Analysis

  • max time kernel
    176s
  • max time network
    147s
  • platform
    android_x64
  • resource
    android-x64-arm64-20240611.1-en
  • resource tags

    androidarch:armarch:arm64arch:x64arch:x86image:android-x64-arm64-20240611.1-enlocale:en-usos:android-11-x64system
  • submitted
    15-06-2024 03:28

General

  • Target

    acbdad42bbdd08324d97dd9e074b8f35_JaffaCakes118.apk

  • Size

    4.2MB

  • MD5

    acbdad42bbdd08324d97dd9e074b8f35

  • SHA1

    78eedaf0ba4ca3448723586028acfd24b1fbc104

  • SHA256

    4653b95a14ed2cbbb030c4d7ac221385f29563c6fcfd8b44c04335a4414d3dc2

  • SHA512

    6af799d5d4548f59f3b92edcd7de8d55b8eee20c24b4c2715e6d69e79b4b82a56409e14bad955eeca1cf1c087f40bcb964d2499edf17e1192d1cb814bb60bd8f

  • SSDEEP

    98304:waEGARsBEko6CjHftv3ZoSUFJCSfBLBDI4jF:wrsBExpUFJZIe

Malware Config

Signatures

  • Checks if the Android device is rooted. 1 TTPs 3 IoCs
  • Removes its main activity from the application launcher 1 TTPs 1 IoCs
  • Loads dropped Dex/Jar 1 TTPs 4 IoCs

    Runs executable file dropped to the device during analysis.

  • Queries information about active data network 1 TTPs 1 IoCs
  • Schedules tasks to execute at a specified time 1 TTPs 2 IoCs

    Application may abuse the framework's APIs to perform task scheduling for initial or recurring execution of malicious code.

  • Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs

Processes

  • com.wigomobile.textviewerxd
    1⤵
    • Removes its main activity from the application launcher
    • Loads dropped Dex/Jar
    • Queries information about active data network
    • Schedules tasks to execute at a specified time
    PID:4479
  • com.wigomobile.textviewerxd:Metrica
    1⤵
    • Checks if the Android device is rooted.
    • Loads dropped Dex/Jar
    • Schedules tasks to execute at a specified time
    • Uses Crypto APIs (Might try to encrypt user data)
    PID:4547

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • /data/user/0/com.wigomobile.textviewerxd/cache/DA39A3EE5E6B4B0D3255BFEF95601890AFD80709
    Filesize

    2.6MB

    MD5

    f981459e2752c8747260735c3cec15db

    SHA1

    f8bf90ec7bed5880f3842271a78ff9c7875203fa

    SHA256

    204c777794eac6617d6f8aa2e739481139bfe10ee64a6d7954ecd7bb8f30246f

    SHA512

    7256adfe79491758f0d361373445aff9cb69f0c92a53b7417176433525065fd088076d86adfa174131b2c8a34530fe7eb70bfff680c1e4e2b5882f86f4fec27b

  • /data/user/0/com.wigomobile.textviewerxd/cache/DA39A3EE5E6B4B0D3255BFEF95601890AFD80709
    Filesize

    425KB

    MD5

    2df0cfcfe600983219e7e475618d7d87

    SHA1

    c33a4ee9ab3e2a7c34168799d4dce10dca03d78b

    SHA256

    6d1d94229af9e0ca7254b9e3adf13f766f18064f9b97191f0993988f23b70617

    SHA512

    06eaf1b0aa5d15fb73baa0d842fb119a2883b52ee5b90d172427741f3fae8401629ec5fd0cc186b650f3c481fb1d7ed382cc716385ef07c1b86470bd9a5c8f50

  • /data/user/0/com.wigomobile.textviewerxd/cache/DA39A3EE5E6B4B0D3255BFEF95601890AFD80709!classes2.dex
    Filesize

    5.6MB

    MD5

    dbe44c9e5de2831350e20b03fe482d1c

    SHA1

    7ffec994f997775af861d34286b6f384dce14f0e

    SHA256

    eb19d7083a246fd8e4406915c9238a6bbf3e30d7a2d84970a619414e6c10ef04

    SHA512

    ae2aa213389da761646e47debebc467e73656ee68d57773fde8c31cef697f4bd98c728ad9e9528abd4ef12caa44550714b1db6274fadbf43cc6745685b718d1f

  • /data/user/0/com.wigomobile.textviewerxd/databases/androidx.work.workdb
    Filesize

    120KB

    MD5

    8602b6b6265df20c1e70d83b7f3b5606

    SHA1

    7374ea672d5da03741063a6109fdcbf002f12cfd

    SHA256

    a43f3d78f0d91fa8b6fbe28f8c9c379ef654c30adf67f19f171274677af7f03a

    SHA512

    d6b80703426932aabff863c5b9c916c55952f154d2cbe8f13387ae362a002f39d84f0ded660b0af371ae7e4c42cb0405e410ab8ec434110caaff5bb49ca1bc7c

  • /data/user/0/com.wigomobile.textviewerxd/databases/androidx.work.workdb-journal
    Filesize

    193KB

    MD5

    7cb91a3d17524f0b2a7b238ea04f0bd2

    SHA1

    1fc61a68a59584b66b900c1620bd022bdd3077af

    SHA256

    c4cc6901540b1daf50d6a0f11331e41981e082f1c1ed7ced4f1ea8c21a4853eb

    SHA512

    9e9af90536a7c6c001e5a882ea5450d2c9ec46a48648170a909fb6ca00e0336bee1e55185f8709e5120c2c15e95ccfddca2524fe6fa915ae7862825ac3dca507

  • /data/user/0/com.wigomobile.textviewerxd/databases/androidx.work.workdb-shm
    Filesize

    44KB

    MD5

    2b3bf7bb0ee6b27bda2ea3feca6a244b

    SHA1

    c20f52d3142f879c66ab293e1f8999a5173221ff

    SHA256

    59ca85a3e7109a6bc2fd34de9f885984bb7c245476bddbc099d29f47ff137f35

    SHA512

    ce5023e44f8febc3baf680a5a4aab88606694e9e8b6411ad97d8b8edda08d62405cb402a4f38d525f05af4940a894e9a36e573fa351c1b18544f54221592dd71

  • /data/user/0/com.wigomobile.textviewerxd/databases/androidx.work.workdb-wal
    Filesize

    88KB

    MD5

    e708ff665288b9e06f6c15193e4c149c

    SHA1

    a5e153b8a572d491c0bbbe8f8c66208cf60b1eac

    SHA256

    54f433ae72b6ad1f302cfba45f720727d07bf53fdb2d3170335b85ac72fbcdb5

    SHA512

    b0e2ed758c253b9b2885a042653156dbc3112a5a561e100efeae2d072b13c2df45ae0635544b34a0962492df2f5208d13baa962edc5cdfa3e2cb044a71de3936

  • /data/user/0/com.wigomobile.textviewerxd/databases/androidx.work.workdb-wal
    Filesize

    422KB

    MD5

    3d9793bdcce7f82022d5889fcebdf7a1

    SHA1

    e2142b441c79919fb940217d9ac538d67049232d

    SHA256

    4e7edb7d94024c312d0c307706161a9a64211ba1c289119f0337e097e1cf37ba

    SHA512

    dee1cb6c6abfe8d95fdcad79e6d22a2017ecd0cac252be819ae9ab745bfda81138a9155690c5af5812fb1ff72445a3c5aa75df96169a6a792a1083b5eb45a341

  • /data/user/0/com.wigomobile.textviewerxd/databases/androidx.work.workdb-wal
    Filesize

    20KB

    MD5

    09fed27203f99537a285aaf726b7b372

    SHA1

    a72c85fd5f2826c71421354ba2bdbfb9e8bacaed

    SHA256

    216a63b8d48f471d90cb57a0182e25cd5029bfc315984457b7979e553e5a428b

    SHA512

    326dd335273337076a941d896209d1fc33136b23a1b66b660bc39a905679b098e269cdf59abb607a591636d971904fa570759d02e24ac455c93a05fae12ef524

  • /data/user/0/com.wigomobile.textviewerxd/files/ZPkFS.log
    Filesize

    8KB

    MD5

    d6287ad4e1f71b27cb7ee6879167f611

    SHA1

    9d983469e54c04f49ccca10bd048e9807de2f563

    SHA256

    a2e32ae5f27deb5e4f3f7957f7b3cbe63ed732c6d49d75a9a2bb3557d77e776a

    SHA512

    825528e5caa111bb4037ccd3905afa84d06ebf68b8a59f008b3240560716c8c5efc5dd1a5fde2384856c2ad5749410caec46e5288ebbfbe0bddb1292f54a07e1

  • /data/user/0/com.wigomobile.textviewerxd/files/ZPkFS.log
    Filesize

    12KB

    MD5

    77380b15a7c7cf3a02097776a37e0b11

    SHA1

    7785838e2729331aa69f2be6c2c19ff52db696ec

    SHA256

    de71a70460c770bdf6a2724513d541248026459bcc673ae15ca46a1f8ea614b9

    SHA512

    c99f3fecb83223dbd7863e6a7a361cacf1c74ff90737c9d6fce32ba4d3d807ca7a6951bf8b92ab057d7e57be5c4f11b57750b421fb499ef152e140fe15de2542

  • /data/user/0/com.wigomobile.textviewerxd/files/ZPkFS.log
    Filesize

    12KB

    MD5

    5385bd2fe8e850550e377993be70cc04

    SHA1

    ab7bbb431b1fec32f7f842a0ea82a5106b8dabb4

    SHA256

    8152ceaa5c7b49427895a91a376c4ea0ff99dfda5db032f80e7d249c2b422958

    SHA512

    2bfe2fe250a58e8988333277b7fb1aaa35d4d2f25675742d0a03be47e4e3acbc4c2f502e09f5edf1257523e5eabaf086d8e76f156abb9704c2b13718212a3bf8

  • /data/user/0/com.wigomobile.textviewerxd/files/credentials.dat
    Filesize

    233B

    MD5

    194e5ad001532345054b7aee49f020a0

    SHA1

    813c0e9e285ede9c838d82458d9173db38d2b8d6

    SHA256

    0437b02b72cdfa16a13da90053a441fc23b741563a6107960f4c7c491531e3f6

    SHA512

    e6721a9f7e94d1912a21733f478e8cc5d9ad5134ba296bc579da4d512345aa18ae1189062ffb4ac912fea55fe096383ac3a5daddb5a7ac505d7f8d1d6d73c0f1

  • /data/user/0/com.wigomobile.textviewerxd/no_backup/credentials.dat
    Filesize

    20KB

    MD5

    9ea14fafb9e2845d52ff9a0fc8a30f7e

    SHA1

    232c101d383e6497e8898390d748ec75120a8139

    SHA256

    83c23f14f72db688a689cf12a535dcc8e3950a2709e21b732b2e1c960ef15cac

    SHA512

    a94edbfc0f68a89f0c81a99270308b188a4203c7a5703b98cf318d23a878180624fd84286c8de90ef793228a1c1d80e396a9d383ca7930397d66a06da36c3921

  • /data/user/0/com.wigomobile.textviewerxd/no_backup/db_metrica_com.wigomobile.textviewerxd-journal
    Filesize

    12KB

    MD5

    58a1aab89059b660bb5fc1f963944c15

    SHA1

    e6adfe2bfd73d07b838f30015c859896dbacb351

    SHA256

    80b48ecfc48de261ae1f2a233db1cd0ff267a8b2cb896015624b8c5973a6dfc3

    SHA512

    898a56aa2fb794e286a559473e1ad8758c72bc728b5a95c4a827a169cea6c1f2f538337ed492f42bd9305dfcb0d4a5187cf4bd2dd025f6107b97fa9de5f1e69d

  • /data/user/0/com.wigomobile.textviewerxd/no_backup/db_metrica_com.wigomobile.textviewerxd_20799a27-fa80-4b36-b2db-0f8141f24180
    Filesize

    36KB

    MD5

    9708ea5da9727be5bfc77f59b2fd74dd

    SHA1

    cc86410e49545e86e945a3e4ead7ec869bcbee4d

    SHA256

    442cd6fa02f8c91001854ef204e1cd73d5ffca30b35948ca4284b1744e68ee74

    SHA512

    6cb4117abbf119182f4ce00e09e666c587b15270e1becdcf41e9284289991e28880f806544791c108a60b4f500e70bc8c33cfcac644da198d82f928b30d01b49

  • /data/user/0/com.wigomobile.textviewerxd/no_backup/db_metrica_com.wigomobile.textviewerxd_20799a27-fa80-4b36-b2db-0f8141f24180-journal
    Filesize

    512B

    MD5

    3bf0a8c78875bd653d68ab3abf4aadba

    SHA1

    90aa2eecc8ede79f4de3c803cac16e5ec8b2bbc7

    SHA256

    7626011f3a4a24ae490512eb0eb8e18146d7077ee1d2c27de198e6d07de8f8d9

    SHA512

    7dc2c695e374e66378e03269c8afbb601b6c0686746256a5299f4ea044163d48bd1794a55a89c14cb205dc71be42bf58c5472e08db64ea8e59a49dbdb0a887cb

  • /data/user/0/com.wigomobile.textviewerxd/no_backup/db_metrica_com.wigomobile.textviewerxd_20799a27-fa80-4b36-b2db-0f8141f24180-journal
    Filesize

    8KB

    MD5

    b138c0de530e6e34bdf5d01a0e0ec753

    SHA1

    42d1c1392ac7f69f7771275263ea560167673a45

    SHA256

    dca4971adf0b0603bf7da9b9d1dc1cf8f68427b8162c56ad6bbc9d136f24ce63

    SHA512

    100c601d4f0940addc61e514f360d6c1768225e704c93ebf2f3f3bbd10bf8f4a476b12a9226c9eee9734652c79b6a885f0a745ddaf882365719913084210e911

  • /data/user/0/com.wigomobile.textviewerxd/no_backup/db_metrica_com.wigomobile.textviewerxd_20799a27-fa80-4b36-b2db-0f8141f24180-journal
    Filesize

    8KB

    MD5

    cf7b1483e975885024be2596bd31d425

    SHA1

    ec20b487dc16ff4efa573de1e92fa1f68637f2a6

    SHA256

    04d4d9ef41075bc1863e315e373d838b7fdb15365694442cdfe3a103895d2a2d

    SHA512

    d1644f5e26554b0aba89a8ce9e9c20f0cf53ece6f238f02344e4a28747465d2a198195ec03b5fb1222991a2fb7bb6b54561973b3036c678468af5ba7a8bd5576

  • /data/user/0/com.wigomobile.textviewerxd/no_backup/db_metrica_com.wigomobile.textviewerxd_20799a27-fa80-4b36-b2db-0f8141f24180-journal
    Filesize

    12KB

    MD5

    0ace05332e9250d7eee00e040d34d695

    SHA1

    fe44c48c9685fd9efe37952db6a4334a5f4f3b44

    SHA256

    b69fb8a72bda152118c4d4861513e352d4f2928aa307bf35ef2c589985b19556

    SHA512

    e4d1e89509f660221f2f8962927a4ff93d15e713aed4e0bbc0d908ad1057664928f830e5142326cc61e6b62f6d9ad1d578544a840d7d615f2242cde954143696

  • /data/user/0/com.wigomobile.textviewerxd/no_backup/db_metrica_com.wigomobile.textviewerxd_20799a27-fa80-4b36-b2db-0f8141f24180-journal
    Filesize

    8KB

    MD5

    e6f03c100b5305d49b7c5999dd6e90de

    SHA1

    06a575e7d05bb4ac12f41805b17379dca228c868

    SHA256

    a682e398949ccc0cd7abb2279b40d9e14c1df398d9e8cdeb41853038d60b0acf

    SHA512

    df531c6cbb8513b8c5e828f296dcef7bfe9a69c6e6f870dcd8219ac22233cd7925c9f99189420298d690314d02026af0f2754eb21aad46b59e9bdb9f7c7477e8

  • /data/user/0/com.wigomobile.textviewerxd/no_backup/db_metrica_com.wigomobile.textviewerxd_20799a27-fa80-4b36-b2db-0f8141f24180-journal
    Filesize

    12KB

    MD5

    97a738651b7f3fef78618c9dbe21831f

    SHA1

    e7d53f1f4c277ab90747066af742860a5502033d

    SHA256

    1cd7510246e54577f29193db291e2922001de00e1aaaf7628ad8b9dfe06145b4

    SHA512

    d5d86d58f282f2b18d75113354c8351a1ea77b45c99bec30390e50b3d9a0395756f620b5eda2ac008c854a9c9d87945675fa57ae382c51300193053af7cfb223

  • /data/user/0/com.wigomobile.textviewerxd/no_backup/metrica_client_data.db
    Filesize

    20KB

    MD5

    73faa834408905988d951cae528794e3

    SHA1

    6f01ca40f09286546b46edbd4d0b7952bbf1e85e

    SHA256

    c4edd90eacba346b6a7b0f4de73f24909e3e7bc5d217f178edd713b36cc5b21e

    SHA512

    14968de71f438a2d2df7f08f0faa0081b48b80b3cbe179490be694476c74737d9dc037ad759cac81e402b5f00def4dd005659ad1b289410c327a30239bc42a5a

  • /data/user/0/com.wigomobile.textviewerxd/no_backup/metrica_client_data.db
    Filesize

    36KB

    MD5

    0f1558a9accffec71d661c83f5a42b59

    SHA1

    aafd1e9655c7ae98a84d469860000b5b5015e537

    SHA256

    2da8c2f44659d753642d5e2e51b6a8d5a9fdacb5dd5850c865570e8826c19948

    SHA512

    64d69e3b473bd5d1d30876ce0c2c4a98ec5414f0c834f61e9d0b3dbd327efa930221054deb3dc8dca00e0ad80c712d4b32adf6c2f01d71c61f28155c716cc5a6

  • /data/user/0/com.wigomobile.textviewerxd/no_backup/metrica_client_data.db
    Filesize

    20KB

    MD5

    3d5dd782e42bfef7c617350f23b2b49b

    SHA1

    a2508e886bba5afcbc9b9999c657887d0b3609e3

    SHA256

    e72f4de575126b8f8edcd1374be488a77dc626d257c852b24cdcc7fc6083ec63

    SHA512

    8a20986f483b8dc1eed5ac2cc20227aab2d311c8e2bc8533315a450cf6b4bbf6811e2ab36f7ffbe7180a4f80e9ea11073d1c3ea80f7d21ad80a760a1aaf8acda

  • /data/user/0/com.wigomobile.textviewerxd/no_backup/metrica_client_data.db
    Filesize

    20KB

    MD5

    5583f91265ce97f05bb71f40c6c0eeba

    SHA1

    d3c6c296c5a2ddafb236567b0831e1243842c40f

    SHA256

    01763b1e9295f3334f9aac77de53e0a28a8249cf20d0c75eb1976fe4130e78b0

    SHA512

    fdf364e4613ca1e29c11209b76228b662986b68a71d213149a217590cf54377e60f9227488caea04a95ec0f2394b54b2919dfa76eda76755a96404269e1a37fb

  • /data/user/0/com.wigomobile.textviewerxd/no_backup/metrica_client_data.db
    Filesize

    20KB

    MD5

    c555707011903d687d33a0dab0982519

    SHA1

    e7daf2952ffe476f0b432fdd8dd3b6a6491cfb8b

    SHA256

    468f643cd897672e2f0a7e0619adcd362089ac8859ec389f64305034da26dcac

    SHA512

    c4f5d5d7e639cf251e4e6f4a77fbbebe9d183b5bb1fb72d66022cdb176f292995ce928a4392e2d644ae8d0057bc7eb8543d5ef1d68a6ed5b34c8bea15b750be0

  • /data/user/0/com.wigomobile.textviewerxd/no_backup/metrica_client_data.db-journal
    Filesize

    8KB

    MD5

    529d8872e0e5c66fe9c9c3b2c69dacf5

    SHA1

    db986be3500398527779dbbc0ecb04c09283afd6

    SHA256

    f6790d63d3fe4d92b553e83b1f92fcec59cca35e483c50d0b04a3b7bdd089a19

    SHA512

    6dac061a4bf4c76cefbfe0731c75e0c2ca71175b4df4208ca86083081f8f6a84419061c48b5b1db16e38b97be35ba6a1684ca663dd4b5d0d4a1744b28569bcbc

  • /data/user/0/com.wigomobile.textviewerxd/no_backup/metrica_client_data.db-journal
    Filesize

    8KB

    MD5

    a90dcd0a15dde3ba26087c63991f0cfd

    SHA1

    31ac44d2ec07f0d58b2dccb1b577c376e1ac2c94

    SHA256

    dbec3bc7c35394c0deb870ef7fc31b65e25aaf39fb7e4473a0fceb527213aba2

    SHA512

    9400b847b50f781f38a63f2612af19755a3b862d11b963b0d0d8600e5b6a464b3095557bab2eebdb8704437614263eb4a119d5e3a21bba4a97f02b280c00c0da

  • /data/user/0/com.wigomobile.textviewerxd/no_backup/metrica_client_data.db-journal
    Filesize

    12KB

    MD5

    a89fc2ac5d0d3070f726ff1240cc5d99

    SHA1

    b343e47710ffae36de6d5f80819a3541ef9ff7b6

    SHA256

    fd4467fc57c1742e14fd25d5a98396731c1eb65e7da9789b3edfc7bb3f748e4d

    SHA512

    9b1639f34ce81a1e8a48c1706775646a86865b8dd4fa08ecd461da2dd3a207557d3627cd1ca8f15d2724b314117e2e57e3d4e00d2422d423c7ff560b09e0191c

  • /data/user/0/com.wigomobile.textviewerxd/no_backup/metrica_client_data.db-journal
    Filesize

    12KB

    MD5

    53885b8b4aebab0f52a5e8f0a8f4c9e5

    SHA1

    d78e13ca1fb04ae70c96e28a9836cf9482466c56

    SHA256

    c4eb3c049ec59f330c20155becf291c0a98f4109f54d039a10747bba13ec7b62

    SHA512

    9e15063ada76ebf78c82c921d49928aacbba31077ba561f570eca59ecab09e89f13b33f0b4bcc9f67f4d3f5b4ab3c0787c500889ee6100432ae7a82f6c9cca9e

  • /data/user/0/com.wigomobile.textviewerxd/no_backup/metrica_client_data.db-journal
    Filesize

    12KB

    MD5

    8a42d2575e71d00276792be3f25a00c2

    SHA1

    c57a4149a10f6672b85c3389b624fae9f7662403

    SHA256

    1b4efea96a8d3520ed3b45917acc2613aceeb921f2c816b6b2491a2dd109a6fc

    SHA512

    c5b5e173f20c0a707e98891aa0e006e43b04119f8778c89275e94e0a90025b13ca9f30709647271b5a95faae6d0858ebddc8fa0eb69e4d2dd19007462869c6cf

  • /data/user/0/com.wigomobile.textviewerxd/no_backup/metrica_client_data.db-journal
    Filesize

    12KB

    MD5

    3dab6f03057eb7dafd892c7cc3a030f2

    SHA1

    91d0200f756ddb40a1d240a714914f47780fe7eb

    SHA256

    4688d605a2c6852360d6011b4349dda30ddbbd95f6efa25ae0e4e5b575da1f60

    SHA512

    a367022917c049d2e5ae028fddd754045f30766e0acd2b1bbdef6eacd3adcc51ad006c9406c5b09f7c75a02bb6c67d3a5daeac588115f29a41d26fcd258a971e

  • /data/user/0/com.wigomobile.textviewerxd/no_backup/metrica_client_data.db-journal
    Filesize

    12KB

    MD5

    b8fd19d0f068fed1a8f69b86c1016cc3

    SHA1

    0f4e6591674c9dd26b479cb2308b3c7b2597b83a

    SHA256

    7950c89a52d0827009651b7ce9f7604291edf5d67a6bfccbec5c5ab2ef126bb8

    SHA512

    3ceebfe69a6d77a7ca8ea4336092e933ebd8820e195433dfd8ff29498c24415d0f4925c4bcf8981b588aeb1bb99dc87ef5a90b791d1b8403d2bafbc982828fa0

  • /storage/emulated/0/Google/google.id
    Filesize

    8KB

    MD5

    fe48b9c2296e0f93af9e5bb5a4100fc3

    SHA1

    f4be4bf974321d0d5681ec4ad880ea8c3a785adf

    SHA256

    ecce6a036276a50136318b7fb95fbf7ce3cc5c6bd0b7f7233682f3a3a31f18d9

    SHA512

    70115ce8b1886afc5b353fe5a4635497bb1281aaaef9f481f81bfdb7642580d875ca0393f4424c17540243cd0dc7fcb9a0806750c010775bc6ae1894e2fb2f99