Analysis

  • max time kernel
    171s
  • max time network
    190s
  • platform
    android_x86
  • resource
    android-x86-arm-20240514-en
  • resource tags

    androidarch:armarch:x86image:android-x86-arm-20240514-enlocale:en-usos:android-9-x86system
  • submitted
    18/05/2024, 16:48

General

  • Target
    55c45f4ff7357411f890d2db66805331_JaffaCakes118.apk
  • Size 14.1MB
  • Sample240518-va9qcsdc96
  • SHA256 10e76f9b66d07947eefe1e515379b278fe824c9b51a66b84bd5004f78e52702b
  • MD5 SHA1 SHA512 SSDEEP

Malware Config

Signatures

  • Checks if the Android device is rooted. 1 TTPs 6 IoCs
  • Makes use of the framework's Accessibility service 4 TTPs 1 IoCs

    Retrieves information displayed on the phone screen using AccessibilityService.

  • Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
  • Checks Android system properties for emulator presence. 1 TTPs 5 IoCs
  • Checks CPU information 2 TTPs 1 IoCs

    Checks CPU information which indicate if the system is an emulator.

  • Checks known Qemu files. 1 TTPs 3 IoCs

    Checks for known Qemu files that exist on Android virtual device images.

  • Checks known Qemu pipes. 1 TTPs 2 IoCs

    Checks for known pipes used by the Android emulator to communicate with the host.

  • Checks memory information 2 TTPs 3 IoCs

    Checks memory information which indicate if the system is an emulator.

  • Loads dropped Dex/Jar 1 TTPs 3 IoCs

    Runs executable file dropped to the device during analysis.

  • Makes use of the framework's foreground persistence service 1 TTPs 2 IoCs

    Application may abuse the framework's foreground service to continue running in the foreground.

  • Queries information about running processes on the device 1 TTPs 3 IoCs

    Application may abuse the framework's APIs to collect information about running processes on the device.

  • Queries information about the current Wi-Fi connection 1 TTPs 2 IoCs

    Application may abuse the framework's APIs to collect information about the current Wi-Fi connection.

  • Queries information about the current nearby Wi-Fi networks 1 TTPs 2 IoCs

    Application may abuse the framework's APIs to collect information about the current nearby Wi-Fi networks.

  • Queries the mobile country code (MCC) 1 TTPs 3 IoCs
  • Queries the phone number (MSISDN for GSM devices) 1 TTPs
  • Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 3 IoCs
  • Acquires the wake lock 3 IoCs
  • Checks if the internet connection is available 1 TTPs 3 IoCs
  • Queries the unique device ID (IMEI, MEID, IMSI) 1 TTPs
  • Reads information about phone network operator. 1 TTPs
  • Requests cell location 1 TTPs 1 IoCs

    Uses Android APIs to to get current cell information.

  • Schedules tasks to execute at a specified time 1 TTPs 1 IoCs

    Application may abuse the framework's APIs to perform task scheduling for initial or recurring execution of malicious code.

  • Checks the presence of a debugger
  • Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 3 IoCs

Processes

  • com.mgyun.shua.su
    1⤵
    • Checks if the Android device is rooted.
    • Makes use of the framework's Accessibility service
    • Checks Android system properties for emulator presence.
    • Checks CPU information
    • Checks known Qemu files.
    • Checks known Qemu pipes.
    • Checks memory information
    • Loads dropped Dex/Jar
    • Queries information about running processes on the device
    • Queries information about the current Wi-Fi connection
    • Queries information about the current nearby Wi-Fi networks
    • Queries the mobile country code (MCC)
    • Registers a broadcast receiver at runtime (usually for listening for system events)
    • Acquires the wake lock
    • Checks if the internet connection is available
    • Requests cell location
    • Schedules tasks to execute at a specified time
    • Uses Crypto APIs (Might try to encrypt user data)
    PID:4314
    • system/bin/sh
      2⤵
        PID:4393
        • chmod 777 /data/user/0/com.mgyun.shua.su/app_lib/libdevhlp.so
          3⤵
            PID:4416
        • /system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.mgyun.shua.su/cache/db_fm.jar --output-vdex-fd=61 --oat-fd=62 --oat-location=/data/user/0/com.mgyun.shua.su/cache/oat/x86/db_fm.odex --compiler-filter=quicken --class-loader-context=&
          2⤵
          • Loads dropped Dex/Jar
          PID:4438
        • getprop ro.build.version.emui
          2⤵
            PID:4491
          • ls -l /sbin/su
            2⤵
            • Checks if the Android device is rooted.
            PID:4514
          • getprop ro.build.version.emui
            2⤵
              PID:4536
            • getprop ro.letv.release.version
              2⤵
                PID:4828
              • getprop ro.build.version.emui
                2⤵
                  PID:4852
                • getprop ro.vivo.os.build.display.id
                  2⤵
                    PID:4890
                  • getprop ro.letv.release.version
                    2⤵
                      PID:4919
                  • com.pingstart.adsdk.optimize
                    1⤵
                    • Checks if the Android device is rooted.
                    • Checks memory information
                    • Makes use of the framework's foreground persistence service
                    • Queries information about running processes on the device
                    • Queries information about the current Wi-Fi connection
                    • Queries information about the current nearby Wi-Fi networks
                    • Queries the mobile country code (MCC)
                    • Registers a broadcast receiver at runtime (usually for listening for system events)
                    • Acquires the wake lock
                    • Checks if the internet connection is available
                    • Uses Crypto APIs (Might try to encrypt user data)
                    PID:4670
                    • system/bin/sh
                      2⤵
                        PID:4706
                    • com.mgyun.shua.su:channel
                      1⤵
                      • Checks memory information
                      • Makes use of the framework's foreground persistence service
                      • Queries information about running processes on the device
                      • Queries the mobile country code (MCC)
                      • Registers a broadcast receiver at runtime (usually for listening for system events)
                      • Acquires the wake lock
                      • Checks if the internet connection is available
                      • Uses Crypto APIs (Might try to encrypt user data)
                      PID:5036

                    Network

                          MITRE ATT&CK Mobile v15

                          Replay Monitor

                          Loading Replay Monitor...

                          Downloads

                          4314.yaqcookie

                          • Path /data/data/com.mgyun.shua.su/app_e_qq_com_plugin/4314.yaqcookie
                          • Size 8B
                          • SHA256 17d2c279b591569e37f8455fc8324e4be7b1b60d43158783e1e44949d0fbd0f4
                          • MD5 SHA1 SHA512

                          gdt_plugin.jar

                          • Path /data/data/com.mgyun.shua.su/app_e_qq_com_plugin/gdt_plugin.jar
                          • Size 636KB
                          • SHA256 e6df28c535e661d33a134407674c32555fb985a6a8f3bf8ec743150db61fa7ec
                          • MD5 SHA1 SHA512 SSDEEP

                          gdt_plugin.jar.sig

                          • Path /data/data/com.mgyun.shua.su/app_e_qq_com_plugin/gdt_plugin.jar.sig
                          • Size 180B
                          • SHA256 b14cbded2b9ebaf940fabcddb51150a196e49025b451d3a63313f32a6212a091
                          • MD5 SHA1 SHA512

                          libyaqbasic.742bd312.so

                          • Path /data/data/com.mgyun.shua.su/app_e_qq_com_plugin/libyaqbasic.742bd312.so
                          • Size 114KB
                          • SHA256 158ec5782dfefefc24866819d840dcdde24f32cad91ecfdad6e6f77c34d6b072
                          • MD5 SHA1 SHA512 SSDEEP

                          libyaqpro.742bd312.so

                          • Path /data/data/com.mgyun.shua.su/app_e_qq_com_plugin/libyaqpro.742bd312.so
                          • Size 113KB
                          • SHA256 55d5e2f026dd0aa86222872eb2fc3a3098ce07f5b86e5ae275912aca39ddab06
                          • MD5 SHA1 SHA512 SSDEEP

                          gdt_plugin.jar.cur.prof

                          • Path /data/data/com.mgyun.shua.su/app_e_qq_com_plugin/oat/gdt_plugin.jar.cur.prof
                          • Size 369B
                          • SHA256 080fa0ab4decdf18cf159cdbf4fbdce3be4b030a34588a80d07f0fd9773fb75f
                          • MD5 SHA1 SHA512

                          update_lc

                          • Path /data/data/com.mgyun.shua.su/app_e_qq_com_plugin/update_lc
                          • Size 4B
                          • SHA256 0c030586945fe504b604ecc2e875c38ede400cd5cd73da9730302162e6b02c6f
                          • MD5 SHA1 SHA512

                          update_lc

                          • Path /data/data/com.mgyun.shua.su/app_e_qq_com_plugin/update_lc
                          • Size 1B
                          • SHA256 bbf3f11cb5b43e700273a78d12de55e4a7eab741ed2abf13787a4d2dc832b8ec
                          • MD5 SHA1 SHA512

                          yaq.742bd312.sec

                          • Path /data/data/com.mgyun.shua.su/app_e_qq_com_plugin/yaq.742bd312.sec
                          • Size 33KB
                          • SHA256 82fc4c505311d6b491d1533e8b8899eb0022947cdd63de8278148a4e163ddaae
                          • MD5 SHA1 SHA512 SSDEEP

                          libdevhlp.so

                          • Path /data/data/com.mgyun.shua.su/app_lib/libdevhlp.so
                          • Size 37KB
                          • SHA256 d1fc9c95188206d1b86adad7e1f5a0474bf9bde33c36b80f3c54ba0cfceea420
                          • MD5 SHA1 SHA512 SSDEEP

                          libsolhlp.so

                          • Path /data/data/com.mgyun.shua.su/app_lib/libsolhlp.so
                          • Size 21KB
                          • SHA256 32cd907d3343c44180294a7c279c2a5f139a6ee443cbf443eb2bd663bca37c6e
                          • MD5 SHA1 SHA512 SSDEEP

                          -5998622401067643521

                          • Path /data/data/com.mgyun.shua.su/cache/VAdNetSdk/reqQueue/-5998622401067643521
                          • Size 7KB
                          • SHA256 e760422a1cae778dd2fbfca93e4a83a5043805a413fd698ca29bbdf95cdbd750
                          • MD5 SHA1 SHA512 SSDEEP

                          db_fm.jar

                          • Path /data/data/com.mgyun.shua.su/cache/db_fm.jar
                          • Size 38KB
                          • SHA256 7b094f25aa995a079c03c4105f52cf340708ba56f0197f700947024af317ee09
                          • MD5 SHA1 SHA512 SSDEEP

                          db_fm.jar.cur.prof

                          • Path /data/data/com.mgyun.shua.su/cache/oat/db_fm.jar.cur.prof
                          • Size 250B
                          • SHA256 f9148f617ca48f8ed215e8d274d521b33617760c4fb4f1a7cfc54c4fe886ebd1
                          • MD5 SHA1 SHA512

                          MessageStore.db

                          • Path /data/data/com.mgyun.shua.su/databases/MessageStore.db
                          • Size 4KB
                          • SHA256 d4c00cdd724106e406e1894f0d443563e24c9961f1d230af39da246f7bd0b54f
                          • MD5 SHA1 SHA512

                          MessageStore.db-journal

                          • Path /data/data/com.mgyun.shua.su/databases/MessageStore.db-journal
                          • Size 512B
                          • SHA256 6fd0015dd3ed4bedd6dc0d235cc522ecfdf27941a89c984e7597eeaa74582dd9
                          • MD5 SHA1 SHA512

                          MessageStore.db-shm

                          • Path /data/data/com.mgyun.shua.su/databases/MessageStore.db-shm
                          • Size 32KB
                          • SHA256 c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479
                          • MD5 SHA1 SHA512 SSDEEP

                          MessageStore.db-wal

                          • Path /data/data/com.mgyun.shua.su/databases/MessageStore.db-wal
                          • Size 64KB
                          • SHA256 b88d9b0e1514a08a31c24c66133ce4fca881741acdb6bea9163eacc800efae56
                          • MD5 SHA1 SHA512 SSDEEP

                          MsgLogStore.db

                          • Path /data/data/com.mgyun.shua.su/databases/MsgLogStore.db
                          • Size 4KB
                          • SHA256 0a8ffb6b327963558716e87db8946016d143e39f895fa1b43e95ba7032ce2514
                          • MD5 SHA1 SHA512

                          MsgLogStore.db-journal

                          • Path /data/data/com.mgyun.shua.su/databases/MsgLogStore.db-journal
                          • Size 32KB
                          • SHA256 c42238d090e81b138a3ea1aad100ba48afa8dc3afba2d8a08f734a1c9371d3ce
                          • MD5 SHA1 SHA512 SSDEEP

                          MsgLogStore.db-shm

                          • Path /data/data/com.mgyun.shua.su/databases/MsgLogStore.db-shm
                          • Size 32KB
                          • SHA256 5a8e2e529f571615bfe7dbe79e9026c1b5187f55df5af9cd883b65ad7aa27cfa
                          • MD5 SHA1 SHA512 SSDEEP

                          MsgLogStore.db-wal

                          • Path /data/data/com.mgyun.shua.su/databases/MsgLogStore.db-wal
                          • Size 60KB
                          • SHA256 3f3691f03eb81ddada19e1ad6e2586af99a3bc195da8f93560d1aa2eaa037727
                          • MD5 SHA1 SHA512 SSDEEP

                          accs.db-journal

                          • Path /data/data/com.mgyun.shua.su/databases/accs.db-journal
                          • Size 512B
                          • SHA256 19d0524cc1f4edf15d6077add836479a5e61e1f1cd285fdc601aada7167f8247
                          • MD5 SHA1 SHA512

                          accs.db-wal

                          • Path /data/data/com.mgyun.shua.su/databases/accs.db-wal
                          • Size 32KB
                          • SHA256 d25c7784ef5f8b92faf08d645f5a6dd74034ed43238856f2f28797d5437e289d
                          • MD5 SHA1 SHA512 SSDEEP

                          cc.db

                          • Path /data/data/com.mgyun.shua.su/databases/cc/cc.db
                          • Size 36KB
                          • SHA256 474c4a54534ed96beacad7cc9a805a3f53ec9c0522fc7bcc59771cf500a6a0da
                          • MD5 SHA1 SHA512 SSDEEP

                          cc.db

                          • Path /data/data/com.mgyun.shua.su/databases/cc/cc.db
                          • Size 36KB
                          • SHA256 7b45f576c08c7f78220168cca4a0e33198b13e9bdc8b1da406ddb6887412000c
                          • MD5 SHA1 SHA512 SSDEEP

                          cc.db-journal

                          • Path /data/data/com.mgyun.shua.su/databases/cc/cc.db-journal
                          • Size 512B
                          • SHA256 c2f954f328f0b4d293b106883cbc7e0ab188b1cf78d6dabc4b458deb84178487
                          • MD5 SHA1 SHA512

                          cc.db-wal

                          • Path /data/data/com.mgyun.shua.su/databases/cc/cc.db-wal
                          • Size 48KB
                          • SHA256 c5523d3892437dfe3ef4c27dcb6c5f9db9728b6471e47ba880261bfe599a12ea
                          • MD5 SHA1 SHA512 SSDEEP

                          cc.db-wal

                          • Path /data/data/com.mgyun.shua.su/databases/cc/cc.db-wal
                          • Size 16KB
                          • SHA256 881c98cb53bbe283de3fc8a62b41fb0de3d83e6e061f81ecf9d75f61a37222f4
                          • MD5 SHA1 SHA512 SSDEEP

                          download_status.db

                          • Path /data/data/com.mgyun.shua.su/databases/download_status.db
                          • Size 7KB
                          • SHA256 5bbc9cc9eea4bd9a47d763fcb8825c61d2e2e7fde4017713a5de6a19f64c12bb
                          • MD5 SHA1 SHA512 SSDEEP

                          download_status.db-journal

                          • Path /data/data/com.mgyun.shua.su/databases/download_status.db-journal
                          • Size 512B
                          • SHA256 16ee23b0a18ad7b13829d62b6cc92e279dfa98c87ff8ec982ca31ee01b20be19
                          • MD5 SHA1 SHA512

                          download_status.db-shm

                          • Path /data/data/com.mgyun.shua.su/databases/download_status.db-shm
                          • Size 32KB
                          • SHA256 1915ed8e7124f4215229c6de8639566224b0abb2c6795bde5656ff33a148ba77
                          • MD5 SHA1 SHA512 SSDEEP

                          download_status.db-wal

                          • Path /data/data/com.mgyun.shua.su/databases/download_status.db-wal
                          • Size 32KB
                          • SHA256 fc051d77bb8b095b96b31ca89050d36399d58241d4ce1b9590ef521376ee9757
                          • MD5 SHA1 SHA512 SSDEEP

                          downloader.db-journal

                          • Path /data/data/com.mgyun.shua.su/databases/downloader.db-journal
                          • Size 512B
                          • SHA256 44594985cb09ebd8546b81fc237160b21ca0d0e3fb978cadbcc48bcb2af8bfae
                          • MD5 SHA1 SHA512

                          downloader.db-wal

                          • Path /data/data/com.mgyun.shua.su/databases/downloader.db-wal
                          • Size 32KB
                          • SHA256 f38d6898e4f856f0497bbde79245f6f158a564488fc249e9b0878d247b5cf8d2
                          • MD5 SHA1 SHA512 SSDEEP

                          evernote_jobs.db

                          • Path /data/data/com.mgyun.shua.su/databases/evernote_jobs.db
                          • Size 16KB
                          • SHA256 8f72919eebbe45ed6d33b7b763d7e45d76a880128aee9aa5c29d28ab79689a92
                          • MD5 SHA1 SHA512 SSDEEP

                          evernote_jobs.db

                          • Path /data/data/com.mgyun.shua.su/databases/evernote_jobs.db
                          • Size 16KB
                          • SHA256 86b4921e63a7a6127d51fedad53b2e514597b4c2da7a87af80ad9bb6236e6529
                          • MD5 SHA1 SHA512 SSDEEP

                          evernote_jobs.db

                          • Path /data/data/com.mgyun.shua.su/databases/evernote_jobs.db
                          • Size 16KB
                          • SHA256 86cf4617376cf379e4bbdebcc99f6b05741927de32bac92b04f42010e5364d7c
                          • MD5 SHA1 SHA512 SSDEEP

                          evernote_jobs.db

                          • Path /data/data/com.mgyun.shua.su/databases/evernote_jobs.db
                          • Size 16KB
                          • SHA256 368c16220fd912ffc26d41ba9d2a16a5af5e77bc39602e71d3624e5efb0ecfaf
                          • MD5 SHA1 SHA512 SSDEEP

                          evernote_jobs.db

                          • Path /data/data/com.mgyun.shua.su/databases/evernote_jobs.db
                          • Size 16KB
                          • SHA256 d6e5b74858d292ce89908b845bbabada3b5f18a84735701ecbecbc3bda8bf135
                          • MD5 SHA1 SHA512 SSDEEP

                          evernote_jobs.db

                          • Path /data/data/com.mgyun.shua.su/databases/evernote_jobs.db
                          • Size 16KB
                          • SHA256 6565433de9df690d65749065d49a37240fd5a44e28b93b8f8ed158436a463c7c
                          • MD5 SHA1 SHA512 SSDEEP

                          evernote_jobs.db-journal

                          • Path /data/data/com.mgyun.shua.su/databases/evernote_jobs.db-journal
                          • Size 512B
                          • SHA256 350937532296708ec3da5653b2586a357059fddb9017cf06edd580d12f85c46e
                          • MD5 SHA1 SHA512

                          evernote_jobs.db-wal

                          • Path /data/data/com.mgyun.shua.su/databases/evernote_jobs.db-wal
                          • Size 28KB
                          • SHA256 b83d44a527a357f63b0b6eadab883fdcc45963d085956bcdcf3dc9ecb1652334
                          • MD5 SHA1 SHA512 SSDEEP

                          evernote_jobs.db-wal

                          • Path /data/data/com.mgyun.shua.su/databases/evernote_jobs.db-wal
                          • Size 4KB
                          • SHA256 c4f73036cf54507545da1942535d9d3b28a02582ce9d18a1cfde212eb450fe51
                          • MD5 SHA1 SHA512 SSDEEP

                          evernote_jobs.db-wal

                          • Path /data/data/com.mgyun.shua.su/databases/evernote_jobs.db-wal
                          • Size 4KB
                          • SHA256 8a01de61e4555d29b5c43bba3492dfc949d8585a34a183f98ce00cf32986fa34
                          • MD5 SHA1 SHA512 SSDEEP

                          evernote_jobs.db-wal

                          • Path /data/data/com.mgyun.shua.su/databases/evernote_jobs.db-wal
                          • Size 4KB
                          • SHA256 1adce0af9b33da886ae378c7271ed19008cd5dd331bed27853f8c86ca9a5527b
                          • MD5 SHA1 SHA512 SSDEEP

                          evernote_jobs.db-wal

                          • Path /data/data/com.mgyun.shua.su/databases/evernote_jobs.db-wal
                          • Size 4KB
                          • SHA256 0a4f4c8828ba526bbcc51606167c6fd05b4e578194951e89c3a384fa5cc1bc82
                          • MD5 SHA1 SHA512 SSDEEP

                          evernote_jobs.db-wal

                          • Path /data/data/com.mgyun.shua.su/databases/evernote_jobs.db-wal
                          • Size 4KB
                          • SHA256 ec74793864be7e7d8f7dbf707605ca09972fe39563ba0c2d8ff0c3ac9cbdd6a1
                          • MD5 SHA1 SHA512 SSDEEP

                          message_accs_db

                          • Path /data/data/com.mgyun.shua.su/databases/message_accs_db
                          • Size 36KB
                          • SHA256 5644a250fa6cef16c2c802b98275656a5fc39dcf89bcc22193742d85c7313f57
                          • MD5 SHA1 SHA512 SSDEEP

                          message_accs_db-journal

                          • Path /data/data/com.mgyun.shua.su/databases/message_accs_db-journal
                          • Size 512B
                          • SHA256 b4c5aa8606418d47cb5b46bd83c638532b609f2099f7aa35f16901e685498cf3
                          • MD5 SHA1 SHA512

                          message_accs_db-wal

                          • Path /data/data/com.mgyun.shua.su/databases/message_accs_db-wal
                          • Size 48KB
                          • SHA256 be8fe7e5813d51d92bea0ea32934e390b4d78bf9d934249adee858f37d32fdc8
                          • MD5 SHA1 SHA512 SSDEEP

                          ua.db

                          • Path /data/data/com.mgyun.shua.su/databases/ua.db
                          • Size 32KB
                          • SHA256 ee8540660c1dd3073c8f578c6c3e08581376609cb6f657e1014465fa90c186bb
                          • MD5 SHA1 SHA512 SSDEEP

                          ua.db

                          • Path /data/data/com.mgyun.shua.su/databases/ua.db
                          • Size 24KB
                          • SHA256 99e754f2874b089a3805f2f6cc2ff9ecab9bb72793bbcbb451bdbee23ab3d45b
                          • MD5 SHA1 SHA512 SSDEEP

                          ua.db

                          • Path /data/data/com.mgyun.shua.su/databases/ua.db
                          • Size 32KB
                          • SHA256 329940b4d46326d58e73c842dd099704061d0ef7338777bf31ad895f29013c17
                          • MD5 SHA1 SHA512 SSDEEP

                          ua.db

                          • Path /data/data/com.mgyun.shua.su/databases/ua.db
                          • Size 16KB
                          • SHA256 05d9384d61c90ccf1a749cb19c6ceb0d2ee7a8ed00ad62679b11978e2321ce41
                          • MD5 SHA1 SHA512 SSDEEP

                          ua.db

                          • Path /data/data/com.mgyun.shua.su/databases/ua.db
                          • Size 16KB
                          • SHA256 e20faed57fd46100ea990d9aaebd5f53ba79a9f63fd547f9a92373a4433e4476
                          • MD5 SHA1 SHA512 SSDEEP

                          ua.db-journal

                          • Path /data/data/com.mgyun.shua.su/databases/ua.db-journal
                          • Size 512B
                          • SHA256 8b9cbf4bad13521378d95ea357e3bb53a6e801ec2040623c7181383ea0f9f0bc
                          • MD5 SHA1 SHA512

                          ua.db-wal

                          • Path /data/data/com.mgyun.shua.su/databases/ua.db-wal
                          • Size 52KB
                          • SHA256 f65ee0a19dbc3f7c623afb638f9dfc4b6115fa463bf60467ff20994075f28e96
                          • MD5 SHA1 SHA512 SSDEEP

                          ua.db-wal

                          • Path /data/data/com.mgyun.shua.su/databases/ua.db-wal
                          • Size 12KB
                          • SHA256 6531b5ba1f83c27a1bfbf3bc4cd4d5d386310797c131d2519f4abb04fcc9da2d
                          • MD5 SHA1 SHA512 SSDEEP

                          ua.db-wal

                          • Path /data/data/com.mgyun.shua.su/databases/ua.db-wal
                          • Size 8KB
                          • SHA256 3a2026090b81c47c263e63df5b2917d74c9fb55d151cd7a1973fb6fe5d4600ef
                          • MD5 SHA1 SHA512 SSDEEP

                          ua.db-wal

                          • Path /data/data/com.mgyun.shua.su/databases/ua.db-wal
                          • Size 4KB
                          • SHA256 78866886b65b20e544cb97517da6d942a1f466f88e6b89d59e648b3de8393e12
                          • MD5 SHA1 SHA512 SSDEEP

                          ua.db-wal

                          • Path /data/data/com.mgyun.shua.su/databases/ua.db-wal
                          • Size 4KB
                          • SHA256 88df4f535c35f2467ed5dc4b2f5b783379b250ad5c2fc728eef25047760c2337
                          • MD5 SHA1 SHA512 SSDEEP

                          um_cache_1716051078632.env

                          • Path /data/data/com.mgyun.shua.su/files/.um/um_cache_1716051078632.env
                          • Size 1KB
                          • SHA256 669ca21fff2cd241cd43ba99d82e17824605d799b37ff5ecff2be0fb25bce898
                          • MD5 SHA1 SHA512

                          exchangeIdentity.json

                          • Path /data/data/com.mgyun.shua.su/files/.umeng/exchangeIdentity.json
                          • Size 162B
                          • SHA256 5731114a39aabc68ddda9a5ab9a5216588b9b06e5e9543911fd994b146fe64a6
                          • MD5 SHA1 SHA512

                          exid.dat

                          • Path /data/data/com.mgyun.shua.su/files/exid.dat
                          • Size 54B
                          • SHA256 89bf2506b2842c83c3d2c75a72577f03a7187d6adc5a3df6b580677067dac957
                          • MD5 SHA1 SHA512

                          GDTSDK.db

                          • Path /data/data/com.mgyun.shua.su/files/gdt_database/GDTSDK.db
                          • Size 24KB
                          • SHA256 bd26523bd56e6855c2f08c1d2405b6ea681a325b2ac42fa6fe3a79298e9492fc
                          • MD5 SHA1 SHA512 SSDEEP

                          GDTSDK.db-journal

                          • Path /data/data/com.mgyun.shua.su/files/gdt_database/GDTSDK.db-journal
                          • Size 512B
                          • SHA256 f4012c9487af35dea4e957a511bc160579e773551f22d8a2d099bb4ec6fe6b1b
                          • MD5 SHA1 SHA512

                          GDTSDK.db-wal

                          • Path /data/data/com.mgyun.shua.su/files/gdt_database/GDTSDK.db-wal
                          • Size 36KB
                          • SHA256 8d4e24283816ea5165a5ddb883651e6b4a5ca9d370845d42a31e8a4de84cfea5
                          • MD5 SHA1 SHA512 SSDEEP

                          umeng_it.cache

                          • Path /data/data/com.mgyun.shua.su/files/umeng_it.cache
                          • Size 413B
                          • SHA256 1c5b4573beae99ada7004cc14a9cca3a104f8870f7d65cec2103deb9340ef4ff
                          • MD5 SHA1 SHA512

                          gdt_plugin.jar

                          • Path /data/user/0/com.mgyun.shua.su/app_e_qq_com_plugin/gdt_plugin.jar
                          • Size 992KB
                          • SHA256 806cf7f383d22a5190df4d2e0d8a0e910c5d69057ef0c40541b8d82c208396bc
                          • MD5 SHA1 SHA512 SSDEEP

                          db_fm.jar

                          • Path /data/user/0/com.mgyun.shua.su/cache/db_fm.jar
                          • Size 84KB
                          • SHA256 7a5359eecc5da7a83859fbc1a3b7eeeb36a8062be1a5ea2cced752f76b2a81c0
                          • MD5 SHA1 SHA512 SSDEEP

                          db_fm.jar

                          • Path /data/user/0/com.mgyun.shua.su/cache/db_fm.jar
                          • Size 84KB
                          • SHA256 caed15bdfa65eededcb5cde6097305716aaf22e8cc839de1bdec497533274638
                          • MD5 SHA1 SHA512 SSDEEP

                          ContextData.xml

                          • Path /storage/emulated/0/.DataStorage/ContextData.xml
                          • Size 111B
                          • SHA256 57df7fa4f27d445190b0c2bdf7817c51ead590dc5c7c4ddcb6c7678cbab93de9
                          • MD5 SHA1 SHA512

                          Alvin2.xml

                          • Path /storage/emulated/0/.UTSystemConfig/Global/Alvin2.xml
                          • Size 65B
                          • SHA256 3325d2a819fdd8062c2cdc48a09b995c9b012915bcdf88b1cf9742a7f057c793
                          • MD5 SHA1 SHA512

                          Alvin2.xml

                          • Path /storage/emulated/0/.UTSystemConfig/Global/Alvin2.xml
                          • Size 111B
                          • SHA256 d8b27444a0afafb36df8b7180f17b636feb37a6fb846340c34d583f19c0b80bd
                          • MD5 SHA1 SHA512

                          Alvin2.xml

                          • Path /storage/emulated/0/.UTSystemConfig/Global/Alvin2.xml
                          • Size 167B
                          • SHA256 7bf5777da17ee00721a8054cd6de0c800cbf96d904436beedccf0248556d4a08
                          • MD5 SHA1 SHA512

                          Alvin2.xml

                          • Path /storage/emulated/0/.UTSystemConfig/Global/Alvin2.xml
                          • Size 167B
                          • SHA256 ebfd087bf04c40177c17541e2c1f857ecf6c7d933c173a84bca89afa0d719d2b
                          • MD5 SHA1 SHA512

                          6e8f33331a9c49798522acf0f7c8f8bf

                          • Path /storage/emulated/0/Android/data/com.mgyun.shua.su/cache/6e8f33331a9c49798522acf0f7c8f8bf
                          • Size 7KB
                          • SHA256 debaf1b88e3b5a8cd76462bed70dc250ed82f7fd090f7e4dfce540e1b5d59733
                          • MD5 SHA1 SHA512 SSDEEP

                          c57da8af3a1a4dca94fa316420e7d3ec

                          • Path /storage/emulated/0/Android/data/com.mgyun.shua.su/cache/c57da8af3a1a4dca94fa316420e7d3ec
                          • Size 1KB
                          • SHA256 e57d5dee8137ddb42c1cf209880467ce475df40c60bb88f021e3cfc93c513aeb
                          • MD5 SHA1 SHA512

                          8d8a3f198fd43721f6df3c8c005a75c0.tmp

                          • Path /storage/emulated/0/Android/data/com.mgyun.shua.su/cache/tt_tmpl_pkg/template/8d8a3f198fd43721f6df3c8c005a75c0.tmp
                          • Size 1.2MB
                          • SHA256 75ea668dfbc7f2e6d5907bb8288ba56125670af07af4460f9a92e305dac992c6
                          • MD5 SHA1 SHA512 SSDEEP

                          inapp_20240518.log

                          • Path /storage/emulated/0/Android/data/com.mgyun.shua.su/files/tnetlogs/inapp_20240518.log
                          • Size 37KB
                          • SHA256 723459d5445c1301a49bcc664d9af45260ee6859fdbdbee57afa3f117c297a33
                          • MD5 SHA1 SHA512 SSDEEP