8c443d9a4e336bb572c4dab689a584fc33697e4bd3d4fd8fc7a17610f7dedca9

Analysis

max time kernel
179s
max time network
186s
platform
android_x64
resource
android-33-x64-arm64-20240603-en
resource tags

androidarch:arm64arch:x64image:android-33-x64-arm64-20240603-enlocale:en-usos:android-13-x64system
submitted
03/06/2024, 22:29

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
92d3994b05edb26944dd82c7a01c42b5_JaffaCakes118.apk
Size 13.9MB
Sample240603-2eejcacc33
SHA256 8c443d9a4e336bb572c4dab689a584fc33697e4bd3d4fd8fc7a17610f7dedca9
MD5 92d3994b05edb26944dd82c7a01c42b5
SHA1 c20d8dc3333716478ba7d3a6200980051d971e64
SHA512 abf07617675ebf40e29233dcd2439c6ea8b170414bcd605dede8ecda7688bb250ad25d0e27ee0e3da1a83900024179e62e158ddcaf73e2998e04faf849b09650
SSDEEP 393216:7mv/3hWmvWF8zmRtsuXIbmDDuNNL4XCh0dXElwRkhTe4TVJI+5:kf8rCicupvhXuymVx5
MD5 SHA1 SHA512 SSDEEP

Score

8^/10

banker collection discovery evasion impact

Malware Config

Signatures

Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
banker discovery

Security Software Discovery
T1418.001

Requests cell location 2 TTPs 2 IoCs

Uses Android APIs to to get current cell location.

collection discovery evasion

Location Tracking

T1430

Geofencing

T1627.001

description	ioc	Process
Framework service call	com.android.internal.telephony.ITelephony.getCellLocation	net.xinhuamm.d1023
Framework service call	com.android.internal.telephony.ITelephony.getAllCellInfo	net.xinhuamm.d1023:remote

Checks CPU information 2 TTPs 1 IoCs

Checks CPU information which indicate if the system is an emulator.

evasion discovery

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/cpuinfo	net.xinhuamm.d1023

Queries information about running processes on the device 1 TTPs 3 IoCs

Application may abuse the framework's APIs to collect information about running processes on the device.

discovery

Process Discovery

T1424

description	ioc	Process
Framework service call	android.app.IActivityManager.getRunningAppProcesses	net.xinhuamm.d1023
Framework service call	android.app.IActivityManager.getRunningAppProcesses	net.xinhuamm.d1023:pushservice
Framework service call	android.app.IActivityManager.getRunningAppProcesses	net.xinhuamm.d1023:remote

Queries the phone number (MSISDN for GSM devices) 1 TTPs
discovery

System Network Configuration Discovery
T1422

Acquires the wake lock 1 IoCs

description	ioc	Process
Framework service call	android.os.IPowerManager.acquireWakeLock	net.xinhuamm.d1023:pushservice

Checks if the internet connection is available 1 TTPs 3 IoCs

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.IConnectivityManager.getActiveNetworkInfo	net.xinhuamm.d1023:remote
Framework service call	android.net.IConnectivityManager.getActiveNetworkInfo	net.xinhuamm.d1023
Framework service call	android.net.IConnectivityManager.getActiveNetworkInfo	net.xinhuamm.d1023:pushservice

Domain associated with commercial stalkerware software, includes indicators from echap.eu.org 1 IoCs

flow	ioc
20	alog.umeng.com

Reads information about phone network operator. 1 TTPs
discovery

System Network Configuration Discovery
T1422

Listens for changes in the sensor environment (might be used to detect emulation) 1 TTPs 1 IoCs

evasion

User Evasion

T1628.002

description	ioc	Process
Framework API call	android.hardware.SensorManager.registerListener	net.xinhuamm.d1023:remote

Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 3 IoCs

impact

Data Encrypted for Impact

T1471

description	ioc	Process
Framework API call	javax.crypto.Cipher.doFinal	net.xinhuamm.d1023
Framework API call	javax.crypto.Cipher.doFinal	net.xinhuamm.d1023:pushservice
Framework API call	javax.crypto.Cipher.doFinal	net.xinhuamm.d1023:remote

net.xinhuamm.d1023
1⤵
- Requests cell location
- Checks CPU information
- Queries information about running processes on the device
- Checks if the internet connection is available
- Uses Crypto APIs (Might try to encrypt user data)
PID:4212

net.xinhuamm.d1023:pushservice
1⤵
- Queries information about running processes on the device
- Acquires the wake lock
- Checks if the internet connection is available
- Uses Crypto APIs (Might try to encrypt user data)
PID:4354

net.xinhuamm.d1023:remote
1⤵
- Requests cell location
- Queries information about running processes on the device
- Checks if the internet connection is available
- Listens for changes in the sensor environment (might be used to detect emulation)
- Uses Crypto APIs (Might try to encrypt user data)
PID:4418

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Execution Guardrails

T1627

Geofencing

T1627.001

Hide Artifacts

T1628

User Evasion

T1628.002

Virtualization/Sandbox Evasion

T1633

System Checks

T1633.001

Credential Access

Discovery

Location Tracking

T1430

Process Discovery

T1424

Software Discovery

T1418

Security Software Discovery

T1418.001

System Information Discovery

T1426

System Network Configuration Discovery

T1422

System Network Connections Discovery

T1421

Lateral Movement

Collection

Location Tracking

T1430

Command and Control

Exfiltration

Impact

Data Encrypted for Impact

T1471

Replay Monitor

Loading Replay Monitor...

Downloads

gbd.db

Path /data/user/0/net.xinhuamm.d1023/databases/gbd.db
Size 20KB
SHA256 de60aabc3a4a6c1b567e2ef6f153cf0733d216ebc9134f5092ce48bea848d1b8
MD5 a0e5aa506eea2533a76aeac30be48004
SHA1 f1c1b11debf237311219f32bf0363e1374a4314d
SHA512 941c9ea219ae6b539cebe6eb46cffa4a6741c1ce9fa9db91660c6107042afb98503b21215eed0652fd3ab6cb23f228f47a82321523084529381bc15c632b8650
SSDEEP 12:TLyK0byNTSFbyGXzsZKMNaRmBEyPbAVOwhA9bX4:TLyWjZnzGSEO2
MD5 SHA1 SHA512 SSDEEP

Submit Download

pushext.db

Path /data/user/0/net.xinhuamm.d1023/databases/pushext.db
Size 24KB
SHA256 619c67ba560426fe99f9baf84b1d66a3f42cb3016a648e26f6eb137bba2e39ae
MD5 92ab50760ff6e190b7445decb829db90
SHA1 f084b5b4432713e0fa0bc746314890b1e9a17a6f
SHA512 4fb7c3504b8b7fdd26f2c8e7374aff191e005ff00ec08292a0e41014927267e1b6b695fce14c6b377e4841a8e8e405c8440fbd3275161e24ed3f34f5fe691e1a
SSDEEP 12:TLZGCAbEVazXKwo17RDmTSFbyJHOOhKM2ZEm5DRmBEyPbD3OwGQ:TLc/AiXy10nu4nmVuGSzGQ
MD5 SHA1 SHA512 SSDEEP

Submit Download

pushsdk.db-journal

Path /data/user/0/net.xinhuamm.d1023/databases/pushsdk.db-journal
Size 8KB
SHA256 f77538ec88871a65e04656ac83cc5a4915c83fe23a1f75c2d863ae8de8c8537b
MD5 fc049ec42e2dbdc827adf7f8d37ff604
SHA1 fc901c48851cd69fc633d2ae2948c5b1e351ac7c
SHA512 1e711ac84668d9b1fa1ac7e372f0d7d48248ad20f6c207504ef6e9fd8048fc0283c25d1d7d59c1746d1e37a226d1770df02d5a0665c6a9b18c3342fa10832975
SSDEEP 24:G6PqR6x50rAULDqF9vO2euTnqZCAmoZnqLiuWmGSPp:G6CR+0rAU49vO2rnqYANqZWpSPp
MD5 SHA1 SHA512 SSDEEP

Submit Download

pushsdk.db-journal

Path /data/user/0/net.xinhuamm.d1023/databases/pushsdk.db-journal
Size 8KB
SHA256 da173418a7572031748855687cafd3d6157c380b033046da4f161a3943affc18
MD5 fd9d5432cd663c6e518aa26b859f40ab
SHA1 da96049e2307340d695682479d67d12dade3fd4f
SHA512 a22f8ebcba43bdf0e843bc5b32b692e73b53bf371fddc013ff0a9b8d5d10a6b0b80ad30808c7b5496b3fd3ab744a72096bfb065a738acbce2a711cc6142b5724
SSDEEP 6:GEdRBjv+RzEFcK+/lvg9bNFlLdKEAlOERX4PBX4ogLugMBX4suuKcW/Q9:BRBqflvqLJdKBRmBEyPbwo
MD5 SHA1 SHA512 SSDEEP

Submit Download

pushsdk.db-journal

Path /data/user/0/net.xinhuamm.d1023/databases/pushsdk.db-journal
Size 8KB
SHA256 79d794bea9398336b1c86a96b7e82757e0fc83af2de6ec6b913cfa9d61217464
MD5 cb69798934ad258a95bde117a0da44eb
SHA1 96c684414f0af61faacb11d785568331ceea0dac
SHA512 2c7c810d7750503e4e08ab857956f98dd4e077156e4045c5e775000d662bf521e0a99949c1eee500a1a8bc8540616b52731e15c860d2245b47f9c5be26eb8734
SSDEEP 6:7+/l9Cl/ing9bNFlq4ysrLbvH8i8PQtLu8iqPqqLGf2OJRHXF/XWERX4PBX4ogLX:7+twl/inqLZrLATN8iqPs3RmBEyPbuJP
MD5 SHA1 SHA512 SSDEEP

Submit Download

pushsdk.db-journal

Path /data/user/0/net.xinhuamm.d1023/databases/pushsdk.db-journal
Size 12KB
SHA256 18ca7c88d2857e90539c200f4c63200027615b17f56124ea998f68f030aadfa2
MD5 6618f47168f7261a6a650b5f4fb3dfb2
SHA1 d6275164089380959cd6f88485cd5f75f0cecdf0
SHA512 995f23b7118295c610866c540f4b49c4bc27277b3875a1186d194d437e3360800f6e569d68fbb6e2a5fbfd4191b5ed73baa54e9260b69776bc880992170af330
SSDEEP 24:7+tWUMBqLOvw0uUduRwCJAWfLq8w7qTQ3o0h7igzD1Z8z1T1VGSK:7MHMBqx0xopA/t37KRiSK
MD5 SHA1 SHA512 SSDEEP

Submit Download

libcuid.so

Path /data/user/0/net.xinhuamm.d1023/files/libcuid.so
Size 44KB
SHA256 0adea2b90475285b1d92df166e57225f1399db7e6eaac1e8e21e527bf684c00a
MD5 238571ae98294aaf719340cb698cbbca
SHA1 75c7376d704561c4d76b49b18d857ed16149c1b5
SHA512 bfa8c3208dc3f51dcf7640a866aadc3d38bd33d9b5d385f24bc4f285169b9f0282952588c101ab206d76dc987b6d3012e197c7f9aa683e843a07822af2a00886
SSDEEP 48:T3R0xopA/t37KRiSi7cLexpaJU9CTZVpKxbW:TR0+pYtQni76CqLpKx
MD5 SHA1 SHA512 SSDEEP

Submit Download

firll.dat

Path /data/user/0/net.xinhuamm.d1023/files/lldt/firll.dat
Size 76B
SHA256 9a2d8d39545dc8bd053e318563a3e333272454e3fcd04b66e2be8c5b79f72fc5
MD5 b5c5f0e6346b32f3594b90d83c47948f
SHA1 0001df435f846b25f4c374063f83f69c1ea6d5ea
SHA512 efa6a6ec98ae25d3ab35abb14fd138d634fd469fc0a1143afb4311d942bb85e4fd6996a573b8a0b1309f19442d9f440cf62db1a4ae973ef7523f82c5df52ecfb
MD5 SHA1 SHA512

Submit Download

ofl.config

Path /data/user/0/net.xinhuamm.d1023/files/ofld/ofl.config
Size 235B
SHA256 a108f6e055d36e02d3896fbe08c4c4ef774693b9a5274def942ec26b21277d5b
MD5 bfbc1d8a8607037448e33c5d9c3b0fd6
SHA1 4febcb6e5574bfc8f7242ea52bed948f69d8708a
SHA512 d101de9b023acf70c4660d6edde8cfa1dab8079491f55b86b0981eb4e83e34904369a135dc38c1e67e7b0d853c3cad9ffca4c48cc4233df5d0df1211dada7f19
MD5 SHA1 SHA512

Submit Download

ofl_location.db

Path /data/user/0/net.xinhuamm.d1023/files/ofld/ofl_location.db
Size 28KB
SHA256 989f3b301f7aaf797c747ebcdf074278ae0e4aa6da9a9582d14b687ec801f081
MD5 d8f34a39842a11f31dc9f81a97a14c29
SHA1 a2fe165afdc20354dca9b483fcd7789334cb5aef
SHA512 844c5378ce9333688f408e13dea43452e57e4de857b3f79c9bfa7c64ca005bb295214f1a72d569c6bbfeacd2fbbdabc87ae8050eb2eba5ae13d3e1165b92fbfb
SSDEEP 12:7+tqEyxLVbUD6U5SH+0UNymNRmBEyPbG1RmBEyPbejOwI:7+tqEcL1c6U100d2GSHGS6I
MD5 SHA1 SHA512 SSDEEP

Submit Download

ofl_location.db-journal

Path /data/user/0/net.xinhuamm.d1023/files/ofld/ofl_location.db-journal
Size 8KB
SHA256 b764fa30829655b9f1730124c58236811ae4e629a823c9146cf03ad94232eff2
MD5 560580e8ff432dc66e2d87f3f3233ae9
SHA1 155fa0b5f49133ea04e8f7197852b145e4e60733
SHA512 058866927ac3fe10b51e0222a59639b93a0b62b73a542f6a4011dbd4e82e2475280484b385a2569452e05c70505172354658d00210826c879629d3cc90843547
SSDEEP 6:7+/l9+Pg9bNFlLdKEAlOERX4PBX4ogLugMBX4suuKsa//:7+twqLJdKBRmBEyPb8/
MD5 SHA1 SHA512 SSDEEP

Submit Download

ofl_location.db-journal

Path /data/user/0/net.xinhuamm.d1023/files/ofld/ofl_location.db-journal
Size 12KB
SHA256 a2faef395c0dd7b4c95c0a765acd31f8aafb728a284a0312e165a65a12166ad6
MD5 2a6b602e7be604441b4d8000f1dea3b3
SHA1 ef73a3115fb87c491133598848e88382c31d8b4f
SHA512 cd9dfc0d90f32e237df8ff6d4a387188696357c97744e735c4728f963b90f5e6c3bd1215a4f56d420b040fb309e8cf8234e4f4a8e6faf154da174b6cf2c2ba1b
SSDEEP 12:7+tlgqLmDbyNTSFbyGXzsZKMNaRmBEyPbB+:7+tiqLLjZnzGSB+
MD5 SHA1 SHA512 SSDEEP

Submit Download

ofl_location.db-journal

Path /data/user/0/net.xinhuamm.d1023/files/ofld/ofl_location.db-journal
Size 8KB
SHA256 c442b4e7f7ecffceac02fd5fe45a80169a1594cc0dd2016ab5c40e01839a0dc5
MD5 3ac0736e482bea7ca457b05225f349ef
SHA1 80fe5a2271eea3dbd30fb476d0e72db3517a0111
SHA512 07101c88504b42bf301ec7e524ee52ee13259fe1870198a0f51fb68deb7830c53b2dfa5e6247c4b9cb18f23c63a28277755dfa6c5dff2ee1d5ed527bcc9e2ea1
SSDEEP 6:7+/l9Wng9bNFlq4ysrTtE/8H3gLu+0zYwIymWERX4PBX4ogLugMBX4suuK4Uxp:7+tQnqLZrTtEK+0UNymNRmBEyPbRap
MD5 SHA1 SHA512 SSDEEP

Submit Download

ofl_location.db-journal

Path /data/user/0/net.xinhuamm.d1023/files/ofld/ofl_location.db-journal
Size 512B
SHA256 37c291c9422c4a7ccfaeebdfd7341f5161bde00bfeec7fc97f65035fa779595c
MD5 22dcece74a7cbd68402ea4c37572146c
SHA1 15d50c9323b4df930258366b2b262133b33ad66d
SHA512 732f33f79b3c43b612d5cb8f38392f19830ccde44324b92f7c639f89051e88a5ddac59df79c9312295110bfa38ff37d141cc9227def2124a511ec20983cff0a9
MD5 SHA1 SHA512

Submit Download

ofl_statistics.db

Path /data/user/0/net.xinhuamm.d1023/files/ofld/ofl_statistics.db
Size 80KB
SHA256 7bdb82ebcebc7a03fcc45b839fbb9ae6dc942cdb25b8d63337b518f212832df1
MD5 fac10168f5a071fb50d2c698bff38399
SHA1 cfa2a6539978958a27f09eb4ddb49c7d4054c32a
SHA512 a14af3e3d7d1a1f5b6bff0325f953d10a7791bbc02cf4d057e623b8042e28c3909072cd512d00efc682d3db76470a42fc22f7e1606130a5ce0550087ae172865
SSDEEP 12:7+tudRqLiuWd7RmBEyPbWhOwIeeeeQQQe:7+t8qLiuWmGSW9IeeeeQQQe
MD5 SHA1 SHA512 SSDEEP

Submit Download

ofl_statistics.db-journal

Path /data/user/0/net.xinhuamm.d1023/files/ofld/ofl_statistics.db-journal
Size 512B
SHA256 d70822603fa8e42daec7cf1001faffdaeb7a114b01a20e8ccdce3b143e8dcfb3
MD5 feb0b98864f4e927585d565e16cb4c9c
SHA1 ea2ff6779d17326cf43297dbae05dfcb98efabe0
SHA512 be28adab217b725428473c1aab6dfb9bb5c28b2fed1274316c98d5be806efff15f2d2bc1c72c1237ce964f28cd9fe2f9acede66e9e02a5e936d56f7a29769042
MD5 SHA1 SHA512

Submit Download

ofl_statistics.db-journal

Path /data/user/0/net.xinhuamm.d1023/files/ofld/ofl_statistics.db-journal
Size 8KB
SHA256 f540ac5a7d769e8c2169b4f52f3c4e4961fadf8e62b79799f55329d5aa10703b
MD5 e8bbc40c19239c0d531306d3fc0c130c
SHA1 7d5f5ac200c731300519682fbb61b32250025cb7
SHA512 5cb0ad04a01e9a1562aee6b9b084955c6af2b0da1c795699f701c2c880c0d9ef9007ec7d295bc7015bb113aa426c710a909d5f30506a4b2a0a969a5ea64749bd
SSDEEP 6:7+/l9fPg9bNFlLdKEAlOERX4PBX4ogLugMBX4suuKzU/k:7+tRqLJdKBRmBEyPbq0k
MD5 SHA1 SHA512 SSDEEP

Submit Download

ofl_statistics.db-journal

Path /data/user/0/net.xinhuamm.d1023/files/ofld/ofl_statistics.db-journal
Size 8KB
SHA256 7982772c21aee9495b5e6380829bd58d68af00d56e12fa1b14eb134e8f895ef8
MD5 bd9955628ec602df8600128c4ac465d7
SHA1 d029b1adbe133c37d9e18714a4e1dfa3768b9816
SHA512 510a361460f7d47ab7dbb8ba6d75a8d16c6f539c1e6477e1495733534dc11118462c759eb3eb4b4d54e5b96ad5d83040568a831693d6e5c52417071b39211527
SSDEEP 6:7+/l91amHPg9bNFlLdKEAlOERX4PBX4ogLugMBX4suuKuOts//sn:7+thqLJdKBRmBEyPbfPs
MD5 SHA1 SHA512 SSDEEP

Submit Download

ofl_statistics.db-journal

Path /data/user/0/net.xinhuamm.d1023/files/ofld/ofl_statistics.db-journal
Size 8KB
SHA256 5044cb8a22666031f1d4628028715653efa3e44658295af869ca71d40591623f
MD5 71c596b5c8be699f90734a76ecc9e47e
SHA1 a54c68080571ba6097eb155799df452e348f5a67
SHA512 f7afa4cdc777629f1d98966413909e3a6dffb7e08d42218b2b7567974fab2669604742e161c44f761e8b10e11a2184369c4167ce5d7a6004fe743cb7eafe78fe
SSDEEP 6:7+/l9NOEng9bNFlq4ysrjl05tA2nI3gLu+ROyDntwIymWERX4PBX4ogLugMBX4s8:7+tTnqLZrao+3BNymNRmBEyPbP0A6r
MD5 SHA1 SHA512 SSDEEP

Submit Download

ofl_statistics.db-journal

Path /data/user/0/net.xinhuamm.d1023/files/ofld/ofl_statistics.db-journal
Size 8KB
SHA256 c8c5a66e65f25ddd0b64d4373f2609f11e742d7c2c507f7f5e3f86e545a23ae7
MD5 14afaf00f2cd84a866e4ed3fc3bc9d7b
SHA1 79c0fb89ce2d54bcd52aa84fd8d8bcd6a62d54d3
SHA512 b450e8ad6ea3c300d5ebf83c10a592d4998d0c374f76ce9affb083b6fb1de5326ecd3836c994801b20fe151fa9c23e8ec51c7c9b36a409b031e7ee8d30df1552
SSDEEP 12:7+t8uqLEyPtlqVSPD6U1o+3BNymNRmBEyPb7S:7+t8uqLE0Sq6UnTd2GS2
MD5 SHA1 SHA512 SSDEEP

Submit Download

ofl_statistics.db-journal

Path /data/user/0/net.xinhuamm.d1023/files/ofld/ofl_statistics.db-journal
Size 8KB
SHA256 6a73a5c23c2aa0b60e6603f391cb101c7a6a82e57f9e443a92c8d6bc811813e5
MD5 35fcb2d60fe86321453c5c2f60ba079d
SHA1 cb7ce77311c6deea1aa941b456694eddd1bcc264
SHA512 46a62713b1ae78f282e2fbc57c86756dce483077e4feb989e3b8da5074f46fd29631c9931461909e5056c1bd9cfff0d6386bdde8c73aa9a85e748bce2922bafa
SSDEEP 48:7MJqAStibdWuvWDrBuJDIiuSSyM150ZGIot2+3psPZYq6ySy:7E1cdVmnhS/Iocup+ZYRy
MD5 SHA1 SHA512 SSDEEP

Submit Download

umeng_it.cache

Path /data/user/0/net.xinhuamm.d1023/files/umeng_it.cache
Size 28KB
SHA256 0eb2691193d5b1af9ae73ce1110ea204d7895f5a39d8d5155f6de13dd3d1d283
MD5 f8df032b186b8daec21b955238836997
SHA1 6670b787d78d0391ca067ee9d89c1fc99ab248b8
SHA512 97472fd05b640d30f6e8d2a722e57a1d670e77391506c54b8e55ddb6109a21acee6a74af8c5098467317fd9292460e54ddfcdcf46e44684ebe7798f7890bbfe8
SSDEEP 6:l9bNFl4/msW1Bs9v5puKx/zrAvH8i8PQtLu8iqPqqLGf2OJRHXF/XWERX4PBX4oJ:TLWeBs9CNUTN8iqPs3RmBEyPbGtOwI
MD5 SHA1 SHA512 SSDEEP

Submit Download

conlts.dat

Path /storage/emulated/0/Android/data/net.xinhuamm.d1023/files/baidu/tempdata/conlts.dat
Size 12B
SHA256 f52db31332534833414abd5e870f78c810b8ebbe5b134bbf599506beecfd1b93
MD5 8d80bc8ea90e9cac010d3ddf97bda5f5
SHA1 f063bc0d356e6ba9ab1eb9a851131ffbefd8fa07
SHA512 9ea732dd572a9a4ba91b70891972230a09576687ca1bc19e62d5a98b5b84e0f2ae11985108008bc9fbccf357219b8bd3dbf146bb70752f618f70dc5d0c46a7c7
MD5 SHA1 SHA512

Submit Download

conlts.dat

Path /storage/emulated/0/Android/data/net.xinhuamm.d1023/files/baidu/tempdata/conlts.dat
Size 155B
SHA256 4cffefc3b60623946baf0d19c4868d7b775e61a83ad994b9dbab271a2dc30eba
MD5 bba22ff7aaef07a75a020d55554f31b4
SHA1 40456ccbfceea402689058dd0bce7ef5061bbbf7
SHA512 fca68d01f7e28156bcaab367d62fa7d4836e8c8b53ac3a169c85657dd4d34a8e0815b35624d9a424694e805536a418659ed9f124bdc1b401313efddb846551f6
MD5 SHA1 SHA512

Submit Download

llg.dat

Path /storage/emulated/0/Android/data/net.xinhuamm.d1023/files/baidu/tempdata/llg.dat
Size 24B
SHA256 f054ef19481234ee5b2db1d1c681839dab235a857ed3a4bc02efa8f785f478d4
MD5 161557b06b4a4d3ce095528dea370eb7
SHA1 8bfe9c4d916fe58d856b5a6ecaf8cd9ea4df2c9f
SHA512 96ce8aedbdbb387438efc86aaabd13a6378628bfae203d2bc25ea1cd7daa6ddbd6dd2c81d631fbdc9b653a93011d3c80f0c085580275b683d5e0bce077e6e449
MD5 SHA1 SHA512

Submit Download

llg.dat

Path /storage/emulated/0/Android/data/net.xinhuamm.d1023/files/baidu/tempdata/llg.dat
Size 490B
SHA256 5d4434947568170f808c164f5abe7e559e5ce555e7b613caf9456b034e4b0b0d
MD5 5d1b3163459067ce595fd0cb2dcd482f
SHA1 fa29c1ccf676ec88b8350e84c91281540db8c947
SHA512 3caab02388da22f5f064eab4add49546eee8a0e7252b18bbd50865b08681fb6ecfd7fa92af95df41ee368976fbb47e231fd5a20fd43a55c8bff98b505b3b4246
MD5 SHA1 SHA512

Submit Download

.cuid2

Path /storage/emulated/0/backups/.SystemConfig/.cuid2
Size 512B
SHA256 ec73a65dd7c7c5cdaf3773052ea63235fdbfc7b4b1bca826c1a50a4bf9a0dcce
MD5 5bd66d82bb8841895d05320a297020ce
SHA1 424b40a04cfef0eb6834e6a2c919bf588c4494b0
SHA512 bd0521a82f26733fa7f0c2188395163e1e0cb2f21c54dafca154c45915160ca28039bb4ded10bc26d44f8d01893db8da6e52019a0b1d6cf5d0a766adab7f0f48
MD5 SHA1 SHA512

Submit Download

lcvif.dat

Path /storage/emulated/0/baidu/tempdata/lcvif.dat
Size 96B
SHA256 80b85534c4665ae8a5cbce236c29e6df4ca0cf99c79a2d520422ede97a13ccc8
MD5 1056b56828472ac97b766d56c027a6bd
SHA1 0c923f060851390180dec3c0594cfc4281a1f842
SHA512 49d52f4d587e7f89d7e2a26936b3d739273d23bb2ef52c108f9d25eba358a11b5bb9c5db8b5c0a99c9f3ad9712523855327dabb59c86394995a29f49f04a8bea
MD5 SHA1 SHA512

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads