2c78901d3fb33738768511a30617afa01d
SHA512b8244d028981d693af7b456af8efa4cad63d282e19ff14942c246e50d9351d22704a802a71c3580b6370de4ceb293c324a8423342557d4e5c38438f0e36910ee
-
/data/user/0/com.wsw.cospa/lib-main/dso_stateFilesize
1B
MD555a54008ad1ba589aa210d2629c1df41
SHA1bf8b4530d8d246dd74ac53a13471bba17941dff7
SHA2564bf5122f344554c53bde2ebb8cd2b7e3d1600ad631c385a5d7cce23c7785459a
SHA5127b54b66836c1fbdd13d2441d9e1434dc62ca677fb68f5fe66a464baadecdbd00576f8d6b5ac3bcc80844b7d50b1cc6603444bbe7cfcf8fc0aa1ee3c636d9e339
-
/storage/emulated/0/360/.deviceIdFilesize
48B
MD54c4c5285293d5141f582aefa4e038669
SHA1e01852a72e5a8e6f7d63a21426b515118196047b
SHA25636c5c63f39ddf7a6a9c01946e4f78b95790aa734176802e793e95724a1b5b731
SHA512097aa673273e307f7bfb7c08861ad389d4b5f7fae55d972a5c1636aa66d0b8d23b5eb9b696cefe0e5b942f23969dabf0147397aeca85fb9a4d75e0473104e399
-
/storage/emulated/0/360/.iddataFilesize
32B
MD56d70dd8546530f73843b729b1461283a
SHA1278cc6c2dc4b6348fdcc8cdec2a1ca70858c8638
SHA2569002fe8e7ce21e8e85b1ae694a14e611fd47abe88c36c90c28110e59f6165eb0
SHA5128c87cbf9ad4c5fb728d291a9a7e9b627387c409e0d4cd26a8014e3bce042a1eae45b1e893447bf3b09599b44e706ff5cb088bbeec4cb5a884e53c07095ae494f