b1b3ee518d136b31ee431491a89f20ff6c8305e0afe5d9b44da78a8cd22430d5

Analysis

max time kernel
135s
max time network
155s
platform
android_x86
resource
android-x86-arm-20240506-en
resource tags

androidarch:armarch:x86image:android-x86-arm-20240506-enlocale:en-usos:android-9-x86system
submitted
07/05/2024, 18:43

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2139d092673729c0b0e028cf4c606eba_JaffaCakes118.apk
Size

8.1MB
MD5

2139d092673729c0b0e028cf4c606eba
SHA1

27d492c21c57fef3cb973d79313473575a54f072
SHA256

b1b3ee518d136b31ee431491a89f20ff6c8305e0afe5d9b44da78a8cd22430d5
SHA512

0b54311efbc9eb2fe7126a44c52a4def0a4114994dd991fb90a3f6d0e49e43076c17022abbe5f6a62b4612e2dded9903d11a6b6667b80f957d8da7db37620c12
SSDEEP

98304:Yv8wdUL+PvptO0kpbAGNpfx7VzHk24V6IgSGirHd6rHhbOK4YqHh2ccSdarZKiaM:DwdXvpgvNpzA36H8HdWyDH0cckaN/a7A

Score

8^/10

collection discovery evasion execution impact persistence

Malware Config

Signatures

Requests cell location 2 TTPs 1 IoCs

Uses Android APIs to to get current cell location.

collection discovery evasion

Location Tracking

T1430

Geofencing

T1627.001

description	ioc	Process
Framework service call	com.android.internal.telephony.ITelephony.getCellLocation	com.hongdd.quxc

Checks Android system properties for emulator presence. 1 TTPs 1 IoCs

evasion

System Checks

T1633.001

description	ioc	Process
Accessed system property	key: ro.product.model	com.hongdd.quxc

Checks CPU information 2 TTPs 1 IoCs

Checks CPU information which indicate if the system is an emulator.

evasion discovery

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/cpuinfo	com.hongdd.quxc

Checks memory information 2 TTPs 1 IoCs

Checks memory information which indicate if the system is an emulator.

evasion discovery

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/meminfo	com.hongdd.quxc

Loads dropped Dex/Jar 1 TTPs 9 IoCs

Runs executable file dropped to the device during analysis.

evasion

Download New Code at Runtime

T1407

ioc	pid	Process
/data/data/com.hongdd.quxc/.jiagu/classes.dex	4249	com.hongdd.quxc
/data/data/com.hongdd.quxc/.jiagu/classes.dex!classes2.dex	4249	com.hongdd.quxc
/data/data/com.hongdd.quxc/.jiagu/tmp.dex	4249	com.hongdd.quxc
/data/data/com.hongdd.quxc/.jiagu/tmp.dex	4313	/system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/data/com.hongdd.quxc/.jiagu/tmp.dex --output-vdex-fd=42 --oat-fd=43 --oat-location=/data/data/com.hongdd.quxc/.jiagu/oat/x86/tmp.odex --compiler-filter=quicken --class-loader-context=&
/data/data/com.hongdd.quxc/.jiagu/tmp.dex	4249	com.hongdd.quxc
/data/data/com.hongdd.quxc/.jiagu/classes.dex	4524	com.hongdd.quxc:channel
/data/data/com.hongdd.quxc/.jiagu/classes.dex!classes2.dex	4524	com.hongdd.quxc:channel
/data/data/com.hongdd.quxc/.jiagu/tmp.dex	4524	com.hongdd.quxc:channel
/data/data/com.hongdd.quxc/.jiagu/tmp.dex	4524	com.hongdd.quxc:channel

Queries information about running processes on the device 1 TTPs 2 IoCs

Application may abuse the framework's APIs to collect information about running processes on the device.

discovery

Process Discovery

T1424

description	ioc	Process
Framework service call	android.app.IActivityManager.getRunningAppProcesses	com.hongdd.quxc
Framework service call	android.app.IActivityManager.getRunningAppProcesses	com.hongdd.quxc:channel

Queries information about the current Wi-Fi connection 1 TTPs 1 IoCs

Application may abuse the framework's APIs to collect information about the current Wi-Fi connection.

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.wifi.IWifiManager.getConnectionInfo	com.hongdd.quxc

Queries the mobile country code (MCC) 1 TTPs 1 IoCs

discovery

System Network Configuration Discovery

T1422

description	ioc	Process
Framework service call	com.android.internal.telephony.ITelephony.getNetworkCountryIsoForPhone	com.hongdd.quxc

Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 2 IoCs

persistence

Broadcast Receivers

T1624.001

description	ioc	Process
Framework service call	android.app.IActivityManager.registerReceiver	com.hongdd.quxc
Framework service call	android.app.IActivityManager.registerReceiver	com.hongdd.quxc:channel

Checks if the internet connection is available 1 TTPs 2 IoCs

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.IConnectivityManager.getActiveNetworkInfo	com.hongdd.quxc
Framework service call	android.net.IConnectivityManager.getActiveNetworkInfo	com.hongdd.quxc:channel

Queries the unique device ID (IMEI, MEID, IMSI) 1 TTPs
discovery

System Network Configuration Discovery
T1422

Schedules tasks to execute at a specified time 1 TTPs 1 IoCs

Application may abuse the framework's APIs to perform task scheduling for initial or recurring execution of malicious code.

execution persistence

Scheduled Task/Job

T1603

description	ioc	Process
Framework service call	android.app.job.IJobScheduler.schedule	com.hongdd.quxc:channel

Listens for changes in the sensor environment (might be used to detect emulation) 1 TTPs 1 IoCs

evasion

User Evasion

T1628.002

description	ioc	Process
Framework API call	android.hardware.SensorManager.registerListener	com.hongdd.quxc

Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 2 IoCs

impact

Data Encrypted for Impact

T1471

description	ioc	Process
Framework API call	javax.crypto.Cipher.doFinal	com.hongdd.quxc
Framework API call	javax.crypto.Cipher.doFinal	com.hongdd.quxc:channel

com.hongdd.quxc
1⤵
- Requests cell location
- Checks Android system properties for emulator presence.
- Checks CPU information
- Checks memory information
- Loads dropped Dex/Jar
- Queries information about running processes on the device
- Queries information about the current Wi-Fi connection
- Queries the mobile country code (MCC)
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Checks if the internet connection is available
- Listens for changes in the sensor environment (might be used to detect emulation)
- Uses Crypto APIs (Might try to encrypt user data)
PID:4249
- /system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/data/com.hongdd.quxc/.jiagu/tmp.dex --output-vdex-fd=42 --oat-fd=43 --oat-location=/data/data/com.hongdd.quxc/.jiagu/oat/x86/tmp.odex --compiler-filter=quicken --class-loader-context=&
  2⤵
  - Loads dropped Dex/Jar
  PID:4313

com.hongdd.quxc:channel
1⤵
- Loads dropped Dex/Jar
- Queries information about running processes on the device
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Checks if the internet connection is available
- Schedules tasks to execute at a specified time
- Uses Crypto APIs (Might try to encrypt user data)
PID:4524

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Scheduled Task/Job

T1603

Persistence

Event Triggered Execution

T1624

Broadcast Receivers

T1624.001

Scheduled Task/Job

T1603

Privilege Escalation

Defense Evasion

Download New Code at Runtime

T1407

Execution Guardrails

T1627

Geofencing

T1627.001

Hide Artifacts

T1628

User Evasion

T1628.002

Virtualization/Sandbox Evasion

T1633

System Checks

T1633.001

Credential Access

Discovery

Location Tracking

T1430

Process Discovery

T1424

System Information Discovery

T1426

System Network Configuration Discovery

T1422

System Network Connections Discovery

T1421

Lateral Movement

Collection

Location Tracking

T1430

Command and Control

Exfiltration

Impact

Data Encrypted for Impact

T1471

Replay Monitor

Loading Replay Monitor...

Downloads

/data/data/com.hongdd.quxc/.jiagu/classes.dex

Filesize
6.0MB

MD5
22ad933ecbfd0467a247eb05aee5b078

SHA1
a8a9fd8ae2d7b53f1afdc0674c0d9419a81218a7

SHA256
261917f2edd70a84641b41eb7f8ecd43040d832de26a859b45b6d4ee6e403fbe

SHA512
597e533865e28395ac9299c673b25131850a4682a1b30b7aadadf321bc1c8d6b953920f6c7fb623785ce15dcd11813c482834889a416b1dbd5762b0c0531293a

Download Submit
/data/data/com.hongdd.quxc/.jiagu/classes.dex!classes2.dex

Filesize
1.5MB

MD5
4b4d9410ce65c54cb9b73ea4c46dba1c

SHA1
5d8f4605345b5bc1f63fc985dafaf4b060299c77

SHA256
425ca2ad6a5599d3fd596ce811a816380cad3f2da29e6d454447b01a9f693008

SHA512
b70f91e9287c29f59db5278d96909830c2ce30cb8a8bd9133d34dd61d9e9a9a5b2d2278ae8a75047492eeb6cc65bc826f3fc9b496dfb7bd071051008bb27fb50

Download Submit
/data/data/com.hongdd.quxc/.jiagu/libjiagu.so

Filesize
496KB

MD5
f07656a2f51ecb23edc102003c32b764

SHA1
3ef18f74b609313887b9e825c56a54b5a9eef20e

SHA256
f6847402ab69102f8495aac58b9beddde9a71dc52470c5de17e382eec2a6b913

SHA512
34b337d2cf98ec3009f80ff299e43984a1c911e5f9eb5942a915915cb7b5b591ffc9f1b79a7989534c2583a703a3f0857e74be68cdd71388f68d5bef354f7238

Download Submit
/data/data/com.hongdd.quxc/.jiagu/tmp.dex

Filesize
284B

MD5
5820cfe2f8b5cdf4316f7b57c5673e6a

SHA1
a3d84d0307bc0da41a50c593abe127489728f871

SHA256
04777124e86a7f87be6769931fc8013fa4fa3e4dd4bb6858946a12a256efb27b

SHA512
51d99d96b2c75d3e15c2d25cf4deb4be2a805f1a15d6c9b1e9346eb331e0964aa288d728f2f566c34cd61485583be6d5b31db373c72a33e1daf263ffdb8612e3

Download Submit
/data/data/com.hongdd.quxc/.jiagu/tmp.dex

Filesize
284B

MD5
f1771b68f5f9b168b79ff59ae2daabe4

SHA1
0df6a835559f5c99670214a12700e7d8c28e5a42

SHA256
9f8898ce35a47aeafced99ea0d17c33e73037bb2307c7688e50819966f4ae939

SHA512
dae27d19727b89bec49398503baa6801640540355688dfabbe689c97545295c2c2d9b0f0dcd7cbc4cfbf701d0c0c3289e647a152f49ff242d1ecc741efe4145d

Download Submit
/data/data/com.hongdd.quxc/databases/MessageStore.db

Filesize
4KB

MD5
f2b4b0190b9f384ca885f0c8c9b14700

SHA1
934ff2646757b5b6e7f20f6a0aa76c7f995d9361

SHA256
0a8ffb6b327963558716e87db8946016d143e39f895fa1b43e95ba7032ce2514

SHA512
ec12685fc0d60526eed4d38820aad95611f3e93ae372be5a57142d8e8a1ba17e6e5dfe381a4e1365dddc0b363c9c40daaffdc1245bd515fddac69bf1abacd7f1

Download Submit
/data/data/com.hongdd.quxc/databases/MessageStore.db-journal

Filesize
512B

MD5
a7fd17c1600acfbc36bc4cd58835465e

SHA1
38096fac55744aaab163ab932854ff3003a795bd

SHA256
c9196351c8492f3066d52c3e2b9c97de325afb5d26076b36ff93b68246dbb1b5

SHA512
c67a3a8a4b33b8ba223bd2e6f736772632550ec24eb75695cacf84a40668c66e0b7c96380842359aff08f09b464be181f2b46722ffb8b7e6b34abd5e8cd7a10a

Download Submit
/data/data/com.hongdd.quxc/databases/MessageStore.db-shm

Filesize
28KB

MD5
cf845a781c107ec1346e849c9dd1b7e8

SHA1
b44ccc7f7d519352422e59ee8b0bdbac881768a7

SHA256
18619b678a5c207a971a0aa931604f48162e307c57ecdec450d5f095fe9f32c7

SHA512
4802861ea06dc7fb85229a3c8f04e707a084f1ba516510c6f269821b33c8ee4ebf495258fe5bee4850668a5aac1a45f0edf51580da13b7ee160a29d067c67612

Download Submit
/data/data/com.hongdd.quxc/databases/MessageStore.db-wal

Filesize
48KB

MD5
fd5abb9910cdcb5723857050ae01069b

SHA1
f40137b714be43b8626c69f365f61ffab0123a97

SHA256
e365ec2d63c499db13d34b40b02302e001c71ed19b3be0448e838e7d5fe11c1c

SHA512
bc5be36160dba03c724dcc08a72d71498120ddb5d9ef5c43c98498dfbb111b83e1aa6a41ea2acd536a75958ca3e54fedda2de18247074c82a38a0e39947d3951

Download Submit
/data/data/com.hongdd.quxc/databases/MsgLogStore.db-journal

Filesize
512B

MD5
2dcf96f8c1cb96b2cd66f93cbf7fa8f5

SHA1
50ee999c7963070d685ac4e269786fb8e255a5c0

SHA256
f3fe1dfa01d551b2b9b16e87a3bdb47e85db313141da0cc59e2c5215943ab01c

SHA512
94146b1c1e00ae92fb3f6eef98ee76255cc875ff90e3c442580a0698f8c566737801fa1cd324ff5f35d66a34efd256806900f83bad33a7b928dfa3379fa461b7

Download Submit
/data/data/com.hongdd.quxc/databases/MsgLogStore.db-wal

Filesize
68KB

MD5
0eafcdce39237e5a9936662d9731c72a

SHA1
c262c15f42c99f202f1e5b9813400b0a81311489

SHA256
93f594a6dfbdce6daae20c4dbbb75eca95c65b1eb150d19f5d56ebdacd40d23f

SHA512
9f0838a6961c020c0a1bf65edaece7b33a8263d14a30b16f8f10724eb7313216e1e47f2e22d7260fddc48b5e44fc77549cb38a2da44bf444722ba5ef05675af9

Download Submit
/data/data/com.hongdd.quxc/databases/accs.db-journal

Filesize
512B

MD5
b2d984cb5d8b60fdb16de87371989e78

SHA1
e507506c2a166de529f4c7d34ea17fc274bf83c0

SHA256
312a6178e34ad2743de318edefaa300596ccb06015430cf6444c8eac4c2578d6

SHA512
dc88eeb5d4da25d2addd7ab8f7bf651b8257f829cde99ad9883c8ff4cd373944d9fe44b0ce8151595c9a7b1c99828f38ad34d5171bbbf15d66b57e95e0c9a965

Download Submit
/data/data/com.hongdd.quxc/databases/accs.db-wal

Filesize
32KB

MD5
537c1eac5258af4ae992886cabb1692a

SHA1
acc49b403863d68b630da3135920e3b0225cb52e

SHA256
83b66ea54b1b43dfe3560ecdb6e002c3be4513266fb67d967ffe64771abf0c34

SHA512
e25a897e16b86440e34c46ee18ec3be710f3c59b00901af6c6fbac41d3df0092e31e2e5fc879a6541b7c2db2248284380445ec24081486f452d73089b520ae6c

Download Submit
/data/data/com.hongdd.quxc/databases/cc/cc.db

Filesize
36KB

MD5
5d7ea1a23af19b4340cc8d90f28297d5

SHA1
4cfe95b23a9e98378d69c4290af81b51fbe76aea

SHA256
474c4a54534ed96beacad7cc9a805a3f53ec9c0522fc7bcc59771cf500a6a0da

SHA512
33071f4c92da0a3df01c4a61dd165df7c7e0f4f37753cafe02d19fc876a5e7fcbb01c069c804e140ab8bfa0644a55f50fd1373646d1c439f817baa5ffbd47f7b

Download Submit
/data/data/com.hongdd.quxc/databases/cc/cc.db

Filesize
36KB

MD5
ce6135aa1b1fe4f2c2db2a546d2a5558

SHA1
79b59582154017aadab783dc266fcb158c252940

SHA256
7b45f576c08c7f78220168cca4a0e33198b13e9bdc8b1da406ddb6887412000c

SHA512
2839075fe374c8567c839ae35ce2d33ec72fdaebf170aa7d224b555e5b0e74d4a43f2f67d17ed806dae841da883e9620d788ea052d06152678afa927307c7ce4

Download Submit
/data/data/com.hongdd.quxc/databases/cc/cc.db-journal

Filesize
512B

MD5
6b4a4b5f32cb31baf81fd83dee9c6fcb

SHA1
c6af169066be1d8ea446e0ca99010a04bd8d8797

SHA256
22ccca77076272e2a97f0b3e95aff5eca97fec24ee177d2692e250ed6a030176

SHA512
3bf0bb28cb0a3213a97ae18ce6ea0afc5cae779825f192b71e01c997ee998907c0844b009be98be32e9dd034a31ecfe9c2e60de17065f9fd266be3b479955c1d

Download Submit
/data/data/com.hongdd.quxc/databases/cc/cc.db-wal

Filesize
48KB

MD5
b61e7448e877696ec1ead011f86a7e78

SHA1
75958f2fdfc711d66a21e0acd3d820a435c5f7b9

SHA256
e6aca81a2183e953db045194ed4548d73337c1940be65459f4671f696524de3d

SHA512
2bc6ef887458125d20a27fb9d1ceba3f136783824e913749a4501ecca582c9443b732eb96168ef971db83046902e4f3b85753458f40baf1bc3f724e96621f67c

Download Submit
/data/data/com.hongdd.quxc/databases/cc/cc.db-wal

Filesize
16KB

MD5
52f2e8da69f8c6eda5a1153c217eb54e

SHA1
ed08fa9c80030327a9fb3e776a7c9a19222391dc

SHA256
a0d4f7ef98d4b7dad36eaa0b46bc987c5f9663bf6a5815cc01b4d7b311941a8a

SHA512
6c19694f10d9fb3e352a6328af27a419285ae12740ce58e372089ed0aedf0fde541066eb5a252ef3e779990d998d20a8806a5cf821e4c5461517eb10434e8b07

Download Submit
/data/data/com.hongdd.quxc/databases/ua.db

Filesize
32KB

MD5
fe1af3b6b0c3efdfc58df6089f9ab07b

SHA1
9e8c32297d83932d15090f1fe19e02b6ae47c722

SHA256
9ec01ad8ea4d23d2a4f4b7b5615741cf8c4f686e167e0eee88d5767c0f02fa18

SHA512
2355776a13ae41742808f08f928c5a9f447c77f95c21a5ed7db7512d2625748769127c750db460b0190e0b29a3da85b02250b2081a835e0aefd847eb5f7ef574

Download Submit
/data/data/com.hongdd.quxc/databases/ua.db

Filesize
32KB

MD5
d604a3bf1f8d992cc320ea5b1f7609bd

SHA1
247f88df0b55c7d523ea5398637711a0e4a483a4

SHA256
329940b4d46326d58e73c842dd099704061d0ef7338777bf31ad895f29013c17

SHA512
67e28f6713cb5c238a9664df128f01a89a2efb7c8c9330c1e45bc0d40ebab81fa20df5166743d84d81dc0386a89ff0329f022281c098339baa2e851ff0a1e1ab

Download Submit
/data/data/com.hongdd.quxc/databases/ua.db-journal

Filesize
512B

MD5
56dbc7b3aaaa357ee90db9bd4a786ee5

SHA1
42e01fc71eb1bac5dae0f9882b763bdee3171c17

SHA256
55fcfd20343af003d67ee0fb9c8e0960b909f69ee6b3981861c3da6a38c928da

SHA512
028232e7c817f3e788fbc81d6ab52d049d88616c969f128f289c64f5f9af8e4b2ac5c1c43d8b66965ff47a22600dc121608680bde387df7ebd1fbbbac1cff8df

Download Submit
/data/data/com.hongdd.quxc/databases/ua.db-wal

Filesize
56KB

MD5
58c7e91b27c70d92542e28d2543e574e

SHA1
8f0e56b58430f04d50e44b0f3ed8b4e86c3a0f22

SHA256
456281c6062ab95f2d5cb26557ab66325fa4a5f5028209e49129957ac9a6baf4

SHA512
e0deea278742d4807d5622709ddbce4a55c7c2e4f14571beb3c735cbc561ee5380c00b5ad2a6fe9cc2498a6d06cebbe679e6b7b958ec99c8e8ddab88d63817c2

Download Submit
/data/data/com.hongdd.quxc/databases/ua.db-wal

Filesize
8KB

MD5
cb1baa8067e6717e4e6a82b39f7862a2

SHA1
f11bdd6edc57e82aed494529bbf87679d8877952

SHA256
3e26d14f5d2246714d1c64dde4f26e40000b2163d38aaf34fba506035b2a48ad

SHA512
058dc63e5f8216e627631be64f24c30953aa3bead9f12b3f05b367bd2897e123c66de7245f39b7ceb20a91fa86396a3d68d2866108ca5e9b8ba6e9f5c195ad78

Download Submit
/data/data/com.hongdd.quxc/files/.jglogs/.jg.ac

Filesize
32B

MD5
0a10ee2b8f31fcc6476876eba1304d7c

SHA1
7c598799f2aef1da05b4c74aed0c19f377f3f75d

SHA256
458f0f136eff2bc5b8e7f62f9e6a54584ed3556002239ddb424c84181c0625e9

SHA512
a4916bbc5bcb1de6aceaeebacfd05bfa9dfd74c7d8ee7a3d7ad0068da24d380ca0bc9aab67d013a837840a5abe1bedfbb493615e761abf3e2427606882f89d6e

Download Submit
/data/data/com.hongdd.quxc/files/.jglogs/.jg.di

Filesize
512B

MD5
14beb8147db3484042f356ea9c4be49c

SHA1
22f3c5245fb2ae82d9bbc888309b4afe28f07a0f

SHA256
a54812c0afed7a0d68a77616483c1f9b5a07ade351356bea11422f06f8c65d55

SHA512
df70fc74a31bc99ab70de38a471a5763049d4f03cf020b3647bf837ebd674a0538d17cf12eed8e68c59c812f1a0342dfabbfeaf117d0936bc72cf120e4230ddc

Download Submit
/data/data/com.hongdd.quxc/files/.jglogs/.jg.ic

Filesize
36KB

MD5
486e2bac2b3e9e1cb411d2838a4854bd

SHA1
81dd0a7537f4af319b830ae834908986be85da8b

SHA256
5644a250fa6cef16c2c802b98275656a5fc39dcf89bcc22193742d85c7313f57

SHA512
c146789563dae163e373489b3df53f22efebd32b69643992969241eb5ad5eec668de67e7cd2aaf5c3a8af57b0842115d00183825734f57643d3fdb09835fe681

Download Submit
/data/data/com.hongdd.quxc/files/.jglogs/.jg.li

Filesize
100B

MD5
2f0be4c7a6bd64e81ee1782c0a3eaf19

SHA1
cba53d7db3538f11aec77a2a8828ad60508a9230

SHA256
e9bb8894fba2d374f104e52567d9f8413c24d92d0cc640df9497ffe25f54a6f8

SHA512
0abbd8e96072db6bba8192ca199069abcd22e2ce3382270ff4f0e5e5994505f4f5f6732aae4616d7539e48908959d86d6e8f5d8edf0c259d5e8db9cbc69f3eab

Download Submit
/data/data/com.hongdd.quxc/files/.jglogs/.jg.rd

Filesize
73B

MD5
41228d4c0eeeb8fc9df83a288153987d

SHA1
59774114b68fa00b97383616827402bc32d2d16a

SHA256
64f7961a83b5bb28083151acb0ecc5d1e9caf07176d5711c1c551c6719f07cb0

SHA512
f6b710ea87662aca7272af8fa723545941533dcf1d494964d19550f4d972a7cea1f3143b841966c20d072a12b111101419d8963fe3aedf527dd76d0672100348

Download Submit
/data/data/com.hongdd.quxc/files/.jglogs/.jg.ri

Filesize
314B

MD5
571483094230e28fe314b32c50f4a991

SHA1
db4f558102bb3e8d093761c0ef9cebc3c01fe99f

SHA256
5718b5967ab91c48b147e4aefd6a455e09df8deb16c4dde0a96595fd7519e3e4

SHA512
6ced62c1fd8747ad714f9d472f2805ee8fcae8d1fb64b3584ad00da3cf34d9e65d045662f8ea09eaa29ad16e9259f639c1cbfb9418157c59a4f14e9444ac9ede

Download Submit
/data/data/com.hongdd.quxc/files/.jiagu.lock

Filesize
27B

MD5
3eaf0ba83660db5c25d37db8ab3c494d

SHA1
81456227686c15abd5eb69650f52874698e38e8b

SHA256
18cc2d3d782ee9fc30c71f67322db7d1abe2c5fae77bef48b7c718b9189eabcb

SHA512
ee36c30a3682cdfdae65a379f6219a9c242b380e178252967da25ce0702cd76fa21099d3e3fe0c79c86765d81dac5d8f40793f50aa0bb4e055f44eafa1c68341

Download Submit
/data/data/com.hongdd.quxc/files/.umeng/exchangeIdentity.json

Filesize
162B

MD5
333d188801f640c2d639649d0609d4a3

SHA1
843daf411b663c2474e857b15b2fc004b74ff2e3

SHA256
f7e88ca4dc06d9a63d88f51dac136a5bff62d5137390c35429f1f0efbefab80b

SHA512
3595222be2849aac58c00b53f3916cd2f0e230f730e3f56c5767aa6d9b65c37295a7b586c74dfeb849d17688c85fa5996845e24b60dc5d4f8e853a078ad84d61

Download Submit
/data/data/com.hongdd.quxc/files/exid.dat

Filesize
55B

MD5
ed04e44243e1ff8bb8d65527ca1b6d8f

SHA1
5df3472e8b6cf3bd904bd36a2fee67d40f9c9235

SHA256
8d191d6c8f6d4ba8022d36eae9fee4a010df0b3b0803299aa301679b8fee1854

SHA512
16d503220fc0afa621a22828882f13a979de54609ffad03fc5d94e0571d593cd8f218790baf46b361fd8f3a60338fd8b94985023f95626a3e3ffc7cc9b5e9821

Download Submit
/data/data/com.hongdd.quxc/files/stateless/dW1weF9pbnRlcm5hbA== /dW1weF9pbnRlcm5hbF8xNzE1MTA3NDkwOTEw

Filesize
1KB

MD5
fde3d1f6a64eeb8166939d7fc9aac9b6

SHA1
2d36d70414ab178e9ffb45f9ba7b7b018125c85c

SHA256
ceb0153ea44daf357a53c4f4e0d73619275ee70c0dcd15b7f931e33505c3465f

SHA512
b1ddc7bfb80231814b52634e8c0a0758a231727f78d52eeaf924dac4d9fdefe31ccb6ef74ff87122a6431770c7e0af13a6bcc560af41fcd9cee19f55f14152f6

Download Submit
/data/data/com.hongdd.quxc/files/umeng_it.cache

Filesize
498B

MD5
d60866aab92c8a44b6e504c1c12922c8

SHA1
aea2c3e1a7ded9530c6a91f03fcd5ad95a6ba178

SHA256
cbb6f60f1eeeec785cdf663911cf1352d1dca20803952f87e74e0488d8c2d0b6

SHA512
94b8f5be7430a37bf370a36cab2b1a51e810bd55ec9113bbd424eb5756112b1372b3f7ae6a37709d7bdee15ac8ecf00d2507f6baa052f07a56878d3fd61a4f30

Download Submit
/data/data/com.hongdd.quxc/files/umeng_it.cache

Filesize
579B

MD5
7c3bbdcf6c3d97c9015f63dbb4ba0811

SHA1
5df103cd2f66bc6d642ab47666ef0e3aa9aa2229

SHA256
169c1e7c94d2a8d25792a98d486f59583a19f69b905d0e7fc0e5172e09af055d

SHA512
428c2160a4776e1e02a4dfec88c379188362eaf522ce1bc91b2c4f56acd713b1940820e8900de6fa6acaed8344ddae08af2ba1114a0ccdcb67c7b662bece54cd

Download Submit
/storage/emulated/0/.DataStorage/ContextData.xml

Filesize
111B

MD5
27a98b21497f15609c096686566f4063

SHA1
deda1663105509d5c38b5d16a208aea6d74537d9

SHA256
c328b01b5441c30265b3733ac5b531150ea80a37ddb92db1d56b62b860b0ce09

SHA512
8e009b46c08719affc97a222332695d899be87c18673cbeacddf4c9ad8b785f0f483e360d0656ddfe57029a743a141ecb9e53955a590368bb53d3cb259578e73

Download Submit
/storage/emulated/0/.DataStorage/ContextData.xml

Filesize
213B

MD5
92e10d30ef84eaa9e8d7c1acd411014c

SHA1
0e1c6868ddf2cebf5e4ba67aaef59122a0b3ecd8

SHA256
a1378845d5a1c19f292f26ce348ca19e16bf96b93928c8317630f78a370243ac

SHA512
17509681ad31f75ff3580d7ccb990a55ee438b58152bcd641d9b290926e22083b85fac6d14e9e8dd86939a61e9aaf0ddb5637020136207172f4d5ef64a3afa04

Download Submit
/storage/emulated/0/.UTSystemConfig/Global/Alvin2.xml

Filesize
65B

MD5
9781ca003f10f8d0c9c1945b63fdca7f

SHA1
4156cf5dc8d71dbab734d25e5e1598b37a5456f4

SHA256
3325d2a819fdd8062c2cdc48a09b995c9b012915bcdf88b1cf9742a7f057c793

SHA512
25a9877e274e0e9df29811825bd4f680fa0bf0ae6219527e4f1dcd17d0995d28b2926192d961a06ee5bef2eed73b3f38ec4ffdd0a1cda7ff2a10dc5711ffdf03

Download Submit
/storage/emulated/0/.UTSystemConfig/Global/Alvin2.xml

Filesize
111B

MD5
ec4a8ee42a62ffc0638b011b2b99cad9

SHA1
543c968330a6c6bb1026eebddc59905d97506847

SHA256
9938d45903bf8d36c3303c52c9ae4bf1bc23cbd0f3e01f0149a6e14466865153

SHA512
7997b0130809682269b86ecba795145320eaea5b4b5ff8ee4a2e7fc33ceed6a9515e3d148756fb9bd5d4bb8b68894887387312488923e21c0c8353022ba901ac

Download Submit
/storage/emulated/0/.UTSystemConfig/Global/Alvin2.xml

Filesize
167B

MD5
bd37b683c2f06f6507da7449bd6829ac

SHA1
63fd6fe05cd9f5a1eee0634896eb26baf606981e

SHA256
caba26ab5c48f7e45f200b351cdbc5d7f153bc2b0685a73d4c30ebf9bfa9c029

SHA512
8e1010b67c178e02d54d20d7e4692e018f258531153ee3eef431af95c6e1a3313865e47c0ed14fcce0f72de76f9b9f0437eaf7c06e35fc3f7a0a39abb635ede0

Download Submit
/storage/emulated/0/360/.deviceId

Filesize
32KB

MD5
1c56df0a0870ed1c3273c17e476a6f03

SHA1
865db3b9119dd6dc82187d525c8b6be494484a99

SHA256
7c6359bd9670bf186ea39c6e8f08f4120d033077a6167ce7d1e76f3dca6bca5c

SHA512
f07447e0c243df2dcf050b93609f339a1d5cb61cd7a240b5bcc02a2bfd160a5783e1a69ada604c72ac6fded56a9607c4624f92794a052e9f2cabbf2c334cc246

Download Submit
/storage/emulated/0/360/.iddata

Filesize
48KB

MD5
5680447ab28c0ee7cd63118a066efb62

SHA1
6eb999e743762be21666ae5b0affc251cf286a53

SHA256
8bd20c39844cae13034ba703df28d29be77f956f48e9a86cb05c38f9ab2b2973

SHA512
c5c2aa618e7b6b4102b77c9dadf59032a7932979a898ce0af25964f1f1fae4f44fda458100019cdf8b3aa7b441ce662f35c447e4f11fa404249e710a921ab1c5

Download Submit
/storage/emulated/0/Quxc/Log/qxc.txt

Filesize
236B

MD5
d8db3efe4c74d810027a61b34bd757bf

SHA1
98d7dd1b7756af6ce2195bc709837d163347261e

SHA256
ee24dc85ce627387b4c3c8a627180e3d4545b11f62d7dc07c4876c413d9de9d2

SHA512
7de18fe119e46c34a749308431e672d6d54fac0c2f1d2d5c9217f9596fe82f143f241326ac34f7cc54ba029e80b48429f3964e1ec95bac9e6337e8dbf48935aa

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads