b9bf4cb9cd2c2b20dd3cb48d20d89cdad443f7a5cb741950ce9dc43eeb153897

Analysis

max time kernel
2742003s
max time network
163s
platform
android_x64
resource
android-33-x64-arm64-20231215-en
resource tags

androidarch:arm64arch:x64image:android-33-x64-arm64-20231215-enlocale:en-usos:android-13-x64system
submitted
24/12/2023, 02:10

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

b9bf4cb9cd2c2b20dd3cb48d20d89cdad443f7a5cb741950ce9dc43eeb153897.apk
Size

11.0MB
MD5

d7aef05a31824be0dd51d723b44985b8
SHA1

8d8ebf646b22232ae8f6ebc0de3ad6495c63604c
SHA256

b9bf4cb9cd2c2b20dd3cb48d20d89cdad443f7a5cb741950ce9dc43eeb153897
SHA512

517bbea4e5a4ed48e5ffc1d94edffb1877f2bee05ad29569f141323f3832e7f5135fc2c869f3f8d44e9933e13a2ee77b14082d074984ef21c76aa33a4eddba46
SSDEEP

196608:1KhAMGdd/c2wD14ZnxZcPEtMtSLnC0FYhzABolc+kQeZ4W2Zid7feJPTIEjv10r:oXGPs4ZnkPwMtbiD1vP2CWdTIEx0r

Score

7^/10

Malware Config

Signatures

Checks known Qemu files. 3 IoCs

Checks for known Qemu files that exist on Android virtual device images.

ioc	Process
/system/lib/libc_malloc_debug_qemu.so	com.tieniu.lezhuan
/sys/qemu_trace	com.tieniu.lezhuan
/system/bin/qemu-props	com.tieniu.lezhuan

Checks known Qemu pipes. 2 IoCs

Checks for known pipes used by the Android emulator to communicate with the host.

ioc	Process
/dev/socket/qemud	com.tieniu.lezhuan
/dev/qemu_pipe	com.tieniu.lezhuan

Reads information about phone network operator.

Uses Crypto APIs (Might try to encrypt user data) 1 IoCs

description	ioc	Process
Framework API call	javax.crypto.Cipher.doFinal	com.tieniu.lezhuan

com.tieniu.lezhuan
1⤵
- Checks known Qemu files.
- Checks known Qemu pipes.
- Uses Crypto APIs (Might try to encrypt user data)
PID:4287

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

/data/data/com.tieniu.lezhuan/databases/.ua/ua.db

Filesize
16KB

MD5
8ac018dc0ae07b14728b865666692bf1

SHA1
138052da5f78e62a9ffdde0599b71de6d70c9c86

SHA256
954a463011108767f8f46bbe37288e964a041a6804309afb3cfb4405a923785d

SHA512
dc186d61db603252de64bb1295d7bcf07e875d3736ec850a0a496e2a4489e90c362801737e51c6a30ab64d58c5f5f683f77a685e8cbc0b1d997304ddd9420f14

Download Submit
/data/data/com.tieniu.lezhuan/databases/.ua/ua.db-journal

Filesize
512B

MD5
63c8a67ee7d3e2be484dd6eb38b1aef5

SHA1
41e2e219d06211b350003c435700ac0567229d9e

SHA256
3753eba4bb23b18839e51583fc92f877dd7b3ca47d2b88deda6e468f790fab7e

SHA512
a2faade4495159dd3a87a72a5ecd95b08bebd92e161cb7970537dc9a47cbbe8d704f21be6e8cf854e7db3dba8b26b220724e659f3e397dd863b3aad479aadde4

Download Submit
/data/data/com.tieniu.lezhuan/databases/.ua/ua.db-journal

Filesize
8KB

MD5
90fb0edefaf4650f3d6a073b35ebdbb3

SHA1
05d704fc33bd0dddb6c181c81512aecfe5fd01ec

SHA256
97be79e0744ff7b0e4435d9145a90be5fc33d7709a307c42261edeedc8bf1ebd

SHA512
0e8aa62619431f436c2adfcbb66f7a6ab30c12210da8f79d7669f4061d825b88491c19d5be3dad8af60a9fe928e0a9f1d93c022ac9f2f742e178123434b7d972

Download Submit
/data/data/com.tieniu.lezhuan/databases/.ua/ua.db-journal

Filesize
8KB

MD5
23a1a4c50a7d5b2fb40ae263c95624bb

SHA1
bd0d6cc00b3323fe6d46a944e7c8b8e8747c3306

SHA256
96a5b02bd3a9aa2fd7616b82d60ae439167fb375eb022630137a9e7939b0c59a

SHA512
632baa8eec769c68e6df22f3fc6596f9bec8da13fab381b88bc111636cc463b4c2147456017417ca18796624679b4e3dc14d242cdd582cc6a581dde0124073ec

Download Submit
/data/data/com.tieniu.lezhuan/databases/.ua/ua.db-journal

Filesize
12KB

MD5
b54977aabd112bd3c5eaa6149e9400a0

SHA1
928481a910a15cc3587328d4f660d9a8b264c37a

SHA256
4408942e05735f0052c2b5538f7e1b6df9e64c00dadd0027589f0832d2824993

SHA512
55047886e33fa72053fd976f34b838c6481b291b0242c16eb2e6b030466c5815b663ac63bae4471bc84ecb77f5ec1e280eaf59e1177edb6a6a739846a4581a8b

Download Submit
/data/data/com.tieniu.lezhuan/databases/.ua/ua.db-journal

Filesize
4KB

MD5
1d1fa10b8fa07bfbfdb79777c51b5407

SHA1
28f934c2068a87f519f4cb5210422e9ca154e211

SHA256
52b6ad851ef0395905e408d9f3e63985b0e0144ba79cb39ae1d5347d94ba2034

SHA512
7821988ce18137a3ccbec3d20afced5abacfcc11ca68ca6a5855b9f008c3ec4a9605c071a2df175fd93e038145a2b84d998eaa73955bf98671850fb64ad5b692

Download Submit
/data/data/com.tieniu.lezhuan/databases/.ua/ua.db-journal

Filesize
8KB

MD5
88905d29aa3e7408132155aadcfbadf1

SHA1
51a40fe5e45cb1c002afa479a2e6938bdab6f4e1

SHA256
587a5c1b0f1fe97003b79fd497d9accdadd9f3a4373ac772657d5e8fb3dd6d92

SHA512
999dfd142b48ea593e5869915c9eca16a17dd0eb624b65c0ad14935819f0c0e11f49c91695bef3c73bb55910bc0f71e9009a945fb65fe3ae51e85b2e27b72876

Download Submit
/data/data/com.tieniu.lezhuan/databases/cc/cc.db

Filesize
12KB

MD5
d89acee9fbf356695093f2724f643ac8

SHA1
22d2f857dfd38f9df961569715333e53fe64ee36

SHA256
4e1313b40c676cdc9653aecd74da0f6212f5d84ef960e1e8bc249811bdeb5783

SHA512
66448f754e7932dfeb98d20cddef9fe318b3a3aff17c2c47d065db78c5f830208febed67faf30a41977bc62cbd5c7a6e8205da054ff296843a75ca1b463f420d

Download Submit
/data/data/com.tieniu.lezhuan/databases/cc/cc.db-journal

Filesize
512B

MD5
25c8daaf6b55ac89cea54a4a90999eab

SHA1
7479763d8e1154c9c16e73448940d200f54f8ef1

SHA256
7680ef669aa40a26ddc756d494d3171752837a2c3474fc65389ac5688406394e

SHA512
5841cf92a15c2a79d88ec9d14589f0ac3632bb6d052530ddf6c7f83add83d8af93963a93c08048a19611e72b54a65f300d70f0ad7f5c249035c4dbe3d1993f0f

Download Submit
/data/data/com.tieniu.lezhuan/databases/cc/cc.db-journal

Filesize
8KB

MD5
b2bb8d9de85346ebc49d3958847354c5

SHA1
f2871ffba096334597e5b6e7bece8fc1fc015e6f

SHA256
778347ce4d4055f758f9c8bfb3a6c87bffc0c7f3e37847fc551bf14de510c5ce

SHA512
4ab002f9b91018a35834b01fa33a3b29b2a7c4a20a5071b786a17693bb11ab8163622c536bdfbc8708a66df99594475d12ca5c9db01e57191a77a766a55adb22

Download Submit
/data/data/com.tieniu.lezhuan/databases/cc/cc.db-journal

Filesize
8KB

MD5
d466bab9832ee2a1f91332434d4608f6

SHA1
d0c7f8c7b61e3902b1afb1c49eda9ae49ed65361

SHA256
11e548468727ae4abd7312cf8014ba2245013ea624b4f55f3c5333c9120a44d8

SHA512
da30aec6fa6a812f9d56d8b040784ff2aa2093c2a0010a502aa6d9f4818eb6f78a989057731713a375ed7154175f36b5709a614bb7511b173e10b9c78bf37022

Download Submit
/data/user/0/com.tieniu.lezhuan/app_crashrecord/1004

Filesize
58B

MD5
0d210bfb2a0e1f1b4c082a6a0f79de07

SHA1
bb8ed9e364db79d1d9f2fcde3f15091893222faa

SHA256
988722c23d78a46021d0e7ca9deee7aa8bb83288269174ffacb7316f381cca1d

SHA512
536e9867b0df29b15b789f8949be6ab37fcdeccb9d39ded981da7dc2052c9533d0ec0e6f9a5444132977605d372e1463d91bdde41b528ff2ca3f65ab152325c1

Download Submit
/data/user/0/com.tieniu.lezhuan/app_crashrecord/1004

Filesize
228B

MD5
0fe0888bb5babf00657e6e2f0010d521

SHA1
201deb9c6129a94d2b0dd88e380792a92037066f

SHA256
f5dde18f3a40105419a87560a1653fbf75315a072105eabe945c5c7431151fb7

SHA512
8b75dc97b59fd2708c086ea436dff21db4a7cef4cf8c3b00186f23000975980c41684d59cb092e80fc37018ffa8de01c20c4143e430fca68f721aa6fffa9a3f1

Download Submit
/data/user/0/com.tieniu.lezhuan/databases/bugly_db_

Filesize
12KB

MD5
edb655088d1ed9f33f9d0d499b7a3ef5

SHA1
565c4f4e43179dbfc285cd6331dc8ac75a901af8

SHA256
bb9e45aad35b43e895393e7a66e4ead6a5f728f90b7627e3c741d391bf65d4f9

SHA512
98cbf923880de82921c38973fbc6d711dc39884428d1eb4ead33658a5a7f163734e5121823d5b043ca44554d19c5b6f966674ac7291513944a94cec97d5be599

Download Submit
/data/user/0/com.tieniu.lezhuan/databases/bugly_db_-journal

Filesize
8KB

MD5
603ccb715591fd4e316ac2d04cb5c883

SHA1
79fb7b2b1c9432569a9407434f00c4dd8d2b498e

SHA256
596ac595d05b88c85a78405aa7e7521ef36c2549fc9044783b1310259b32e3aa

SHA512
b191cbb4dac7270e174cf0e78c2e0b1d8cf7bd7ed0768b85f993ebc373d4c397aad757299c27b2eeebc875a67edb88f34e9a493b9c9a870eda868c407ba54dfd

Download Submit
/data/user/0/com.tieniu.lezhuan/databases/bugly_db_-journal

Filesize
8KB

MD5
925d3c4e9d2850a61135886ab6ec9b25

SHA1
dbc301b1c70b31abcaf679d5d6faae381d50f682

SHA256
b7a064f46bc99683e98d6c8e95fc23709652d67ff8cd836a85756f42c8553fff

SHA512
646f250e05ab33c50be5ff33554a48f561ae91986111ccf6196a42f6f194c7da4f7b8adc07b00a8a2226f2c2971f0850d2dd52a54e71ab86c52d7c3fb29de0cb

Download Submit
/data/user/0/com.tieniu.lezhuan/databases/bugly_db_-journal

Filesize
8KB

MD5
1cfc48906c7987ad0d9f66f76d9f7a13

SHA1
2a5252cb97ffde244e386e04f5dc78ef16ef86d0

SHA256
6f80708e92df19abc66b26c308568509041381fdd8401590e8cabf5184d2a5c2

SHA512
56195a25fd0a319090cac0dc409e1c3869a90e6b603b0ccfe6b414f1b59ae074f486e81ab68d42211372565bfec9de7ec26a364cdb6347e1f98e698b7dc6cc4f

Download Submit
/data/user/0/com.tieniu.lezhuan/databases/bugly_db_-journal

Filesize
12KB

MD5
51304fbf95e5eb3f79b55fa6f4aa4162

SHA1
43cacaf905a3eeaf4a437ae1a5322ff7e8586b4d

SHA256
39a76298c813f546031501d4930b738af767753951536c84da80bff1bad67114

SHA512
e823abf903282983f8362c939899743354bac795317433b9df905d08bf40b258539f91bda563e39e6437fa3a9fc51e85de3409940a58360edf61f1a1e8976d99

Download Submit
/data/user/0/com.tieniu.lezhuan/databases/bugly_db_-journal

Filesize
512B

MD5
842b0cb54eb16c550bfa90f985091788

SHA1
c4405a99b7ac5d22d9c4e494828502e1a04c9e11

SHA256
f85e97fdf434bedc422a2aeb3d3e8fca30f02f0677390326158f829c9a49b9e8

SHA512
0c00b0daba036352db529429664a972ebf6e5745fafa78b141f0caa1210c78453ee54fc15e5a7294ea97a1fd6fda0710ef2d015bed4936862fd567581c46994b

Download Submit
/data/user/0/com.tieniu.lezhuan/databases/ttopensdk.db

Filesize
40KB

MD5
8d6956c6065399f11cc52aa257275bc5

SHA1
55240dbaca52c721f125c913de3d626af0ced236

SHA256
ce88dd91633da49ca3fc097a3101cbf4ed4f7819ff0cc89a6277957c61f12a02

SHA512
6b04826d76b5fa1eb7395ee7126ea5c26f843fb641a45884e567c774f6e59531e8075b5c2fa333049db688e88e71895267e0131911b789d699fac0257e66db80

Download Submit
/data/user/0/com.tieniu.lezhuan/databases/ttopensdk.db-journal

Filesize
512B

MD5
7317634c050319bcbde55533c72f7ea8

SHA1
97f5037de209b12128887bc3d4cf2141d4ea33cc

SHA256
70a174e51fa9ba1185ce4165cb5c599c07967de784617fd8c309f7fe3e9949e7

SHA512
85802ca04e3c46b26677829a3b2c125206051278873e75a8993e3b336a5d1b5b3e2bd96a02a3a575a49d8470f1a0a0fce222e673e246cd64098004313aa4ec51

Download Submit
/data/user/0/com.tieniu.lezhuan/databases/ttopensdk.db-journal

Filesize
8KB

MD5
6114e04b06528a1ea39aeac9a5d9797e

SHA1
31d0f8c70c4f2cc7f8e9943c6e5f76d2aab2332f

SHA256
d9b6e9eaeb2c111bcd3fda3cc18e966769a2edc564f10109b0bd74170db40aaa

SHA512
d72ec97da8f8d28948609b9117c2c54da4905ba4e37c2f63a26abcbdccc19d8fd5b5f55e230228600f91d8c14129f04587b31434c7399baa6f4e8e646c53abbe

Download Submit
/data/user/0/com.tieniu.lezhuan/databases/ttopensdk.db-journal

Filesize
8KB

MD5
d74b672b76a37888af5b8fc50b8452ec

SHA1
5f8b16356a10da49ab0a45e023cb160824b33bdc

SHA256
a901a871747113fcc2047e35d441a8507e89b36be236fba078a6aa5a0c404410

SHA512
f8a0b9b24020dd8ab8978a9520b0fb65f6f2da8aa3099448dfe57474019f01009a71eaf1b8a27b60ae8f6067b8b499c7a8d5e1c2bb37f68beed0e034ffaa81ef

Download Submit
/data/user/0/com.tieniu.lezhuan/files/.um/um_cache_1703549052624.env

Filesize
1KB

MD5
14b5599e206a0e35e150b07a5fd126f4

SHA1
058e310e562f8708822668b44585e54cf10a0735

SHA256
8c9790c8737b69fb9046f23f21bebe72e95e678e790e64f80e381cf2cbf11a04

SHA512
24ad938fd4fd36aaef878b67d786d774858c26707b350585e31395a8784c25806baae9c452deae45eba867e9843fa704f6711194d546fcdf1393c56ccc7586f5

Download Submit
/data/user/0/com.tieniu.lezhuan/files/.umeng/exchangeIdentity.json

Filesize
162B

MD5
bb14246097c62a4d0b7e0f48fe9a4f86

SHA1
72b44b56c8443ad125e5e7465c1437189f027e5a

SHA256
f73b8cd4bc0b84ccb12522b21f7bbec3c0b0853acbfb0f25acbda93a78714e7b

SHA512
5db83326c325046a4e4fba1306fa2be64b3f86243d73df6fc6d12c25e0ab28f9836b13d08d3cd756047fcfb8f7e4622a8e11acd2c6307bbbe9fc620f9acf93fb

Download Submit
/data/user/0/com.tieniu.lezhuan/files/exid.dat

Filesize
60B

MD5
52a8d35b2f9e80640379df5bbd1e6112

SHA1
2b758929dfc4ce37ae4801c3b0187aa362faa2d9

SHA256
973dac26be358bd9c20817ecfd89bee90b0caaca8c1e00b8b36e2372e6e038c5

SHA512
dfbeccaea1dcc5705b785e1eaeaaa067dae6ca59f57ecddae809046ce4b8d2aee7685c0d08d7f3d862f909f259a1b4f8b02e8870f2479056078f1c506701aab8

Download Submit
/data/user/0/com.tieniu.lezhuan/files/infoc_sdk/batch/86_831ecd65-95c9-43c7-acea-577502731902_1703548921121_0.ich

Filesize
221B

MD5
167c349fd6a7e232281b2869a6230474

SHA1
e6464588508a96c9bfa8e1105467bea71cdfbac0

SHA256
08702aab7116e4d8a4fa97e6776ddc190739c7da2260a6841b44afbf41754c60

SHA512
e8e12c8d62944bc6398b8220c5b3e4bcb4af5b7efb6e4a43abc6c584aeea0aaed3ce03702b039cf3b30d789519be6269b9ecbd78055bfc510db0595b04c9cee0

Download Submit
/data/user/0/com.tieniu.lezhuan/files/infoc_sdk/urgent/83_f87c7505-f42b-4113-93d2-90b6fb6ae966_1703548921311_0.ich

Filesize
183B

MD5
92807c23117d61c9c16d8fe65066678b

SHA1
fe10ba169fce33f55706b27796ee9a5913d0e0f0

SHA256
655401284166d489f9e3b81534f1f9ea454bceeedcea817db0b1445d01a38185

SHA512
6106a5f9c71324b160ac94c7c2d63c83c70b22b945bd1c2e674912240ae766027acf54fec54c587568fd428e16d6e996761d21820c89eafe7608bde71668bc61

Download Submit
/data/user/0/com.tieniu.lezhuan/files/umeng_it.cache

Filesize
328B

MD5
33a1d57f60ca147d4eeea34b2aaf9aa0

SHA1
5696013c50909030933b8aa9efc0ad668189e8fd

SHA256
bf31042eb597cd9750faf776fa7f04a0bcc1a7271ab22b838a2a6101dba15c42

SHA512
18d750eba8f1eb08c7c47d1584b9a668b64cb06971dd178e6071360e4810eb8d5cd38aca38308dce3b29eb33f71ce74a2d8ca89cb881f30bef70e737565921eb

Download Submit
/storage/emulated/0/.DataStorage/ContextData.xml

Filesize
111B

MD5
ad024b1a4c661193f128ffd56f3844c5

SHA1
17b6aea4271e3a2d0d995e327628f90ff3a85803

SHA256
f7078be13537243e38a5d8fd0999dc70defd15a62c9868d61ced0cf1f4b1402d

SHA512
7aa37fcca8b76abaef2f05aede2c85e667fd82155b56203b11d1504ee5004c6df56d9822edc67d2958c3485f0e858ba629c7f2238e01e3788df4b79be2c9f1ce

Download Submit
/storage/emulated/0/.UTSystemConfig/Global/Alvin2.xml

Filesize
65B

MD5
9781ca003f10f8d0c9c1945b63fdca7f

SHA1
4156cf5dc8d71dbab734d25e5e1598b37a5456f4

SHA256
3325d2a819fdd8062c2cdc48a09b995c9b012915bcdf88b1cf9742a7f057c793

SHA512
25a9877e274e0e9df29811825bd4f680fa0bf0ae6219527e4f1dcd17d0995d28b2926192d961a06ee5bef2eed73b3f38ec4ffdd0a1cda7ff2a10dc5711ffdf03

Download Submit
/storage/emulated/0/.UTSystemConfig/Global/Alvin2.xml

Filesize
408B

MD5
440d09bc20e9e3476ce7047a2b2924fb

SHA1
580715916f6e1c8995ae65e461ab5a646c6180c8

SHA256
61de36b7c46308bc66ac1aa0d8796087ba095d97325fdddb6004742c72f741d9

SHA512
66e36190de493b4d66cc7b785ea6dbcbd64a63132d4da2b2b019773e043562c46221769c87bce1532cb22fa23c20adcdd00018c5ec2e3a9f9ea214eb3784986b

Download Submit
/storage/emulated/0/com.tieniu.lezhuan/config/5ac714da7be6d534dd74c84a097f98e0

Filesize
344B

MD5
81c233ab39a49c5e1804695652694a44

SHA1
bf4f2988a1c6c395c13540e2bf28bf2fa4f9eb1b

SHA256
11e46fbbe530ec0e8405fbf05a12ccbe41a71d07a5a8375c3d3fd1cc5c85c4c4

SHA512
d8f4be78a6ac599f81824722d47a93a387e09d01bee21faa47def64ddd14cc2d1efc6529bcbcd8fc92012658c6a27fe2cb02cf85ecf6deb7b9c2ca1699c618bd

Download Submit