8bc8edecd1885e1b40cda5f0142d2d9d4d24234378884ea5fbfe9ef6c5a371ae

Analysis

max time kernel
179s
max time network
191s
platform
android_x64
resource
android-x64-20240514-en
resource tags

androidarch:x64arch:x86image:android-x64-20240514-enlocale:en-usos:android-10-x64system
submitted
28/05/2024, 08:44

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
7c5bfd934e4fe20043721ecd4f93c914_JaffaCakes118.apk
Size 23.8MB
Sample240528-knj2raea83
SHA256 8bc8edecd1885e1b40cda5f0142d2d9d4d24234378884ea5fbfe9ef6c5a371ae
MD5 7c5bfd934e4fe20043721ecd4f93c914
SHA1 dbb1598a3a77b94456cfa04178199f176c0a2e7d
SHA512 93e6fa3ffc53e20d4c4028310116ad0ef175df9ca1c1b6cbf182179f62718b87017fff83e00d10d724191729f0f244ecc2ff6f881a4d4de21610846c5c88b325
SSDEEP 393216:Zv1m6trC1T3renzomBKg8M420xXjs7xaupQ2cYOevstzeMMHAc8iBYZ986bhT3FK:jm6NmiUmBKgvcxXAN9Qe0tzeMuAfis/e
MD5 SHA1 SHA512 SSDEEP

Score

8^/10

collection credential_access discovery evasion impact persistence

Malware Config

Signatures

Requests cell location 1 TTPs 4 IoCs

Uses Android APIs to to get current cell information.

collection discovery

Location Tracking

T1430

description	ioc	Process
Framework service call	com.android.internal.telephony.ITelephony.getAllCellInfo	com.wzmt.ipaotui:remote
Framework service call	com.android.internal.telephony.ITelephony.getCellLocation	com.wzmt.ipaotui:remote
Framework service call	com.android.internal.telephony.ITelephony.getCellLocation	com.wzmt.ipaotui
Framework service call	com.android.internal.telephony.ITelephony.getCellLocation	com.wzmt.ipaotui:push

Checks CPU information 2 TTPs 1 IoCs

Checks CPU information which indicate if the system is an emulator.

evasion discovery

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/cpuinfo	com.wzmt.ipaotui

Checks memory information 2 TTPs 1 IoCs

Checks memory information which indicate if the system is an emulator.

evasion discovery

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/meminfo	com.wzmt.ipaotui

Makes use of the framework's foreground persistence service 1 TTPs 2 IoCs

Application may abuse the framework's foreground service to continue running in the foreground.

evasion persistence

Foreground Persistence

T1541

description	ioc	Process
Framework service call	android.app.IActivityManager.setServiceForeground	com.wzmt.ipaotui:push
Framework service call	android.app.IActivityManager.setServiceForeground	com.wzmt.ipaotui

Obtains sensitive information copied to the device clipboard 2 TTPs 1 IoCs

Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.

collection credential_access impact

Clipboard Data

T1414

Transmitted Data Manipulation

T1641.001

description	ioc	Process
Framework service call	android.content.IClipboard.addPrimaryClipChangedListener	com.wzmt.ipaotui

Queries information about running processes on the device 1 TTPs 3 IoCs

Application may abuse the framework's APIs to collect information about running processes on the device.

discovery

Process Discovery

T1424

description	ioc	Process
Framework service call	android.app.IActivityManager.getRunningAppProcesses	com.wzmt.ipaotui
Framework service call	android.app.IActivityManager.getRunningAppProcesses	com.wzmt.ipaotui:push
Framework service call	android.app.IActivityManager.getRunningAppProcesses	com.wzmt.ipaotui:remote

Queries information about the current Wi-Fi connection 1 TTPs 3 IoCs

Application may abuse the framework's APIs to collect information about the current Wi-Fi connection.

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.wifi.IWifiManager.getConnectionInfo	com.wzmt.ipaotui:push
Framework service call	android.net.wifi.IWifiManager.getConnectionInfo	com.wzmt.ipaotui:remote
Framework service call	android.net.wifi.IWifiManager.getConnectionInfo	com.wzmt.ipaotui

Queries information about the current nearby Wi-Fi networks 1 TTPs 3 IoCs

Application may abuse the framework's APIs to collect information about the current nearby Wi-Fi networks.

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.wifi.IWifiManager.getScanResults	com.wzmt.ipaotui
Framework service call	android.net.wifi.IWifiManager.getScanResults	com.wzmt.ipaotui:push
Framework service call	android.net.wifi.IWifiManager.getScanResults	com.wzmt.ipaotui:remote

Queries the mobile country code (MCC) 1 TTPs 1 IoCs

discovery

System Network Configuration Discovery

T1422

description	ioc	Process
Framework service call	com.android.internal.telephony.ITelephony.getNetworkCountryIsoForPhone	com.wzmt.ipaotui

Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 3 IoCs

persistence

Broadcast Receivers

T1624.001

description	ioc	Process
Framework service call	android.app.IActivityManager.registerReceiver	com.wzmt.ipaotui
Framework service call	android.app.IActivityManager.registerReceiver	com.wzmt.ipaotui:push
Framework service call	android.app.IActivityManager.registerReceiver	com.wzmt.ipaotui:remote

Checks if the internet connection is available 1 TTPs 3 IoCs

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.IConnectivityManager.getActiveNetworkInfo	com.wzmt.ipaotui
Framework service call	android.net.IConnectivityManager.getActiveNetworkInfo	com.wzmt.ipaotui:push
Framework service call	android.net.IConnectivityManager.getActiveNetworkInfo	com.wzmt.ipaotui:remote

Domain associated with commercial stalkerware software, includes indicators from echap.eu.org 2 IoCs

flow	ioc
21	alog.umeng.com
118	alog.umeng.com

Queries the unique device ID (IMEI, MEID, IMSI) 1 TTPs
discovery

System Network Configuration Discovery
T1422
Reads information about phone network operator. 1 TTPs
discovery

System Network Configuration Discovery
T1422

Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 3 IoCs

impact

Data Encrypted for Impact

T1471

description	ioc	Process
Framework API call	javax.crypto.Cipher.doFinal	com.wzmt.ipaotui
Framework API call	javax.crypto.Cipher.doFinal	com.wzmt.ipaotui:push
Framework API call	javax.crypto.Cipher.doFinal	com.wzmt.ipaotui:remote

com.wzmt.ipaotui
1⤵
- Requests cell location
- Checks CPU information
- Checks memory information
- Makes use of the framework's foreground persistence service
- Obtains sensitive information copied to the device clipboard
- Queries information about running processes on the device
- Queries information about the current Wi-Fi connection
- Queries information about the current nearby Wi-Fi networks
- Queries the mobile country code (MCC)
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Checks if the internet connection is available
- Uses Crypto APIs (Might try to encrypt user data)
PID:5184

com.wzmt.ipaotui:push
1⤵
- Requests cell location
- Makes use of the framework's foreground persistence service
- Queries information about running processes on the device
- Queries information about the current Wi-Fi connection
- Queries information about the current nearby Wi-Fi networks
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Checks if the internet connection is available
- Uses Crypto APIs (Might try to encrypt user data)
PID:5241

com.wzmt.ipaotui:remote
1⤵
- Requests cell location
- Queries information about running processes on the device
- Queries information about the current Wi-Fi connection
- Queries information about the current nearby Wi-Fi networks
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Checks if the internet connection is available
- Uses Crypto APIs (Might try to encrypt user data)
PID:5297

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Event Triggered Execution

T1624

Broadcast Receivers

T1624.001

Foreground Persistence

T1541

Privilege Escalation

Defense Evasion

Foreground Persistence

T1541

Virtualization/Sandbox Evasion

T1633

System Checks

T1633.001

Credential Access

Clipboard Data

T1414

Discovery

Location Tracking

T1430

Process Discovery

T1424

System Information Discovery

T1426

System Network Configuration Discovery

T1422

System Network Connections Discovery

T1421

Lateral Movement

Collection

Clipboard Data

T1414

Location Tracking

T1430

Command and Control

Exfiltration

Impact

Data Encrypted for Impact

T1471

Data Manipulation

T1641

Transmitted Data Manipulation

T1641.001

Replay Monitor

Loading Replay Monitor...

Downloads

cc.db

Path /data/data/com.wzmt.ipaotui/databases/cc/cc.db
Size 36KB
SHA256 38f8548795ca7470b449dd1de9598c07a247ba59883c0764c9c96ff0b7d31d7f
MD5 0908e924aa236931dc7166fef6e00862
SHA1 7782648d6d8f6e835bd47058d4852932c096a467
SHA512 3c16fbc5172aed04cd206e776c46d26e911732c6e3631536410a71f1d217449475727ac9b3175e827c5ce645a1da9e05900258ee6ca27c936a9060f241361dee
SSDEEP 12:TL/sP2yMHdqVcV7p5WUYUW5LfpBKKyBGtbDrNTSFbycKrHBGtb5RmBEyPb8FOwGQ:TLd7sL7yot3BVrHotGGSgGQQQ
MD5 SHA1 SHA512 SSDEEP

Submit Download

cc.db

Path /data/data/com.wzmt.ipaotui/databases/cc/cc.db
Size 36KB
SHA256 02aa4efce93882603789b1396bf5693123fd34e9b4996e874a2b21e4bacec13c
MD5 f30cc3c066044aae46d823b7d94a47eb
SHA1 d71ac5a3b4f90d8f26c1a0a53159b6594f599e60
SHA512 b4dab62c5bb5a589a6fab5c3c6fb80d20ec8b102adc92fe84a3bb595a4781b643e50fbc5f6e534b09841bbe4933bcf8e2845e98dd8cde636e67397d505f8a463
SSDEEP 6:7+/l9i8ng9bNFlq4ysSl05tA2nI3gLu+ROyDntwIymWERX4PBX4ogLugMBX4suuB:7+tpnqLZ7o+3BNymNRmBEyPb6aBQQ
MD5 SHA1 SHA512 SSDEEP

Submit Download

cc.db-journal

Path /data/data/com.wzmt.ipaotui/databases/cc/cc.db-journal
Size 8KB
SHA256 c0f278911198c0b81a3cc3e02f451b34f0429f0e2d23c10fbf8062c1b4521b77
MD5 6662e5aacceb58c77f59af6c65c1b785
SHA1 23f11809c8a6f4d4214a6079ad44be1a131d559e
SHA512 6cae139bf23cb3bcb95148c22cf9c255e5a0a33a5d453009af534e66d2ff80491ba842218fbd6335a13b59b2364c7ca989e18bd89f9731f8b393d6461066fe82
SSDEEP 6:7+/l9t0SFPg9bNFlLdrlOERX4PBX4ogLugMBX4suuK20kl//O:7+tVBqLJdTRmBEyPbHhXO
MD5 SHA1 SHA512 SSDEEP

Submit Download

cc.db-journal

Path /data/data/com.wzmt.ipaotui/databases/cc/cc.db-journal
Size 512B
SHA256 bbad6cc36600341b115faeda58951ca88da4a6cc4001d6bef3f44d2575733ba4
MD5 37d85eba1a775f2ba304ed5a8aa503c2
SHA1 9b6ea42d7ed190992561f23475ff026b14414940
SHA512 44b03d2e18e584d182ebf25234102333a6cec860e8f8056cf6b464c19cef5915e1d79e565bcccbf93dea82734f18741b993c424a2670b90e7899c48f29882384
MD5 SHA1 SHA512

Submit Download

cc.db-journal

Path /data/data/com.wzmt.ipaotui/databases/cc/cc.db-journal
Size 8KB
SHA256 bd16d79a5861ff24f664b057b7bbdab40bf2cb2aedf64d5196c574cff4528bb1
MD5 aad1ddf8e4a8ab3f77865cc0e496242b
SHA1 af36e21ed4602d69df8b884b2ac88db29ff96d85
SHA512 02d36b31f044c14320b19fb4cb2b1871ee1d27fe58c1c72abeaf7f507482535bc87104bcf7f1151c8ed586884cfb0585a6b518a904ad6d6ae2cf65c9855eaaa7
SSDEEP 12:7+tJMvqLEy0ttlqVSPD6U1o+3BNymNRmBEyPbiX:7+tJqqLEVtSq6UnTd2GSe
MD5 SHA1 SHA512 SSDEEP

Submit Download

cc.db-journal

Path /data/data/com.wzmt.ipaotui/databases/cc/cc.db-journal
Size 12KB
SHA256 f9e5fa71cd4651dc43a60430996c53b7f8670bd42c6d834d56c203a94a3d2d7e
MD5 6b137177b6e679a41bca6d2f3793fcb2
SHA1 f534bc37e661e8d2c03c43061e66e4d2be598515
SHA512 fa5ef4356338336f991e03566eda0b7f8bdc0bc9dd1bdbcaa14a17ba57bb1597d7cf02cae63c5c9124344e0970b468ca5a1658734405b933991c58137c46833b
SSDEEP 12:7+tH9Hm0DfiLWqLqrP2yMHdqVcV7p5WUYUW5LfpBKKyBGtbDrNTSFbycKrHBGtbh:7+tFTqLN7sL7yot3BVrHotGGSE
MD5 SHA1 SHA512 SSDEEP

Submit Download

cc.db-journal

Path /data/data/com.wzmt.ipaotui/databases/cc/cc.db-journal
Size 8KB
SHA256 7257d1c8b5c6a4c674686fa601cafc4dace809501674ad231a8a59752d729aef
MD5 1c0f8764f19be268f24e4e7fb9a284eb
SHA1 a620cf4c6edfccd87213711924bd1a77cf92df4c
SHA512 fcacd6708bff5c49c0cd52a0ea477efe0b448955aabc86e112370a201b3a0a5f13928d684860924b867cde35132c50793bfc8b3f2129850d4bd23a536ac3d7a6
SSDEEP 6:7+/l/5lR1CDg9bNFlEuWdOlOERX4PBX4ogLugMBX4suuKom:7+t/5l2qLiuWdwRmBEyPbQ
MD5 SHA1 SHA512 SSDEEP

Submit Download

cc.db-journal

Path /data/data/com.wzmt.ipaotui/databases/cc/cc.db-journal
Size 28KB
SHA256 5f266f7cf5a44a3cfcc9bfbba94735081851edc224cb071fa6e650227e214279
MD5 2cd47ada17ad7a4e3d5e2717cb2762c6
SHA1 7cb844672cec4a3bce75c8cf81e80e8ad7cc49e5
SHA512 c25229cca649bc8ef54c0770a976034801c0a300d181c107c41879d7f6b7056c6282210c98661428078381032dc6fb0872112dde7e8efb1a9f9b333877f18dae
SSDEEP 6:l9bNFl4/msW1O+9v5puKx/zrAvH8i8PQtLu8iqPqqLGf2OJRHXF/XWERX4PBX4oJ:TLWeO+9CNUTN8iqPs3RmBEyPbGtOwI
MD5 SHA1 SHA512 SSDEEP

Submit Download

ipaotui.db-journal

Path /data/data/com.wzmt.ipaotui/databases/ipaotui.db-journal
Size 512B
SHA256 de35f683108df30ac4fd00ff79904ae7504433453e271c30e7e5b4ae48bd281a
MD5 70adc8fb8779534a5126da18a80265ea
SHA1 db10a6f56b49afab99700b7c773895133c373316
SHA512 3cf8015b4d3a79fdd5f0a66b642eaf6f68740f6bdbdd6863e7b349bac0f31badeeda2c867b3a25bf34b19afef65c2ef8764cd0b987592c6c933c167641f65488
MD5 SHA1 SHA512

Submit Download

ipaotui.db-journal

Path /data/data/com.wzmt.ipaotui/databases/ipaotui.db-journal
Size 8KB
SHA256 db46838fc5a3bdd8f27598af6fab1b4798827c9634e4f232fbc807d97b3bf1a9
MD5 402fc124487e5efd4d002a80e1240517
SHA1 ef72c2f423cb45ec87c4d6de4f74b15d60e02c44
SHA512 ea4d960c712caa783f6c9b777a6fef323fbaab78d7c2238d6fad6e69611b49290918f5ef07879f80c87a8786a457761cbd1066d70ba1e01085764344dcf9a0f3
SSDEEP 6:7+/l9lX1Gg9bNFlEuWdOlOERX4PBX4ogLugMBX4suuKr:7+tUqLiuWdwRmBEyPbc
MD5 SHA1 SHA512 SSDEEP

Submit Download

.imprint

Path /data/data/com.wzmt.ipaotui/files/.imprint
Size 928B
SHA256 41c32fbb3ae8ecfbf1b62125b67ab23e23f8ecbc0499ef07ef7617c5fe900c7b
MD5 c0d6ab2f74d69ab572e0d626e59ed582
SHA1 eaa12f5be68b94df31486e99994ac037d1be5e13
SHA512 d6c37ac4616e51946029a07ae3f82f49858d3cd2c99c65ee5de6f502c619b13e690efc86153fd5d84366aa30835f176cfcb5ee27ef7a111db8263e20669c4028
MD5 SHA1 SHA512

Submit Download

exchangeIdentity.json

Path /data/data/com.wzmt.ipaotui/files/.umeng/exchangeIdentity.json
Size 8KB
SHA256 5c7b24a51da1c98496b1c691c73afb2450b6b67076ded97636ef243a2bbafc0f
MD5 97b99b4fa87e128ca137ba0c0e864dfc
SHA1 02e6a3a90f3d3ccead8c471f7d9f3aa4731a99cb
SHA512 14720b24483ba06dc993c93b107e272c84b69102c69d0b439b93eb63e3cd1fb0649e9c4ffece0b8a935d2c7ef658f363794a193c0944bd0ef14bdb913cd3f33e
SSDEEP 6:7+/l9COl4n1v/pg9bNFlEuWdOlOERX4PBX4ogLugMBX4suuKwbn:7+tYLpqLiuWdwRmBEyPbx
MD5 SHA1 SHA512 SSDEEP

Submit Download

jpush_stat_cache.json

Path /data/data/com.wzmt.ipaotui/files/jpush_stat_cache.json
Size 125B
SHA256 bb47da69156e746417c6b0b491aa09da969c5abbe12a7ddfa527b8763fe53093
MD5 0a0b077cd4b46d2eb6eb04e1858c8f60
SHA1 3fa4b324b91924828a27d7045be83fe08117d34c
SHA512 e995fd12fcc573f2c7ca377c929a90a49dfc0d89b7b2f77649687cba59873a9c664ec0b4d2c97006a880587d1b3b504497d83cf98012d9c5dd7821afe98e9fbb
MD5 SHA1 SHA512

Submit Download

jpush_stat_cache.json

Path /data/data/com.wzmt.ipaotui/files/jpush_stat_cache.json
Size 167B
SHA256 2598b45a88a7691247f9f7cfba5b61c13c4501d23517f5f5868f00ee0e4b01a7
MD5 67e650f25673aacf72e5a13017398f34
SHA1 cf431f4c8e0f2d5b1953c26b2c6bbb820612ed84
SHA512 d175caec1a0c1d87df2bc4106c749f2fb6da04bee914648c229becd624c238dff681147934d748448766654bad02eb834d6c9c89339afa89f9d0eb83b12f37fb
MD5 SHA1 SHA512

Submit Download

libcuid.so

Path /data/data/com.wzmt.ipaotui/files/libcuid.so
Size 8KB
SHA256 6a28ffa858d3b126685ded2bcd769b5f8f54febdbc97253be9b718257216ea9f
MD5 3426bbcd5c21fd4d2f9d30bdb9431d7b
SHA1 6b1e8cfcf76863f0c8ada9e1c3adf6f1aa89f288
SHA512 5c7eee00291f0a11c9594c7ba3e04ff6f342dac3c1f12d367e12e219cc97e22a0077f9e6c1dae583014341a04125434a04cc36378ca5ac2922cceb0fee3f65d6
SSDEEP 6:7+/l9dgOn1+fg9bNFlEuWdOlOERX4PBX4ogLugMBX4suuKjn:7+tABfqLiuWdwRmBEyPbIn
MD5 SHA1 SHA512 SSDEEP

Submit Download

ofl.config

Path /data/data/com.wzmt.ipaotui/files/ofld/ofl.config
Size 235B
SHA256 bf6c735f50dfc7974af63e817c24fffba096b2d9bc6a2707b62fc81ae50c4d12
MD5 930d6953b86a8cc3ad503b4cd45f481e
SHA1 26cad6b7e595bbeff861a4b832471c76962eed60
SHA512 ee77884add6aeae289a3d06adab124c24e6a45d90a382f0a7c5f717a7b3703f2bc761c670c9e6e88a4af756b88cfa50bd7a75e10203f0d0dbcd3b1e056af3331
MD5 SHA1 SHA512

Submit Download

umeng_it.cache

Path /data/data/com.wzmt.ipaotui/files/umeng_it.cache
Size 80KB
SHA256 8b47d5b310d68b6911dbcfd7ecda4d7131351f66365f81db82f2979ae2f53592
MD5 744ba4d6f58e22f8f82d56a50e4b5373
SHA1 535e389f9b7f2e0d14e550fdd00011dfc255e0b6
SHA512 e888ccb7fc6722eaf8fb6bb8370c55f9eaab299be08db7c57038efaf945569b62b7b6b2dde5169044c5d60a4a9a9051ee7a7c2146153aa7d22d8b7c8f3310055
SSDEEP 48:Tzt5FkbdWuvWDrBuJDIiuSSyM150ZGIot2+3psPZYq6yS:J+cdVmnhS/Iocup+ZYR
MD5 SHA1 SHA512 SSDEEP

Submit Download

umeng_it.cache

Path /data/data/com.wzmt.ipaotui/files/umeng_it.cache
Size 221B
SHA256 ed67516e3f0322b0bd382799af192c4f14e4e20a27025ff24c799fa130ec49ef
MD5 7cfe8245f3e7fcd3e8e2efd8dd834575
SHA1 e463afb42d9031e361d09bc8baa674e968f106e3
SHA512 c88e775566b69413c77d1d35c1f8cdfbc538fa4244ec7c435ca14e97bac0c20ff1f559d9e2bc8c21baae5fb1c3f616ea02efe86abfd9670e7b844ebf39d09849
MD5 SHA1 SHA512

Submit Download

ContextData.xml

Path /storage/emulated/0/.DataStorage/ContextData.xml
Size 8KB
SHA256 0a7768a02969f5260e9f363c50f8b425006a72c7b9b0eb5018d3b09850032d55
MD5 7e98a99d1e6a3a5f6dd75cc2d7d6029d
SHA1 f408f6826749a4c3963ac13af5cfc7870b909d7a
SHA512 cc01acd7d22b040c0ef56da3dcc4b92c9ccf467aae1e983cff6a1641435667f690da2f5814c22295e16ddff195f8f2128f8fe302a2f66da7cd7764b68fc92f94
SSDEEP 6:7+/l9LPg9bNFlLdrlOERX4PBX4ogLugMBX4suuKslDP//Y:7+tlqLJdTRmBEyPbnDY
MD5 SHA1 SHA512 SSDEEP

Submit Download

ContextData.xml

Path /storage/emulated/0/.DataStorage/ContextData.xml
Size 8KB
SHA256 ac9331b1a577d01fd7b2395b9d2e68c263fd89ecc1762a025e059c24dffaa044
MD5 f7c5e753d844e2a75829585cb0325beb
SHA1 e47cf4514159ff89eabb58253f972ea7c3a0fa2e
SHA512 0809b7d5dd9dfc9b0e2c9de44636a0513fd3407f7a056e62a49da4a69f59e8a57b9107777ad9cc6a0d911898c49e28d03c5d62db64526799bece446fb26040f5
SSDEEP 6:7+/l9j5W9ng9bNFlq4ysmtE/8H3gLu+0zYwIymWERX4PBX4ogLugMBX4suuK4Qxt:7+tB5W9nqLZmtEK+0UNymNRmBEyPbct
MD5 SHA1 SHA512 SSDEEP

Submit Download

Alvin2.xml

Path /storage/emulated/0/.UTSystemConfig/Global/Alvin2.xml
Size 512B
SHA256 852773b0ae475d887acef555fad2bfa8fe4c72a34306d95522a6d95138fb5c72
MD5 3a10af064c268629202180c758e990d5
SHA1 a0ad134da99273104ab453029278cc5f38d14f68
SHA512 ab0dcff74b1496416d635e0a31ca5d0072f1b7ebe3386972264d037d39023ed7d9974c1ff5126f819285f162bfd218dc41f330b327f6ef380d18ba71a936e1ca
MD5 SHA1 SHA512

Submit Download

Alvin2.xml

Path /storage/emulated/0/.UTSystemConfig/Global/Alvin2.xml
Size 28KB
SHA256 63d7b59dcdc791b5d1380a1d06b9e199f6136965dc21a887efdd0cfac9d0a1b7
MD5 49eefa442e55be8652c7c3c5f28d912e
SHA1 941ef7e65d47d38dd5f47084663f4fd7f57fbbc9
SHA512 b6c9d8a985a865c43348e34d94f149e4b552359d9afc7f5db660535ea107fbbdcedee542b9bfa018f1881c6c021b1e9bd331debe9562dcdffe2f8b3655d2d3c7
SSDEEP 12:TLEy0LLVbUD6U5SH+0UNymNRmBEyPbGtOwI:TLEVLL1c6U100d2GSiI
MD5 SHA1 SHA512 SSDEEP

Submit Download

Alvin2.xml

Path /storage/emulated/0/.UTSystemConfig/Global/Alvin2.xml
Size 512B
SHA256 4abe0d5410e6c9cabd70d0de331907d73748a62ce4ef6a758e179d645297634d
MD5 55bb8128fa0b426f95277e7eb12e753e
SHA1 e1d17631bba65b73bda3ab9b51c1cd2254943956
SHA512 d678601d50aa8b9f54ed59eb3ca1eca0a6e6968ed61f723d44b88e6da5414a9e05aeb4fac1c74e5058a87b953260f795016e8b669ae6a5de7e88be1381558d53
MD5 SHA1 SHA512

Submit Download

conlts.dat

Path /storage/emulated/0/Android/data/com.wzmt.ipaotui/files/baidu/tempdata/conlts.dat
Size 12B
SHA256 f52db31332534833414abd5e870f78c810b8ebbe5b134bbf599506beecfd1b93
MD5 8d80bc8ea90e9cac010d3ddf97bda5f5
SHA1 f063bc0d356e6ba9ab1eb9a851131ffbefd8fa07
SHA512 9ea732dd572a9a4ba91b70891972230a09576687ca1bc19e62d5a98b5b84e0f2ae11985108008bc9fbccf357219b8bd3dbf146bb70752f618f70dc5d0c46a7c7
MD5 SHA1 SHA512

Submit Download

conlts.dat

Path /storage/emulated/0/Android/data/com.wzmt.ipaotui/files/baidu/tempdata/conlts.dat
Size 204B
SHA256 087b88573afc09df43b10347f0b2babfeeb38cb64b0cc09d92840ede37078b68
MD5 94cd491f1af4a19186d213a9993ce83b
SHA1 1c806ce00002f9a2e94a54153bd761607cf7542e
SHA512 d9e4862da6c01be0e8610e1645ae928de845113849e410bdb5bd56b34039cba0ee1a2ad99403489182275a8d29bcd01bd392d5bc68949e13176dac9f010f507a
MD5 SHA1 SHA512

Submit Download

llg.dat

Path /storage/emulated/0/Android/data/com.wzmt.ipaotui/files/baidu/tempdata/llg.dat
Size 8KB
SHA256 18782c66b4d5ecc93118072f8c6457e0706c61dacddf714ec51d129d9b9e65ac
MD5 25edaf1ce9b597dd0cb3aba9e344742c
SHA1 36f9022c7eb4098c7e896216238460eca0b5721b
SHA512 cc5cee56621b258a2c2d1188ffa8c60800f3c97b64be8011d89f53394c26e4f0d3e912857eff657f2a264c7af32a4b33064209153fb1aec70146125f2ac8f608
SSDEEP 6:7+/l9lE/g9bNFlLdrlOERX4PBX4ogLugMBX4suuKjU/pO:7+tk/qLJdTRmBEyPbq0g
MD5 SHA1 SHA512 SSDEEP

Submit Download

llg.dat

Path /storage/emulated/0/Android/data/com.wzmt.ipaotui/files/baidu/tempdata/llg.dat
Size 36KB
SHA256 847fc0628c3580ca36a6e4070ca3e4d0d731bbf41ff386e8c6f4bede27fbf505
MD5 4be086c32caf9825d2773b3c9ac60cff
SHA1 f1391e9669079e4b253338a8376ba6e3bc788fac
SHA512 974ac46c9146733999dd8e2387391672661385a5b724e7c2a197cbc1afd9218dc95ebcb046bf810485995d64f1f0be7b663134f5a556ce6725bcf557c10cec7d
SSDEEP 12:TL6ESP2yMHdqVcV7p5WUYUW5LfpBKKyBGtbDrNTSFbycKrHBGtb5RmBEyPbP/WQQ:TL6E7sL7yot3BVrHotGGSP/WQQ
MD5 SHA1 SHA512 SSDEEP

Submit Download

llg.dat

Path /storage/emulated/0/Android/data/com.wzmt.ipaotui/files/baidu/tempdata/llg.dat
Size 2KB
SHA256 486e25992d792d803156355f8cbcbc90587faa04f4756523e5de43f31025e459
MD5 74e3a12db00d2b593e4845fd3ccafae5
SHA1 f80097fb06ec5583a52390caf6fb43d3f2cc33a8
SHA512 1af06d405d72e44ae4095dc699bb489c47ef672a8a3cb294e77d17fb70757639909640d9394ed52d75f2a7e3365cf23f02e45b78903b808604285219f47c033a
MD5 SHA1 SHA512

Submit Download

llg.dat

Path /storage/emulated/0/Android/data/com.wzmt.ipaotui/files/baidu/tempdata/llg.dat
Size 17KB
SHA256 16bcc2f8905e579b98a8a2a829414a2d7eb8094c9b86394e4065f9d00458570b
MD5 aa8f2dc52f1173faa78c025d18debd33
SHA1 54b8d46a2b35eb79afa11b9cc373561d5bf16312
SHA512 cfd68e1db581c43a1e090691b73bb38cfd75c813179d4c0f750f0a252919d771b3d70c63c21772ed892c8a180333efde4ca57e3aff2661a7eb2a3e69d465ebaf
SSDEEP 192:sNe5X4nbjAu3WL/1xIWGlsLhkBb95vWG9:sNYXkXp3WL/rSRBjvWG9
MD5 SHA1 SHA512 SSDEEP

Submit Download

000.html

Path /storage/emulated/0/Android/data/com.wzmt.ipaotui/maituowangluo#ipaotui/log/20240528/000.html
Size 8KB
SHA256 87c9127d4592d63a6d18c66e37809f819dd107ccb9347ba78c8ee6fbe43d38ba
MD5 65234a4154da1ac84715ba335d8267ed
SHA1 66e003486ba602f7f13fe7f750c81686d6c344c3
SHA512 1af12fa94b0b6da9dac5323b4b97dd7eda927844619e03d64dd6cf7986bf33d48233cbf3eb33b9196082f38875816209d6b790f7d203df100da1b41ecc63ba6a
SSDEEP 6:7+/l9hwil4n1+qg9bNFlEuWdOlOERX4PBX4ogLugMBX4suuK6R:7+tsieqLiuWdwRmBEyPbLR
MD5 SHA1 SHA512 SSDEEP

Submit Download

000.html

Path /storage/emulated/0/Android/data/com.wzmt.ipaotui/maituowangluo#ipaotui/log/20240528/000.html
Size 84B
SHA256 dd1287786c6e04189ee10e1f60bb081e3342fbd3e13fc96ed625a8be7bf945bc
MD5 a264c03b19f8c55d4672b5a8bdd04db1
SHA1 956a7bf408dc89a3f77dc6ffc32766b99e608f7e
SHA512 e88d3e86f68dd197b7201ee409aa8db38ded2d586bc8a5c9a97ef9b42c7a795450df050ac30d2f55da688e8a8110a54f39b10d8393085364766a30a3bc5d6f90
MD5 SHA1 SHA512

Submit Download

000.html

Path /storage/emulated/0/Android/data/com.wzmt.ipaotui/maituowangluo#ipaotui/log/20240528/000.html
Size 4KB
SHA256 df93e276a11d0dbd7dc79187bd0d8478fd921f655ac7cfb57148cb9dd18397ae
MD5 0cefb035f3829d7d3660fbe4574b1323
SHA1 be1223dc4e9e6283433b9af7a34a410ba7a1a3bf
SHA512 a67191594d1717ba46291ada34c77245d2a75bd6a42d92c1da0e2264e0245901e30d76715d6d463be11b46717cb9a8d1741b3962f86c3d2718f00928bb6476e2
SSDEEP 6:7+/l2Bg9bNFl+lXs10Z9v5puKx/zrAvH8i8PQtLu8iqPqqLGf2OJRHXF/XWERX4e:7+tsqLEy0Z9CNUTN8iqPs3RmBEyPbXi
MD5 SHA1 SHA512 SSDEEP

Submit Download

000.html

Path /storage/emulated/0/Android/data/com.wzmt.ipaotui/maituowangluo#ipaotui/log/20240528/000.html
Size 85B
SHA256 5cbd855624240892c6baf3fcfb881a7455cd159f6d8b09d5efd9822ddd9a76ca
MD5 e1e673d60f0679f46893fe9d9ec78c38
SHA1 61dceb15d89725b4052d808cb3ecc76edb29ca13
SHA512 27f69152ba3f2ae049d1f4169d70c4e5caaf26103c442593a154122de1cbdfea6cc41e26373b417081d65b88a87a4306e49275705b550ecc8dc66b680ebd6167
MD5 SHA1 SHA512

Submit Download

.cuid2

Path /storage/emulated/0/backups/.SystemConfig/.cuid2
Size 8KB
SHA256 90a767dcac323c8f59b3783bb652590a55ff9633bef9ea533ec98d15b1e27e11
MD5 4b759cc42a8ab81e20a75d7e40c927eb
SHA1 d3976b0d4fd221c78a806c9e8bcccaf4cc0e1b6f
SHA512 896d5673ee38fd5a0a878eb78a5dbaff9e97772984fb75f0bf8955060f878ce2717110b906f3f39c6461778ecf9ad866ef574dda8523d315ce4c781b01a6c7d5
SSDEEP 6:7+/l9/Pg9bNFlLdrlOERX4PBX4ogLugMBX4suuKNby//k:7+tFqLJdTRmBEyPbcbyXk
MD5 SHA1 SHA512 SSDEEP

Submit Download

lcvif.dat

Path /storage/emulated/0/baidu/tempdata/lcvif.dat
Size 16KB
SHA256 c81a67ae149bb929b06eb3c4aec6b61867a0d2795fcb2116917215b78c483a01
MD5 2c4730e0e6ccbb51dbc21ed7c2287112
SHA1 b9ebadfcb0ff31d8f44e5e0da5d12f186b00c98f
SHA512 52f6d9dcc52082f4039ab488bf506283fe609a1cd86d287b9fa9a4f48a57e5fedbc35158ccabf42489cd758f04d525a44da3834ce050a971c03ef8719e281344
SSDEEP 24:TL4FUGjy4b7BhB7B6ErtWwsmVrWdhWPWdWOHqgXkLm9Gx3G0gh00hnGiQ10GSN:Tk5rBU/mMEL++t1DS
MD5 SHA1 SHA512 SSDEEP

Submit Download

ls.db-journal

Path /storage/emulated/0/baidu/tempdata/ls.db-journal
Size 8KB
SHA256 a6cbfce61b87a3ca5f8a393d76bf48357d9c80398579789347ed9fb0d94bd074
MD5 ab879f2aea2fef68656888d685bc8b0f
SHA1 ffea94d7c2964eb647fa3e5e6fe2588208ef28e9
SHA512 e2085108cce6396801e9498caba60e1bff83f2e8dc8b631c7796a24b4db5b535e38bd13b4ba7d20baaa845f6333efcee5a581b8cbba9c9cd180cf00c981ba160
SSDEEP 6:7+/l9iing9bNFlq4ys+bvH8i8PQtLu8iqPqqLGf2OJRHXF/XWERX4PBX4ogLugMP:7+tpnqLZ+ATN8iqPs3RmBEyPbalJmn
MD5 SHA1 SHA512 SSDEEP

Submit Download

tbslog.txt

Path /storage/emulated/0/tencent/tbs/tbslog/tbslog.txt
Size 2KB
SHA256 ed5f44c5c781d1b8f3568a773dab474cc9b36cc4e413f6239aafd263de6d9ab7
MD5 0b55331f7bf8c7ff84af1af9c48ee098
SHA1 8a1dedd30cb8aff13f81109a8799fa84f1aee232
SHA512 461d860c8905db00d66ad9ac1c0e1a12ce2b9a534268c016fa7d83a8a1ec29f02f35f04e5862b9bd9189e5045c72d395d9bad0e0ec0165137bade1718032a16a
MD5 SHA1 SHA512

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads