Malware Analysis Report

2024-10-19 11:48

Sample ID 240615-fqgbeszbpg
Target acf7b82c588732c171fe8920ad812887_JaffaCakes118
SHA256 52d488c072923b9d02483ab1d3108e28a0ce7f6f27be680dd3ac0cb7cf542f82
Tags
collection discovery evasion impact persistence
score
8/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Mobile Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral4

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral6

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral3

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral5

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral7

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral8

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
8/10

SHA256

52d488c072923b9d02483ab1d3108e28a0ce7f6f27be680dd3ac0cb7cf542f82

Threat Level: Likely malicious

The file acf7b82c588732c171fe8920ad812887_JaffaCakes118 was found to be: Likely malicious.

Malicious Activity Summary

collection discovery evasion impact persistence

Checks if the Android device is rooted.

Queries information about running processes on the device

Requests cell location

Queries information about the current nearby Wi-Fi networks

Reads information about phone network operator.

Requests dangerous framework permissions

Queries information about active data network

Domain associated with commercial stalkerware software, includes indicators from echap.eu.org

Queries information about the current Wi-Fi connection

Queries the unique device ID (IMEI, MEID, IMSI)

Uses Crypto APIs (Might try to encrypt user data)

Registers a broadcast receiver at runtime (usually for listening for system events)

Checks memory information

Checks CPU information

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-06-15 05:04

Signatures

Requests dangerous framework permissions

Description Indicator Process Target
Allows read only access to phone state, including the current cellular network information, the status of any ongoing calls, and a list of any PhoneAccounts registered on the device. android.permission.READ_PHONE_STATE N/A N/A
Allows an application to write to external storage. android.permission.WRITE_EXTERNAL_STORAGE N/A N/A
Allows an app to access approximate location. android.permission.ACCESS_COARSE_LOCATION N/A N/A
Allows an app to access precise location. android.permission.ACCESS_FINE_LOCATION N/A N/A
Allows an app to create windows using the type LayoutParams.TYPE_APPLICATION_OVERLAY, shown on top of all other apps. android.permission.SYSTEM_ALERT_WINDOW N/A N/A
Allows an application to read or write the system settings. android.permission.WRITE_SETTINGS N/A N/A
Required to be able to access the camera device. android.permission.CAMERA N/A N/A
Allows access to the list of accounts in the Accounts Service. android.permission.GET_ACCOUNTS N/A N/A
Allows an application to read the user's contacts data. android.permission.READ_CONTACTS N/A N/A
Allows an application to write the user's contacts data. android.permission.WRITE_CONTACTS N/A N/A
Allows an application to read SMS messages. android.permission.READ_SMS N/A N/A
Allows an application to read from external storage. android.permission.READ_EXTERNAL_STORAGE N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-06-15 05:04

Reported

2024-06-15 05:07

Platform

android-x86-arm-20240611.1-en

Max time kernel

46s

Max time network

160s

Command Line

com.moji.mjweather

Signatures

Checks if the Android device is rooted.

evasion
Description Indicator Process Target
N/A /system/app/Superuser.apk N/A N/A
N/A /sbin/su N/A N/A

Queries information about running processes on the device

discovery
Description Indicator Process Target
Framework service call android.app.IActivityManager.getRunningAppProcesses N/A N/A

Queries information about the current nearby Wi-Fi networks

discovery
Description Indicator Process Target
Framework service call android.net.wifi.IWifiManager.getScanResults N/A N/A

Requests cell location

collection discovery evasion
Description Indicator Process Target
Framework service call com.android.internal.telephony.ITelephony.getCellLocation N/A N/A

Domain associated with commercial stalkerware software, includes indicators from echap.eu.org

Description Indicator Process Target
N/A alog.umeng.com N/A N/A

Queries information about active data network

discovery
Description Indicator Process Target
Framework service call android.net.IConnectivityManager.getActiveNetworkInfo N/A N/A

Queries information about the current Wi-Fi connection

discovery
Description Indicator Process Target
Framework service call android.net.wifi.IWifiManager.getConnectionInfo N/A N/A

Reads information about phone network operator.

discovery

Registers a broadcast receiver at runtime (usually for listening for system events)

persistence
Description Indicator Process Target
Framework service call android.app.IActivityManager.registerReceiver N/A N/A

Uses Crypto APIs (Might try to encrypt user data)

impact
Description Indicator Process Target
Framework API call javax.crypto.Cipher.doFinal N/A N/A

Checks CPU information

Description Indicator Process Target
File opened for read /proc/cpuinfo N/A N/A

Checks memory information

Description Indicator Process Target
File opened for read /proc/meminfo N/A N/A

Processes

com.moji.mjweather

getprop ro.miui.ui.version.name

/system/bin/sh -c getprop ro.board.platform

getprop ro.board.platform

/system/bin/cat /sys/devices/system/cpu/cpu0/cpufreq/cpuinfo_max_freq

/system/bin/sh -c type su

getprop ro.miui.ui.version.name

getprop ro.miui.ui.version.name

getprop ro.miui.ui.version.name

getprop ro.miui.ui.version.name

Network

Country Destination Domain Proto
N/A 224.0.0.251:5353 udp
US 1.1.1.1:53 api.moji.com udp
CN 210.14.153.69:80 api.moji.com tcp
US 1.1.1.1:53 rqd.uu.qq.com udp
HK 43.135.106.212:80 rqd.uu.qq.com tcp
HK 43.135.106.212:80 rqd.uu.qq.com tcp
US 1.1.1.1:53 register.moji001.com udp
US 1.1.1.1:53 ugc.moji001.com udp
CN 103.17.41.69:80 register.moji001.com tcp
CN 39.96.132.98:80 ugc.moji001.com tcp
US 1.1.1.1:53 semanticlocation-pa.googleapis.com udp
US 1.1.1.1:53 abroad.apilocate.amap.com udp
CN 59.82.44.11:80 abroad.apilocate.amap.com tcp
GB 216.58.212.238:443 tcp
US 1.1.1.1:53 android.apis.google.com udp
GB 142.250.187.238:443 android.apis.google.com tcp
CN 210.14.153.69:80 api.moji.com tcp
CN 39.96.132.98:80 ugc.moji001.com tcp
US 1.1.1.1:53 alog.umeng.com udp
CN 223.109.148.177:80 alog.umeng.com tcp

Files

/data/data/com.moji.mjweather/databases/alarms.db-journal

MD5 2d0ca2e5252e6532e3f246435f6bda04
SHA1 10b7797f155d044ed7b8aeead59397b978629ea6
SHA256 ba8fe3bde6252b98c2a83647072b902c00c3789d5a6a49c0be7bbfbb8bf54d99
SHA512 a40c21bfacadbd61cc7951e0e61885b48ef635a383218806e93adb2cfe82fc6d145630e6f04d96670e2ee30354da3f7311492bb1926cabfc72372168f0c8f244

/data/data/com.moji.mjweather/databases/alarms.db

MD5 f2b4b0190b9f384ca885f0c8c9b14700
SHA1 934ff2646757b5b6e7f20f6a0aa76c7f995d9361
SHA256 0a8ffb6b327963558716e87db8946016d143e39f895fa1b43e95ba7032ce2514
SHA512 ec12685fc0d60526eed4d38820aad95611f3e93ae372be5a57142d8e8a1ba17e6e5dfe381a4e1365dddc0b363c9c40daaffdc1245bd515fddac69bf1abacd7f1

/data/data/com.moji.mjweather/databases/alarms.db-shm

MD5 bb7df04e1b0a2570657527a7e108ae23
SHA1 5188431849b4613152fd7bdba6a3ff0a4fd6424b
SHA256 c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479
SHA512 768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012

/data/data/com.moji.mjweather/databases/alarms.db-wal

MD5 7fde38812378bffcfefc5537ab9240c6
SHA1 76e758f4a65f29118b4a87c9594a1ee90f8066eb
SHA256 4cf98ce7aa402e25a492f7fe486e05e6629709c3857bb3a92f0a9f477eca4335
SHA512 48cf20439cfff841e7bcf45bb441b3c513dba5448b553105bdbb26175db770e295f3f3b87121a940d9384bfbf36bb3205ffb00a2a3cf1ea675561acf40c3c438

/data/data/com.moji.mjweather/databases/bugly_db_-journal

MD5 9def84e9ba2cd078cb5a5bd22868ab58
SHA1 34c12771a6b43fa58c1f1d0dffb3b38a21298f79
SHA256 2e9c2ee601368df6519c4ebc0736ee6e87bed58c5b2baef57338b5d0ef570b70
SHA512 794e918117469d2bac2a3447eb779a47529cd7f004296b7c9f373035b46922b1eddab572d02194f86a443bac837ed4b701997ea14268610ef15951f7c262694c

/data/data/com.moji.mjweather/databases/bugly_db_-wal

MD5 2588f8f5835f47390cb36ff7f70d448c
SHA1 1e1375c6d2511a8a6af0269c4481e8aa5d140333
SHA256 9f565cb6547fb8c3ab110ce740e90a060e2fbb0ed31216f99c98fd955f8fefa3
SHA512 7b4524a261326f3fdb19544a8b51092029b7e75abdc1bf45b652c950ce839b09f305fbb21f5df485880f7de2df47773a4c76cb84bedcc7acb04fa306a0e64424

/data/data/com.moji.mjweather/databases/mojicity7.db

MD5 d76a17b7f6d5d384812a0a4513dc2ed4
SHA1 7f2e5f4b96c65e2baa8dde2724a19fa8f3f11134
SHA256 6ab8718d6dacc6d60b21926a0c05167b0731173f7e5a72480b842e360cd11722
SHA512 5958f1e9c5d97b8330ff1297a19c23cad978d43ab18bdf38f98500fdf3601664425bcc188fba4ec5c148f0480636d08749619ae59e8383a6922f8bc729bb2515

/data/data/com.moji.mjweather/databases/mojicity7.db-journal

MD5 276381cee1e380d7c222a6edaf1cb4bc
SHA1 147f8a73e74b910218aeb7fba07be472bdfe8368
SHA256 f759f14597d905fd9ec870adfa11c61f55a92f6f5634b5fc8e6a967ad68aa05b
SHA512 0835ad7ad3a152db941bc92fb3110bf64ea4a1d950e80bc084b66daa4073995a2f1e965c3ab63fa0f4d6ea3b61e000a5ea4c69987b7ee1aa3f45980aa0001eb0

/data/data/com.moji.mjweather/databases/mojicity7.db

MD5 7e563fb4d865e3290e2d4d78a11619be
SHA1 81e2560ce7262bded7cb0f44aa1bb426e82b7a80
SHA256 7bf640f21883f2b237254b934752fd72189b2606e6c9a2cd0c4b9e5a39fcf081
SHA512 315f38488dbcbb5c61ae3110c234733928b0dc2b2ec36d0b3641cecbfc3ec53f2d9e6f3496d5720572e2fe995eac3b268ec07029b1addc13125327b82453e7bd

/data/data/com.moji.mjweather/databases/mojicity7.db-wal

MD5 255b331a1c32e6a538742c91c385b1bb
SHA1 b8ece7c322b18f073865ccb740e0d148037369fc
SHA256 89559bc26567bcc07e65c7e72980ffdc5df5558134cfccf21c3ef3abe9225467
SHA512 2d5e709088b13daa021adcd5a98cc61f13fd5d96ea5b61a10d0595cf08181ad5607d36799fb9dba25ed182f121dc477e94e47472ea87869904bdccea2c70548b

/data/data/com.moji.mjweather/databases/dynamicamapfile.db-journal

MD5 21786e82815997d743502da924082c2e
SHA1 3cee048e2a63465c884a3f087dc9e0a85b958a09
SHA256 216f34e3f89bdff5fee0fce05ca521ff7e08f2172511adde98d54f9c6b14c0e7
SHA512 2801b9df1bc163ff162db2a0eb5fbe9358657fc822af78f03944db229814d70d7f938ed2d73c9292860f3e4bd2d54c94266363711704b98f3edee6746db26300

/data/data/com.moji.mjweather/databases/dynamicamapfile.db

MD5 bdc9fd0fe2c7dd88e3fd3a3b455e35bb
SHA1 8819a3137213af03a57269a26c0bd5990f7dd239
SHA256 577571f576541a2d19d1d4d58eb4fae566b94729c42b25f116dc3f422f31117b
SHA512 6987fe9beb000f53bba1b4fbb07792902a9c065fdfdc1d337ada7f2ee0bc7e945358711b9b9e489c8690a668182f889c7f6c543d3d3accff4131679a55c7c65b

/data/data/com.moji.mjweather/databases/dynamicamapfile.db-wal

MD5 c81a8134d743eeaeb1dc43988cf25ac1
SHA1 a6a6c4351c457b294515f71dfebef4a9a3364068
SHA256 037a5d4467333d7c5516ecc48cc3f5be91c06b99d5a4df647fa6d0bb2e3608c9
SHA512 71002ce1a701bf16834684fa5f212a486fd5ab33c6d50e65a13c1c67f0d4fe8ecad02be1f9d6806e01ee0979e6868885500c67e2b3d3c46be43489da7e15b07f

/data/data/com.moji.mjweather/databases/db-journal

MD5 a1da76284dc489d0c933d174c19595b4
SHA1 7edbf48598baf9c78afd2752ac4dac545e379c5e
SHA256 a2b400852cadfe91058f794dcf671828aaadc7bce9af16e20c52d0ca8945b205
SHA512 6159456c5832f0e6a6081cf1696d59f63cdf736440594e0f31944fd65f3390925f591cb67b5f33f91dc7d85900fa498bf4c69b89c079b769eab09ef89e10392e

/data/data/com.moji.mjweather/databases/db

MD5 b0ef4ca8e16d8d658a2d4a54206c0f2a
SHA1 038202098136d1c85a74d17851cb0ed0de625108
SHA256 7edf7cb0d5c445429d7ed2867d2876daa48a72a09d0281ed3cae675669dbd9c7
SHA512 81cef3b55fd580d406bdc8c45b15f95d2258999f7077b5daa0b3850ee16c4d3fb3aa3963003be8de797a8c7e4867999d40369c59e845daee6f1f8756f72e6951

/data/data/com.moji.mjweather/databases/db-wal

MD5 18c2c46e3750ca0db541ec1a523a9a5a
SHA1 1ffb4ef8fbae3a567753960bd504bb624db51253
SHA256 40311af75b70001dfb702c7f551974c4ab833af9ece216bd9a7b46a7fc06efdc
SHA512 ac0428cd5eeb3cc3d1617036e94a634cd5873c4e82c3f72d74a480378d45c4d5caf39ee011115dbf0cdac7510889d6aadb7ff8e5e795a02a2bf66d2fefa69d42

/data/data/com.moji.mjweather/files/buglylog_com.moji.mjweather_.txt

MD5 e0d95c93172300b594501bc5858389c7
SHA1 9b654f2595e6615934c109bf93c272c59c496b47
SHA256 bcdf0b19c2b3d2cca4b4d872e46a317c1417edf1640cad5a3b7e7502e4cb3679
SHA512 a416515b4c4ab7ecce55027444ee51905747b5d3d614e838b7472e07e9a2c5ab0cfcc6c009d45866d18da8371dbd6a99a435c88ae4a0cbc9654a05737384481f

/data/data/com.moji.mjweather/files/buglylog_com.moji.mjweather_.txt

MD5 cbd32b334fc075eac4e5dc22972fb56c
SHA1 9f5b6d0686f24e5c57ed7f0cd4a56bb79c424969
SHA256 9920091b494689a74994384b8ffff575537b98d29fb52e2e6f41c30bf873db5e
SHA512 47ecf1848b1d476a4320ce3a393c0bea813877d6436b3a652c8b163c31e2e3a5db5b13dd18893d7eb513ab47200e9285a76573e08f6f8d3c0ee02f88eaf1170a

/storage/emulated/0/moji/temp/lla.log

MD5 3466566946a9f5b905381fa260ca00ed
SHA1 352f6bbc38f78314aaf5d8d704e97e92246e77a8
SHA256 fe21933294e1c4e499ef787a357a93613e97ad2cbff2486ab0a3ebbb75c3f27f
SHA512 94d1df881a06c3c2c447ff5a0684f386e52faa760ef7e51aa63d707ea44c6a45303faa38a5dcdc62b9d1be5370360f085e176044549459fa4025da42e9ce0b85

/data/data/com.moji.mjweather/files/buglylog_com.moji.mjweather_.txt

MD5 9e8c8b8da230347b8ea5552792f65aa1
SHA1 a902b041ae7ffd3c4a696286c5b2859d4660996d
SHA256 ffc0b3c8f123c4a797f67f54260a7df42d5e6c161b23225d866f813c9d2e4ec1
SHA512 e1a6eb4781d8380f1393e080d6de32e05f51d6dcb4994d90e053397bc45663e405a55dc5feef8118d300c414bb0b22c8613c6b7d0eec1ee11f3552499a753b0b

/data/data/com.moji.mjweather/files/buglylog_com.moji.mjweather_.txt

MD5 552eab26bd59e91f94b8e8a707d3cee0
SHA1 c3900bcc281513abdc096f6582074785f7141fd7
SHA256 a6bed9c3017224e9bd3681fe329fdb1ff117f9a9b8ee4f5ee9c9b1db4c2344c1
SHA512 6f79b1e75f01385662557eea8a0d4cad623048e0f74efc03f502e8f15d319679929037d260f822fbef66b9d35ada19ccf1d86aacd76f9af0b5d44be85effdbf9

/storage/emulated/0/moji/temp/lla.log

MD5 95410f80e2fa8c76db6fed3cf1fa3a89
SHA1 75280ad0e6d914b6ffafeb71719101a15b368bc2
SHA256 f0e8a81cd4248d4a1a55d35c92a781214af3040a999190675c4a9c04ac0733c2
SHA512 a46d1b32270e237b74f09ee7dcd9deaa943437017bf269f9805d3a84d49a2eab78c7d5c9fedf63dabd67bd4aa19f30bfa8305a0fcf6773cc49f35bb0c7345f0d

/storage/emulated/0/moji/temp/lla.log

MD5 a0c79a6dd07411ae4541a11a78f69e41
SHA1 5d3054b8fbca9d47e0c32de9437587f379681775
SHA256 335c6ba4f3cd4b1ab3427fbb78347bba48f845f626fefd1ea9fa0a95ff185138
SHA512 15a590473992064388dc090758e6b434d2480ca317c4a9d9ae96b90c969ac0288d37b1aa252aa82d5054b4e727d4ca6e5669d5dcfb8187c8641b05ad699d0822

/data/data/com.moji.mjweather/files/umeng_it.cache

MD5 035b1ff48c59226c623f3ededfd4432c
SHA1 dcce933063268a6933190222908a1a814afaca8e
SHA256 ad0daae799c8a4e89aeeefe24b1121551b510cc8b0334358c5ecd225a59190aa
SHA512 0aa9ca73f84733b576ea7845eae0c01779b7088a04666a32e10763f7fde71d8cc5cf5b5e449fe3f79b2509ef4d48949018e149f274c2cd429d500d8a6d1d1c91

/data/data/com.moji.mjweather/files/.umeng/exchangeIdentity.json

MD5 773294bbc5f480c37a2fa4352a9b5283
SHA1 ae75b930d71a29aaeed92804144c890958eb390c
SHA256 a4ecb681440b80f4dd71d511a395ca26d2fd5b6c603e5c60109a9d849cdafe01
SHA512 f8e720a7a4f8d11135c5883d05d4f7fa1ac0adad65bd183fbd7bca076feb2acc1c6bd609742ee46d6ff27693ab7d8cd160218f58bd334334b4640977b21968e7

/data/data/com.moji.mjweather/files/.imprint

MD5 1a29d6e4a1df61de6bc92049eaf3ed31
SHA1 8f5a421fe3866ad4c8823436e40fb73997b34b7a
SHA256 35cf47f610694dff871e090c1ef77700d89477a19607e4104a27dcb001767207
SHA512 ec9b0f61602d8ce1d39eb093328463476d97b21dc1dd069decb6af51d96d306d6db4e9e17dcab1ebe298132cd63b36229992d1246cfa2ece11ab5cfac5f43a43

/data/data/com.moji.mjweather/files/umeng_it.cache

MD5 720e0a94e7db5ea280a7cb65c11a3e1f
SHA1 efbe1d67a8ac4d2b8d8a6b58e91609e0305fe653
SHA256 d57db95e8e242ecf8718db731a5ea74c96f24f87b76884b03e3dcd1f3c90b7b1
SHA512 1b4ea07154ae0abcfb3775bfb05481d75e61f4ac74faa4f8a4ac71f35cd25e426452bb3d85239d07c4347fa839181ef943c6da09073eff476556059e66c708a4

Analysis: behavioral4

Detonation Overview

Submitted

2024-06-15 05:04

Reported

2024-06-15 05:04

Platform

android-x64-20240611.1-en

Max time network

6s

Command Line

N/A

Signatures

N/A

Processes

N/A

Network

Country Destination Domain Proto
N/A 224.0.0.251:5353 udp

Files

N/A

Analysis: behavioral6

Detonation Overview

Submitted

2024-06-15 05:04

Reported

2024-06-15 05:04

Platform

android-x86-arm-20240611.1-en

Max time network

6s

Command Line

N/A

Signatures

N/A

Processes

N/A

Network

Country Destination Domain Proto
N/A 224.0.0.251:5353 udp

Files

N/A

Analysis: behavioral2

Detonation Overview

Submitted

2024-06-15 05:04

Reported

2024-06-15 05:07

Platform

android-x64-20240611.1-en

Max time kernel

7s

Max time network

150s

Command Line

com.moji.mjweather

Signatures

Queries information about running processes on the device

discovery
Description Indicator Process Target
Framework service call android.app.IActivityManager.getRunningAppProcesses N/A N/A

Queries information about active data network

discovery
Description Indicator Process Target
Framework service call android.net.IConnectivityManager.getActiveNetworkInfo N/A N/A

Queries information about the current Wi-Fi connection

discovery
Description Indicator Process Target
Framework service call android.net.wifi.IWifiManager.getConnectionInfo N/A N/A

Queries the unique device ID (IMEI, MEID, IMSI)

discovery

Registers a broadcast receiver at runtime (usually for listening for system events)

persistence
Description Indicator Process Target
Framework service call android.app.IActivityManager.registerReceiver N/A N/A

Uses Crypto APIs (Might try to encrypt user data)

impact
Description Indicator Process Target
Framework API call javax.crypto.Cipher.doFinal N/A N/A

Checks memory information

Description Indicator Process Target
File opened for read /proc/meminfo N/A N/A

Processes

com.moji.mjweather

Network

Country Destination Domain Proto
N/A 224.0.0.251:5353 udp
US 1.1.1.1:53 ssl.google-analytics.com udp
GB 142.250.187.232:443 ssl.google-analytics.com tcp
GB 172.217.169.42:443 tcp
US 1.1.1.1:53 api.moji.com udp
US 1.1.1.1:53 rqd.uu.qq.com udp
HK 43.135.106.42:80 rqd.uu.qq.com tcp
CN 210.14.155.212:80 api.moji.com tcp
US 1.1.1.1:53 android.apis.google.com udp
GB 216.58.201.110:443 android.apis.google.com tcp
CN 210.14.155.212:80 api.moji.com tcp
GB 142.250.187.206:443 tcp
GB 142.250.187.194:443 tcp
GB 172.217.16.228:443 tcp
GB 172.217.16.228:443 tcp
GB 142.250.179.238:443 tcp

Files

/data/data/com.moji.mjweather/databases/alarms.db-journal

MD5 68b098ed9706ee3a4e5dd5a9f1376f0f
SHA1 d652ee189faf04f115dec3e6ed6d5ae05f3d17f1
SHA256 52d92b5e127735ebe90969ac4ce06821d6f1d88f1c273e7dd4bfcb4a677781cd
SHA512 650f7dcf48be108a151a14a280115e628423d191e8de2d81de949934b6224c810ffce2ba760ab6529277e104a4ff87a4f5998fb876be55560da6586ebca53558

/data/data/com.moji.mjweather/databases/alarms.db

MD5 e22aa98bb16cf4777d1dd739348859d4
SHA1 b4905c33323344030a29a232bec50ab181a04584
SHA256 b8e3a59551a99d0d9f3529c0c5386cfa0fa6c837068b8d7894fdfba7a68cba96
SHA512 0e348e97576d348b41a71f1b3359db4c4c60a7a9a7a4eccde92dc48009163be4b664774953a85a96a7713e35638fbc132dda2c2b0822b520eadb1eaa2314d60f

/data/data/com.moji.mjweather/databases/alarms.db-journal

MD5 3f83c7120e72cdb9af2c177c3f8e56b9
SHA1 b94adc5d36b83fce4a7717d5153a9900fab29e82
SHA256 34f674f54eb36097ca762829bd7b36cc49a80c7af043cf6cbbe22c6688c47af0
SHA512 42ff1e61180fa2275311a3b24ca136f9a8b9eb046df973e2242c607956a1f6bac8142b27ab241dccb03d03db441b771a0c5b785c2de1988b57393d5b3ed184c7

/data/data/com.moji.mjweather/databases/alarms.db-journal

MD5 a2512fddc7327e273ca94723053d3506
SHA1 ecf418172797e383c28239e92b3a1f3079f5bb1a
SHA256 f5f49995177eaed37fd07945c15335355af0c00ce7d03c1b4f2cebb5377bf3d4
SHA512 8265f9614091134645c837e56c89985ea9db6d20c04255959efbaa2be5fd1cb84472ffa9d9e4445713f2c2d795067eebf53c4118f1323887819fd48734ddb370

/data/data/com.moji.mjweather/databases/bugly_db_-journal

MD5 10768e5513be4ceb1b34ba2706b888b0
SHA1 9d4d5959054e3e9a6d6c1b54b0395e0e5338bfb2
SHA256 c294a2ae3750b80bd63368989637368138240899d878cba0a301134847b5daa2
SHA512 f56c9c897cc96aa710abdf292556a1b29a7c7421962a56ee5000d5be717c40cf6d83f2569c4928eb503045e2bdb9050ab351f880c6245b7fb0db349213945d03

/data/data/com.moji.mjweather/databases/bugly_db_

MD5 3a68d8b3774e93fce9ca60c893568c32
SHA1 c2e65bd2bf9098731c31ce4e4530b84b44e82a58
SHA256 28e7b065c2de2d54e4f41ce0da47eed67b97d46b97b119f3cf1d4d50597daf0c
SHA512 3e586c8e92212f6e110dbfe1f7fd46da71a7e0b0a437568f06d737fc93972f29f58c67ca44c8079cebb12756472d2c00341ed6b639c1e9917ed6fba8d2572bdf

/data/data/com.moji.mjweather/databases/bugly_db_-journal

MD5 d5c5fa10e54a320d7f701658b59324cb
SHA1 39e61d1a3069aa621bd5351487686447072ed0ec
SHA256 56d0cd87c6f37497901ade4f7390a90f23f5a4634686a76bcd1f9d068d2d94af
SHA512 710d36f1e8fb78665d478496515d94bafe5b249e59451522be3ab2d8076947b63d48224ee9875cd5fbf4b6f0450b1b7a93dab4e73992499afd29248958c5df9b

/data/data/com.moji.mjweather/databases/bugly_db_-journal

MD5 43782785c2048af4c77c2076fd46a34d
SHA1 27cba70d72f86b21ac24f96f7ab29f0b4f9108b1
SHA256 7263b3316e2d74a4d5fe46dc38cdf00ec32fda1324d1c57de8e8a26700886aa7
SHA512 76c534e802c8ddc0af447cc86452b29fc97c62c3fee0bad1410a06f2a625330c17362643e7fd4d3783a6935942aea2205a363ed82bc2659ffb74d6c9e53190c2

/data/data/com.moji.mjweather/databases/bugly_db_-journal

MD5 f1b2dd38ee159e7757270ded30aa9af0
SHA1 66c61b29eb4985aa7bfcc3165e1b80100e0fdac7
SHA256 5864d137eca9619272fcb1e4613a53a9a074a698cdd2e4febdad97130e948724
SHA512 ce79b0bc6d06c5476cb78cb9c2831eb92ced019da2fe9debb8cae6cc22ea0ad0db9881a2bf19cb313d147e77aa784fc09b7014b1d4b7b499f8eda58f2cf29456

/data/data/com.moji.mjweather/databases/bugly_db_-journal

MD5 56dde5871acb0b8b61083ee536cfc972
SHA1 0495dfdd5b89c1976add7e12e426cfd6df8c2816
SHA256 a599296eca7a83822ca5536b9df102dbdf2516eefc7c8989bdef89ea233e1f23
SHA512 c9a191e4d58a0b70bb245ac0c1d3de7560708b870f3e0896d53ed0c2d29cd6174f85aae34a0d7e3a3e8c0e292d82ce046c2892abf0254426203c3d5d0e1697b5

/data/data/com.moji.mjweather/databases/alarms.db-journal

MD5 bbf662f196ad023922a215016ecdcc00
SHA1 c2622a0dfb27e810750fae091d4375afa492eb83
SHA256 928c37e2a6c6b287e81014f8da7d586836e3b71b7108ee1547762a175d07b6d3
SHA512 ed3bed82561a10149ec01936bf72e1943eb57db774f06aa4f996a71c46fbe8beb59413ab6e137765c4d09c5b9f6789d63fa0351855ae8697861e6227d9196878

Analysis: behavioral3

Detonation Overview

Submitted

2024-06-15 05:04

Reported

2024-06-15 05:04

Platform

android-x86-arm-20240611.1-en

Max time network

6s

Command Line

N/A

Signatures

N/A

Processes

N/A

Network

Country Destination Domain Proto
N/A 224.0.0.251:5353 udp

Files

N/A

Analysis: behavioral5

Detonation Overview

Submitted

2024-06-15 05:04

Reported

2024-06-15 05:04

Platform

android-x64-arm64-20240611.1-en

Max time network

8s

Command Line

N/A

Signatures

N/A

Processes

N/A

Network

Country Destination Domain Proto
N/A 224.0.0.251:5353 udp

Files

N/A

Analysis: behavioral7

Detonation Overview

Submitted

2024-06-15 05:04

Reported

2024-06-15 05:04

Platform

android-x64-20240611.1-en

Max time network

7s

Command Line

N/A

Signatures

N/A

Processes

N/A

Network

Country Destination Domain Proto
N/A 224.0.0.251:5353 udp

Files

N/A

Analysis: behavioral8

Detonation Overview

Submitted

2024-06-15 05:04

Reported

2024-06-15 05:04

Platform

android-x64-arm64-20240611.1-en

Max time network

8s

Command Line

N/A

Signatures

N/A

Processes

N/A

Network

Country Destination Domain Proto
N/A 224.0.0.251:5353 udp

Files

N/A