061e65c1e8cd4ae5bb17f880ddfdf0932b2fa2a4ff3f2b4ae0b7802ff3357ec3

Analysis

max time kernel
179s
max time network
183s
platform
android_x86
resource
android-x86-arm-20240514-en
resource tags

androidarch:armarch:x86image:android-x86-arm-20240514-enlocale:en-usos:android-9-x86system
submitted
29/05/2024, 22:14

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

821fbbf68d1ca8a1a1f8d47fadf7f2c8_JaffaCakes118.apk
Size

10.2MB
MD5

821fbbf68d1ca8a1a1f8d47fadf7f2c8
SHA1

e67e84ebcdfeefc3778c168ce673324b4021a75f
SHA256

061e65c1e8cd4ae5bb17f880ddfdf0932b2fa2a4ff3f2b4ae0b7802ff3357ec3
SHA512

f6f5b278a28a13f47dfdd7b3a728d886479e1d0951484262fa32512d68eba03d7577bca7ad93c316537b92cef62392503eb899e931719633880844defd4651ad
SSDEEP

196608:vv96vV5o9vjzbfdwd/IOEc+Q1w3O7AkJ0gknMq4LZ7ESrebuw95vr+wG4:v16N5oZzwgONv1mO7AkAl0FreCw95y74

Score

8^/10

discovery evasion impact persistence

Malware Config

Signatures

Checks if the Android device is rooted. 1 TTPs 2 IoCs

evasion

System Information Discovery

T1426

ioc	Process
/system/app/Superuser.apk	com.aihuizhongyi.doctor:pushservice
/sbin/su	/system/bin/sh -c type su

Checks CPU information 2 TTPs 1 IoCs

Checks CPU information which indicate if the system is an emulator.

evasion discovery

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/cpuinfo	com.aihuizhongyi.doctor

Checks memory information 2 TTPs 2 IoCs

Checks memory information which indicate if the system is an emulator.

evasion discovery

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/meminfo	com.aihuizhongyi.doctor:pushservice
File opened for read	/proc/meminfo	com.aihuizhongyi.doctor

Loads dropped Dex/Jar 1 TTPs 13 IoCs

Runs executable file dropped to the device during analysis.

evasion

Download New Code at Runtime

T1407

ioc	pid	Process
/data/data/com.aihuizhongyi.doctor/mix.dex	4326	com.aihuizhongyi.doctor
/data/data/com.aihuizhongyi.doctor/mix.dex	4392	/system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/data/com.aihuizhongyi.doctor/mix.dex --output-vdex-fd=57 --oat-fd=58 --oat-location=/data/data/com.aihuizhongyi.doctor/oat/x86/mix.odex --compiler-filter=quicken --class-loader-context=&
/data/data/com.aihuizhongyi.doctor/mix.dex	4326	com.aihuizhongyi.doctor
/data/data/com.aihuizhongyi.doctor/mix.dex	4326	com.aihuizhongyi.doctor
/data/data/com.aihuizhongyi.doctor/mix.dex	4326	com.aihuizhongyi.doctor
/data/data/com.aihuizhongyi.doctor/mix.dex	4448	com.aihuizhongyi.doctor:pushservice
/data/data/com.aihuizhongyi.doctor/mix.dex	4448	com.aihuizhongyi.doctor:pushservice
/data/data/com.aihuizhongyi.doctor/mix.dex	4448	com.aihuizhongyi.doctor:pushservice
/data/data/com.aihuizhongyi.doctor/mix.dex	4448	com.aihuizhongyi.doctor:pushservice
/data/data/com.aihuizhongyi.doctor/mix.dex	5173	com.aihuizhongyi.doctor:core
/data/data/com.aihuizhongyi.doctor/mix.dex	5173	com.aihuizhongyi.doctor:core
/data/data/com.aihuizhongyi.doctor/mix.dex	5173	com.aihuizhongyi.doctor:core
/data/data/com.aihuizhongyi.doctor/mix.dex	5173	com.aihuizhongyi.doctor:core

Queries information about running processes on the device 1 TTPs 3 IoCs

Application may abuse the framework's APIs to collect information about running processes on the device.

discovery

Process Discovery

T1424

description	ioc	Process
Framework service call	android.app.IActivityManager.getRunningAppProcesses	com.aihuizhongyi.doctor:pushservice
Framework service call	android.app.IActivityManager.getRunningAppProcesses	com.aihuizhongyi.doctor:core
Framework service call	android.app.IActivityManager.getRunningAppProcesses	com.aihuizhongyi.doctor

Queries information about the current Wi-Fi connection 1 TTPs 1 IoCs

Application may abuse the framework's APIs to collect information about the current Wi-Fi connection.

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.wifi.IWifiManager.getConnectionInfo	com.aihuizhongyi.doctor:pushservice

Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 5 IoCs

persistence

Broadcast Receivers

T1624.001

description	ioc	Process
Framework service call	android.app.IActivityManager.registerReceiver	com.aihuizhongyi.doctor:pushservice
Framework service call	android.app.IActivityManager.registerReceiver	com.aihuizhongyi.doctor:core
Framework service call	android.app.IActivityManager.registerReceiver	com.aihuizhongyi.doctor:core
Framework service call	android.app.IActivityManager.registerReceiver	com.aihuizhongyi.doctor
Framework service call	android.app.IActivityManager.registerReceiver	com.aihuizhongyi.doctor:core

Checks if the internet connection is available 1 TTPs 3 IoCs

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.IConnectivityManager.getActiveNetworkInfo	com.aihuizhongyi.doctor
Framework service call	android.net.IConnectivityManager.getActiveNetworkInfo	com.aihuizhongyi.doctor:pushservice
Framework service call	android.net.IConnectivityManager.getActiveNetworkInfo	com.aihuizhongyi.doctor:core

Domain associated with commercial stalkerware software, includes indicators from echap.eu.org 1 IoCs

flow	ioc
21	alog.umeng.com

Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 2 IoCs

impact

Data Encrypted for Impact

T1471

description	ioc	Process
Framework API call	javax.crypto.Cipher.doFinal	com.aihuizhongyi.doctor
Framework API call	javax.crypto.Cipher.doFinal	com.aihuizhongyi.doctor:pushservice

com.aihuizhongyi.doctor
1⤵
- Checks CPU information
- Checks memory information
- Loads dropped Dex/Jar
- Queries information about running processes on the device
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Checks if the internet connection is available
- Uses Crypto APIs (Might try to encrypt user data)
PID:4326
- sh -c getprop ro.yunos.version
  2⤵
  PID:4367
- getprop ro.yunos.version
  2⤵
  PID:4367
- /system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/data/com.aihuizhongyi.doctor/mix.dex --output-vdex-fd=57 --oat-fd=58 --oat-location=/data/data/com.aihuizhongyi.doctor/oat/x86/mix.odex --compiler-filter=quicken --class-loader-context=&
  2⤵
  - Loads dropped Dex/Jar
  PID:4392

com.aihuizhongyi.doctor:pushservice
1⤵
- Checks if the Android device is rooted.
- Checks memory information
- Loads dropped Dex/Jar
- Queries information about running processes on the device
- Queries information about the current Wi-Fi connection
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Checks if the internet connection is available
- Uses Crypto APIs (Might try to encrypt user data)
PID:4448
- /system/bin/sh -c getprop ro.board.platform
  2⤵
  PID:4574
- sh -c getprop ro.yunos.version
  2⤵
  PID:4604
- getprop ro.board.platform
  2⤵
  PID:4574
- getprop ro.yunos.version
  2⤵
  PID:4604
- /system/bin/sh -c type su
  2⤵
  - Checks if the Android device is rooted.
  PID:4650
- logcat -d -v threadtime
  2⤵
  PID:4746
- /system/bin/sh -c getprop ro.miui.ui.version.name
  2⤵
  PID:4768
- getprop ro.miui.ui.version.name
  2⤵
  PID:4768
- /system/bin/sh -c getprop ro.build.version.emui
  2⤵
  PID:4793
- getprop ro.build.version.emui
  2⤵
  PID:4793
- /system/bin/sh -c getprop ro.lenovo.series
  2⤵
  PID:4818
- getprop ro.lenovo.series
  2⤵
  PID:4818
- /system/bin/sh -c getprop ro.build.nubia.rom.name
  2⤵
  PID:4843
- getprop ro.build.nubia.rom.name
  2⤵
  PID:4843
- /system/bin/sh -c getprop ro.meizu.product.model
  2⤵
  PID:4872
- getprop ro.meizu.product.model
  2⤵
  PID:4872
- /system/bin/sh -c getprop ro.build.version.opporom
  2⤵
  PID:4897
- getprop ro.build.version.opporom
  2⤵
  PID:4897
- /system/bin/sh -c getprop ro.vivo.os.build.display.id
  2⤵
  PID:4921
- getprop ro.vivo.os.build.display.id
  2⤵
  PID:4921
- /system/bin/sh -c getprop ro.aa.romver
  2⤵
  PID:4946
- getprop ro.aa.romver
  2⤵
  PID:4946
- /system/bin/sh -c getprop ro.lewa.version
  2⤵
  PID:4972
- getprop ro.lewa.version
  2⤵
  PID:4972
- /system/bin/sh -c getprop ro.gn.gnromvernumber
  2⤵
  PID:4997
- getprop ro.gn.gnromvernumber
  2⤵
  PID:4997
- /system/bin/sh -c getprop ro.build.tyd.kbstyle_version
  2⤵
  PID:5022
- getprop ro.build.tyd.kbstyle_version
  2⤵
  PID:5022
- /system/bin/sh -c getprop ro.build.fingerprint
  2⤵
  PID:5046
- getprop ro.build.fingerprint
  2⤵
  PID:5046
- /system/bin/sh -c getprop ro.build.rom.id
  2⤵
  PID:5071
- getprop ro.build.rom.id
  2⤵
  PID:5071

com.aihuizhongyi.doctor:core
1⤵
- Registers a broadcast receiver at runtime (usually for listening for system events)
PID:4422

com.aihuizhongyi.doctor:core
1⤵
- Registers a broadcast receiver at runtime (usually for listening for system events)
PID:5089

com.aihuizhongyi.doctor:core
1⤵
- Loads dropped Dex/Jar
- Queries information about running processes on the device
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Checks if the internet connection is available
PID:5173
- /system/bin/sh -c getprop ro.miui.ui.version.name
  2⤵
  PID:5213
- sh -c getprop ro.yunos.version
  2⤵
  PID:5229
- getprop ro.miui.ui.version.name
  2⤵
  PID:5213
- getprop ro.yunos.version
  2⤵
  PID:5229
- /system/bin/sh -c getprop ro.build.version.emui
  2⤵
  PID:5264
- getprop ro.build.version.emui
  2⤵
  PID:5264

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Event Triggered Execution

T1624

Broadcast Receivers

T1624.001

Privilege Escalation

Defense Evasion

Download New Code at Runtime

T1407

Virtualization/Sandbox Evasion

T1633

System Checks

T1633.001

Credential Access

Discovery

Process Discovery

T1424

System Information Discovery

T1426

System Network Connections Discovery

T1421

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Data Encrypted for Impact

T1471

Replay Monitor

Loading Replay Monitor...

Downloads

/data/data/com.aihuizhongyi.doctor/databases/bugly_db_legu

Filesize
4KB

MD5
f2b4b0190b9f384ca885f0c8c9b14700

SHA1
934ff2646757b5b6e7f20f6a0aa76c7f995d9361

SHA256
0a8ffb6b327963558716e87db8946016d143e39f895fa1b43e95ba7032ce2514

SHA512
ec12685fc0d60526eed4d38820aad95611f3e93ae372be5a57142d8e8a1ba17e6e5dfe381a4e1365dddc0b363c9c40daaffdc1245bd515fddac69bf1abacd7f1

Download Submit
/data/data/com.aihuizhongyi.doctor/databases/bugly_db_legu-journal

Filesize
273KB

MD5
8a11d60c62af9e08597d9bd9256594b1

SHA1
724ec5f2378ecbf7139929ea1eaf46693276d9da

SHA256
ef7552b625708c4aad954766f9896096d417feffa42d2d5001d1bc304b4eaa35

SHA512
d370c44fc22afb28c1df3ae215e19a9e96e873903fbdb24e84365b4ca29f117d5692c61ad382961a228e93139c31f8fb1601d4dfd66d18af1a840f5523adcc54

Download Submit
/data/data/com.aihuizhongyi.doctor/databases/bugly_db_legu-shm

Filesize
32KB

MD5
bb7df04e1b0a2570657527a7e108ae23

SHA1
5188431849b4613152fd7bdba6a3ff0a4fd6424b

SHA256
c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479

SHA512
768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012

Download Submit
/data/data/com.aihuizhongyi.doctor/databases/bugly_db_legu-wal

Filesize
92KB

MD5
d9bf0a9f3d7d682eec218a8be2f1dae0

SHA1
0969cd1fe935b9b6e4d150d562de013ec74edd65

SHA256
c58d7665db1bd171fb498b3f883280e7faeda5fd9801f5b12fe7c3b7fc5737d7

SHA512
f4d01e7dc5591b2dc9503c6cc1ee751149bc6881d92cc7721d9cbab8ce6a1871fc97198f2fbbe290060588332b9f327fc4d95eee898aeaf172bedeaa54fcb631

Download Submit
/data/data/com.aihuizhongyi.doctor/databases/cc/cc.db

Filesize
36KB

MD5
5d7ea1a23af19b4340cc8d90f28297d5

SHA1
4cfe95b23a9e98378d69c4290af81b51fbe76aea

SHA256
474c4a54534ed96beacad7cc9a805a3f53ec9c0522fc7bcc59771cf500a6a0da

SHA512
33071f4c92da0a3df01c4a61dd165df7c7e0f4f37753cafe02d19fc876a5e7fcbb01c069c804e140ab8bfa0644a55f50fd1373646d1c439f817baa5ffbd47f7b

Download Submit
/data/data/com.aihuizhongyi.doctor/databases/cc/cc.db

Filesize
36KB

MD5
ce6135aa1b1fe4f2c2db2a546d2a5558

SHA1
79b59582154017aadab783dc266fcb158c252940

SHA256
7b45f576c08c7f78220168cca4a0e33198b13e9bdc8b1da406ddb6887412000c

SHA512
2839075fe374c8567c839ae35ce2d33ec72fdaebf170aa7d224b555e5b0e74d4a43f2f67d17ed806dae841da883e9620d788ea052d06152678afa927307c7ce4

Download Submit
/data/data/com.aihuizhongyi.doctor/databases/cc/cc.db-journal

Filesize
512B

MD5
e90c481f53a01b10da147b744490893a

SHA1
2843f07398924cbd73421993b6f98a09146a99b2

SHA256
735b0f22d8b4daf0730b60e49286bbcfd8e87f0e8d53f386b9e29552cdbc0330

SHA512
6321f9984ec27fa4edfa47092c4b94ac2ba27000f23284320e1cbb47d6c82b859c14731bf85e4c12e83f9a13e2e60e85c47c1ade73dcf9cc4ca14250216eb303

Download Submit
/data/data/com.aihuizhongyi.doctor/databases/cc/cc.db-wal

Filesize
48KB

MD5
efae53cd2648e90ad12f3579f65ff058

SHA1
f2f06e52c07e9712641ff57831b80cdd10974ebe

SHA256
e8d605a687b972150dc139d5203630dac8257096bce835efe1a59bddc9ce6271

SHA512
f0f033aa5e4a63cc60071abd3d62446b1a337fedc90abba4c520f63d19f6008ff87845af66e3eedd681c934134f2093cedc8be3ab2bbb695383065ebdca08ef7

Download Submit
/data/data/com.aihuizhongyi.doctor/databases/cc/cc.db-wal

Filesize
16KB

MD5
997adf15caabf0ce986103435cb42a0e

SHA1
4e21fdf26000a50a9d25628adab51a7c63951494

SHA256
6b48d359c7ddd2d56d4345af7a36b562594d4fc7527556e78b768dc17cd6cbe6

SHA512
e5fe8d83b9855f14145e53dc3e474bca368735673f210a5ce528f098ca9ed58ce7e5b4898c8987889924d1d4e886907ff8e1be71f4e96ea61205c6611db5b0a8

Download Submit
/data/data/com.aihuizhongyi.doctor/databases/pushsdk.db

Filesize
4KB

MD5
2eb252e7d98a3cf94fd5e30fe229194b

SHA1
f96e6ed0ac297516a46328e150193960571715fc

SHA256
5bb944fe18a173d4fc5af94ee9987143f9f1d18eba4376e45d1754669ed7660b

SHA512
525ed170c1fd6edc5ac0d4ff5812307ecb252c62e5cda112aa79e6c2810a4ed371b354b438fcc4e9dcf93ed9e90a4a8f21760d36896f6c96ce2ddb02852972bd

Download Submit
/data/data/com.aihuizhongyi.doctor/databases/pushsdk.db-journal

Filesize
512B

MD5
68c213aab764dfe99f6da002d887d2d0

SHA1
65984297e58fd64aacb9d6c729d282acaaf0d117

SHA256
6ee5b31464228531dedb70882e124153d1c652fd32548d8bad1a72939e2987b2

SHA512
df2bff7da5dc94155b47d7628e5ef50e7c518a72e5c31fa8b44fea5f08d3edfe0473b8c1f5857a1aef02eada774beb46b7e24e2c796b7d7138362ee58f471423

Download Submit
/data/data/com.aihuizhongyi.doctor/databases/pushsdk.db-wal

Filesize
185KB

MD5
934fba8e9637187b67e24fb341681bf0

SHA1
ee5556ac809e2740bf12f308c874cca0fc1c1a83

SHA256
849dc38dbce5263822804eaa250c10fce209f61b73c60249b9c910c2b7f3f2d7

SHA512
aa305231a28b5c2f84763925d46ffb667c9b67d089d72dbcf8977df7a84558da78a54fcca3e2874bf71f150eaa80d43de9e3335b755254e93f0ede401d96ccba

Download Submit
/data/data/com.aihuizhongyi.doctor/databases/ua.db

Filesize
32KB

MD5
e732f8fd59bee2b4bd2ba6e4c4b58da9

SHA1
8e1c5201c2e5b86d68e5cfb3f068790332f51152

SHA256
496b9e003b0d23f2e3c58d8e32985431dea652d7ecf94dbdcf91eb50fc62a9ee

SHA512
4db7144547ee4b33e2bb6c6505d3cef1eb631298b152d5a367d4e3d9bc8c1fb0dc29a59aae1af836444e29cc542cfc867ad488bab398bb240520eba256823132

Download Submit
/data/data/com.aihuizhongyi.doctor/databases/ua.db

Filesize
32KB

MD5
d604a3bf1f8d992cc320ea5b1f7609bd

SHA1
247f88df0b55c7d523ea5398637711a0e4a483a4

SHA256
329940b4d46326d58e73c842dd099704061d0ef7338777bf31ad895f29013c17

SHA512
67e28f6713cb5c238a9664df128f01a89a2efb7c8c9330c1e45bc0d40ebab81fa20df5166743d84d81dc0386a89ff0329f022281c098339baa2e851ff0a1e1ab

Download Submit
/data/data/com.aihuizhongyi.doctor/databases/ua.db-journal

Filesize
512B

MD5
090db09268652c7646c53d810ed4e040

SHA1
12a2ad004447ab74b49c1d8495794ff045a6bd51

SHA256
0d03a05bc79a65b0a4c9b9fb2b35fb6b32dab328c444ae1babd8addcc673b7cd

SHA512
cdbb78b3706ea3185837ab42e21e269e659cb5a617d5740c8d458ee252470e13c5aad6cfdfd7930f087588c015649c8804f43749541757af6db916fe12631a23

Download Submit
/data/data/com.aihuizhongyi.doctor/databases/ua.db-wal

Filesize
56KB

MD5
4ee9fbfcc7a165b7a6740acb9b570a77

SHA1
94908db066110914921381bd76eee98bb4e055aa

SHA256
50e9300c8a34f8a6178a7dc11e89213d0da42d31f1549523c52a0fbfe672bfb8

SHA512
e43b8b0abdab1492b21e5e681d99728c31e65a7b475de0f3e8b31dc2325841fba1b83dcf7e6a5c2343da559f2c8c4f0ef16b7ab27260803889fcccfbbb6dd211

Download Submit
/data/data/com.aihuizhongyi.doctor/databases/ua.db-wal

Filesize
8KB

MD5
c571df7bf5ba76c4e2dbd3cfc153be14

SHA1
a5aeb67268da50dd53d994780c421807b7dbbc2f

SHA256
9d3ea3065960a4b606824d560fc44d4c440e1d2d99435e0d23ddf45daa6483f8

SHA512
7ad634b8aea3faaf577fba26c795c28ae8a716a57a4631d944e2e6558433455b53f16f5d0ea591e4cb5495ac8cc6b0bb49d0e4636045a8c853390439175758d7

Download Submit
/data/data/com.aihuizhongyi.doctor/files/.um/um_cache_1717021026596.env

Filesize
1KB

MD5
3e2a249bf35dc959e714c19f962b124e

SHA1
c852fdbdaa21525ab4a7f37fc7ffdd3b2bbe565f

SHA256
c510546408562390fabf5b6adfc679808d85288393655179fd2a3706781b8b33

SHA512
8d5b90a772d84372d34e8fedbbadf4dfbcc5c32cab980417c4a66be849f421a98be257379b704dd68460acffb6287466b5eec304b73e4f72a2a215bd263628c6

Download Submit
/data/data/com.aihuizhongyi.doctor/files/.umeng/exchangeIdentity.json

Filesize
162B

MD5
c6d2d73f7a88b7898c2c9ea80ec1bb7d

SHA1
e3088a227cbada7f361bf5725e842fac47765e3b

SHA256
4114432f9f03f85816a60926d4a0054d58d6cf97ce5fba37be4b9be864d5fcf1

SHA512
91d12b8edf7f977a5b7fc30a5a10e936e0e526ddcb51ee59beb024837fc78f920112407f4b467e41162301586efb359fae9a886b242002781416701f5658f9c7

Download Submit
/data/data/com.aihuizhongyi.doctor/files/exid.dat

Filesize
61B

MD5
9126641e9b83f1dd76a9b0afdce641c1

SHA1
710df5879d18dc45a05e0a752070809bebe30249

SHA256
749aa8a94f13d3c620d995effda2e48fd2b9f6c7e946adaf7987c09cba15e7f4

SHA512
809b6da303cbb14dccbad43df36dd12136700d3d48b0b7b66d8358c5afe8d1587a45436ab8dff717a2208b7eb86df3e0b31b72b63e75eb04ab30892d8976ad74

Download Submit
/data/data/com.aihuizhongyi.doctor/files/init_c1.pid

Filesize
45B

MD5
7b05fda5cb78489604c498e515b89ad2

SHA1
fcfd1ee80bff22a2e77d8de48fc1bfc75d38c3e8

SHA256
2f67bd19254bfd30706baa06f7a83d819c16dc713c91afd8d0c1236b8921fba9

SHA512
8500ead61c75605d12855ff11e38cc5baa8dd7fe7f19742a955f992eafe001cb62cd133b261eacd99346c26f9e28469dcec3b2edf2e7293cf5d2669df2225d66

Download Submit
/data/data/com.aihuizhongyi.doctor/files/init_c1.pid

Filesize
14B

MD5
03e1d384b101f369be6717e8637f5205

SHA1
3a3b7387952c93d23e262ca0e24564b34f7d5a52

SHA256
f5b326e136f592c1f4df58b968fe0b2a1a57c84b91027416b6f9c1c96c4f9adb

SHA512
7aa3e36f26fe68912baee3bd9c1936f7cdff139fd7d9de7acefdb857dc56bced84eecf0d9ec138fcc910facb7be7b96ad1efb01fe8e8ed1ee71961025e24337b

Download Submit
/data/data/com.aihuizhongyi.doctor/files/init_c1.pid

Filesize
14B

MD5
9a62af4afc8e668e193792f30eefde58

SHA1
5649f9cf2fba98a9343e878633c4beca182bfb4b

SHA256
62777d5080bf965aee6da3d5837429f5c290e0aee902e1c0813601d699c87566

SHA512
6c6f396dfc99d475d01763a7e4bfd0729ec5576cf4b55d2df43f1e3cc2c0916d6c4b8627a40e11083c503056117e26800e4e167b5d9a1db73e2fb03717943a65

Download Submit
/data/data/com.aihuizhongyi.doctor/files/umeng_it.cache

Filesize
413B

MD5
f1edefeeee532ea0a802461815654e53

SHA1
1925138a8d0c92b637aa69a45f39a410d6b55c5a

SHA256
e4effc02dc4316da4bb60df24e4aa9e174d87ed5445622fe51a98e3c132fce9e

SHA512
8de3528be39a2d7026eecb13805e3cfe30205cbae5f1c31d8b8a939f1bb7c1a8408dbac4395427527b4bf2898c1c5821f84d7c549ca33c95f384e400c6a8e7c2

Download Submit
/data/data/com.aihuizhongyi.doctor/mix.dex

Filesize
292B

MD5
54f7a815fd0e393ca08a0face3fb99ae

SHA1
918cdf45deca251d6cde1f7a60d5532d99fcb4d8

SHA256
2988fc63bc87d05b02c29e23866727204e5c1dcbbc6d87250d874b1acc6635ab

SHA512
c53b345b6f0ccf1dd9640f8bad74499c82fe33d3dab026a7289bd31bdb29560347fa889d3a2631cbf49e05b99bdfb04bcc0d70d1b14f099bafcb92bc94cea2cc

Download Submit
/data/data/com.aihuizhongyi.doctor/mix.dex

Filesize
292B

MD5
63f77f99bd2c2b772a479923bde11974

SHA1
c7632e7d301e4463fafce85f84e9c3d7da3fdbbe

SHA256
4c76a3af64cdd2f8713ffe2733dea50dbe714d0ca41c17d1847ee5b62a7ca615

SHA512
3aae4a89d1ed51fdd911cb367eb10afe3c2264e4222085891b18a60d5412f85d10bf5c8f3c6642db70abb9aa42732bac5c42c42ee32d587100f53c21b5beb16c

Download Submit
/storage/emulated/0/Android/data/com.aihuizhongyi.doctor/cache/app/log/demo_20240529.log

Filesize
112B

MD5
ff577a70522436adeaaf82b13e38c5c8

SHA1
507bc7c08b36db45922bbfe014f6aa43eecca3ee

SHA256
ec7de84cf4cac23fbbf0bd98db1fd0b01d43d6a268a406f043629ecefa159cdd

SHA512
07a5475a5e07e959442dff20f3dbd0e17e959be6a985dcfe1071da56ddc4d4a22c968c95b468bd993712eb085c0f6e6252e5fed11ff6d6d48946fbe85fd7eee6

Download Submit
/storage/emulated/0/Android/data/com.aihuizhongyi.doctor/cache/app/log/demo_20240529.log

Filesize
45B

MD5
195d266bf582607d62dc021f7d9289a5

SHA1
4c135f9ac5dc6a591e5ce2203d89333dc24800c5

SHA256
fa9f189cf39ba2e40d85467fde49d1bc713f7a2898aa92ab9237329ffe16a2fd

SHA512
8cbd6c2a1fed4b7193b9b2622fc61817fb71405508e245970d3a9e3d23b02153ead0cdd44deb9dfea177b2b64cdc9f9b3acae1f50e6a8f21fd2b08e6521a6f02

Download Submit
/storage/emulated/0/Android/data/com.aihuizhongyi.doctor/cache/nim/log/nim_sdk.log

Filesize
32KB

MD5
b5edba162d5418a65f9a28e1273d97b8

SHA1
06ad214b5bbea486b49e87d5227092f34f20a35b

SHA256
937c2964c0bfcdca718d444991688e1598f31b85e6b7671c05b4898b8ef682ca

SHA512
89f2ae3c21d0b9971ace11c029ecfd29c12fe6010edfdc2e9684e4991844d3cc9374bafe6547827d5896e61bf7434cd0e0847d406082c4a47fa37420da2e2e8a

Download Submit
/storage/emulated/0/Android/data/com.aihuizhongyi.doctor/cache/nim/log/nim_sdk.log

Filesize
96B

MD5
76ac0febb27db1f6724293b40010abd2

SHA1
03486dd5546b8ccfce97407627c4dafc1305bc9a

SHA256
713b512187957cb2270c5302c2688291a9449c588913a7fe0a055a1ad011fe0b

SHA512
a77d9579d0a9899e465623ec9b46ee405dae6a179792bf0cc65e21655c7c234add69329773cc0d6695091c5b86864cb619f5a0359c80674b1141f3d9abf83db3

Download Submit
/storage/emulated/0/Android/data/com.aihuizhongyi.doctor/cache/nim/log/nim_sdk.log

Filesize
94B

MD5
567e89aedeb041b53b30ccaa9e604d36

SHA1
2c7b6e32fc9691da2724ed06c3a35180f7c83959

SHA256
8513367630e5f26855767822b4b86bb9a084e86f564368c410d3711b1d4c0173

SHA512
81653b696e6c24fdd64d56b5f95cb9f308e7252f49a69bdc62d2b30ea88f5ef8bfb4bf4a7f5023b1296ed53006475ba34c541865d49d75b0511b0397ef2cd27a

Download Submit
/storage/emulated/0/Android/data/com.aihuizhongyi.doctor/cache/nim/log/nim_sdk.log

Filesize
79B

MD5
a72b32f447e4ef11e8702dfde307ecbd

SHA1
d612dc0bff7239967856d11cfc963211881a231e

SHA256
ff7fe8181d294d964ecb4689ae8105423bfd2781e90d241ab53e469144001aae

SHA512
4c24586230f53c48d33f59ebad524bdd8c5085cc66f60e17557b5d8a5fa743b18588765345a95e4c7abb57a3e27774fb29430be28b6b75729888a08cae94eb7d

Download Submit
/storage/emulated/0/Android/data/com.aihuizhongyi.doctor/cache/nim/log/nim_sdk.log

Filesize
80B

MD5
5f66144ab20310f59dd73a4a24a0cff0

SHA1
3ae76e47d394b998825bf3bea396eb076af1033c

SHA256
216643fb9ebcea827e41c7e605f791aff09f7d526385e0d8d62c3f6fdca03a5c

SHA512
aff14ef2415d5a43e5f4a9ee780470800d2ba843b34068213efb957419205470057dcd6bb6e8857a83a42534b6df7de6d080a72d9acc63d3790e475f298980f1

Download Submit
/storage/emulated/0/Android/data/com.aihuizhongyi.doctor/cache/nim/log/nim_sdk.log

Filesize
161B

MD5
b3ead69264a907e14a15540742d3afe5

SHA1
3930adbdace2542c22eadf3fb104efb69a04e054

SHA256
d08d237de6052b6ea55f30837d5da47f78f09ac831cf7ca48fd69fd33c86dc52

SHA512
17f28f5f02dbd032d1f6dda13a3a0ac635d6990f57ab1a0845964626968157dd82c0fffc59dc0c71d291e19b68988df823ecb56506f234ed099ed108283ecf1d

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads