b07ba1c3c75dcbc3b940fdb5600acd75b6ff4c093af3e907734727170540025a

Analysis

max time kernel
176s
max time network
185s
platform
android_x64
resource
android-x64-20240624-en
resource tags

androidarch:x64arch:x86image:android-x64-20240624-enlocale:en-usos:android-10-x64system
submitted
20-08-2024 01:21

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ad5a70706be4aeab629291ba58aea57d_JaffaCakes118.apk
Size

6.1MB
MD5

ad5a70706be4aeab629291ba58aea57d
SHA1

22287ad276db1897247999c1323433c85d90d1af
SHA256

b07ba1c3c75dcbc3b940fdb5600acd75b6ff4c093af3e907734727170540025a
SHA512

58e76d9cdb369ae3425590334799a63a2e9b921aa34ac7b19d8f5ae5539a92c90a45e3f6518d9f40ef82927f3b65f18f9959d4bd37361231e81db89dd8eb3449
SSDEEP

196608:elWVGbqBk+aw+yrONA2wq+6m/u0ESHVT7:elWgQk+aUON9h+TzE0T7

Score

8^/10

discovery evasion impact persistence

Malware Config

Signatures

Checks if the Android device is rooted. 1 TTPs 7 IoCs

evasion

System Information Discovery

T1426

ioc	Process
/data/local/bin/su	com.gosing.earn.wwz
/data/local/xbin/su	com.gosing.earn.wwz
/sbin/su	com.gosing.earn.wwz
/system/bin/su	com.gosing.earn.wwz
/system/xbin/su	com.gosing.earn.wwz
/system/app/Superuser.apk	com.gosing.earn.wwz
/data/local/su	com.gosing.earn.wwz

Loads dropped Dex/Jar 1 TTPs 4 IoCs

Runs executable file dropped to the device during analysis.

evasion

Download New Code at Runtime

T1407

ioc	pid	Process
/data/user/0/com.gosing.earn.wwz/[email protected]	4974	com.gosing.earn.wwz
/data/user/0/com.gosing.earn.wwz/[email protected]!classes2.dex	4974	com.gosing.earn.wwz
/data/user/0/com.gosing.earn.wwz/[email protected]	5085	com.gosing.earn.wwz:pushservice
/data/user/0/com.gosing.earn.wwz/[email protected]!classes2.dex	5085	com.gosing.earn.wwz:pushservice

Queries information about running processes on the device 1 TTPs 2 IoCs

Application may abuse the framework's APIs to collect information about running processes on the device.

discovery

Process Discovery

T1424

description	ioc	Process
Framework service call	android.app.IActivityManager.getRunningAppProcesses	com.gosing.earn.wwz
Framework service call	android.app.IActivityManager.getRunningAppProcesses	com.gosing.earn.wwz:pushservice

Domain associated with commercial stalkerware software, includes indicators from echap.eu.org 3 IoCs

flow	ioc
10	alog.umeng.com
28	s.appjiagu.com
50	b.appjiagu.com

Queries information about active data network 1 TTPs 2 IoCs

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.IConnectivityManager.getActiveNetworkInfo	com.gosing.earn.wwz
Framework service call	android.net.IConnectivityManager.getActiveNetworkInfo	com.gosing.earn.wwz:pushservice

Queries information about the current Wi-Fi connection 1 TTPs 1 IoCs

Application may abuse the framework's APIs to collect information about the current Wi-Fi connection.

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.wifi.IWifiManager.getConnectionInfo	com.gosing.earn.wwz

Queries the unique device ID (IMEI, MEID, IMSI) 1 TTPs
discovery

System Network Configuration Discovery
T1422

Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 2 IoCs

persistence

Broadcast Receivers

T1624.001

description	ioc	Process
Framework service call	android.app.IActivityManager.registerReceiver	com.gosing.earn.wwz
Framework service call	android.app.IActivityManager.registerReceiver	com.gosing.earn.wwz:pushservice

Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 2 IoCs

impact

Data Encrypted for Impact

T1471

description	ioc	Process
Framework API call	javax.crypto.Cipher.doFinal	com.gosing.earn.wwz
Framework API call	javax.crypto.Cipher.doFinal	com.gosing.earn.wwz:pushservice

Checks CPU information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/cpuinfo	com.gosing.earn.wwz

Checks memory information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/meminfo	com.gosing.earn.wwz

com.gosing.earn.wwz
1⤵
- Checks if the Android device is rooted.
- Loads dropped Dex/Jar
- Queries information about running processes on the device
- Queries information about active data network
- Queries information about the current Wi-Fi connection
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Uses Crypto APIs (Might try to encrypt user data)
- Checks CPU information
- Checks memory information
PID:4974

com.gosing.earn.wwz:pushservice
1⤵
- Loads dropped Dex/Jar
- Queries information about running processes on the device
- Queries information about active data network
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Uses Crypto APIs (Might try to encrypt user data)
PID:5085

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Event Triggered Execution

T1624

Broadcast Receivers

T1624.001

Privilege Escalation

Defense Evasion

Download New Code at Runtime

T1407

Virtualization/Sandbox Evasion

T1633

System Checks

T1633.001

Credential Access

Discovery

Process Discovery

T1424

System Information Discovery

T1426

System Network Configuration Discovery

T1422

System Network Connections Discovery

T1421

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Data Encrypted for Impact

T1471

Replay Monitor

Loading Replay Monitor...

Downloads

/data/data/com.gosing.earn.wwz/.jiagu/libjiagu.so

Filesize
480KB

MD5
27575837c253f3278c1dc8121aeebd4e

SHA1
76c5ce47b682f66c8dcad561ebf4ab4ceb958f81

SHA256
9a23319c6c4c39605c7bc75400462b6187b37cd05ca96aca3a83a8d1d0d8a10d

SHA512
beef83aa23dc0f91140ede4e679962f31c657185e254c76226ffa299aa37ee84f4ad6b805b8fbd4ca2510ff5740e70ca87f5d030a4e3cd5789a42125f631618e

Download Submit
/data/data/com.gosing.earn.wwz/app_crashrecord/1002

Filesize
231B

MD5
4d5671557f2c6fb4cd753a948d928dae

SHA1
1858d764737d1b36e2847347273090f5f9bcdc69

SHA256
0cfe4d78fdba627abb8dc603c4d3094f30fe79109098964cef3038c4809c9f8e

SHA512
25d6e87d67384dc9d3faa0dd0d5437be9c2ac41718c346f44ea81fe3a88225d83f7b196caea6a9d4a9bd71d7d5ac6c722190efe3b833852301c572c7ed1ab3bd

Download Submit
/data/data/com.gosing.earn.wwz/app_crashrecord/1004

Filesize
231B

MD5
1a287f8aaa11a02d68b953b32f7b8993

SHA1
498c553cbe731caad1bb5868ae6a61f309c27c21

SHA256
0f49b4e646d91d1a5a5d3a64948d42884a38767cf41d6965a480eca3d92e6b21

SHA512
f1d6c4a4ffea033e92724627d2cb1fa7327f8a6794396e3cb93c253466d322d4dca2ddc990326308c784ae87eaa3bb4f338e0be7ecd7c90e19245909455f5e88

Download Submit
/data/data/com.gosing.earn.wwz/app_crashrecord/1004

Filesize
58B

MD5
0d210bfb2a0e1f1b4c082a6a0f79de07

SHA1
bb8ed9e364db79d1d9f2fcde3f15091893222faa

SHA256
988722c23d78a46021d0e7ca9deee7aa8bb83288269174ffacb7316f381cca1d

SHA512
536e9867b0df29b15b789f8949be6ab37fcdeccb9d39ded981da7dc2052c9533d0ec0e6f9a5444132977605d372e1463d91bdde41b528ff2ca3f65ab152325c1

Download Submit
/data/data/com.gosing.earn.wwz/databases/.ua/ua.db

Filesize
32KB

MD5
3467a484ab4436b3f9cafe49d7c81f30

SHA1
27dc4391d60bca3d8869b8faba32e58c3b65177b

SHA256
4a56bf9494f2005474839d6d8d6063f9996b83ff38f8b1ba8fcb38fa62d2ad5b

SHA512
7c694cf91874acadc532fb556d6cf5089f0dac1832cee440bbaf1a08cff33bed097631e747b96fd3e39510256f7283d96e60b5333c40b12ba79eb2dd7d08e66e

Download Submit
/data/data/com.gosing.earn.wwz/databases/.ua/ua.db

Filesize
32KB

MD5
38564ad4c73e5619bc2264b0c44997a5

SHA1
e55f6fe1b20347ad4cd58d77af0b0feb149f63d0

SHA256
1820a909a310bf7bc4ddaab6c8be3954dedd53612749f7bd08fefbef31670ec8

SHA512
30d84731a3d8380e63bb73227623e86bd779476474269f252abe546028531c77658573874444e66b862ea049724e93a9344b1d4fd9f26c0fe02a79a4079a9a7d

Download Submit
/data/data/com.gosing.earn.wwz/databases/.ua/ua.db

Filesize
16KB

MD5
55670a83ab455ab2cf7af3b6abd3d123

SHA1
c8a999b2964815735e8a594f23316945d3b83085

SHA256
7aa112a3c0e20d0998d3cea02b052ca87644db49890f789ee363b22ae4292d0a

SHA512
55acc3587463fa24bf4b207e121aa5aae3c6a5b8b4e03e95d559fb3810a97fa75cca154ae50f8317e26323280dbbc58605fe768dd367fde25493207ac820c675

Download Submit
/data/data/com.gosing.earn.wwz/databases/.ua/ua.db

Filesize
16KB

MD5
9f10160b8ddc323373b83add47014a20

SHA1
5584df4c93436b507ce8b23eb705342f15d23e7b

SHA256
cee9b00a3b109515e44b0c65f134ae469dd6b6d5f14449060ff23c224d4826ba

SHA512
dca2cf376498898e38e91ae2bec5663e3abac884c60d72a3216fd59d9b86f3ef23109ffbd5bdbe20ec5c0dacfd9ead112d44c76af31fc04c3aef83a82c8fcd92

Download Submit
/data/data/com.gosing.earn.wwz/databases/.ua/ua.db-journal

Filesize
512B

MD5
88fd347bd9c317e79433ee724d705045

SHA1
ffbf24deeb39ff39e18a16c0e1cfea16f1a79070

SHA256
9149ba2dc83743c92932145a3a6276c99c33430fb952219fb918c06ddb608617

SHA512
3b405525f9f1c53e6aa4c2c4c2befd159766bc4e76322f3e27d0eeba74d381b821f0e69435d1657374efc208a59c7d29dc0ebf52f7f1499d7b18179176a710fb

Download Submit
/data/data/com.gosing.earn.wwz/databases/.ua/ua.db-journal

Filesize
8KB

MD5
611f962b610f629af8b01fd78baa4f8d

SHA1
a06fddf3ef791ce92aa89a23c772c72549f114b6

SHA256
0a5b1ad6e7f45f1decce6522b7ac4995b602242f97b1300a3ed508bffecf8432

SHA512
89f5e90038077bca76ed74b9bcabf450740c7914725306e9c4e3db9d657c9affded937c34c8987e052eff84d30bc3df8f6a5b6b459035801ae5761040278b58b

Download Submit
/data/data/com.gosing.earn.wwz/databases/.ua/ua.db-journal

Filesize
8KB

MD5
57a2e79cb45d21d1c59405ed4d9883f3

SHA1
109c16565ab75626cefa13c9d8f732555e9bb8cc

SHA256
c51c5c83ae13776f146100d67a4c5962560474a7ae3f1aa13094c3facea69ac8

SHA512
e249e10d86ac0a134ba13e86829af84d16deba4193d9d8d0fd557ea0cc642ea6fe19261d25d8dc3ee253f45e0a593876762f512242f47fd87e740ffc15a66a16

Download Submit
/data/data/com.gosing.earn.wwz/databases/.ua/ua.db-journal

Filesize
16KB

MD5
00c82611a910b3512ed6589492dd8760

SHA1
dafcd16bfe97db5dfcc4ceb98a6cc5caae5fb7c3

SHA256
b5b4e9fcbfb153a3587e21205f54effa01dc2b9a545b413d003abe0b7bcbedcf

SHA512
bcadb83126bf71fc7f598e9408609caea4da0fdb3c5100bdd7fa5100a57e938df1d1a50f315a29da9adf4107d0e27558098d470acf2354071e15aeab3cf857b4

Download Submit
/data/data/com.gosing.earn.wwz/databases/.ua/ua.db-journal

Filesize
12KB

MD5
5c3ba4c68a766db811dd6cd956095457

SHA1
c0450b474a9160cf0c7c010510a4afc43b5358cb

SHA256
178ea079938c0582044c8f5195bd0604e459caef432627607253d5808e497cfd

SHA512
1aa8c3fdba088ecb11a85e16cbc505bcc1518a5f84dd094b796e238c55698047d5b70dece20a0801bbf334ab146c7c79967b51c5e41128403338ecd5f58a62f9

Download Submit
/data/data/com.gosing.earn.wwz/databases/.ua/ua.db-journal

Filesize
8KB

MD5
d12243bd2ca241446aed5cbee3c5919b

SHA1
8f37bbc51e69df9baccd6dec4f60937838e238f5

SHA256
474adbb9a1e790bd524bb80c46233298fc5e3af7c3b74af5ace9b15725d8d045

SHA512
f8d65760da8fee35d4ef12443a7b985ab7435a1ae87571553060b2538bc95b0805a5041ebf1badbf65658bb95e73edf8f1d1225c110a3fde6418ce3bc248f6cd

Download Submit
/data/data/com.gosing.earn.wwz/databases/bugly_db_

Filesize
52KB

MD5
a41556d1f0226da108fb1b73ee0dfae6

SHA1
c9968a41512848959ee9912bd7da828f67ffe642

SHA256
7c0ba54acf9f62d0db7d2a72729cb5794f6bfdcb9280b592980662986b696e4d

SHA512
ac969e1649b562cc829966593c9e328d078e9e8d7526d08c6ba0255867592b15ab22afd2b482e44e7c89cf4e7f4983124b8603b98a1fb24a68f0dc9ac81482f0

Download Submit
/data/data/com.gosing.earn.wwz/databases/bugly_db_-journal

Filesize
512B

MD5
bfbed9528e68d05926228a6fb5f19282

SHA1
2ecc62a55985f3f2fa31e7ad76b51b066b945960

SHA256
8496cc0ef4324ec752ed3d16f7e1d993e2c837ee1e4b5f28120483e2394fb285

SHA512
1ad1a28f5187127d7f743df8f437ff448fb1da0ec8b687a29c72a1ef82156638840d76058aeb87da813096d9ad29cb0a2f9471b16220e56f870cb7285f3eb19d

Download Submit
/data/data/com.gosing.earn.wwz/databases/bugly_db_-journal

Filesize
8KB

MD5
25d7a2ff563a7432159d79d592dec6b1

SHA1
394ef9b73e138f082e87c2f8bdd48785111b08dd

SHA256
2ebd9dc8261bbc0381bcbfa039a2197fd236eee105f2c6d4f2b436d63db500f2

SHA512
9d0fb35090cc98ed30f8857d9d5e1268efe34bef5bedce73cf999eb47de693ed6125f01a1bd74eb2e5b398f6d6b034559263a7d3c0cb1bbd98692cd03c13f969

Download Submit
/data/data/com.gosing.earn.wwz/databases/bugly_db_-journal

Filesize
8KB

MD5
ffaff9c298eb5419fd8f76587b1c0070

SHA1
631fec86a3321d0741524ec9f6e46b74523d0139

SHA256
5e67edb518db3efe57252007ec79439245f9a867779df71a8b8161d7868f76f7

SHA512
3ddcfa8650ce21e883ab2ae05f572243ecc1e051812ef015762be2ba784dee32108dd9f24bca6fac424716ffefd2a385a5e7efca24d0f4944d9d413da94f2ab1

Download Submit
/data/data/com.gosing.earn.wwz/databases/bugly_db_-journal

Filesize
8KB

MD5
d11f23da50e20bb875e0b1bec12cc7db

SHA1
920c1a4667eea366d63396a0e175ae7cc320a991

SHA256
5ac177a0928391fb43f63061dc5d50779415f235502434eece77df6d4a21c957

SHA512
c3a8885cc9ee97d20f5d2fcd4ea3597d58f95402ee4fa3cd6687ce3daa71f366acf5920919e0b494e38351715e38e5fcb3937e4557cb55f8243ec4c8df0a12e2

Download Submit
/data/data/com.gosing.earn.wwz/databases/bugly_db_-journal

Filesize
8KB

MD5
84546c62022d75638bc93d0d23bb81e4

SHA1
6ba55a0808fe20a8ecce5b43504bf8863b411b3c

SHA256
b260d598c736796f2416fc8acfece95d2b707c8dc3b4c9097a2d540695ec049a

SHA512
4d6e29f5f1fc72f3e8dca621ecbf6bf84c599a16f8576746be4389d635ca98c49594df4d38729621fd82b6f37bc8ed3a93fec0ac62b94c8e887423448c1373fd

Download Submit
/data/data/com.gosing.earn.wwz/databases/bugly_db_-journal

Filesize
8KB

MD5
fe03504e763c15646fd9b1482512543e

SHA1
2b5656147205b9bc63bda6a2a971311003330f5a

SHA256
552c844066b1d411ad1372658ce757a4e32c00c1bbdd4e06c3eeeb73fccac844

SHA512
62d640bf2c82f7e61611947e8a607ec6c87f1538cf69a801eb711586174d2e7e1bfa97637d5369be917c6f426fa338808d7a31a118a01057c2a2a785632de1bc

Download Submit
/data/data/com.gosing.earn.wwz/databases/cc/cc.db

Filesize
36KB

MD5
0908e924aa236931dc7166fef6e00862

SHA1
7782648d6d8f6e835bd47058d4852932c096a467

SHA256
38f8548795ca7470b449dd1de9598c07a247ba59883c0764c9c96ff0b7d31d7f

SHA512
3c16fbc5172aed04cd206e776c46d26e911732c6e3631536410a71f1d217449475727ac9b3175e827c5ce645a1da9e05900258ee6ca27c936a9060f241361dee

Download Submit
/data/data/com.gosing.earn.wwz/databases/cc/cc.db

Filesize
36KB

MD5
67c12933d1e0e63d9801a6aa43092ce7

SHA1
b6936908554e4a1986b8eb08289e2d3545e8ff74

SHA256
abda5dd4cc2e7dbb951637c4b49d6990f9f34411fab4dee1a387dbcc8e7eed40

SHA512
db8b818daa3ff4ec7678645f84bf8b45c809bcbb758ea78b28982d071572655bba2d20e6f1ca4f0d057ab34fa655c5bc40457dc65050180351a2fc04a47175dd

Download Submit
/data/data/com.gosing.earn.wwz/databases/cc/cc.db-journal

Filesize
512B

MD5
d2848058572461162b587efd8a07c26e

SHA1
15a0ed1d40269fd2041efd7a6656b96085bf3174

SHA256
a1e34918b10d9a72d46c5434225ac9b0dca7c3f3e3ad67fe1a8db5c15e6c2d03

SHA512
79e0ba2a6606be4b2d4b2ee90defe2c5981dff2c2d9d4a7063ebc4c13193835a555b08d1b16bef932e3e2a7eb5d02df60c720727a8b720351edb3eff4bf8a0ec

Download Submit
/data/data/com.gosing.earn.wwz/databases/cc/cc.db-journal

Filesize
8KB

MD5
ff1b414333bf596a15b41cc515328a4e

SHA1
ed27389cbaa9b09f3b3f9f7661fc54b188285d95

SHA256
4172f34a16c04f04f96b589457e50dc66f0c0ec7b5538c1aa089faa08e07b794

SHA512
72bb54813c19474e4199613d5252178f7c0d10fe6e1d47f4a8d3e380729acb276bb3853fa3181bdaf4ec309d1c05d87a089b7474fd6645a95f05774d51d1a45f

Download Submit
/data/data/com.gosing.earn.wwz/databases/cc/cc.db-journal

Filesize
8KB

MD5
08e222f4855c123e8d7a8c0b1b380d04

SHA1
2075e1d8e73768cd3c624f299ff893e3c7e84c49

SHA256
7bab38c63e02575cfc01fef89c9eeac14d88d32f75974c3d0134a25856f29b0e

SHA512
1ddbd8235a752e85c143b15f4c8bc11fc85fabfc4ec587e1da7c28ab131329d9d3867ab936a41033be4b313f9570144b08ea40ae59791e70c76066be6529ddeb

Download Submit
/data/data/com.gosing.earn.wwz/databases/cc/cc.db-journal

Filesize
8KB

MD5
c45426a91289a35390bd95e41fa70494

SHA1
63a0308ff1fb7ee5e8c0f30e22834e91d0c4f832

SHA256
c14804453ef9bb36871eb3697e22d8ef8d7799e63cebc738e3f8702f4dd8ba90

SHA512
674a399aad4ab4e08fa6353723917f49278395850705714e7c76eb59275d7fb51d74f0143099487ed1a1236c3b28b7f297a408646a433a4b13876593724467f8

Download Submit
/data/data/com.gosing.earn.wwz/databases/cc/cc.db-journal

Filesize
8KB

MD5
cdbccd4049666786521e298010f81dff

SHA1
e79f6a3835ec9710c7ca422395a74628bfd89151

SHA256
74ea68f6036a246019e79eaa0a06611410d0e61a7f1ebcce6464f7bc60aeb74c

SHA512
69d5d13fb55d6e8d1d2422d740afd37589fe5dacd74e17b492302646ad58f8a57870b13d6888586509a5903ae1a3d5680e63787b933339b1bf783ae8ba764544

Download Submit
/data/data/com.gosing.earn.wwz/databases/cc/cc.db-journal

Filesize
12KB

MD5
7d67e3eb86baa22c10a8d6158082591f

SHA1
7c8e3fa49144dc635f49401f93caa707aa339833

SHA256
ac9890e17e0e47acc91cf7d06363f5ba67c98dec8b0caafe46170d87f1d81bc2

SHA512
d0e955e7b1e4ee5a2995f3a4bd7a965446868b0567f0ff816bcafdf6a5897b549eba24caa0f2d0faa141fca6e8febf15a49b98c7721e4239f69cc6a13fa6ac8f

Download Submit
/data/data/com.gosing.earn.wwz/files/.jglogs/.jg.ac

Filesize
40B

MD5
188dbc2a33372a39140c3c2971a8b878

SHA1
96dd286d7a65cdd319c46f71135ec794c9318ef3

SHA256
314f2f196fe3845e8d20a3e2370f118b363d4bdd77b67af60c60604dc294f429

SHA512
67393e5f06271d076baf9d42ea2d0cb0e6502a0dc218d1a9d30a12e96211f4a352095d327e2147443eb11de7db7b48a15087ee95ac93dba582bbfc3968b18d03

Download Submit
/data/data/com.gosing.earn.wwz/files/.jglogs/.jg.ac

Filesize
4KB

MD5
17f4ed0dee3b60d49f3baff642edfeb9

SHA1
84e15df1f3fdc30c0d9eab7cb1b2013c0d97aab9

SHA256
c39ff2f138fc1fa37a1707bfdd33afbbe7e2cc7f6570ee18ca81ecaf00b02338

SHA512
49e1de494ffea525bfee94281b591c5d05ad57823e3584c8cfd3efccce7533af51ab25639c86ac6d7fa6447531f8e0064f06419aa857e4984f488fdee561dc96

Download Submit
/data/data/com.gosing.earn.wwz/files/.jglogs/.jg.di

Filesize
340B

MD5
edb2e401287b30f24f269de372a67b6f

SHA1
716afc21da152d39adcad8b580c30518e83d9d1d

SHA256
5553cb2f5494f2a0be8db5c0eb45ba77078599fa30559232a5864acff68588e4

SHA512
a5c63382c7947212c4401426921926bb88129a30e4cdf75b104a86a3091cf580131e50419db80cc8750c4c9bb3180cb7706e2218d52e19e97b6436e8ab6282df

Download Submit
/data/data/com.gosing.earn.wwz/files/.jglogs/.jg.di

Filesize
12KB

MD5
f59cde988e8f2ad7a9e59c74fbc1a178

SHA1
fd077fd39f488db1b0294011eb75f3753f5f266f

SHA256
4ca70b3ead044160e4746019dcfdc3e09e671f56ba199230ca5f4895c2822978

SHA512
13005dc191f919b41fc1e6230946a311e730b671049b2b2a71a4233aada5c71e64ba787dc1ce4d7b2389d0307c0c32cbdf25f0794c00ca8537ff5511d6c2a45f

Download Submit
/data/data/com.gosing.earn.wwz/files/.jglogs/.jg.ic

Filesize
8KB

MD5
bcf0660b68b5970acf89b8a4c7effd32

SHA1
79e1da71c43b298b42d7c836e2bca24bb68122b8

SHA256
fb10cd75d4ebd3d395a37c1f7f90ba4c4f67374d22cf8c1c72bea80b81565a34

SHA512
2dca3a3cb75fafd1db016d8ef11d12c8c1dd470e44e080b2e31708d92e09111854caca8f90d57e8e633b326a38d6db8879eda6942c52677f29b4a758c1f1b07b

Download Submit
/data/data/com.gosing.earn.wwz/files/.jglogs/.jg.rd

Filesize
8KB

MD5
ba38525c9336311decc6a56f45fd0f10

SHA1
beb6ffd7b26db32e5818445f1574eb45194d7297

SHA256
c6ed6c037a5b2f37beed9f010cfd9a71de98f32c00e4452cc2e1c9c892c6a28a

SHA512
6e85b56ac9142366898c6737be2b4bc90c2bf6a3564a31cbdd95ba138351a2f7720e9a64553f2382222b7fa82b581c57ccb76786b0c7d4b8f9cbbd57dbde44bd

Download Submit
/data/data/com.gosing.earn.wwz/files/.jglogs/.jg.ri

Filesize
48KB

MD5
e12d8de758c95f824ad45bf31ed35452

SHA1
1e71ab992b9de93a9758bcf1d3d56daa6244e611

SHA256
633ec86c61c87bd51782340b159b28c82d87a2d891de14e23e3632a0b8cb9641

SHA512
9337f774e4c203dfc0cb8f285233a8a9dc30e2ce49f5b870fc327a93aefd9068a2c092b71daddb144d9e417096ad7d2189b9b850dc18b5d5e9a616e61075fe41

Download Submit
/data/data/com.gosing.earn.wwz/files/.jglogs/.jg.store

Filesize
127B

MD5
90f381b9e164bf6d0a61c54725c2abc5

SHA1
ea1aed1575b40db217452a32d43330cc6dca423b

SHA256
025c2a80614f544a63c7ab90e7578234725cae92ec8201be1b7a2a62b0bd5470

SHA512
739d5c159f6d0e78b8be3765c4495126a2faa22e5ed4f483f79728c59cb4feaa802b355bd59495e278e72c9e63de86d8d2eba83cd50cebe4ec2c5305fe3c0275

Download Submit
/data/data/com.gosing.earn.wwz/files/.jglogs/.jg.store

Filesize
8KB

MD5
b8a450931dddf71442b9f834784dc60e

SHA1
776f6ff27e36c733968b8b8d30cd5e33ead12104

SHA256
63335536a9cd7e191bc2bd736e5716a2aef60baa76bd8f09da395cc6c17644d6

SHA512
c171ffc21b88da8363bd7ed6718894e9a40460dfc49c0bf5886b865005a368c06403b55438f40ac80796bd96bfa1e18320244723da9acb14ca0e5111c1a5b50e

Download Submit
/data/data/com.gosing.earn.wwz/files/.jiagu.lock

Filesize
512B

MD5
bf979855d1ee459216f743f0ccf53cbf

SHA1
c1885e2479384b93882d90cade0ec842bbd67111

SHA256
99292ae22e9f28cbfe67620caee0c9f66ebee63a996c8606523283bdc7ae4d4c

SHA512
1fe362eadfde43d405af3ea9116c6518c19312c681c3581fe057226aeff6b6c07897b19889bf65eb8e2e4fff391cefebaffee6be9fed035659438b732f17e4c9

Download Submit
/data/data/com.gosing.earn.wwz/files/.um/um_cache_1724117052742.env

Filesize
1KB

MD5
fadb510d1e0bfde00d3c254e0b040608

SHA1
aad1c3beb0cd6fa360ff3eac8d95eb5d15b93c5d

SHA256
7679de579ebe242996369ec7732d388c3c3df4d7263c18e81a4bce1865545894

SHA512
d231e282bf0f3f0709abf234da04668adb241afeeb21875d617ad925c879d2070d579763aa2cf117f0e67b9b7a0828a1c2b591c328454e67dc3d14b8f2b99273

Download Submit
/data/data/com.gosing.earn.wwz/files/.umeng/exchangeIdentity.json

Filesize
162B

MD5
1fe771124358042a822b179ad4cca996

SHA1
e6e7b5e3f126fbd27ef8c666c1a13b94710d057e

SHA256
d7ebc462dee196474798735047f2ab2eed07a963f8b12d71a100dcceee2735ea

SHA512
9a5c55a565c385c5dfb5598d00b7eefd44281e4a387aa6ef7cba85a6d7163aba7fea6f96c72d194d8efa16d0c37de9c9cf8bcb4f66d0a7bb1e72f232bd1d9e96

Download Submit
/data/data/com.gosing.earn.wwz/files/exid.dat

Filesize
56B

MD5
597eefb3bef6806b53a227ab09b30ee2

SHA1
2c13abce071c61f98419162bad93f4ac07aeddd9

SHA256
a109c304bad1eb2256f884e2f1c62fa19f8a6221f2703b308c1f9f346c7a7f46

SHA512
7d37262b5fd55265e9be09784e5801a2058e9b86966509b165376af0c2ba22cfca29886542af632930bcd7a141ad0234d0d7d16738cd6f5a628d8a7c00007717

Download Submit
/data/data/com.gosing.earn.wwz/files/umeng_it.cache

Filesize
350B

MD5
d31476086c2baf97af7d320fbb34fe70

SHA1
d88a94963441ede1fe1655e343bc2d303881feb7

SHA256
62f602f6a1303d170bfaf9c47effc79c26644f666744d4fe9fa3d86b9f707fa0

SHA512
db0f209d8d135c2ee53ee6a9cfcff97d398d1f5705f3a984240f3e4e6a1773554b33481d034ac45ea4032136e4cbe3af3abfe53e10c4c7091bc46de110bfd849

Download Submit
/data/user/0/com.gosing.earn.wwz/[email protected]

Filesize
6.1MB

MD5
7ece55ff6a1af734546577e56e690319

SHA1
c797dfad914bf01dc7b20222728f8f24ebe2d968

SHA256
06950e0edef2ff8028074e212bb0f4c9c311cab2f7afdfe9072a4c8a17b4deba

SHA512
5ea35bfe4106022dcc4a0e62b50fe7861d89da3a1ad40b3d9130e2bf13bbc65d67441463e168df4b961ee0d3fdb479772b459708483e611c82e010cd33f63d78

Download Submit
/data/user/0/com.gosing.earn.wwz/[email protected]!classes2.dex

Filesize
2.5MB

MD5
5883910facbbafa7c98f8349f9b952b0

SHA1
3872ff64822d23464deded08e57adf607a32d899

SHA256
b93549c4999a0ee33b3e083feb3c7f02b856468b7a91fbe118907d0188252291

SHA512
c8ab64e05c8b9061be7fec598432e4baeb091f949b166e149d3ddbcff3fbdbe40e818e00f1d0c67e14dcb3a131bb09da5ac52422fe04630806e952c78f00c50b

Download Submit
/storage/emulated/0/360/.deviceId

Filesize
48B

MD5
4c4c5285293d5141f582aefa4e038669

SHA1
e01852a72e5a8e6f7d63a21426b515118196047b

SHA256
36c5c63f39ddf7a6a9c01946e4f78b95790aa734176802e793e95724a1b5b731

SHA512
097aa673273e307f7bfb7c08861ad389d4b5f7fae55d972a5c1636aa66d0b8d23b5eb9b696cefe0e5b942f23969dabf0147397aeca85fb9a4d75e0473104e399

Download Submit
/storage/emulated/0/360/.iddata

Filesize
32B

MD5
d2164ff9265de8ce3eba0f488e7e6113

SHA1
95580eca2c4ff27d47ebff9bfdbc81e9579d7649

SHA256
6c83377d7b069dfe340ce104aeccab6630d75916c26920c117e35fc9f4a8ffad

SHA512
0c142bcc80be03745a8d662e922f79578cc200af30b17f16d70b21b51aad66af2624da1f9d6f4b616bc012c3a3ca55c83cd019b15de8ffe9eebf204d19e29a95

Download Submit
/storage/emulated/0/Android/data/com.gosing.earn.wwz/files/tbslog/tbslog.txt

Filesize
4KB

MD5
033255f14e85314f999af3521ded45fd

SHA1
bb7cc4a1d6b0bddd696572c74d2309f2b920ee71

SHA256
3032d8011ee5e133f835bead4e29b7c93df05984f68237fe2d70664b4fafd293

SHA512
4d7703526b26fe103c713b33d4cd1ee0702c38f819ed6c446155f13a07dc7c82112a31bf6507eb84a4e5f02a2e059855487a75a269b90264aaa5238b9030e4c1

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads