2fd5f9b5459e2ba9c304366e28504edf89e48834ecbf7c1566eec437c2a798b8

Analysis

max time kernel
179s
max time network
185s
platform
android_x86
resource
android-x86-arm-20240514-en
resource tags

androidarch:armarch:x86image:android-x86-arm-20240514-enlocale:en-usos:android-9-x86system
submitted
28/05/2024, 12:15

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

7ce9e771a68768b3f7b724570d4f3694_JaffaCakes118.apk
Size

4.5MB
MD5

7ce9e771a68768b3f7b724570d4f3694
SHA1

b9f5d14f1998f1b4fff376842fccb4e8974e9cdc
SHA256

2fd5f9b5459e2ba9c304366e28504edf89e48834ecbf7c1566eec437c2a798b8
SHA512

ded5a08bb0c7a22b63c5d5dd98f6836e930db91f381c280f9c4bd72e9b7e210194abf38cd559cfc6b8b74ecec4ac15b595749e7a5cc39c76d65f96f86f0f73de
SSDEEP

98304:ZwyZmXGfkhxLBBYvGqYInWXkV+L0Ij3BSraCkN4UTfcbzNRj6/1:Z7ZgGfkhxLBBYb20V+4g38raVKUTEbpa

Score

7^/10

discovery evasion impact persistence

Malware Config

Signatures

Checks CPU information 2 TTPs 1 IoCs

Checks CPU information which indicate if the system is an emulator.

evasion discovery

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/cpuinfo	com.qq.cleaning

Checks memory information 2 TTPs 1 IoCs

Checks memory information which indicate if the system is an emulator.

evasion discovery

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/meminfo	com.qq.cleaning

Queries information about running processes on the device 1 TTPs 5 IoCs

Application may abuse the framework's APIs to collect information about running processes on the device.

discovery

Process Discovery

T1424

description	ioc	Process
Framework service call	android.app.IActivityManager.getRunningAppProcesses	com.qq.cleaning:channel
Framework service call	android.app.IActivityManager.getRunningAppProcesses	com.qq.cleaning
Framework service call	android.app.IActivityManager.getRunningAppProcesses	com.qq.cleaning:mult
Framework service call	android.app.IActivityManager.getRunningAppProcesses	com.qq.cleaning:xmpushservice
Framework service call	android.app.IActivityManager.getRunningAppProcesses	com.qq.cleaning:bdservice_v1

Queries information about the current Wi-Fi connection 1 TTPs 1 IoCs

Application may abuse the framework's APIs to collect information about the current Wi-Fi connection.

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.wifi.IWifiManager.getConnectionInfo	com.qq.cleaning:xmpushservice

Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 5 IoCs

persistence

Broadcast Receivers

T1624.001

description	ioc	Process
Framework service call	android.app.IActivityManager.registerReceiver	com.qq.cleaning
Framework service call	android.app.IActivityManager.registerReceiver	com.qq.cleaning:xmpushservice
Framework service call	android.app.IActivityManager.registerReceiver	com.qq.cleaning:bdservice_v1
Framework service call	android.app.IActivityManager.registerReceiver	com.qq.cleaning:channel
Framework service call	android.app.IActivityManager.registerReceiver	com.qq.cleaning:mult

Checks if the internet connection is available 1 TTPs 5 IoCs

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.IConnectivityManager.getActiveNetworkInfo	com.qq.cleaning:bdservice_v1
Framework service call	android.net.IConnectivityManager.getActiveNetworkInfo	com.qq.cleaning:channel
Framework service call	android.net.IConnectivityManager.getActiveNetworkInfo	com.qq.cleaning
Framework service call	android.net.IConnectivityManager.getActiveNetworkInfo	com.qq.cleaning:mult
Framework service call	android.net.IConnectivityManager.getActiveNetworkInfo	com.qq.cleaning:xmpushservice

Domain associated with commercial stalkerware software, includes indicators from echap.eu.org 1 IoCs

flow	ioc
52	alog.umeng.com

Reads information about phone network operator. 1 TTPs
discovery

System Network Configuration Discovery
T1422

Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 5 IoCs

impact

Data Encrypted for Impact

T1471

description	ioc	Process
Framework API call	javax.crypto.Cipher.doFinal	com.qq.cleaning
Framework API call	javax.crypto.Cipher.doFinal	com.qq.cleaning:mult
Framework API call	javax.crypto.Cipher.doFinal	com.qq.cleaning:xmpushservice
Framework API call	javax.crypto.Cipher.doFinal	com.qq.cleaning:bdservice_v1
Framework API call	javax.crypto.Cipher.doFinal	com.qq.cleaning:channel

com.qq.cleaning
1⤵
- Checks CPU information
- Checks memory information
- Queries information about running processes on the device
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Checks if the internet connection is available
- Uses Crypto APIs (Might try to encrypt user data)
PID:4319

com.qq.cleaning:mult
1⤵
- Queries information about running processes on the device
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Checks if the internet connection is available
- Uses Crypto APIs (Might try to encrypt user data)
PID:4467
- netstat -ant
  2⤵
  PID:4735

com.qq.cleaning:xmpushservice
1⤵
- Queries information about running processes on the device
- Queries information about the current Wi-Fi connection
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Checks if the internet connection is available
- Uses Crypto APIs (Might try to encrypt user data)
PID:4497
- netstat -ant
  2⤵
  PID:4767

com.qq.cleaning:bdservice_v1
1⤵
- Queries information about running processes on the device
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Checks if the internet connection is available
- Uses Crypto APIs (Might try to encrypt user data)
PID:4536

com.qq.cleaning:channel
1⤵
- Queries information about running processes on the device
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Checks if the internet connection is available
- Uses Crypto APIs (Might try to encrypt user data)
PID:4942

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Event Triggered Execution

T1624

Broadcast Receivers

T1624.001

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

T1633

System Checks

T1633.001

Credential Access

Discovery

Process Discovery

T1424

System Information Discovery

T1426

System Network Configuration Discovery

T1422

System Network Connections Discovery

T1421

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Data Encrypted for Impact

T1471

Replay Monitor

Loading Replay Monitor...

Downloads

/data/data/com.qq.cleaning/database/pushinfo.db

Filesize
40KB

MD5
3a975fe93f8b2f46a8765232ab8c1d66

SHA1
33eb16a94e38c7693c7d1315824e37a2638626c9

SHA256
f34b2092842c38fbfc9c91e8f6d16b5c5c380062ca44b5ca1a95ad48d020a12a

SHA512
08f24b1f38c6c5b0ed2d63535dfceef5911a41a1494e487ead1eff5ff711f0beaf040e67da7d22d8686e0893fb58c47e99f4a4148624853c6e05430fbc648b04

Download Submit
/data/data/com.qq.cleaning/database/pushinfo.db

Filesize
20KB

MD5
6dfd07659a504074e2c0e161f6967b8b

SHA1
ed36a0d9c284e5b80ccc1dff99560851799ea73a

SHA256
b8e0759885298151e748c1b700a48d4bc6b268952dab3ffeb6264a38dcc6565c

SHA512
1e4d3980a70e2bc65a2a7adac61a998f6fab801c2da9cb6de4daa4f81445b56cf7353753c65b08f7ed18c99f8d5575dccbd1f6e8a6566939c19ce3cd54486a7d

Download Submit
/data/data/com.qq.cleaning/database/pushinfo.db

Filesize
24KB

MD5
b0dfd14eecf14cb23668704795aed744

SHA1
df68153d3439d891214d4195974dabcee2c4351f

SHA256
9f81b1aedca4b816ff70051b29b2d9ddc57bd0c74dd081dd36d8f3048b41ef5b

SHA512
ac916c45c271b43f5dd950edf3f432aef94bdd5754d036f2762ed2ae2b23cfede47646b14afc409a8e329cd96d4167c84c58b400e06025b122894d2b22dacb61

Download Submit
/data/data/com.qq.cleaning/database/pushinfo.db

Filesize
16KB

MD5
3a8cd45b481d822a1173f6e2998a9c10

SHA1
34bc2ff7d6b8b9b05a9ba3d3bbafc9cefe5aca90

SHA256
302dcfe90cbb33fb84d9e87c1582ed78f8e693428f340bb3532af1d20b816d1b

SHA512
4a1b60d53ea3f17f4171449a239c8a04f372d8dfd57d64057369244ed3f708d164e06b3d155de96e0f4a31822f735ef1eb6482c46cb65d742b27421a01ce5813

Download Submit
/data/data/com.qq.cleaning/database/pushinfo.db

Filesize
16KB

MD5
e3e7614ce43c7b8ed084b3abfb4d0f58

SHA1
96630857f77713895bd1e38b0bb0bfa5df90b3b0

SHA256
4ee6954c05843f1986e0321948c71604d369bd58c4119e2f53b048ccf5dd16c2

SHA512
129e385361002652fbd755ebd9b5072b77360312da60491bb4da7d7ed342b9c472091a59f14d8565973398022ceaea4e4717c824a005db20942c1b61f7c893c2

Download Submit
/data/data/com.qq.cleaning/database/pushinfo.db-journal

Filesize
32KB

MD5
bc4479fb0428e92f62367efac5215520

SHA1
5a489a9eacf528d969bf9601d9553c98528b98f1

SHA256
0582fc1321ade03711f96bbb64783425214ceda5b8e62587fd00de1860ce4120

SHA512
fec090023a31390e181a05f2cbd8885f998816749a6997271b5aec068e541ba331d4344475d748297ae47b40eb3ccb22d83883f3514c24666bd8ed69f55493df

Download Submit
/data/data/com.qq.cleaning/database/pushinfo.db-shm

Filesize
32KB

MD5
4691c0993b3483f98e484e9061a73a57

SHA1
68d9c1b7f84c9a3f79576c5ad311fc9a1c51a1fe

SHA256
7d43023d6929e9aebd0742dc873276e438e25d3f1427a7c48b7614ebe653cb20

SHA512
4d5dd1cdaa6bc05c6fc15bbf0e94bd841fd88a418ac06d7818c96d92aebf91c621579567b96a1e092a2621c81387c839cb24fa532b140b18c963916319c749b9

Download Submit
/data/data/com.qq.cleaning/database/pushinfo.db-wal

Filesize
48KB

MD5
cda385a896df4a380d947e9eb3ee1775

SHA1
a51cecad6baf3b256491af8bc4f1db8e23f002c2

SHA256
fd0ad654f333d8e72290a2630fa5f82a7f23699b95dd8cd79e00aab36297ea3b

SHA512
b10b929fed7059a98a248acfabd23fe35bf89853ab3a2cdf0ae84d44fb69a2ea4f4f2644a22dbb0d54dbbe5175d781206cd6f598af39a77b9b08c7db92df11a3

Download Submit
/data/data/com.qq.cleaning/database/pushinfo.db-wal

Filesize
16KB

MD5
5732e333c6327602c79792a17858591d

SHA1
6bfefbba4be1dfa6655c9bb1b5605ad071167efc

SHA256
dd7f82a308d35c7e7b5451db6a24a80b0e7d0f44ed318134cebcac450ce98873

SHA512
8061e202c18f604d9d768e42add2d0f989dc1c0f3e4bf92f95e7a6f67457fd0bf7b038190a27f2ccef6244480b96c698e02b53764e4c121340c66d826da02f52

Download Submit
/data/data/com.qq.cleaning/database/pushinfo.db-wal

Filesize
36KB

MD5
e3fc832046cb9e87e9e5d2b06d6daf90

SHA1
569ba5677a65bec0cdb2d80ff1776b0706e6346e

SHA256
42e3b7476cc41edc748b2c6826663d271aee727f5125c5e5a0dc4d2e26f57e32

SHA512
a1f048806088df211f0e592c9d7c554fd97fca020bc444cfbeaebc69042efc75e076ad7d557716e2b9f8591dd0c65f424f78247b2a4b96aacfab32d2a65523ba

Download Submit
/data/data/com.qq.cleaning/database/pushinfo.db-wal

Filesize
16KB

MD5
4156e83242a16cf3e2b3dd96c19b83b4

SHA1
b2db3c10a6f100abff5f06ae09dd58041c60a41c

SHA256
9d9516c3bd4d2f839433e20e141b8cae0eeb1cfa1e68f2f558f78c75ce809086

SHA512
6cf059728613591e2782dc1deaea95a62866f65d12efb96544f1c52f4b9be581d9b6992695a7f7d197ee611adc77e8a795f80a380a1c96b7c07d8f1342fd239a

Download Submit
/data/data/com.qq.cleaning/database/pushinfo.db-wal

Filesize
28KB

MD5
7c02528badf31fe49c0899083a878428

SHA1
d37cf11af6460e4e20cbce361a6e4595841a7665

SHA256
39c6fc12917fec72599cdace3c8197ab40839f9e15a62912a7f5e9609367f184

SHA512
13d0abf9632c7d4f006478e64352fe8fb44b3d743fd7f05757376cc880bbbc74573ce837158b09ffdf42f2f39c6661f274dab744c19f7713a1bca9abe75942ae

Download Submit
/data/data/com.qq.cleaning/database/pushinfo.db-wal

Filesize
4KB

MD5
bd4ddd7512d4ed64fc3f3b6d4b20c958

SHA1
50ccda6fea0d71ff464860eef5db580f82ac6f28

SHA256
581dd872f2c7baa11d6c6bc053cf16f30ec819166ff638ab3960c6ee4510aa51

SHA512
22691f24c4c0fafd17e4d38fe550c4f5c412d701dd62cc64fb1b6455d686f4e72ae94427ebf8c783ae19c6f5b786904871c008234e80fe164290f277c32fdd2e

Download Submit
/data/data/com.qq.cleaning/database/pushinfo.db-wal

Filesize
8KB

MD5
0759e3f396129cc351fbb39485b40155

SHA1
7dcdf460190ad44502a4cbec5e772001d1950690

SHA256
97fcbd504b6b80619219cef9754583b74d6024b1123ca17cddb5ff2882cf740c

SHA512
48fbe40ab86e9887ebfa9044589013c56e59dd03f4cf2afc9ea123d1cf2118b42ee47aef98a96aa6cd83357cdb711487ffec40f5743f20454d1f630a853d1ae9

Download Submit
/data/data/com.qq.cleaning/database/pushinfo.db-wal

Filesize
28KB

MD5
beefc5740514a9e82de49388707bd9d5

SHA1
d7f1c4868dbac82f1a3de0685522531c3a456a91

SHA256
4dc98f780f500eb735e2c8879e16d149a6303fb630d85076a7fe78f823c19925

SHA512
e923e2a0cc9d74bffc4d282c914a3d9ec2cc850dbe29f9c67fc33e9a110198d1c9524de5cccf4a4690a8239faf7c661f10d514d7c1f5cfce94940f4d0457d823

Download Submit
/data/data/com.qq.cleaning/database/pushinfo.db-wal

Filesize
4KB

MD5
a37934e3302254eff370f585da0e9bfe

SHA1
759707ee011ffe727e0f46d33c07d955964ff2a1

SHA256
188687c61e53552e4c46cd70de7df5dfc8470ec9d64880d717e5a6eb31c42364

SHA512
7d49052d002bf0b27f329c6dec8b52c8cc5ab2725fbac95334b9aa84523fbfd6246e3d45cb1e00bfd2306e26b58ffbab577de559099b73ea837c8f8ad00777a2

Download Submit
/data/data/com.qq.cleaning/database/pushinfo.db-wal

Filesize
8KB

MD5
0a9081f705257030c197ee338180c7e1

SHA1
d65f2cace19f3e788a8182536a9f7aca486f7838

SHA256
7f9411aac45f97a25f4dcb7651e816c1e29d28a7b91c5e0bfd8d94fa82412210

SHA512
0c7d82111fe594abaa161b9df0d9123c3eaefb4712c50b155213fe0106d076d161a43daf2ed203b27ee3d914a134b28fb765bd8177ecec26b015544ffc915c68

Download Submit
/data/data/com.qq.cleaning/database/pushinfo.db-wal

Filesize
4KB

MD5
c1d71dab3c11f2a9903987b8dcd8bb4b

SHA1
2ed4c9b03efabaac627425aaeb812c9248c11b3f

SHA256
726b3865aaf6548538a641b8b2142651076d8fd6646fa9b0681384080cdab0d3

SHA512
90251ab7d4c71122ee754b4450b9ca0e50f4056dd0bb3f2458c8dfbcea568ca8cc269679e2de031e4fba659e9f9ef015d72334b2623b6d3382f1ada414beb52d

Download Submit
/data/data/com.qq.cleaning/database/pushinfo.db-wal

Filesize
4KB

MD5
e25ca486a5561544531406a50f23c2c6

SHA1
799f65a4022ff6a16a73a2183b6d3420ad609e57

SHA256
8c47073bfc617c0a4eb05dc1739c52a38a4e2b577ea24702365e262c9151fca8

SHA512
c5fc5f13862292efa10e23d9af22a0c055a41e8bd6b83fb5cf134d8c071d635b66c292446c52191f79556f6f40322d605f43b73a16d49d2f8fff2274fe38fec6

Download Submit
/data/data/com.qq.cleaning/databases/MessageStore.db

Filesize
4KB

MD5
f2b4b0190b9f384ca885f0c8c9b14700

SHA1
934ff2646757b5b6e7f20f6a0aa76c7f995d9361

SHA256
0a8ffb6b327963558716e87db8946016d143e39f895fa1b43e95ba7032ce2514

SHA512
ec12685fc0d60526eed4d38820aad95611f3e93ae372be5a57142d8e8a1ba17e6e5dfe381a4e1365dddc0b363c9c40daaffdc1245bd515fddac69bf1abacd7f1

Download Submit
/data/data/com.qq.cleaning/databases/MessageStore.db-journal

Filesize
512B

MD5
c5768ec4e10f971ed933b2517a419017

SHA1
17090f2a2827152a29875bfea41e737a66ab7fcb

SHA256
ca3d13bfc7c7540129b33654fe56a4a949e7875f303a6c95009959f032861d44

SHA512
a5b65495214601ca1e0e1bfe81c34b4102affcea7803ad7785332f5fd30a9318dbffd3c4aaadc3eb36f6fdc66b3d62d931ac2f1bc8b68871aa30b5564b05f801

Download Submit
/data/data/com.qq.cleaning/databases/MessageStore.db-shm

Filesize
80KB

MD5
17fb5c952ac741b9b4c5dd60a25aedf7

SHA1
2dd38745b2cd754ad63da51b8175d56397ac1b67

SHA256
c9facd1096d7a76418898170b43553fe1a7828c9e6a20ec94966290c5abcc4f7

SHA512
63940e6e4d278eb44387087bbaefc245a9b49a731f3c06aafa3dc44e165999e482e7dc5e7d08ede7d9359b43603017c5e0c725aaf3186ce19d5e26cd09507aa9

Download Submit
/data/data/com.qq.cleaning/databases/MessageStore.db-wal

Filesize
80KB

MD5
553cda92b98a78315e29d2ad962069f4

SHA1
c1f6bf0349db1bea0418c0b2ff79c379c4f73254

SHA256
c052f278f631bcc5b9f9b775a729084803831f85aa007cb2d1cdcbdde1bd103b

SHA512
d937ef3afd05408047f4915c5f579428c915bd482b7667ffd3080b4dd92e89a38f7b102ac497050bc44ef1f1f5a7d2ce93b3bba99b66b6e6d53c4507258aeb6c

Download Submit
/data/data/com.qq.cleaning/databases/MsgLogStore.db

Filesize
4KB

MD5
45b2a3df600d36a6759c0e7945fb170f

SHA1
8b45660033bd5d43caa9b6cdd84cc5c215144707

SHA256
1dcee804d0b6922b2cd83346b28748967ceeac8c49c8e86bba58199d03bf71e1

SHA512
3f51f2bfa3ea696ef62a00d3a1c7466c2683aab506dd6712584d7fe6d13825ed91f9d18d7b336f710aadfdbae18b86abdf60cb93ed4016061be5bdd70d4758da

Download Submit
/data/data/com.qq.cleaning/databases/MsgLogStore.db-journal

Filesize
512B

MD5
66b75c4b4cef64567e4e24991a4c5d4f

SHA1
fd867e92eb74dc8a3b097927fed96244f92ec94f

SHA256
de4f6ffeca7307b6210937669afbb2d4a3f7b60cb948f11a5a47d423ade45969

SHA512
1b4a987c37d3f8d6c4de323cbf944d85a7bafb19145130522339a1c46e9404826f09d09c7af519e5eefbab2d148df378e0f903ded59b0edc1679d86227f3f0de

Download Submit
/data/data/com.qq.cleaning/databases/MsgLogStore.db-shm

Filesize
32KB

MD5
bb7df04e1b0a2570657527a7e108ae23

SHA1
5188431849b4613152fd7bdba6a3ff0a4fd6424b

SHA256
c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479

SHA512
768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012

Download Submit
/data/data/com.qq.cleaning/databases/MsgLogStore.db-wal

Filesize
68KB

MD5
3fc44419f77c67d7e8638337036e5f7c

SHA1
aa5d0de0d7ce84fecddde646e25eefd2a5da389a

SHA256
2ad90ad96e4355e51e0e38eb89e06cf9917dfd666720c13a4054aa00d35604b8

SHA512
0d6b27d0a52686573103503be8b709d9511d4c884e1600ca755b36cd6f08076021212f616e37e6bf1a9d2851c1b47e97610ba4f86c53597e7a5dd8978bc0f12c

Download Submit
/data/data/com.qq.cleaning/databases/accs.db-journal

Filesize
32KB

MD5
07192abff3b85f9390e5aeaf8a6bd337

SHA1
542cf8f85de9206428b1331fedf5a510e4fe155b

SHA256
652aec7ec526bd919c924b5178aebc5c8c99b0c51619de35c83597cd0066d55c

SHA512
8d9c047fd770be61352c53298ec4cb12e6b104b86e5fddb8085cc2f746288a24873a520457c9d58c505e52e5384b2901aa548425db085e6a80a3c38bd6ca0d0f

Download Submit
/data/data/com.qq.cleaning/databases/accs.db-shm

Filesize
32KB

MD5
da4749195d7f6d651c4088613a2c8029

SHA1
33c0b015776a16ba26a8bcaa8ea97076d56facc7

SHA256
c9b6136c1b2a3921ebc5a9aa656da42326a87c8206df75bc25b1a7f7a9c51df0

SHA512
89948943b2fdca792bb94462c1b24b85aad1eb07df79794c126e297d03c747c3f704fc98f0b090520fc2b752a4c4a8d48f9a070c4db8e9a40eaf7743297ac3e8

Download Submit
/data/data/com.qq.cleaning/databases/accs.db-wal

Filesize
32KB

MD5
883c5206dd85be6e023732da1a4b7691

SHA1
03e79448e3f67ca5dbfe65792ed2f65877eb4d43

SHA256
2e87ab7184aea28b8b2f9559a29baf9fd3f1b0e786096d83f59980ed4aa565a7

SHA512
95100f75b35ab4e259477e0c423cb3b4b088b5d0d51b75e16eb751e59147c4b14829e0224c7dba28d0d51ddb2365cad03ecd1fcca44a0801c67b4883b3045bbe

Download Submit
/data/data/com.qq.cleaning/databases/cc/cc.db

Filesize
36KB

MD5
5d7ea1a23af19b4340cc8d90f28297d5

SHA1
4cfe95b23a9e98378d69c4290af81b51fbe76aea

SHA256
474c4a54534ed96beacad7cc9a805a3f53ec9c0522fc7bcc59771cf500a6a0da

SHA512
33071f4c92da0a3df01c4a61dd165df7c7e0f4f37753cafe02d19fc876a5e7fcbb01c069c804e140ab8bfa0644a55f50fd1373646d1c439f817baa5ffbd47f7b

Download Submit
/data/data/com.qq.cleaning/databases/cc/cc.db

Filesize
36KB

MD5
ce6135aa1b1fe4f2c2db2a546d2a5558

SHA1
79b59582154017aadab783dc266fcb158c252940

SHA256
7b45f576c08c7f78220168cca4a0e33198b13e9bdc8b1da406ddb6887412000c

SHA512
2839075fe374c8567c839ae35ce2d33ec72fdaebf170aa7d224b555e5b0e74d4a43f2f67d17ed806dae841da883e9620d788ea052d06152678afa927307c7ce4

Download Submit
/data/data/com.qq.cleaning/databases/cc/cc.db-journal

Filesize
512B

MD5
b2c625adcbf3663e9934d3bc827ceade

SHA1
c47fd28fdf12c55217ba5e968c69b52e33c2756a

SHA256
bb467e3dd5d035854baeb77b9f52c0d75c5ef6666951ec946a5d3b34735935d3

SHA512
d07855887e032fe9c2d3dda176e9af7620cbfb4747088fd4a50fb1208611ed746916c0a289a1c399467f763f4fa0de68fcd4b2cf5ad71f5f96faf8436fe81f80

Download Submit
/data/data/com.qq.cleaning/databases/cc/cc.db-wal

Filesize
48KB

MD5
7b5a292760b897346eea1960708bc940

SHA1
358cb298621855ba984a9c527226a906444af2fd

SHA256
d2ef23eea3baf068108f9f272e8046f0d72a47f2b00f539c207b4a7b5b29c3ab

SHA512
7ea0cb13d3e12bd5389f9dd697b4bd04098af1fa4d070d649821d3d93a6042a4534332ec1c7f54342e8fc7e09bd689388656c570a4b10528fa4b688d2aee666f

Download Submit
/data/data/com.qq.cleaning/databases/cc/cc.db-wal

Filesize
16KB

MD5
14708dff0033ab63184b31bdffa55c62

SHA1
75cc357d4d4e1cc3b3efa4890c6a6c247784df06

SHA256
d3d9781e9ebf1b4c76d10ad7b136b7da7099da820b1d1006e327d37f5fedd809

SHA512
8d66175980dc0f87155b148ddbfa508d8a668202fd5714a2d4174dc8f0e527494bbce35224a09c9bff066aa6d3539a22539f9dd773fb9de9b41c1be615fc26ca

Download Submit
/data/data/com.qq.cleaning/databases/pushstat_5.7.0.db

Filesize
52KB

MD5
5aa44b36db91a8ff75e35158fa0c58d2

SHA1
c5831a0999d174bee02ffa33a8b516a3cc3ee21c

SHA256
935b0e3354db1a82ee402f299f8569e56668649bcfd38dc53f7defdd72307f08

SHA512
cb352d6ee671c66cbd1552c95ec539324cde71ddb0017c8ec2012ef5b7ca4c33c308794f0e6174f1c443f18952b9a05e0fb25817bf1d3aeb76b85b052e35e468

Download Submit
/data/data/com.qq.cleaning/databases/pushstat_5.7.0.db

Filesize
40KB

MD5
34df02d17ba86b9248a2cfd8623f1e45

SHA1
228006b1013a566adcdb2dcf98bbb1530d1e3d6e

SHA256
6b6391a2b52984242956ed4b1717a8637b3afa90b3d4941721ec0de5545e649b

SHA512
9a16fc724b606e6e64736ac735101abd0e4b532ca589d2a52f0d0763d7294b9759ee95f18606033a18dc5c777d6647663b65cb338889638d4f99b29c5f19e23f

Download Submit
/data/data/com.qq.cleaning/databases/pushstat_5.7.0.db-journal

Filesize
512B

MD5
6ff0442027861c374ed1ef67811e1468

SHA1
359259e0f9a543a805214b1f12287cb2b238ab3e

SHA256
ac890c21ff7f99fbd307a97175d4360528abb384f18187a0b4062b5ddc358122

SHA512
2d205b09903538bdbc20c1887ef1c3a583077e818e40b80641711bd31c639f3d41f125e5d2fa0ac5afe0d988adb977147b0c535a0d75784ce52e02aa3f719d46

Download Submit
/data/data/com.qq.cleaning/databases/pushstat_5.7.0.db-wal

Filesize
72KB

MD5
6e5939f1be1dcface693a8774f6d636c

SHA1
7838d37ed736e6ebabd3315fe6520490a3e0b666

SHA256
c94cebff91157f0e6a0b4e54e7981615c7e5904c6f66e9b79576f21b762afaf6

SHA512
7ebcc87c5f2ca49082aecead397a95ebd6d2a73cdf9f7ef573e95524d1be81d5789767dc05d82188d029de69f230154e59ff6b594b279d0c1e2853183be532c7

Download Submit
/data/data/com.qq.cleaning/databases/pushstat_5.7.0.db-wal

Filesize
12KB

MD5
8a19ea46901062cb8ab290b52acca38a

SHA1
25885bfaff5a4cafdb24c63c9cce8ad6b736f6c0

SHA256
0b295f6a5c23d0667713c3f28842e8d6571b8abfa90918507287d8546ff7b95f

SHA512
0306669f3a0dab1168f26bf5fe172072b90a0c8edb3de762d07be8d5273079c9bfff458cac2a0facc382439613fd5b625fecfb7889332021eb1ad0d9997ef848

Download Submit
/data/data/com.qq.cleaning/databases/ua.db

Filesize
32KB

MD5
81e51c7fb1ba4bd62aad976dbe26ce3d

SHA1
59bb3ed1aa4852cd53f17621e5ead9f82b7f72d6

SHA256
8e7131ee004d9d46d8d4d4e716565ce1aae20ab9afd863a32f1c0ef4d47924bb

SHA512
c00432eb3a5f2cc2d0f4a07c25fe60f5ee75ad356c04ca50e2fcd1b00ed2c51735055bd26cb40b4c796be8d0297316d8ceaf4fdd4107ba75c23beb92c9e85c08

Download Submit
/data/data/com.qq.cleaning/databases/ua.db

Filesize
32KB

MD5
d604a3bf1f8d992cc320ea5b1f7609bd

SHA1
247f88df0b55c7d523ea5398637711a0e4a483a4

SHA256
329940b4d46326d58e73c842dd099704061d0ef7338777bf31ad895f29013c17

SHA512
67e28f6713cb5c238a9664df128f01a89a2efb7c8c9330c1e45bc0d40ebab81fa20df5166743d84d81dc0386a89ff0329f022281c098339baa2e851ff0a1e1ab

Download Submit
/data/data/com.qq.cleaning/databases/ua.db

Filesize
16KB

MD5
a1e79e562d2d6889e719432940246003

SHA1
09703eed9386013aff257b811f90d19864d1414e

SHA256
137bf941228ea73cf189c58842a1ff27f8072ebc719101eb9f573344f0d832ef

SHA512
48dbb93973382cdae8fcde77fd12d3ed294a244c462c234d5c1b5d50c88537cd7f29943f3214cd4443d57bfeba890a867d5db2141c2571b92cc33b61032cd694

Download Submit
/data/data/com.qq.cleaning/databases/ua.db

Filesize
16KB

MD5
ec485932afa5ab0d3805869a4134dd23

SHA1
3e741542c3538e4c0fa6be46304aa1e298ae5de4

SHA256
36fdd56c2b0b0fb65b5172f1f41aae105203c2d4ba210f4f4879bd794c447f8f

SHA512
b04b31af2e53e727ae53301983d43b462fc193311bf1026538454cb44b00e05b73c9bfa96b1da56be05c3b16ba0a15e0115dc6d3365d82ac85373139cba50f6b

Download Submit
/data/data/com.qq.cleaning/databases/ua.db-journal

Filesize
512B

MD5
3dbf1261973a5b594377c6aa14e9fa8b

SHA1
1860ebb76b6e52a23d605ff15bcab216767bbbc7

SHA256
1e098295279e743cde3b8f2fe101edd75a46348014ed79b588999ddd4354c616

SHA512
9a858f4975860b9879f7c621676ce6c3d5e218f40e2459fb1594497b94e08134c51ca4fdf611081134d549d1bcebcc428123e77597808b699b85378480ad4d7c

Download Submit
/data/data/com.qq.cleaning/databases/ua.db-wal

Filesize
56KB

MD5
c87aa8ed795cda75f13011e149247d34

SHA1
f5c0e79ff841ec365921b5b0bf6dcbb185548886

SHA256
fd0ab1a56752094ef1bca94695f0f4ab36a1f9afde9de28dab94e26a416c662a

SHA512
4c9bdba69534205941a94408363ba5a7e37cfb6d99287d8745a534b6f50401054a568d21ef87d6d2512f03fffb6b8d163aef9906bc2f43ef81039ab1653f0b48

Download Submit
/data/data/com.qq.cleaning/databases/ua.db-wal

Filesize
8KB

MD5
764d4e8f606eb35424d9dfcc66d1593c

SHA1
f015edbe9362461ccf3ddb84a71429402c8cda81

SHA256
3f91cd168b739749c66e0d4e977bd794ab169683376c2255150625a1def62926

SHA512
9f3a58bb09ac64a3a310560d0ea8e72e4d42a0f5b9bdb68f3b6e71393ee27d201bdada01b3ed9041a9db94208b0bc079df14ac2d83f5ab24e4963757527f62fc

Download Submit
/data/data/com.qq.cleaning/databases/ua.db-wal

Filesize
4KB

MD5
83247ddf392007e64930808ab7a87d4c

SHA1
386ae35ca4873d490a01d0f4c4f5b5099bc9ad0a

SHA256
2ef8248cfbb2f45683e13e4d2d89df56225411ab39b92c9b004ec7f5381f1b71

SHA512
c6c8c86ba33cdce30c4024752d8eb05e548d6e12d238129896cc6302c3f1486f23a2a722ef8b15c558a34ed3c4753f83802e759b781f9943ee9361396dae115a

Download Submit
/data/data/com.qq.cleaning/databases/ua.db-wal

Filesize
4KB

MD5
f5ad118da81127d94e97d5bc4e29768e

SHA1
a93ae2784725f32e27affe48d6778e0ba7dcda51

SHA256
276cd20aec502e2722be1fd3c6d7485d6b8e4899c89242c567c69143b00b2a32

SHA512
90626c5d67a5cb2a0509e302161679688758e7d8e051364800da6ba1ea46ac1761df5008c8bc8e346fc0f5514269394c51ebaa6646e193423eb7c1fdf33fd26c

Download Submit
/data/data/com.qq.cleaning/files/.um/um_cache_1716902504840.env

Filesize
1KB

MD5
70b4698814de0b2db843a8cd139a8eec

SHA1
7ba87e55c95d9d300b8e0432587141494e60d81a

SHA256
9e060f401ceccec180fc46594a584b23b9631fa741cdcf191fcc367db4df2d73

SHA512
3c82f5574712e9da82ff8fe8c481c7d7fcdbb5ce2d0c9a8472b8848d70bddcfc685ef32cfdd64f10683c97f46da6e86f1e34c8f60a95e2b6e766c95e998f1bc3

Download Submit
/data/data/com.qq.cleaning/files/.umeng/exchangeIdentity.json

Filesize
162B

MD5
5168b2192350ce0bfd72669eb92f67b7

SHA1
9c8831b24a48979fbdcffe39060f4a9fe8d1cfd8

SHA256
d417eb5040df507554ca66c9c2c1f512581b50dce472a6a43d01e296a615d50c

SHA512
c942e3c6d15b8465c30c51e03275aedd3063118d97044754b0353a221e35fe096895943b2be3b931b664f3589257c6dffa76797cc7f339ea555fd02805dc25b9

Download Submit
/data/data/com.qq.cleaning/files/exid.dat

Filesize
54B

MD5
d6baf2a5ee52302022f5a187ab7f5ab2

SHA1
e331b0b0895c2dc537be120f86f85b9f8465ea75

SHA256
256b3f01645cd9f238df581c21f89796982b38b3e14b86847c54b44a14500d7b

SHA512
802c1584451ce72d97c774f2039a6fa18030603e9e57ebd6c7d122bc9d3eec6152e6322b743fe33fac8e0d43d065556986cdf3caad05393925f66f7a42bfbc59

Download Submit
/data/data/com.qq.cleaning/files/jpush_stat_cache.json

Filesize
120B

MD5
19dc5d68c5c29abca6d4cfa8e1cf774a

SHA1
4e5821bb354a233884f2e7f09f9128948eb8423a

SHA256
4c0570af3d39bfa91ad4e319998a215a64fa046e2baa33e01d540b222ef9ca6f

SHA512
d007202b00601bef315143eadad456b2b28ddac57c09539322aff37022f580cb7954f16e4d67cdae9bae5bd3821c1efb4f7a1cc0da225bc93b158da270170d5c

Download Submit
/data/data/com.qq.cleaning/files/libcuid.so

Filesize
8KB

MD5
4f3965df3a71fc2e91782681a912bf63

SHA1
2a14be3273ea3a3c46c9eeaea3e2a83eb004dae0

SHA256
37136e5342bc041bd6f3959200317fe567753a52cf6636a1751f269c58f8e869

SHA512
1c643b1c2a74230f5c27d6a6706e0733202ec0fb3583288b67b5f8d9bd1c86af67a57c606d162e26dca5beb84a210074523856cb74a2968c0ed9ff9ac318a0c7

Download Submit
/data/data/com.qq.cleaning/files/umeng_it.cache

Filesize
498B

MD5
084819da1fa7a1cb4c2eeaad6f907da7

SHA1
1cbe14d8123128df5a592169dfb03c0728eb08de

SHA256
38caa76f308d0e359129be56e8fad6325599283445ce9d60da1ed5985fe8356a

SHA512
c1ba283ca9aca6c83776870a11d0e735c9ec43c1a83b14e6d47da049088c81d070a5b9bbc5df3d51daed806d45e21d5382f77df37f979c8704d2a57809118be6

Download Submit
/storage/emulated/0/.DataStorage/ContextData.xml

Filesize
76B

MD5
4f8f7c8d3047a75b44cdb2aa2f5288d7

SHA1
a4906d6acca593455b857d24069e43c6fef22547

SHA256
b341da2b169634afe27f03d0977e555bea6bc752b99c0cc62add419798b9e887

SHA512
020861c1c41b63dcac275bdf9857ca04ee1aff5eaa436ceed2c86c00da80b6b0ea76452526723e523b3847b3f0b54af7ee3da138dd32feb0cab0e0596ef49bd1

Download Submit
/storage/emulated/0/.DataStorage/ContextData.xml

Filesize
240B

MD5
1cfd56f90428302b55231514b6524975

SHA1
2b640b724227a272cf5dcc51c3b76656397c9cd9

SHA256
6d0b214022f4ebb5cb1d95f52b37327b2fe764b35206f728c0b7c8fc7a259b94

SHA512
a2896f0918593b858ad9ae14c5dc479a643d714fb52ea9ffcf81673bfe516cf9fc5b7ac1cc19017ed635c8ef54b05efa71b78d697886a9ff3c3b3ed08b9dd480

Download Submit
/storage/emulated/0/.DataStorage/ContextData.xml

Filesize
32KB

MD5
3ad3e7a79106e57e9985a67f14b6cd5f

SHA1
1fe82c46c3e5ebbc2cd963ec14c33e9668d731d2

SHA256
4b630114714a0a8d44a66ae91be19217a667f550ced37d5e3c6b154262e76cd8

SHA512
7ad11689b5408ff04a26cecde53fc5b689c62aeff3ad2fb74401d3cd1cb2c6d60200eeb3b8191feffd332c7ebb239a9dd03118f0ed19c6abf277ec76a912ed78

Download Submit
/storage/emulated/0/.UTSystemConfig/Global/Alvin2.xml

Filesize
16KB

MD5
cdd05571a08f3a7e860b16c801893d8d

SHA1
636430366b51c5fec416902eb26882354c344ba1

SHA256
e9d4a7bb0fa094a2bc890c4d37f77c058b72b06767035f71a21bf40d7c19631a

SHA512
67a090e67a59a926fc24317cef777503bb19e2eee6650278b9d4661de0499c29ba08cc013f665d11c29f5427a9730ff46ea6fc3e4ee1c7bf0cf6132bc5f12be2

Download Submit
/storage/emulated/0/.UTSystemConfig/Global/Alvin2.xml

Filesize
16KB

MD5
c04dd36f3257e379c1ba0de0005ad657

SHA1
17d870d3dfc178a897fd7f938e6d62e51762c56c

SHA256
d7b61f5015f9188681dc700e26b60cdfdfc9e91aa506f45ba8c3b7a28691c6c5

SHA512
136248cf917f25f881f0b564bf269a370bc8ff9e629f26a7bd8b0a89e049f6a5e6f0711f9c25d6b19905258214aee9497c0592fcae9788a098c76a363c04b70a

Download Submit
/storage/emulated/0/.UTSystemConfig/Global/Alvin2.xml

Filesize
28KB

MD5
aaf0473603e542e3d71122918819046e

SHA1
85114afbf4a31f375d364aa22419cbd1f352e639

SHA256
fd2f1fe7eb7493f0cf184c6d817ed2eecc6e0978139d72af7fbad46e5fa9f456

SHA512
0c5b5b70d8ca2074334d5aa53f6bee18737e8c0d8c28b23f4aac56aa0b7334e4b8b30dd2be3b60c44801eea3e517599bfdbf0d923be2807d3e0fd30bd2fd97a5

Download Submit
/storage/emulated/0/Android/data/com.qq.cleaning/cache/027c114550034b37a241efef8b045910

Filesize
1KB

MD5
4013f922d6e2b5127df7532c533abfa3

SHA1
d2c113e1b1527a8525d50ac571499d2cfb04eb1e

SHA256
8592bbbcb58d5d04cd7358acbda5fe0488fcb60a101ca6a36e9f7f0f2f0ec00e

SHA512
99103ad0ed45dceae56810e570ffc612d69a7713fbd85208301fdd0cca77dcb12e4d61699b9431836e6cc239375eb22d5499fcd16802e60d2ac0c49c168709d4

Download Submit
/storage/emulated/0/Android/data/com.qq.cleaning/cache/58419b2991114fd9ac56d32e888745c6

Filesize
4KB

MD5
e2ef162ee5b1f59ef2753aafc89879fe

SHA1
00c26593931eff1113ea47ede275cf3cb7f1152c

SHA256
8d52ba08d4daeaa5d847746df88b4b6081e3c4af10e29de88d6398c63df305da

SHA512
e57e8266b83f1fecd9d2c39621930b429a0051257c164fcd42a069b73c2228884ed547e7348c11185bbb7d40afab927002779dd1155c7b9d5d5ebff0c43b0aa0

Download Submit
/storage/emulated/0/Android/data/com.qq.cleaning/files/tnetlogs/inapp_20240528.log

Filesize
71KB

MD5
f5eb1b44ebaad14c54d3b59204610a13

SHA1
2bbb4013f872120867748d2eb87b9e66d6250732

SHA256
63f6bf11fc4e3dc649dca8abea1cb4ee491133076a4c9bff935d5f258c1672bd

SHA512
00f9300a4af4036f597aaede340e80ce90b8a79fc86a860a1b93afd560f2670b33e9fe186934676cfdd7aa87ffd71e77a3d574599899f80b997b3ee9d5e079f1

Download Submit
/storage/emulated/0/backups/.SystemConfig/.cuid2

Filesize
24KB

MD5
8f7f9225ac2ef90cee9a5726b806ad14

SHA1
d368e0aa187e577580a3504be1d533785d9959e3

SHA256
3299ea92badd2f5ca3af8d8e056be29e10b832c9115d75da830d48fd7d293dec

SHA512
41b70d8cb531facbda4ad6ca7d49019b965d5f582950fedf308c572c0f62c767c6786a09bf4ad3570ecddc451b0f621c29daac38bc3e4d3ed65cfc5ea61633f9

Download Submit
/storage/emulated/0/baidu/pushservice/files/.info

Filesize
89B

MD5
80a92ab48851f0ae8b4ad59b921345eb

SHA1
395e361f79c88c7a54916912bd61262f8831bea7

SHA256
38e8fe2ffaa32651feb2cd0e453735ab6497d0f106005f7be9dbed87e59878da

SHA512
8b2510f6016158e0151ba7e8362352f82d1fce6279cd32aefc894346381af2caf80b8c868aec0154c4fba06484c1287e85d14aa12bb75c5a2e68c14b694379b7

Download Submit
/storage/emulated/0/baidu/pushservice/files/msg20240528.log

Filesize
32KB

MD5
14456c372d8147334c9fc13add2ef9cf

SHA1
1a326425dbf7c58583978f388d2783f441a4142d

SHA256
5b1b641d25c9febf2d83551ef5f5cd0fe4d46b7cf2e09a387e736c9a197b549f

SHA512
0a7074ff033f9d5c2626373f2e073b02a1c79e1eb514bce45cd96d8acfa50b6b9ed4fe35ea9d28a3ec9e84aff49acb84666c6d848180904777269991f0e867be

Download Submit
/storage/emulated/0/baidu/pushservice/files/msg20240528.log

Filesize
16KB

MD5
f164f5e94fdb997b5160fd5366dd4c25

SHA1
814d54820f7c08a51f688c5b287506c950062b33

SHA256
e86c3e5b0ad7e37071dd5e58dc4d3f8f6a9df2d5a6914d6c47cc7b4ca4d0f144

SHA512
780cbdd47c6c93b77c638ccd586d0ba86c7e9ffa341b3784a401cd7c8b433ea0470aec3478b2876c541aea0b375b55f2181413e8b9443d18d77c341dfb06996e

Download Submit
/storage/emulated/0/baidu/pushservice/files/msg20240528.log

Filesize
32KB

MD5
0b940914c7b72e26d5010e4b8d5e9dd2

SHA1
bd33986d60aef63f2e02a6c397ff1ff8dbacd2a7

SHA256
b7a0565764a79b39fedf020991cccf0e08e85f97d0bb5e5d6072728470fb9faf

SHA512
0069799aca9318f2458d8a4ebb6d6965272dd4e4cdab9e140540843a1ab1d94b67d3096b12554bff93985675e91648b09af185d1c8ef8d7d665c1c941e71e509

Download Submit
/storage/emulated/0/baidu/pushservice/files/msg20240528.log

Filesize
24KB

MD5
2f0d71a0e63d174f39dc680a59d3b430

SHA1
f01a6deddb480b115b72ebe3fe4d0fd52e4f0d85

SHA256
2be1c4cde0efd738c8089ea4892744886d647f261d0e9c7c9197c107ae218c6c

SHA512
b9c534a7899415319c69f17bf7a28f2dfe4b6023bd872916a676f62ecfa80e2e1342b122ad853f1987b5af043f3cf2089ddbae7e86e89b2e27e0e2c9be113cbd

Download Submit
/storage/emulated/0/baidu/pushservice/files/msg20240528.log

Filesize
8KB

MD5
c5db3c3d85122aa2de08e093f8aac8ef

SHA1
de3825e5981d6837507588e3c6f420df9db8729c

SHA256
dfa1fd75ca7e66fa390800b2f08bf135cb67b064d2ffd2dd2f37a57941640fc3

SHA512
4d120f80ce514e3a90c52de0a91105040caf002c2b4a426c9603196fd3d24e899b94a770ff5c918b8697e19c6a732267e973800ba9eab47c6fdeb55e4c856e75

Download Submit
/storage/emulated/0/data/.push_deviceid

Filesize
32KB

MD5
8d9527f188b4a43eb47ea184f4825940

SHA1
7a65d84ad9dd8764fa5b17549af74764a7d7607e

SHA256
397b817caa89afa5dfe088528848f34b0b9f868d4e76e21801791a5f2edc122a

SHA512
026e9eb188025abcf1c12b9c6d8c29af384f26804cb64f501d755c997dd605f2b391edf0a87ddf0ce167be639d83f186eb249b1b6d1d8879b79c6000ef9bb7d4

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads