9f38b747c09c46d512f3deb89d98cfdf751bc0a5ccb0bfcfadcbfe999a4a9bd2

Analysis

max time kernel
146s
max time network
152s
platform
android_x86
resource
android-x86-arm-20240624-en
resource tags

androidarch:armarch:x86image:android-x86-arm-20240624-enlocale:en-usos:android-9-x86system
submitted
13/10/2024, 01:22

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

3d0b79a7a656defd3100a0bf4f12a577_JaffaCakes118.apk
Size

7.2MB
MD5

3d0b79a7a656defd3100a0bf4f12a577
SHA1

4f2cad0b4cea5d985d92b399f717759820023c87
SHA256

9f38b747c09c46d512f3deb89d98cfdf751bc0a5ccb0bfcfadcbfe999a4a9bd2
SHA512

ad40b4df5f3b65c0e824131f7ba3c28200365bede03ba4018e112c6cb7c206e58ff33859675f1df606597d22cee87323247ba0a2a989302ea44323f7888d4d99
SSDEEP

196608:pBA1Y1JCgF309448MZ6Z6hXBLy9ltfUdHTp50Eoodif:71sga9420iBLyfhSzpeEjQf

Score

8^/10

collection discovery evasion impact persistence

Malware Config

Signatures

Checks if the Android device is rooted. 1 TTPs 6 IoCs

evasion

System Information Discovery

T1426

ioc	Process
/system/xbin/su	com.icitymobile.wxweather:remote
/system/bin/su	com.icitymobile.wxweather
/system/xbin/su	com.icitymobile.wxweather
/system/bin/su	com.icitymobile.wxweather:pushcore
/system/xbin/su	com.icitymobile.wxweather:pushcore
/system/bin/su	com.icitymobile.wxweather:remote

Queries information about running processes on the device 1 TTPs 3 IoCs

Application may abuse the framework's APIs to collect information about running processes on the device.

discovery

Process Discovery

T1424

description	ioc	Process
Framework service call	android.app.IActivityManager.getRunningAppProcesses	com.icitymobile.wxweather
Framework service call	android.app.IActivityManager.getRunningAppProcesses	com.icitymobile.wxweather:pushcore
Framework service call	android.app.IActivityManager.getRunningAppProcesses	com.icitymobile.wxweather:remote

Queries information about the current nearby Wi-Fi networks 1 TTPs 2 IoCs

Application may abuse the framework's APIs to collect information about the current nearby Wi-Fi networks.

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.wifi.IWifiManager.getScanResults	com.icitymobile.wxweather
Framework service call	android.net.wifi.IWifiManager.getScanResults	com.icitymobile.wxweather:remote

Requests cell location 2 TTPs 2 IoCs

Uses Android APIs to to get current cell location.

collection discovery evasion

Location Tracking

T1430

Geofencing

T1627.001

description	ioc	Process
Framework service call	com.android.internal.telephony.ITelephony.getCellLocation	com.icitymobile.wxweather
Framework service call	com.android.internal.telephony.ITelephony.getAllCellInfo	com.icitymobile.wxweather:remote

Queries information about active data network 1 TTPs 3 IoCs

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.IConnectivityManager.getActiveNetworkInfo	com.icitymobile.wxweather
Framework service call	android.net.IConnectivityManager.getActiveNetworkInfo	com.icitymobile.wxweather:pushcore
Framework service call	android.net.IConnectivityManager.getActiveNetworkInfo	com.icitymobile.wxweather:remote

Queries information about the current Wi-Fi connection 1 TTPs 2 IoCs

Application may abuse the framework's APIs to collect information about the current Wi-Fi connection.

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.wifi.IWifiManager.getConnectionInfo	com.icitymobile.wxweather
Framework service call	android.net.wifi.IWifiManager.getConnectionInfo	com.icitymobile.wxweather:remote

Reads information about phone network operator. 1 TTPs
discovery

System Network Configuration Discovery
T1422

Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 3 IoCs

persistence

Broadcast Receivers

T1624.001

description	ioc	Process
Framework service call	android.app.IActivityManager.registerReceiver	com.icitymobile.wxweather:remote
Framework service call	android.app.IActivityManager.registerReceiver	com.icitymobile.wxweather
Framework service call	android.app.IActivityManager.registerReceiver	com.icitymobile.wxweather:pushcore

Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 3 IoCs

impact

Data Encrypted for Impact

T1471

description	ioc	Process
Framework API call	javax.crypto.Cipher.doFinal	com.icitymobile.wxweather:remote
Framework API call	javax.crypto.Cipher.doFinal	com.icitymobile.wxweather
Framework API call	javax.crypto.Cipher.doFinal	com.icitymobile.wxweather:pushcore

Checks memory information 2 TTPs 3 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/meminfo	com.icitymobile.wxweather
File opened for read	/proc/meminfo	com.icitymobile.wxweather:pushcore
File opened for read	/proc/meminfo	com.icitymobile.wxweather:remote

com.icitymobile.wxweather
1⤵
- Checks if the Android device is rooted.
- Queries information about running processes on the device
- Queries information about the current nearby Wi-Fi networks
- Requests cell location
- Queries information about active data network
- Queries information about the current Wi-Fi connection
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Uses Crypto APIs (Might try to encrypt user data)
- Checks memory information
PID:4263

com.icitymobile.wxweather:pushcore
1⤵
- Checks if the Android device is rooted.
- Queries information about running processes on the device
- Queries information about active data network
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Uses Crypto APIs (Might try to encrypt user data)
- Checks memory information
PID:4311

com.icitymobile.wxweather:remote
1⤵
- Checks if the Android device is rooted.
- Queries information about running processes on the device
- Queries information about the current nearby Wi-Fi networks
- Requests cell location
- Queries information about active data network
- Queries information about the current Wi-Fi connection
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Uses Crypto APIs (Might try to encrypt user data)
- Checks memory information
PID:4339

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Event Triggered Execution

T1624

Broadcast Receivers

T1624.001

Privilege Escalation

Defense Evasion

Execution Guardrails

T1627

Geofencing

T1627.001

Virtualization/Sandbox Evasion

T1633

System Checks

T1633.001

Credential Access

Discovery

Location Tracking

T1430

Process Discovery

T1424

System Information Discovery

T1426

System Network Configuration Discovery

T1422

System Network Connections Discovery

T1421

Lateral Movement

Collection

Location Tracking

T1430

Command and Control

Exfiltration

Impact

Data Encrypted for Impact

T1471

Replay Monitor

Loading Replay Monitor...

Downloads

/data/data/com.icitymobile.wxweather/files/cfg/a/CustomIndex

Filesize
4KB

MD5
4b0ac5409aea846169390ebe55250e0a

SHA1
06f6726034f8a9ecb367c8dfa041fcc3c7279cd7

SHA256
21d502d8854588180ce5c57e92974f0d90936c5ea953cb3c465053e7e308795f

SHA512
0a1597a05bdc7fb133fb3b3da40d66f2bbcd5b58eb95349d3fda68fce5900d67d15859412d6f2715218521af9dacf94a2fed2365352d9a509acd261914d8fc9e

Download Submit
/data/data/com.icitymobile.wxweather/files/cfg/a/mapstyle.sty

Filesize
699KB

MD5
13cd2716d64825c7466f86b67a1b0468

SHA1
04abfef534a8cf413b10e96efbb0ee261843af58

SHA256
50bad27cbda98b6211e93da02882abba42d341c39c1fbc98b434cfebf95d18b8

SHA512
c5d8d5c78378047aca15286a57794401257dcfa2253395d56c9cef3c9b63e7fed60f7156cf4ff9027ff00fb69e04e4e17b980a953170d1ec9fff5427ceeb58cc

Download Submit
/data/data/com.icitymobile.wxweather/files/cfg/a/satellitestyle.sty

Filesize
366KB

MD5
43d8e1eac760776144667e06f7fa6125

SHA1
86e1107c3005828e82a9df6b68ae8dde967af8ab

SHA256
9f2d16f46378885fad1701984df4df19892fcaa25c60f36123aafcdbebc72a1c

SHA512
6d41707ae5652c8e31cd453aa364c04de22a4d30e4cbb782b85d048df0c4a36efad491d788f588ada7e06282b77aab85021777782c2462aaeb2302eaad6adce5

Download Submit
/data/data/com.icitymobile.wxweather/files/cfg/a/trafficstyle.sty

Filesize
7KB

MD5
831c0530133dcc6511bf3d9e15d44505

SHA1
b608f72729bf14b2397b06a54b933229c454b38a

SHA256
15a5813a7868f81ebf58cfd76b93e4f40d139bfa46f93112f247f3ed25deb161

SHA512
ec4120830d2737e3f97fdc0e894e3534ccaa84edb2af7709cdb8070439ff63e4130ac000daab3fadfb95cfebe123d5c7a7929a8e5313b67cf7baabff911c5f15

Download Submit
/data/data/com.icitymobile.wxweather/files/cfg/h/DVDirectory.cfg

Filesize
68KB

MD5
ddb9afb9386b4ae32c24bb7e8573ba01

SHA1
dd7e249d83916f11373dc859caa364ca595a300d

SHA256
78423fdf34ba70a62a07e791fd361a506e49167fffd8e31046cb452b462ffab8

SHA512
67c33f1370e2b6de612dcac7037029fa6e7d4c0e673621a1d89648fc861f77016beb8a737e9e3405bd6d439bcc3166ae07635033c2c1387aff9d13bd4afe925d

Download Submit
/data/data/com.icitymobile.wxweather/files/cfg/h/DVVersion.cfg

Filesize
352B

MD5
41f0e4f2b59bbb29115b4bdec0d44cef

SHA1
63764035cc6e1c68e030c042b6cd50c741883cb9

SHA256
bdf9c0066b322ff479562a56b9effd13bde3566fe3c1805d95a7875d1a04a13f

SHA512
f548f57d1c3dfadf958d2e4bf67cacf953a0689adf79293709b537c5d970ae1ec3ca08c7bf2b0e92a3d320e14845ae05c77481196f7e6f53a689eb543a10c440

Download Submit
/data/data/com.icitymobile.wxweather/files/cfg/l/DVDirectory.cfg

Filesize
68KB

MD5
1107c2249c958b6d8ea65fb5584fc123

SHA1
30b1ac251159756a41ef1c13b0eb48487bb4eb20

SHA256
9889f14eec0d798ced2b8c7a1dba11bcf5f12fb04b5b5116775439038b34e4ac

SHA512
fd00cfb78c0871fbf4e253ca7133365578b6abebd4edc43a5988f62fa7c5e1725986856dd0638dfdc0d6769c6edded483d147bd19a6f3e81d950c9b16356a421

Download Submit
/data/data/com.icitymobile.wxweather/files/cfg/l/DVVersion.cfg

Filesize
127B

MD5
f966fc1bb228591a2dcdad350c976c85

SHA1
b8cbf9b0532e83bb33e10bba314de47c9b4c8d5c

SHA256
8ac4b86eec713ce1da36eefbe1e303bce41c36455cd1d00bbb8bd8d0cd4b3728

SHA512
03dc27bdb26afcd2c0e31043c1e7d44fb6d25177996d018c2744d7ac7fb33767abea8cefce41faa5489ba74b83e42b628c208b2063cf0fce6aa92a9b4105128f

Download Submit
/data/data/com.icitymobile.wxweather/files/count/1728782582

Filesize
28KB

MD5
0d3e99204c6401ea499fe9e6d9855497

SHA1
09829f00ca458eab7374d5079393a2cd69a2348a

SHA256
63ad014cb50908591939d6a1536f85eece807425af4f4e8a1f9b9eeab13cc5ca

SHA512
8d9a50aa9abd17e508ed3ac35a3033e8f9e550d1088baa951f53e6c4697c5ac026d22b90e36e27341d64baa3f0202bd89ca97583e99feb25f8c26b5776c59c68

Download Submit
/data/data/com.icitymobile.wxweather/files/custom_city

Filesize
512B

MD5
f8011835301751207fe53f41ad286c71

SHA1
c95b1ae5fe45e8f4fc2cef075d65735be1360b95

SHA256
d6c47b8ce00667d92b2879a9ef2e9ff7cfb0ab02358349296d865f01030be2a0

SHA512
d38b33f30b2b8016ebf94899895d55c4fae57617f270a745e28b4f7e92f4bf674491a57dfad783caf0b35620fdfa53175c55cf7f08208904351069c0de3fa830

Download Submit
/data/data/com.icitymobile.wxweather/files/libcuid.so

Filesize
598B

MD5
5df4f9c64ef9bd360a49f092077c2c89

SHA1
dd075ace6523588ac1bbeba1e2d89e6724f007ee

SHA256
c73ecf74c22f2a434c9625b9b934457f64f0709900938d18b11687c69059a285

SHA512
1fec2cbe2545c0d75b4e047adcbfea5a1831a92968e5a229f6b50ee18a740f653c07b8cf8d679c071b18ffb54db9652218a499216d8c820352aa57bf105a69dd

Download Submit
/data/data/com.icitymobile.wxweather/files/lldt/firll.dat

Filesize
10KB

MD5
8635d90bf3f1d885d2365c29ee6672a6

SHA1
36862300eed674e22f397d1e4f13fcc402e00565

SHA256
ff2a75551d4166c9d16b88b9d3d76c8f3ca59eec52fb8e1514b54efefc7a124c

SHA512
32516270a6b2ade4d532e7fccde571fa0e8f7bfbbe7432a89d2bd7d11c8cd5c426be2da4dfa1f82f10b5b1be19c205113becad2a56aa6bb5b359280d1d6eadcf

Download Submit
/data/data/com.icitymobile.wxweather/files/ofld/ofl.config

Filesize
10KB

MD5
cc3fad9057e0940ad4d4c7ad27922023

SHA1
403cbbcd7b819733b5caf49ed2a58d654441e99d

SHA256
f6d90bd8621889ab994374b4f51a1c3f9b028aab1a2129b8b3b0e1d7c5c37864

SHA512
ebaf2b8c56bc15826ef38b36e72ae41765fc723470c6dcc40bf9f31118f252777072ad39a535a79f53b6aa29811b4b21cebbc9810c47e34ef9400246d789ab21

Download Submit
/data/data/com.icitymobile.wxweather/files/ofld/ofl_location.db

Filesize
4KB

MD5
f2b4b0190b9f384ca885f0c8c9b14700

SHA1
934ff2646757b5b6e7f20f6a0aa76c7f995d9361

SHA256
0a8ffb6b327963558716e87db8946016d143e39f895fa1b43e95ba7032ce2514

SHA512
ec12685fc0d60526eed4d38820aad95611f3e93ae372be5a57142d8e8a1ba17e6e5dfe381a4e1365dddc0b363c9c40daaffdc1245bd515fddac69bf1abacd7f1

Download Submit
/data/data/com.icitymobile.wxweather/files/ofld/ofl_location.db-journal

Filesize
512B

MD5
1b33b96935b6b1278f1fea3711f42ba9

SHA1
5482930ef9c50c0594f197f6e3a4a3386e1e60a3

SHA256
effa846121ba89f7825caea2e31f3756170b1e8fbb9424f2f2e345803361bc2d

SHA512
7254c53bdc9e9cc00c0254a491eef83023867f6e284371efa60b7f1d489f53ee9ca5f72f603c371ef5198b00a4d6b3cf5cd6174039781b4d54e2b7250b84853e

Download Submit
/data/data/com.icitymobile.wxweather/files/ofld/ofl_location.db-shm

Filesize
32KB

MD5
bb7df04e1b0a2570657527a7e108ae23

SHA1
5188431849b4613152fd7bdba6a3ff0a4fd6424b

SHA256
c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479

SHA512
768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012

Download Submit
/data/data/com.icitymobile.wxweather/files/ofld/ofl_location.db-wal

Filesize
48KB

MD5
c7bae1a91c3c4ae3ebaf426781882bc4

SHA1
7d39c95a49b1d5661ca7a008beff3919dcf004e0

SHA256
1a571ef85a13d7e491ec7a2e60c54c0d16ef0c5cfb0d5cb007ac43e4759e5e4c

SHA512
bddfd02cfb3dd37ce4db78065699861a6da6c207032147bfd34719f69eeb9f135c30a74247db191b40c715d04fb684a03d0572cf21dcc4bafb404e08523ef82b

Download Submit
/data/data/com.icitymobile.wxweather/files/ofld/ofl_statistics.db

Filesize
780KB

MD5
50a3a60cb3f313669e80d670c5d73763

SHA1
84ea55ff01cd3a2fe2e57e7150acb6351328f2f8

SHA256
e4af2f6b2580dd07c1866b6d85181840a39b315fa48456fbd1c9f7b1ee660ada

SHA512
2056c13569cc05a7ec58ff72331ea3b63a6300310104eb96455a8d3f349222e071759512d99172bafb8c48a8e8ac54d978a5826369a5c74ece167fcb0e63a973

Download Submit
/data/data/com.icitymobile.wxweather/files/ofld/ofl_statistics.db-journal

Filesize
512B

MD5
72ac2ca69098235ed09dd2a3332d87f0

SHA1
cf980a683731936497c49d0bc82fff1180375982

SHA256
4099299de5846ad7949288e2a2a72e9ac0ab0a948e493ed4dd629de09f27f3e4

SHA512
3f92bc615ffd6086aa2fea77135cd3b789175e499a48ca764cdca72d080b2ab1d1b5597f545ebc0e7a957ff97f6c74409fc44035cc1f39c89ca0f30f000137ba

Download Submit
/data/data/com.icitymobile.wxweather/files/ofld/ofl_statistics.db-shm

Filesize
46KB

MD5
c7f6d5bba17d8e3378e0eb38d8594b44

SHA1
db9aae9e559f81e961c8e76453699344baff21e0

SHA256
d76fae27cabee97a100136f6865266bfe33ed6ebe36df6ba541e96b2baa47333

SHA512
3c42ecc940068f8a63ea42d78d2e24f9ade779348e940ed89ece58b8a5ab9a9e462b3c29007e291d0da2858f14654e3e3bf59c741f8c9fc2a99bd567660760f4

Download Submit
/data/data/com.icitymobile.wxweather/files/ofld/ofl_statistics.db-wal

Filesize
156KB

MD5
cda349d6c5d3fcdfb6b85457752ab27b

SHA1
cd886f909e80d8d5f232b286d9efd3e59113cdff

SHA256
7170f63ca3f7cb54895abd33e1db4d4ee7999fdca109df5cd9990b163829e402

SHA512
c301b06fd9f29081584030ca8aed03764a83e8bf79d41d3d9467e3e54a833e329db540ee3399c9e36904fee20465790a67286c29adb7bda6faf4f8d3682f2da7

Download Submit
/storage/emulated/0/Android/data/com.icitymobile.wxweather/files/BaiduMapSDKNew/cache/tmp/DTTempdat.dat

Filesize
2KB

MD5
a63fea11cead3f3f664ebda6c899c041

SHA1
986bbd80c7848e6b39f3033a9820b2c6e235e360

SHA256
38944097ab6af721dcbc1ee9dfb52135af777ccbab011daf2b337dc3c94a67f7

SHA512
ff3180462835f1b3461df7ce5e79961bbdcff0025f65ee308867b325685b2539eb2a84e15c2de760e6eee746c4d0b2434a48cf4d4ad0b185bd3c67756f3467e5

Download Submit
/storage/emulated/0/Android/data/com.icitymobile.wxweather/files/BaiduMapSDKNew/cache/tmp/DTTempdat.idx

Filesize
164KB

MD5
9821fa9bf06a0d5162dcaa8b76421dcc

SHA1
921532f0899bceb3d4573c6c1af5c5781f182db4

SHA256
d6441b5f22170d11a2cb15c2b58ab912734740ff3c083e6ebfd83914ea2ca6a7

SHA512
54f2fd30be645b1ab1b4ef3a4cf052642ccfb6f7ca461f8f97ad7a6d674f609e2fe3e815b00e2cbf421fd2123eda59faad451767d8e8479fa54d7f8d59ca9664

Download Submit
/storage/emulated/0/Android/data/com.icitymobile.wxweather/files/BaiduMapSDKNew/cache/tmp/DTTempdat.idx

Filesize
8B

MD5
7dea362b3fac8e00956a4952a3d4f474

SHA1
05fe405753166f125559e7c9ac558654f107c7e9

SHA256
af5570f5a1810b7af78caf4bc70a660f0df51e42baf91d4de5b2328de0e83dfc

SHA512
1b7409ccf0d5a34d3a77eaabfa9fe27427655be9297127ee9522aa1bf4046d4f945983678169cb1a7348edcac47ef0d9e2c924130e5bcc5f0d94937852c42f1b

Download Submit
/storage/emulated/0/Android/data/com.icitymobile.wxweather/files/BaiduMapSDKNew/cache/tmp/HMTempdat.dat

Filesize
2KB

MD5
6690cb911ac12fb0db8fa5a6c22ebab2

SHA1
f3531f5f6dbb119b60e50bd7279d7119021a1922

SHA256
ce85d9dc96d017fd013589198b27bcd32f1839c99ef5cfc4bbd3f755d9119cd8

SHA512
120c88be8494615d79da14abeb461f3c42c88533a12ecb126661334ab38bdc50e849b7bc2193a0829177f11401704a52be4377a8b34e8648ab434297d863fa89

Download Submit
/storage/emulated/0/Android/data/com.icitymobile.wxweather/files/BaiduMapSDKNew/cache/tmp/ITTempdat.dat

Filesize
2KB

MD5
a516a2dfadbd37c0c7e13127013949e5

SHA1
3edfcf8c4b293371bd79f14dae536f6f909afec7

SHA256
88b37a85571a30506c970e8a946934ee99c7a83a390012e7f388a64b08f022bd

SHA512
3bb4762d328b714c71885bce80d2bbd727c214e1f78e21ca2c44fd4af33dcd536f7ae230c3b7c5c3301dd43df077e162b7cb26cde2a44e607cff7b8d6bc56516

Download Submit
/storage/emulated/0/Android/data/com.icitymobile.wxweather/files/baidu/tempdata/conlts.dat

Filesize
12B

MD5
8d80bc8ea90e9cac010d3ddf97bda5f5

SHA1
f063bc0d356e6ba9ab1eb9a851131ffbefd8fa07

SHA256
f52db31332534833414abd5e870f78c810b8ebbe5b134bbf599506beecfd1b93

SHA512
9ea732dd572a9a4ba91b70891972230a09576687ca1bc19e62d5a98b5b84e0f2ae11985108008bc9fbccf357219b8bd3dbf146bb70752f618f70dc5d0c46a7c7

Download Submit
/storage/emulated/0/Android/data/com.icitymobile.wxweather/files/baidu/tempdata/conlts.dat

Filesize
10KB

MD5
a743010f6d7536ca3dfe38bfd91a1a22

SHA1
f4193d0d6f61e41d9fd84eb74b88eddc217bca88

SHA256
22f89ca49ef8eeaeb05cf19d55d81b14e1834852a15571aedee1f5c0e96a86a5

SHA512
db6226a946555ef490c554a833fa248025bacc4b6fc6c796021c5eafe1cfe0fe59501534ebb677aa60aa38f2eec1b2f4fc66749a32229b229ee745799a8a48c5

Download Submit
/storage/emulated/0/Android/data/com.icitymobile.wxweather/files/baidu/tempdata/llg.dat

Filesize
1KB

MD5
11ed43e96f09a823eb14788bf3caa090

SHA1
8e29e6ef80cd77c0540b429532c49b24bea8cb9c

SHA256
8f871252718e80ce8ce25f36bd390f813cf6798035e18da2a385369a747aa41b

SHA512
bc7af1e6da3d69bcf86db46749a99a410d40c7ede77d1fd37c7afc12b067ede9659d89ed356b27ae877cea45ec7b93dfd46d618c358bdf7219d91e55e2364891

Download Submit
/storage/emulated/0/Android/data/com.icitymobile.wxweather/files/baidu/tempdata/llg.dat

Filesize
450B

MD5
da2152831086efcbbc919aab0fd09045

SHA1
8d8331a9d48911cb308993ec10bcf08221b17093

SHA256
0aaf04383a5035bfb7fa772a794c6c107a83acb90ffcd0af929e2acb2eee421e

SHA512
567eafe49f2d87f2ec374658b3087a99765d60072610499d319fb772a37de0ae1e1b9057d4ae9296ef8cc6fcdc962115d4f822fc4aea8d278ab97d3910bec3e6

Download Submit
/storage/emulated/0/Android/data/com.icitymobile.wxweather/files/baidu/tempdata/yoh.dat

Filesize
24B

MD5
a936690571e9104e1922dda4a0ba5bd1

SHA1
65f49c57edde2f96be2a1dbdfc3f7351f1e66554

SHA256
f0f5049c51879dd7da0ce4a43349b5b34ce053d072a0ca704f62cf22ba4a8412

SHA512
3be1c3693963aebdfc04e86b1c820ee0ec3cf0b200e6a4788ef1141f39fd6c2f77f4227247ae4affa66c0a6c027df8466cc0dcec1e67ebfb953e36bee97de394

Download Submit
/storage/emulated/0/Android/data/com.icitymobile.wxweather/files/baidu/tempdata/yom.dat

Filesize
24B

MD5
1681ffc6e046c7af98c9e6c232a3fe0a

SHA1
d3399b7262fb56cb9ed053d68db9291c410839c4

SHA256
9d908ecfb6b256def8b49a7c504e6c889c4b0e41fe6ce3e01863dd7b61a20aa0

SHA512
11bb994b5d2eab48b18667c7d8943e82c9011cb1d974304b8f2b6247a7e6b7f55ca2f7c62893644c3728d17dafd74ae3ba46271cf6287bb9e751c779a26fefc5

Download Submit
/storage/emulated/0/backups/.SystemConfig/.cuid2

Filesize
129B

MD5
de53396d31d5a5c504c89f0a0138d299

SHA1
4eeb727288871f6cf68f47d3de99aea7c3d1ded2

SHA256
433d133e5877fb1a5cbead85765b6e18acd1c03ee98b1288f09d2fa3da2c677f

SHA512
822a88d13e9d6a00dadff9ce11945c64687bf01d1fece0c669d05e1b673ac9d109d11eb5ba702ba56dd9d9cef8a77d2a8c892d4cbaaf9eef2c21664ec277ef48

Download Submit
/storage/emulated/0/baidu/tempdata/lcvif.dat

Filesize
257KB

MD5
9fab0f1fcc6c764bf0eee994eacf2dd9

SHA1
4f0139dfca44b1e5da69d69097396f61724959b3

SHA256
a75431b0f2fb06cf3c563e5805047b38d0c8f915517fe8783514e829ee15e549

SHA512
3cab952676833e2fcaeb9e45252d3ad8ce494e599feb0c73916770368c4abcf0b3934fb1c691451f2332405a5bf8c919f0d119829debd30d00e8709465acfab5

Download Submit
/storage/emulated/0/baidu/tempdata/lcvif.dat

Filesize
96B

MD5
b6d4b6692a61f7886f5259ae8e18a914

SHA1
709028a7407667933ce12f1d848237a7f5920b7f

SHA256
d5406041a07d49bd007670e815eda00e0c0df29c9588e38e52ad5b74a99ca935

SHA512
1f0c9f1c848966427b309ceef8453ff2a9a2a94156f17eebed9af0d8f74b84172af0dc00481ff5cd6eb40832bd02d6dc5d93bb3d733a4b1aa5330cb156c1b40c

Download Submit
/storage/emulated/0/baidu/tempdata/ls.db-shm

Filesize
32KB

MD5
3e60e07938fec8332f89787b7abb234f

SHA1
d5e1709f563c58f65a128abe3a6c55d87f8fc6a4

SHA256
9b26543bb9d5d14534ca03d54d04a7dbbd0da8134e90d17d55165f8b71344d90

SHA512
a396ad935a881bd97bce38a5851a9939fccdfb693308587c7a0ee1c106644e396272847f0f02a4105435535baf5a98018e1a1e01218e313ba2bfd8a2f5fc0e86

Download Submit
/storage/emulated/0/baidu/tempdata/ls.db-wal

Filesize
52KB

MD5
64a3947f13a13fbc22c744515d88b171

SHA1
b10532bb0eb36c3eeb71becd304e7502a3b75d4d

SHA256
d97b1784938f8d92bdd4604bb21b816cde36c5350b4cd98b1a73d7c3e4defe92

SHA512
f59954a30088e18239a8ed07f13dfbe7f51b01f41e79962506eba3b145287516f340288e38ae71a9a045b595851e48dea509fb906ba6400a4ea2cb8119549ffd

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads