676fabdd229a06558244e2d84e549a727b9116036e2ac80aec1f5d31a11ef830

Analysis

max time kernel
179s
max time network
184s
platform
android_x86
resource
android-x86-arm-20240624-en
resource tags

androidarch:armarch:x86image:android-x86-arm-20240624-enlocale:en-usos:android-9-x86system
submitted
23/08/2024, 03:20

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

ba27809f5e6ce590cc2464e175078cfb_JaffaCakes118.apk
Size

18.7MB
MD5

ba27809f5e6ce590cc2464e175078cfb
SHA1

f0bae056fc2f6620aa92c3af639cf0dd66cd759d
SHA256

676fabdd229a06558244e2d84e549a727b9116036e2ac80aec1f5d31a11ef830
SHA512

a734635a72389f3b316ed83e44f40b9ec92c8e776fc9b33a8eab9081940dd80854d5a42e91b580c2ea70b736a44a7487a43937b37607378239766571256e7171
SSDEEP

393216:FMoaIev2zgPO9w3ZdGSbz5dL9PSYh3ylDlzTSjU9IGc5nDAx:PabvPrGSRdL9PS2MR9Ib5s

Score

8^/10

collection discovery evasion impact persistence

Malware Config

Signatures

Checks if the Android device is rooted. 1 TTPs 5 IoCs

evasion

System Information Discovery

T1426

ioc	Process
/system/app/Superuser.apk	com.nowcasting.activity
/system/bin/su	com.nowcasting.activity
/system/xbin/su	com.nowcasting.activity
/system/app/Superuser.apk	com.nowcasting.activity:pushservice
/sbin/su	/system/bin/sh -c type su

Queries account information for other applications stored on the device 1 TTPs 2 IoCs

Application may abuse the framework's APIs to collect account information stored on the device.

collection

Stored Application Data

T1409

description	ioc	Process
Framework service call	android.accounts.IAccountManager.getAccounts	com.nowcasting.activity
Framework service call	android.accounts.IAccountManager.getAccountsAsUser	com.nowcasting.activity:pushservice

Queries information about running processes on the device 1 TTPs 2 IoCs

Application may abuse the framework's APIs to collect information about running processes on the device.

discovery

Process Discovery

T1424

description	ioc	Process
Framework service call	android.app.IActivityManager.getRunningAppProcesses	com.nowcasting.activity
Framework service call	android.app.IActivityManager.getRunningAppProcesses	com.nowcasting.activity:pushservice

Queries information about the current nearby Wi-Fi networks 1 TTPs 1 IoCs

Application may abuse the framework's APIs to collect information about the current nearby Wi-Fi networks.

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.wifi.IWifiManager.getScanResults	com.nowcasting.activity

Requests cell location 1 TTPs 2 IoCs

Uses Android APIs to to get current cell information.

collection discovery

Location Tracking

T1430

description	ioc	Process
Framework service call	com.android.internal.telephony.ITelephony.getAllCellInfo	com.nowcasting.activity
Framework service call	com.android.internal.telephony.ITelephony.getCellLocation	com.nowcasting.activity

Queries information about active data network 1 TTPs 2 IoCs

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.IConnectivityManager.getActiveNetworkInfo	com.nowcasting.activity
Framework service call	android.net.IConnectivityManager.getActiveNetworkInfo	com.nowcasting.activity:pushservice

Queries information about the current Wi-Fi connection 1 TTPs 2 IoCs

Application may abuse the framework's APIs to collect information about the current Wi-Fi connection.

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.wifi.IWifiManager.getConnectionInfo	com.nowcasting.activity
Framework service call	android.net.wifi.IWifiManager.getConnectionInfo	com.nowcasting.activity:pushservice

Queries the unique device ID (IMEI, MEID, IMSI) 1 TTPs
discovery

System Network Configuration Discovery
T1422
Reads information about phone network operator. 1 TTPs
discovery

System Network Configuration Discovery
T1422

Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 2 IoCs

persistence

Broadcast Receivers

T1624.001

description	ioc	Process
Framework service call	android.app.IActivityManager.registerReceiver	com.nowcasting.activity
Framework service call	android.app.IActivityManager.registerReceiver	com.nowcasting.activity:pushservice

Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 2 IoCs

impact

Data Encrypted for Impact

T1471

description	ioc	Process
Framework API call	javax.crypto.Cipher.doFinal	com.nowcasting.activity
Framework API call	javax.crypto.Cipher.doFinal	com.nowcasting.activity:pushservice

Checks memory information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/meminfo	com.nowcasting.activity:pushservice

com.nowcasting.activity
1⤵
- Checks if the Android device is rooted.
- Queries account information for other applications stored on the device
- Queries information about running processes on the device
- Queries information about the current nearby Wi-Fi networks
- Requests cell location
- Queries information about active data network
- Queries information about the current Wi-Fi connection
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Uses Crypto APIs (Might try to encrypt user data)
PID:4250
- getprop ro.build.version.emui
  2⤵
  PID:4397
- getprop ro.build.version.emui
  2⤵
  PID:4423

com.nowcasting.activity:pushservice
1⤵
- Checks if the Android device is rooted.
- Queries account information for other applications stored on the device
- Queries information about running processes on the device
- Queries information about active data network
- Queries information about the current Wi-Fi connection
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Uses Crypto APIs (Might try to encrypt user data)
- Checks memory information
PID:4341
- /system/bin/sh -c getprop
  2⤵
  PID:4442
- getprop
  2⤵
  PID:4442
- /system/bin/sh -c type su
  2⤵
  - Checks if the Android device is rooted.
  PID:4492

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Event Triggered Execution

T1624

Broadcast Receivers

T1624.001

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

T1633

System Checks

T1633.001

Credential Access

Discovery

Location Tracking

T1430

Process Discovery

T1424

System Information Discovery

T1426

System Network Configuration Discovery

T1422

System Network Connections Discovery

T1421

Lateral Movement

Collection

Location Tracking

T1430

Stored Application Data

T1409

Command and Control

Exfiltration

Impact

Data Encrypted for Impact

T1471

Replay Monitor

Loading Replay Monitor...

Downloads

/data/data/com.nowcasting.activity/app_crashrecord/1002

Filesize
233B

MD5
3c11269d90d08540da5316acc8cedba9

SHA1
0758cd516291114068a3582967fbce2cf45e2729

SHA256
83a64f239682858ef9c1329fa3bcd1e3eb353945a654df941d3f8bdfa76eeb1b

SHA512
694a969e484399b82b8f817f85a283ca603b1133635ae820ce966f430afb282d43386754b32a5f56aa915ae0a79cc5c543709b6df18907dd90e4295312fc849a

Download Submit
/data/data/com.nowcasting.activity/app_crashrecord/1004

Filesize
233B

MD5
6f0bbb671f398a015bae7d269d826eb5

SHA1
4fa1d9d0a658aeddb45fd23a0a9fad83fe5218fa

SHA256
826e749af0f3146584a052871fe5284d61f0bb506f9feb2d577b65929849ad31

SHA512
b5f21a89146e0a43efc464b6bf4322235001dff317db2bfeda16b2fa846e4e9ab3b45eb54b0cce16539d70d31f5ef91549bb24de1525b4dadab3273de9eee557

Download Submit
/data/data/com.nowcasting.activity/app_crashrecord/1004

Filesize
652B

MD5
70cb37f0be5afba8caf08f65ae569f33

SHA1
ccfcb9a3d19d2b500af576f226a387bf4bae09d4

SHA256
5e324bba47d2ad3d5848e3fc9dfe4c4c28a5f13cac778833b7eff651c55fce4d

SHA512
764ae9538c7b7555c2b0c69830788d71e332eb0d297417720c3113338947862108b4d03efcb861d4ea66270e3a861466c46383b4b5c6aeecb5d2fbb6dd72e9d4

Download Submit
/data/data/com.nowcasting.activity/databases/ThrowalbeLog.db-journal

Filesize
512B

MD5
3359e542c210b2d24299c337d846cb86

SHA1
ab97bc63f05e4960dfebd5519c8201d22d18a341

SHA256
8538092923da309f7aca2e14dd302bd580686c61c608aa639368ed72200671a0

SHA512
c76cc02d954d00fd4c8c313f69e8865743bc1e5c13a053f00c57237b567dc3729fbb0a4a5ebc02a18c7ee3c9772ff3eabf9011f738ca4d1a4683f50be9627213

Download Submit
/data/data/com.nowcasting.activity/databases/ThrowalbeLog.db-wal

Filesize
32KB

MD5
31623d3c22f397ebbbd86d3989bab02b

SHA1
5e91952fb6ca83c2cf1dd1f45b91d6b9679a5e81

SHA256
d2ae3333fccd37bcae74ea91d7892b6eb2b4ca7c7896006b7f73a4e4e1a7cccc

SHA512
3f05686931562a7d95be7cec7f3cec9a881a87f32cb7540308b6d67a1aac814e981877293f13a1cdd00df194b094bfec1b80f3da613b683e6d7e0aedea74a74a

Download Submit
/data/data/com.nowcasting.activity/databases/bugly_db_

Filesize
4KB

MD5
f2b4b0190b9f384ca885f0c8c9b14700

SHA1
934ff2646757b5b6e7f20f6a0aa76c7f995d9361

SHA256
0a8ffb6b327963558716e87db8946016d143e39f895fa1b43e95ba7032ce2514

SHA512
ec12685fc0d60526eed4d38820aad95611f3e93ae372be5a57142d8e8a1ba17e6e5dfe381a4e1365dddc0b363c9c40daaffdc1245bd515fddac69bf1abacd7f1

Download Submit
/data/data/com.nowcasting.activity/databases/bugly_db_-journal

Filesize
2KB

MD5
2075ee0e4cfca7701bf7a6f62490a9e5

SHA1
dd83952a2a22d0314f922c44b1c7cfc7cf28310d

SHA256
291b674e2715e11c3ab516d69f0a49c69b1f9df45321aace28a53b8fb3f58290

SHA512
5b6b488c0bf6c4bab0c437b61e9b8ce1b823a687eca7c30f1f5ffa167c615e575e681ff2d453ee80ea74df19f985c20436deac0e81c8e2edf948dc10faa7c635

Download Submit
/data/data/com.nowcasting.activity/databases/bugly_db_-shm

Filesize
32KB

MD5
172d2f646a0165843c0d4327ab8ecb3f

SHA1
f232b5951a80ca6c39e640a5aeec4102f36d80d9

SHA256
85f8afca6bb058ff186940dda3e1a01c98d8adb1055d34b4f353309f94f32c34

SHA512
afc9e8238be1a40d57a5106feeaa25cc005d915b4d247c8566c5f412f422b9172ec823043305f2c2f21bb0b478529a11612a899217cf17c6ccd801840c7ad28d

Download Submit
/data/data/com.nowcasting.activity/databases/bugly_db_-wal

Filesize
84KB

MD5
4168fe12e7ce1c35a242af7a79922759

SHA1
2bff565089a84eb7e114917c8ecd99cb3a3b3856

SHA256
566b7cd7cbb4017f757527131da6aa896448c09568a6d2375ed5914b671ff3ce

SHA512
2b02c996e8e55e18afd1645556cb8eaa381694ce7a6f9dce8021041da1723de6971673d0379c757c0f536ed9699a9bffd61f8abf98f3258f8852109cff064fe0

Download Submit
/data/data/com.nowcasting.activity/databases/caiyun.db

Filesize
4KB

MD5
773f36bf45647a9675b1a87ed560ba69

SHA1
3ac072f4e27951d95ab7d1775cbd3a7705920e5d

SHA256
96f0b406c74d38a519783a975eed05e3194d24ce55d2e98207d2e888ea69cb6f

SHA512
3d8537c0a9009799bdb3f371d63738ee2d0d0a313a239ec825a7c2572b490f6a49246fde367582e79b17f3562dcbd6b40f3e4c42a3233709f67f78d37fccc781

Download Submit
/data/data/com.nowcasting.activity/databases/caiyun.db-journal

Filesize
1KB

MD5
20d4ff50e4408ce7e56b1065d7de8bf8

SHA1
4e1ad8dea9cf1c227d5f747f605fac81c6294c1c

SHA256
18db502e850551c778ae007350f84bbfb7f0a865ebd8e32d412f0f88574d7814

SHA512
e1b3a05c6fb7d453f0cec831b90f617a8a0cfd5170e3785511efac5533945151929b60dd361f00585465fc301b1760de8782e6c031182fdf9830b4c768dce6eb

Download Submit
/data/data/com.nowcasting.activity/databases/caiyun.db-shm

Filesize
32KB

MD5
f1aae1f23b2e8a8616d637ca96722ffb

SHA1
09ebd3bafa65f24ec28269c2179dd5539e00af7f

SHA256
9c7cdbf47aa2e2ef93271a87eec63e382a13aee9d03ef6367e4e205b54efde1e

SHA512
8d88c96b6a444b933ad7bfd91d980001f13ff7e42efc46edb2c97e1c56a1d3065e08d0987f7486440ad0d0c29aa8a1031815a0e6b381cb393596c87d48df565e

Download Submit
/data/data/com.nowcasting.activity/databases/caiyun.db-wal

Filesize
72KB

MD5
d2f5cee469416a64f6b7545fa171e898

SHA1
46fee1e4e38b1b1fe6053ad8460d417c6f51d22e

SHA256
890cf80e5cde830d6599179943517153774e9a5872123acd9dcdfe07cfa43f6b

SHA512
f821813b4670fe48df5e5a1741d39d17211ac11eea90f6610ae8c58b000d2a8d4783f25ce6841081fe82158f45b4156c7dd14cc71f8cb383054899d5e1cd8f42

Download Submit
/data/data/com.nowcasting.activity/databases/geofencing.db-wal

Filesize
40KB

MD5
a4b75acfacaa7155f94ddd9ce0893842

SHA1
139c195274fb1d837ddebdae0060000faae7bbab

SHA256
9abc9c002ae90c280517ccb2449c83708983243ae70c23667bd4d9e7c7548a6e

SHA512
5dbb7b66d07ba21083982fca07dd0a48074f6be47ace0d6435a7c59677c52758608504a16e6ceac96b34e89156d50c0f76a0b22cfba2142a3d37d0c9f6ada3a5

Download Submit
/data/data/com.nowcasting.activity/databases/hmdb

Filesize
12KB

MD5
3fe30614d7e0d11db870b4624f6c50e0

SHA1
053ff0fc621ab40f2afeddb3e7b4a73ee41ec533

SHA256
67c532f0324228dd33b445cd399c1426e3a0e0cdc7b9358c66b402c5d40a838d

SHA512
c7c09e97a408e88aacaf8099ad4d1fa604d58113393500a384eb3c2eb7c3c105af41314934b86eca2f088045cbab5a20d768bbb295448dc1ae6cb6c3f59821ae

Download Submit
/data/data/com.nowcasting.activity/databases/hmdb-journal

Filesize
512B

MD5
86aea7e8ca4b83dd6e3b8057a111195f

SHA1
d3683b42c1c3e70ee5c6b01e47b0add9843ff584

SHA256
9db47e59745c04df9f07b91db84bf4959c7dd40f8584dac26cdcdc5b7660f942

SHA512
8b9e4fce461ef23205f692698d555680fb9666ba53c91f5da873cded419cc59218d3a2f9da4082c8c4cdec78e538bfad85d422c547e5c5152c28711ea0e94023

Download Submit
/data/data/com.nowcasting.activity/databases/hmdb-wal

Filesize
16KB

MD5
5413c91f06bff8f3108740a55e761796

SHA1
4d9e722ba52bb8fa26ec800298fcd17bffb0185e

SHA256
6fb04502e01d4fe7419e31520822f51a2c7abaaa20a35da8094fc0654456f2b3

SHA512
8c19bee3a209542ae43b78a1d7ec1e24449d13c00de00599e8b1fa6b9aecc04a73b415fb44fb2ac268bcc74aea70e8a561444d8bfc3109a19d97310199463373

Download Submit
/data/data/com.nowcasting.activity/databases/logdb.db

Filesize
36KB

MD5
a7b5debf648af8527d38065f285c6754

SHA1
ad8513c878ca1483a2472c7f8dfc8a416418517e

SHA256
0d8f1987d41b042ee7aa1ae97d1950a40884ff4ed620fd02371017160e50eaf5

SHA512
c879b912d723e9c382e547f605dea4d77830d9300c3cdb1a14c2758cf4e895000c7ba2afe37584ed2fb94a9893e8ff47bdfda4dfbf2dc47aca75efc5d28984e4

Download Submit
/data/data/com.nowcasting.activity/databases/logdb.db

Filesize
20KB

MD5
e8c2e2b595dfd5bfa97dcaf872a831d9

SHA1
36229e2ae826b59116cd202c076886a89d286044

SHA256
0f99585f2c60e426f7ee165076e1f7e550aa12d3db2df3b9d77ee8ea237558bd

SHA512
e4bf945563b3f238e9ee92335e0ba2d3f2b214d3f220e81c8b3d7e36a6a2c6e12fbf921db94d547c9e376e4d5b2908589055aee4339008afd333f42d7f2966fe

Download Submit
/data/data/com.nowcasting.activity/databases/logdb.db-journal

Filesize
512B

MD5
30e972fb7e429b3ad8734aba2b9f0e98

SHA1
33cfbae58ec6e1fe98be9ef286c35a6b434a45ef

SHA256
065e14b32807dedcb3b20c485a739df97455ee77f8cffaaa28e75d20f66674a1

SHA512
4d08a71180251e2c6994fbcb85172f67f5309f674022c8a61848d10f1b5110a12f1023042f9693e3308cb9449a4dacaa4c0145fc494d95b6bbf60b0f2a822580

Download Submit
/data/data/com.nowcasting.activity/databases/logdb.db-wal

Filesize
48KB

MD5
6512a8a08de8778a23ca7e1b9463a710

SHA1
1545fc3721a5466ea09f73612030af391da42804

SHA256
5842ca23d409f0f4470c9eb067261c5a19e5cd08684c9337ab811c0fde4e03e3

SHA512
2e3e92814efe27bf77dd4aba3217c26856196cc459eb6065c0e9c3bd35319ce8f91af157dbfbaeddc1dee0b23e88de526bff74a52e46f644413438cf1448045c

Download Submit
/data/data/com.nowcasting.activity/databases/logdb.db-wal

Filesize
8KB

MD5
48784cd8b661ac9270ea692a3751580f

SHA1
9b8aa4a56d9fe1a7685f40c739b4f53117cd8563

SHA256
0df3090e37c8019d05acfdbf3122bc2689b1e0e5354eb0e9f77c4977b95364a1

SHA512
467a4ba6f39c9eeeff68ddd79446b5534354d63e318fd91d87961d2250da3b3e5b3f05f39c16a0e5365a26a04cd9a79587a1f42b6d90b60400b4990abe7662fc

Download Submit
/data/data/com.nowcasting.activity/databases/ttopensdk.db-journal

Filesize
512B

MD5
75f1871611886a9bcfe3bd4b8373306f

SHA1
c6cf7fa671e0181fcee7d10ab1e8f31614a37158

SHA256
3ee8daac1eb4baec7b6bacc7427d46b011325aefd847b49abee358e329a25efc

SHA512
d550b09c9cfc15b4a6cc2a3de85427f4e05119108be47f254a318e98260c8617c48ec1180c49d219385f5b55e66a5b02874cc7a21118837b5d0862c25823b4d0

Download Submit
/data/data/com.nowcasting.activity/databases/ttopensdk.db-shm

Filesize
32KB

MD5
bb7df04e1b0a2570657527a7e108ae23

SHA1
5188431849b4613152fd7bdba6a3ff0a4fd6424b

SHA256
c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479

SHA512
768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012

Download Submit
/data/data/com.nowcasting.activity/databases/ttopensdk.db-wal

Filesize
44KB

MD5
8559e9e42415851372ba5bfd16856506

SHA1
7d8e695aad3ec0a886f3b2d2b496e11f4235affd

SHA256
b8633dff2de27160df26e4864544f07836a7c427d14fd3e218572f897040efed

SHA512
ba40bbbc6fd9b36ce862fbb72ebdaa5bc68ddb0cf8094ea967cbb350f4c07d561e233eff95c6982d1b923922f86bf89eccf541ef6ff390b2b2a55eddf45d9c5a

Download Submit
/data/data/com.nowcasting.activity/files/Mob/domain_1

Filesize
58B

MD5
0d210bfb2a0e1f1b4c082a6a0f79de07

SHA1
bb8ed9e364db79d1d9f2fcde3f15091893222faa

SHA256
988722c23d78a46021d0e7ca9deee7aa8bb83288269174ffacb7316f381cca1d

SHA512
536e9867b0df29b15b789f8949be6ab37fcdeccb9d39ded981da7dc2052c9533d0ec0e6f9a5444132977605d372e1463d91bdde41b528ff2ca3f65ab152325c1

Download Submit
/data/data/com.nowcasting.activity/files/Mob/mob_commons_1

Filesize
2B

MD5
99914b932bd37a50b983c5e7c90ae93b

SHA1
bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f

SHA256
44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

SHA512
27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd

Download Submit
/data/data/com.nowcasting.activity/files/Mob/share_sdk_1

Filesize
23B

MD5
8e24e79baab91c4d0604eaa9006a0cb3

SHA1
e427afc94a4b957a7096f73e395a10ea404c076b

SHA256
65ee797326cb9d94a4c8b13fb114a7273d80af9ae547496bf56556c479f75e4d

SHA512
45bde5e1b5da5e54f7f5baf24cf4d9158ccf5813f0babc05677437bfedf1d54c4707090a1c425089e8f9582a85fed80b25c1e1f30ec2051afc6fe68bb8a76bae

Download Submit
/data/data/com.nowcasting.activity/files/a/b/24c110e1f76093b35c3c2df1927aab79.0.tmp

Filesize
591B

MD5
61a428c8d242249218ed3f05bd57e4fc

SHA1
5d934313ca35c6b84af1f64ed6bd47f19c3dfc1d

SHA256
5e550c5b14af3919b91d0790ac73f40897b929b7b0f98d6eb25f03eed7506d1f

SHA512
449e30ba0f9dcf6d3718d119994043cd0f410439bbe410425760617ad790510026246294bebc7c2d90ce9198033be2f51720deca97a534adde6914b82f6c9dbf

Download Submit
/data/data/com.nowcasting.activity/files/a/b/4c984fe24161907e5b5b9423ecec3163.0.tmp

Filesize
567B

MD5
adba1b502ee1ef0812cbadc1308d191d

SHA1
c0c306ffcf5c7bd7d5fcea1ad789b0d4b194e981

SHA256
fc936d684134841354465de99e25b2ee6ca07174a9c6faac569dacf7e27bc8ce

SHA512
ce15303df5b9cd8c545d918cad56461c04e4f987092180039b391dfe15a4a2a0961b845de4da30c7ee5319a6e4513564a0ce5a5d72aad308e41df6271bb2dce6

Download Submit
/data/data/com.nowcasting.activity/files/a/b/journal

Filesize
113B

MD5
0cf77f36c527abcba3e91da23011c1bf

SHA1
3bd240ceb6e24c9ceb3e2ac8cbaab6cec10cdfdf

SHA256
a6bb2d97757402adee9ec84cd2497f9e23a9408d3ac4f09f2d8fd23066cad0b6

SHA512
6e6e40d6ff7a2e539b81246e9176b4ee18937c9f7884592a91b7613f4eaa754c54c97dde39c6c7c81fbb6901231c3136a288c801bd3c654e58bf24a29112cca4

Download Submit
/data/data/com.nowcasting.activity/files/a/b/journal

Filesize
195B

MD5
36622c061e4db6002597395498f3cc04

SHA1
75fb8760d823e8b753ee4328adab2efbb3f5a428

SHA256
9c6760cb82fba0f721e794ee663121dad4169c96a2a235f78d00a2e88804f748

SHA512
800d773eb346622f6b520273e059297e6cc5ceab5bdca6eeb82fd2e87cfc22f8aa2b103d303707913dd6947dfb25e37d8a266bdf287a93bcd5432396eb7134d2

Download Submit
/data/data/com.nowcasting.activity/files/a/b/journal.tmp

Filesize
31B

MD5
8c92de9ce46d41a22f3b20f77404cc1d

SHA1
8671a6dca00edb72be47363a7071be65cf270373

SHA256
68bb33ddeed9200be85a71f70b377985f9ee68e91578afbde8321463396f1274

SHA512
30f45fe9954215d6adafcc8f0a060a7ff41963a64f9b849a37f0d18fe045038d429ec13bf15226769c4ba78dad3c52f3d9e0dbbb4fcdea4828a1efe956e48f56

Download Submit
/storage/emulated/0/.mn_410185822

Filesize
146B

MD5
f3a15d2b3d750271eb5d73104d20195f

SHA1
81f1fdb8dbf94a153bb0035fca904c7a4ac24810

SHA256
b9c034d360f19394e1af764cabfddbfab5ca531a9bb5db898250c61f37010c2b

SHA512
6c46c66cd3725dce04ce945bfed0250aca01ff2a0612b9dbe4fcfbf4896876bf3d145bd9f66c6a13c5b13b86519c37f28b2e686a57562afd8952f8bb6dc0b05e

Download Submit
/storage/emulated/0/.mn_410185822

Filesize
130B

MD5
f321656a466363e5192773d92000e401

SHA1
3a6abe9be1a6f4deffaa98fd27f3449c888d3c4a

SHA256
53efd5207de6ed80429ec3c7865eed2b64023a0ed66e0fd29e7f45b708a1751c

SHA512
fcf6884bf5ce8d10b3a3dd461fad96cb6cf0bc4129e01788de112551230fbc4d8ea6961b04411d1c7816e248437c4560277069d9c544e5450612abc0e2c0171d

Download Submit
/storage/emulated/0/Android/data/.mn_410185822

Filesize
245B

MD5
81c6be46e1ad3fc85ffdefe6de4d9f8f

SHA1
4c0a2c5f765be3db338e12114a0b74e811b0e8c2

SHA256
821f1dcfb4fe6c63b77e441056d28c2b386ee567477d1c59c3c2dd86e04785d4

SHA512
7d559508f7b4ccf9f021d5d8ea9792c8a02defbe12328010a91edc90501f25a1af8733a42b9d7b1a02265a1c9fd99540bd39921a7e334a63f698f761edb3de2b

Download Submit
/storage/emulated/0/Android/data/.mn_410185822

Filesize
245B

MD5
7fe2b2ff147c27d0d618a352633b24ab

SHA1
d145f135c138a66dda84e40384100651e1ee3ed4

SHA256
b2848f1b8874808d34c65c553e0d4eb2b1a246198c4507148db1b0add0bfc1e6

SHA512
f94041deb2e95eb1efe8c7ebb5fb0272069cb1aa2ec649e748416535913eb27291a42e6caca69ef0786ef0c7218973d3ad46872a3f6219a45c8c71a3c429ef59

Download Submit
/storage/emulated/0/Android/data/.mn_410185822

Filesize
194B

MD5
50f1301f2e630e45d25cd1afaa5515a9

SHA1
a0ad74e2b3d408f22a4410ca0da5833370c1e218

SHA256
d596f82ea566174cf9e0ea1101538a42f594cfeaa3644478c6a2473d324eec95

SHA512
6de50dcad250e4dcab916cca8c64cc30600cd47a2204a3320766ed004400ef96185e93d0848382eb7823b6ca3de21b007e19cacab8dc21d7fed4a834e02ec17f

Download Submit
/storage/emulated/0/Android/data/com.nowcasting.activity/files/MiPushLog/log1.txt

Filesize
1KB

MD5
08172179e3c6e889dc28de19d4e22353

SHA1
92444b186f017565686c7478394eeb6cdfe8d3af

SHA256
13ffddddaeffa60fc121ae19d71b5ab9304e25cca0b2b69bbbc9db0bc57fcb6a

SHA512
962dab688c953b78c3441a10b7933e0725a736bb9252063ce8918271fa6513dec8db670d4f7d6186949e27f550774342917cea7d7e912cc9522b651de468d67c

Download Submit
/storage/emulated/0/Mob/.mcw

Filesize
82B

MD5
3d1f3abd058ab078e95dd63f6c308b54

SHA1
ebd249a32bff42461b054d99580b8f985733847a

SHA256
6ae4aece7fb7fb236a9c21989fe89324da0892f07c002438ea958e341ef2dd44

SHA512
298140a0cfecd9346c3b5e8006c72f3f2756a9f582478e0130b9429fa1d684cd5c1bb3d0d3295eb326245f9c43f2b413e31b271ceddf48bc2b15ce0836308672

Download Submit
/storage/emulated/0/Mob/comm/.di

Filesize
80KB

MD5
953dac1743409e3ea67a7ae43980408d

SHA1
e50e54d484ee6a11eedf5654310b0efad96ad89d

SHA256
fda7f097d1a916ee9cae506bd001d196e0a9abf4205e1a1c2636c43dc468920f

SHA512
76eb9af36af0fa447cd9edb4db9928b387d68ce1cc34318bd7a376fc4d57f5277fec1c25a0ef8d7ddf9031730b98751958c77f72ae695448017f40c1721b7232

Download Submit
/storage/emulated/0/Mob/comm/dbs/.duid

Filesize
132B

MD5
d99f9ebaec8ab2eb488b17c8be3ff841

SHA1
6037eb9fac8ed58ac7886fe5f23f0d7dfd10dada

SHA256
56ed58090605c94baab160be3019b7f2c61776a5a1bf2811abdf1425af33432f

SHA512
072fd67dd664c8ab652db38b1cfc1ee4bcbd8da899265c5615badf3d60e3dd03dfe8d750cd441c372faad59be556fb2cde65e24e74b7f133738ad91ec287e17b

Download Submit
/storage/emulated/0/amap/openamaplocationsdk/alsn20170807.db

Filesize
20KB

MD5
731fba9d21f23915576ea5dc2ea3ffb8

SHA1
d1fdbc209db8b71d1b4e5341e75b8cc88647146a

SHA256
87510194f38897a04cd1f80bd6fffc3344fa8ef21baa61de020a2e790a7268ab

SHA512
b643177cf3a30543342d3a521a2dcfce70df4ec450b040e2b61d8692bbed4b3cde2f9f304cbf496869b89455e3cc6a501e8ff720edbdf0f6898e6a5f31fec25d

Download Submit
/storage/emulated/0/amap/openamaplocationsdk/alsn20170807.db-journal

Filesize
512B

MD5
e9781bcaeea24cb25c7a6e884fc29b5d

SHA1
d0edf602fca3781602aa5b6b2195b8f671fabada

SHA256
1292d3a74efe784577819ea617b550a2dbd3945fd45cd79b42180dfc2c39db29

SHA512
921ea9dc7e9bf16b1e8900caae2fbd438bb1e9565137f6de154eb4821ffad8dd0aaa07ce757023e83c619cb43d8a2acd171b88235249f0ba1991335a5df73b3a

Download Submit
/storage/emulated/0/amap/openamaplocationsdk/alsn20170807.db-wal

Filesize
32KB

MD5
dbc40e039a1aab45c4cb616e0624733a

SHA1
3da25cf93ee003988b1fdd3c0b2b304c6815d4ee

SHA256
1e9a4afed99e91ca2e4197c7282fa7c652a9ff9aa51aee9b84d2d3df489d14b9

SHA512
ca25ba8d2ad18c54f40bc7bd9e9df3b095b2137e950862b1761f2c0430115be471b65d4ce10e8b1010876356e6c7564357ffc10eb9c36f69bfec949775d90765

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads