4887a0a98ac7a3b8a546a6cba2b5803c5f5089ec60d71345cc4b245c83b52789

Analysis

max time kernel
176s
max time network
190s
platform
android_x64
resource
android-33-x64-arm64-20240603-en
resource tags

androidarch:arm64arch:x64image:android-33-x64-arm64-20240603-enlocale:en-usos:android-13-x64system
submitted
04/06/2024, 23:40

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
96a6f72414d075c7f49f938b0ce16596_JaffaCakes118.apk
Size 14.3MB
Sample240604-3pc9psfd5s
SHA256 4887a0a98ac7a3b8a546a6cba2b5803c5f5089ec60d71345cc4b245c83b52789
MD5 96a6f72414d075c7f49f938b0ce16596
SHA1 c606a9d1e18ca8fdb5938aab553514baf7d601ca
SHA512 5a872998ce0c1e8316c241a0362380f7c42d4e1003e00c56af398b36f04dbcb7f771abde52ecd6023f91350391f0e3785eb6ecd53e431029f9a3479309e23cdb
SSDEEP 393216:6QZ7BXGf8pyUPRewRmSyBaytO5y6zcrxV:6Q7S8NmSyBH8pzaV
MD5 SHA1 SHA512 SSDEEP

Score

8^/10

collection discovery evasion execution impact persistence

Malware Config

Signatures

Checks if the Android device is rooted. 1 TTPs 3 IoCs

evasion

System Information Discovery

T1426

ioc	Process
/system/bin/su	com.shuixin.bubulaishang:remote
/system/bin/su	com.shuixin.bubulaishang:watch
/system/bin/su	com.shuixin.bubulaishang:pushservice

Queries information about running processes on the device 1 TTPs 5 IoCs

Application may abuse the framework's APIs to collect information about running processes on the device.

discovery

Process Discovery

T1424

description	ioc	Process
Framework service call	android.app.IActivityManager.getRunningAppProcesses	com.shuixin.bubulaishang
Framework service call	android.app.IActivityManager.getRunningAppProcesses	com.shuixin.bubulaishang:process1
Framework service call	android.app.IActivityManager.getRunningAppProcesses	com.shuixin.bubulaishang:remote
Framework service call	android.app.IActivityManager.getRunningAppProcesses	com.shuixin.bubulaishang:watch
Framework service call	android.app.IActivityManager.getRunningAppProcesses	com.shuixin.bubulaishang:pushservice

Queries information about active data network 1 TTPs 5 IoCs

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.IConnectivityManager.getActiveNetworkInfo	com.shuixin.bubulaishang:pushservice
Framework service call	android.net.IConnectivityManager.getActiveNetworkInfo	com.shuixin.bubulaishang
Framework service call	android.net.IConnectivityManager.getActiveNetworkInfo	com.shuixin.bubulaishang:remote
Framework service call	android.net.IConnectivityManager.getActiveNetworkInfo	com.shuixin.bubulaishang:process1
Framework service call	android.net.IConnectivityManager.getActiveNetworkInfo	com.shuixin.bubulaishang:watch

Requests cell location 1 TTPs 1 IoCs

Uses Android APIs to to get current cell information.

collection discovery

Location Tracking

T1430

description	ioc	Process
Framework service call	com.android.internal.telephony.ITelephony.getAllCellInfo	com.shuixin.bubulaishang:remote

Listens for changes in the sensor environment (might be used to detect emulation) 1 TTPs 1 IoCs

evasion

User Evasion

T1628.002

description	ioc	Process
Framework API call	android.hardware.SensorManager.registerListener	com.shuixin.bubulaishang:remote

Schedules tasks to execute at a specified time 1 TTPs 1 IoCs

Application may abuse the framework's APIs to perform task scheduling for initial or recurring execution of malicious code.

execution persistence

Scheduled Task/Job

T1603

description	ioc	Process
Framework service call	android.app.job.IJobScheduler.schedule	com.shuixin.bubulaishang:watch

Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 3 IoCs

impact

Data Encrypted for Impact

T1471

description	ioc	Process
Framework API call	javax.crypto.Cipher.doFinal	com.shuixin.bubulaishang:pushservice
Framework API call	javax.crypto.Cipher.doFinal	com.shuixin.bubulaishang:remote
Framework API call	javax.crypto.Cipher.doFinal	com.shuixin.bubulaishang:watch

com.shuixin.bubulaishang
1⤵
- Queries information about running processes on the device
- Queries information about active data network
PID:4221

com.shuixin.bubulaishang:remote
1⤵
- Checks if the Android device is rooted.
- Queries information about running processes on the device
- Queries information about active data network
- Requests cell location
- Listens for changes in the sensor environment (might be used to detect emulation)
- Uses Crypto APIs (Might try to encrypt user data)
PID:4876

com.shuixin.bubulaishang:process1
1⤵
- Queries information about running processes on the device
- Queries information about active data network
PID:4790

com.shuixin.bubulaishang:watch
1⤵
- Checks if the Android device is rooted.
- Queries information about running processes on the device
- Queries information about active data network
- Schedules tasks to execute at a specified time
- Uses Crypto APIs (Might try to encrypt user data)
PID:4889

com.shuixin.bubulaishang:pushservice
1⤵
- Checks if the Android device is rooted.
- Queries information about running processes on the device
- Queries information about active data network
- Uses Crypto APIs (Might try to encrypt user data)
PID:5272

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Scheduled Task/Job

T1603

Persistence

Scheduled Task/Job

T1603

Privilege Escalation

Defense Evasion

Hide Artifacts

T1628

User Evasion

T1628.002

Credential Access

Discovery

Location Tracking

T1430

Process Discovery

T1424

System Information Discovery

T1426

System Network Connections Discovery

T1421

Lateral Movement

Collection

Location Tracking

T1430

Command and Control

Exfiltration

Impact

Data Encrypted for Impact

T1471

Replay Monitor

Loading Replay Monitor...

Downloads

npth_log.db

Path /data/user/0/com.shuixin.bubulaishang/databases/npth_log.db
Size 20KB
SHA256 e9da8820d91c5f0c1d623a7f86536c3f25af811a9ec623218c89143211941e9f
MD5 3b540b8d7c20ec66a4cd628527180cde
SHA1 917e4c3668d395d58a42b9a5263fac44387026b3
SHA512 b28f3f224b7331b1a6af5ca4019c62766cb610d56cf851e2d79877dd8baf700252dcbf6f3d5fca08bf879fdb4cb7bf4470e095e076a27a81885321bb2e4e33a9
SSDEEP 12:TLmAqsyNTSFbys3KVD9CU4LCRmBEyPbAVOwG:TL101CblGSEG
MD5 SHA1 SHA512 SSDEEP

Submit Download

npth_log.db-journal

Path /data/user/0/com.shuixin.bubulaishang/databases/npth_log.db-journal
Size 512B
SHA256 09d7a9d0dfdb5e64808cc957373efee450acb3bdfab815e98d1617b5eb048519
MD5 2d38675f362354d1be74916c1d3e8d88
SHA1 c648c597aa3d1dda8b5353f1cd78429ec3b8748c
SHA512 7317fa97482b77123f8f4bdded7de617d68068616e6f13a28de78dcb8f0b8fabe78a5865a6bf2e7676a3491b32bcf7fcf1dc686db0a667a77fd47f3fd8f9d40d
MD5 SHA1 SHA512

Submit Download

npth_log.db-journal

Path /data/user/0/com.shuixin.bubulaishang/databases/npth_log.db-journal
Size 8KB
SHA256 9128dbae2dcf601ab6894b686f32826fdd0161a7917f95daf164f844bb5e08c8
MD5 c229978cee1b9aa4f39e2be539c40ced
SHA1 8d8f7e57ab4284e5bef0afa85be2ea18b907a8ad
SHA512 2b50f6a5452d2c50a28e3f68124496d72154c88bbb11ca1987958a55dee4d4a71739b14aa1e247b126a106bd3f92b6e134e822ec95fb78187fec2c013d2b4494
SSDEEP 6:0hDn1k3g9bNFlEuWdOAlOERX4PBX4ogLugMBX4suuKD:Oy3qLiuWd7RmBEyPbc
MD5 SHA1 SHA512 SSDEEP

Submit Download

npth_log.db-journal

Path /data/user/0/com.shuixin.bubulaishang/databases/npth_log.db-journal
Size 48KB
SHA256 dfa59670bd3f39c3740854c314fcc8443026afc149be1f2222abd0e70e6f2b85
MD5 536c28946ba0b8a0760a0210317c1aa4
SHA1 37a61f1eb078edd3f983c3a9e3e2925a54bed5f7
SHA512 929660f846711d1992f5a0d81ae17ad2fcba566ceb570027bbe534b4b8620c5c7bca9f6c3b7635132f9b7a8f4d930e0788456411b7a3a5fe7ccbb86af02c20b1
SSDEEP 24:TL7aps9QW0uUduRwCJAWfLq8w7qTQ3o0h7igzD1ZHtU/TVGSFliRpZOllIT0bcgT:TXq/W0xopA/t379y/MSTiRpZUC0btPa
MD5 SHA1 SHA512 SSDEEP

Submit Download

pushsdk.db-journal

Path /data/user/0/com.shuixin.bubulaishang/databases/pushsdk.db-journal
Size 8KB
SHA256 95d999e199764c1a400509d0a3406cfbf02091444306c8763cc506fc8dc00f6d
MD5 26fd380d5a8cd5fd924317431d94bb33
SHA1 7e0b994b48c4229017ad67a86c7661f5604248e4
SHA512 21bceeeb87945ebb27b37401aa567d192322e85004698de6da2dbfe713be262d20c970f14efa36d6ad44341dee595f301a64cfa6c854d64f60a0a2f60c5c3ac3
SSDEEP 24:7+tR58RpZOllITMZE9oTUUZZ+mFqLCT9s9QW0uUduRwCJAWfLq8w7qTQ3o0h7igh:7MRSRpZUCToHqE9/W0xopA/t379y/MSy
MD5 SHA1 SHA512 SSDEEP

Submit Download

firll.dat

Path /data/user/0/com.shuixin.bubulaishang/files/lldt/firll.dat
Size 76B
SHA256 291ea143988651f74dc98b1454231508968de6509f216f91514edb7be3da9fad
MD5 011b3a0c86b2c9fde706b2fc0967aa62
SHA1 a4ecd5ffdea4bcd030dfb9c185043bad011f517d
SHA512 eeaa1054bcba3c5a77954976380776a4e82df995742d372923b8c5189b07b4c9a01d2d9e8cd2154ec63d3048fc3b07358336c73185e71d75ae69fab289cd5f18
MD5 SHA1 SHA512

Submit Download

gal.db

Path /data/user/0/com.shuixin.bubulaishang/files/lldt/gal.db
Size 20KB
SHA256 2e8db32be5175dcb850a342cdea253b8ad2c28ddce14f71f3a1c70bb83026ae1
MD5 90fcdc024811a9b19b5870287db721ee
SHA1 3514f8836b3fa2b8881634ed6f5156b8f3d79c23
SHA512 8792e7d2ac80d0624007f7fa0e44934334f43374185757b42030c54d10004a2594b2cd84d0d0ef17387a44f9010b66e26cdbd79600dfb25b8b9efa81a6e6f0db
SSDEEP 6:l9bNFl8l/yl1OtlIcpW8q+3gLua9EIqN9MyDlOERX4PBX4ogLugMBX4suuKfpqif:TLyK4lZW1ia9EIqNTDHRmBEyPbAVOw
MD5 SHA1 SHA512 SSDEEP

Submit Download

gal.db-journal

Path /data/user/0/com.shuixin.bubulaishang/files/lldt/gal.db-journal
Size 512B
SHA256 948a7136c3cac1160a383441c010cad00c61c54c3a7fb89ff6949d73660eb6c0
MD5 1898dbb12e3cd74cd8ba443a6577a2d6
SHA1 b45fba521f1bb25648fe3e8f663ce86b6d84489b
SHA512 d98028e6d0b4a107e778dd996e8b900131461b770b35032016f50b01d57cbdaefad8099d623c3314fd3230c5bf3fb72e1991f439ade1050af221bc9873389296
MD5 SHA1 SHA512

Submit Download

gal.db-journal

Path /data/user/0/com.shuixin.bubulaishang/files/lldt/gal.db-journal
Size 8KB
SHA256 bb280b9228c607c53706d7e23547b4362ef694efefdeb2afac1b043737b32e33
MD5 60c57b3cd4bee89d0875dca412907293
SHA1 226df5e9f132e7b00ed73f7889eabbdeb2897d99
SHA512 1402d4e1a328fdfed4e3359298ef2f7d602a815c4c54cfedb0ff9a12429c216a2abde0061b67c40ba9046431bb9c66d5ea8bbcf535c5fc8a8293fdd105d2f217
SSDEEP 6:7+/l9SSFn1ang9bNFlEuWdOAlOERX4PBX4ogLugMBX4suuKz:7+t1iqLiuWd7RmBEyPbM
MD5 SHA1 SHA512 SSDEEP

Submit Download

gal.db-journal

Path /data/user/0/com.shuixin.bubulaishang/files/lldt/gal.db-journal
Size 8KB
SHA256 4336cfe20d1e08c34e0bc5d553f709a598376544dab6d62938522abc57a33b4c
MD5 f6bb511969be5c43f553d04547eb9ad0
SHA1 de5073c2efad46a6a44eb1662f5367d75b058495
SHA512 85780c31c52de87a6d88f91edac1e124697f5915bc039d0616adcfca4dbea69e98aab50fe296765b5de9348ed982c462ed43533be710270b6a25ab383fd1a752
SSDEEP 6:4FzP9a4tIXKFhg9bNFlLdKEAlOERX4PBX4ogLugMBX4suuKkD20//+:4FzoqeGqLJdKBRmBEyPbF+
MD5 SHA1 SHA512 SSDEEP

Submit Download

gal.db-journal

Path /data/user/0/com.shuixin.bubulaishang/files/lldt/gal.db-journal
Size 4KB
SHA256 518f592c11bd190ea5b0362db07d72b9c75388c5ecafdab1f5093756de0bff1e
MD5 2b6642ce531732e478461a694c27c2fc
SHA1 522de368a525c4b2040a8e71557cf2ee6c438dfc
SHA512 9577f0021abf0972f49aaa2e349d6aec66e91e6785aa3cfe942da51f4395351ed80bdfe0c46525ed8e928957744ea7d58fe11276c042d7b790acce7bb07ad033
SSDEEP 12:7+t3nqLZr9lZW1ia9EIqNTDHRmBEyPbDY:7+t3qLbKNmIwDsGSs
MD5 SHA1 SHA512 SSDEEP

Submit Download

ofl_location.db

Path /data/user/0/com.shuixin.bubulaishang/files/ofld/ofl_location.db
Size 28KB
SHA256 16969d55c6f0e55c63c8e9a0c98011387ea74d1deb141cae8d781ef910a74eef
MD5 4a5738275ba2210055579a5cb2b8f245
SHA1 8684e24b58caa38f49e0e3dc58722d542517020f
SHA512 768e58b37fb90f36df11e66494ad15f059bb7e0bbf7e76e17471babd8bf97d07b6c7974628a944e2f564bfb9dbb188a6192a3c03f32547eb48ea67edf2b95488
SSDEEP 12:TLEyxLVbUD6U5SH+0UNymNRmBEyPbGtOwI:TLEcL1c6U100d2GSiI
MD5 SHA1 SHA512 SSDEEP

Submit Download

ofl_location.db-journal

Path /data/user/0/com.shuixin.bubulaishang/files/ofld/ofl_location.db-journal
Size 512B
SHA256 04ae233f1842cf6a091e765fe3c28ca3c2ca41cf21cb29245c94d14e288493b3
MD5 e74b5519a6e2b26ff0c97083b37e62df
SHA1 70d206007d217fea10823cd6b3a687589c415b56
SHA512 c27b0f07a2b0260492e57f9b160c7d17453181c3422c249ccbf817e2091462ddc64608fd479393a4ecf9712aa391130904f41d3ccb692d7d80a211a856b7f995
MD5 SHA1 SHA512

Submit Download

ofl_location.db-journal

Path /data/user/0/com.shuixin.bubulaishang/files/ofld/ofl_location.db-journal
Size 8KB
SHA256 699f9d43b1ff651bbb5c7c42e69e26a3f5e6c532873311f904de40ba2dc4dacb
MD5 9ed03f79f442feda487aaee842507ccd
SHA1 a96817acc0ac965b6f1d115d83dd141693e872f1
SHA512 f191ed3bd81eb24c0266b8d1cb90b20a11fbe0b00ed674345344a2c1b7847178559bbc47ee7eaa547db87de7d09d96f0c7e6566db758d0529b97ad44b8f90bfd
SSDEEP 6:7+/l9rFn1mfg9bNFlEuWdOAlOERX4PBX4ogLugMBX4suuKcs:7+tsqLiuWd7RmBEyPbw
MD5 SHA1 SHA512 SSDEEP

Submit Download

ofl_location.db-journal

Path /data/user/0/com.shuixin.bubulaishang/files/ofld/ofl_location.db-journal
Size 8KB
SHA256 af25518859ba3574d9ad53af9171ca4d9dce6cce965cce580a33bab56c39c4f0
MD5 8388c58fe4e009f4815f7610b55de356
SHA1 172c308a35dbb2b56763997903257ce58740c96c
SHA512 66657a4a39ee4ba367aac424b4680a2db9c9697fdfe1390d3388f6540e2c6ac79ec135e95895e8402c053e1d1d1c1b99a2c90eeab7c7d702aacbf6202635f9c6
SSDEEP 6:7+/l9qF4Pg9bNFlLdKEAlOERX4PBX4ogLugMBX4suuKlM/yH:7+tsCqLJdKBRmBEyPbh+
MD5 SHA1 SHA512 SSDEEP

Submit Download

ofl_location.db-journal

Path /data/user/0/com.shuixin.bubulaishang/files/ofld/ofl_location.db-journal
Size 8KB
SHA256 22c73c9c30cc2a6768a23bb3014ed70373e15ba6c64d64bae480aa67ce4912e4
MD5 6498ad7121ca226ee7a94071640f9227
SHA1 05d54e68963e9a5c47abfb71a893e2f4a4a81d1f
SHA512 3f6b5fe64e18c540ebcba005baf1d88c79d309b63f5bd4b27d9393c0fb03ec80362d3b9116a4fb12a14e018bbf9c06a5c7b8a2376f86fd31d2f505bfa8cb201e
SSDEEP 6:7+/l9el/ing9bNFlq4ysrTtE/8H3gLu+0zYwIymWERX4PBX4ogLugMBX4suuKCxe:7+tsEnqLZrTtEK+0UNymNRmBEyPbbe
MD5 SHA1 SHA512 SSDEEP

Submit Download

ofl_statistics.db

Path /data/user/0/com.shuixin.bubulaishang/files/ofld/ofl_statistics.db
Size 80KB
SHA256 b761bcedaf9a60a17270a5e5b5ac7fb2d333d66a7023a105e9c07c50eae55be1
MD5 cf2cea7e9b08ffeccdad60248f536765
SHA1 61f97840aaf57a7d1c9ce994a5176ccfcdd7188c
SHA512 c24815df7cd1dba14a84805b4684e43d6d20fbbaadcdaf8e85ac533941ff1331ff78e697c240f401e4e0386495b6f311200c28d112064efeb9785b72edc79009
SSDEEP 48:TIt5FkbdWuvWDrBuJDIiuSSyM150ZGIot2+3psPZYq6yS:4+cdVmnhS/Iocup+ZYR
MD5 SHA1 SHA512 SSDEEP

Submit Download

ofl_statistics.db-journal

Path /data/user/0/com.shuixin.bubulaishang/files/ofld/ofl_statistics.db-journal
Size 512B
SHA256 1bb45b2118e4e8ec0358650159c51d30f8b2813d0abb4dbb7744d418031a884f
MD5 bcd177e2a7c9ac2610de1598cdd64983
SHA1 99aaa29c5e38c150cb4bd4954f032c43a05b91ad
SHA512 a59c83d612815f165b6339cdabacd5324eeffc4633ac27e67c4b61e68b9d720f875bc8b67af91790b08caa06ffaf640152c4b91f43935c2dcdb45341654859f2
MD5 SHA1 SHA512

Submit Download

ofl_statistics.db-journal

Path /data/user/0/com.shuixin.bubulaishang/files/ofld/ofl_statistics.db-journal
Size 8KB
SHA256 ba0fb2ed6d50f2b69bae7ffa94729d9976263852b4343b7e70e370a65badce8d
MD5 a76dbd5cb49c4c4feaa21594087d31bd
SHA1 c0272ec1e0160ed0271452022b7c31e31dcc477f
SHA512 1ebc8111bf0c342325fce690d82547819b2ede1d2f0bbfba9cb42ee40838a8359b349e51eb40500dd1f5c967f095b49076774f6bedf53162eb3e0cb8ce9b4776
SSDEEP 6:7+/l90lFn1+Wg9bNFlEuWdOAlOERX4PBX4ogLugMBX4suuK4r:7+tul9qLiuWd7RmBEyPbl
MD5 SHA1 SHA512 SSDEEP

Submit Download

ofl_statistics.db-journal

Path /data/user/0/com.shuixin.bubulaishang/files/ofld/ofl_statistics.db-journal
Size 8KB
SHA256 6b2ca3323d53f43fb64cee2b30efe5445b1c80fc3e4cd49f604a2f02b672405d
MD5 ff5466e9d80d87189e8d36871371b173
SHA1 f214fe54e817d469275254a9deb4f31da18ea753
SHA512 53a894bcb91f0c55902b47712b9ba3a1a7d6b422bdea402d18848d35e3b9d7aa05e0742431bfe686ac6ec75db67683fe8700c12fc393ec8e62530c0c22cc1f7f
SSDEEP 6:7+/l9aHPg9bNFlLdKEAlOERX4PBX4ogLugMBX4suuKwK//0q:7+t+qLJdKBRmBEyPbG0q
MD5 SHA1 SHA512 SSDEEP

Submit Download

ofl_statistics.db-journal

Path /data/user/0/com.shuixin.bubulaishang/files/ofld/ofl_statistics.db-journal
Size 8KB
SHA256 edf44ee8dc5dffcc733f4da4858ee74c5d06d34b12d0ecc5da62db2783ce1339
MD5 a3cf1e284bd0f6c75028a08e969847e7
SHA1 9a066f54b2ef77dd5b8b710a26ef6c1cd5931264
SHA512 9619d3a727f13d4a5c96b144898d63aff2e8d88a61a149e1d34006e549a8e6d99659e925bf48c74203c386b0e4174d06988279a0dddfc65455c9ccf8ce616b38
SSDEEP 6:7+/l9nl49ng9bNFlq4ysrjl05tA2nI3gLu+ROyDntwIymWERX4PBX4ogLugMBX4t:7+tpW9nqLZrao+3BNymNRmBEyPbKJn
MD5 SHA1 SHA512 SSDEEP

Submit Download

ofl_statistics.db-journal

Path /data/user/0/com.shuixin.bubulaishang/files/ofld/ofl_statistics.db-journal
Size 8KB
SHA256 95d09cf74fa870b78523b68485755f01844b1fe0fe306b4ee807d35e86ffdc91
MD5 a67cb7f6aa771888fec4c65551f01640
SHA1 6b3ecd64e64f10042f66c202f32b7619fd9a40da
SHA512 78004cab369b2366df908fc925d2086ff50d31b0f4ab336b21fdd0e3a79375e86be9f1b85a6e482083b5acdfb3439e3ad5ad7e952d4c5cdc89732da24710784e
SSDEEP 12:7+twfqLEyPtlqVSPD6U1o+3BNymNRmBEyPbAF:7+t6qLE0Sq6UnTd2GS2
MD5 SHA1 SHA512 SSDEEP

Submit Download

ofl_statistics.db-journal

Path /data/user/0/com.shuixin.bubulaishang/files/ofld/ofl_statistics.db-journal
Size 8KB
SHA256 147bc771ad50e3b7bf683bd35959a51eb51bcfa22d89fd1546841107a8f2e78f
MD5 288345ce3fe8d0cdd9dc06899b33dabb
SHA1 7111a4900b8b0b193f858851689e6fa3f190513c
SHA512 d0005b66ac49c86eb06cd5835c820f089f7cc12bd9e8f14bad723b459b0f1cf9e4adbf0eefcbb1bbc317906d8ba23bf6126c4557720158479531e96798ceffd9
SSDEEP 48:7MxqAStibdWuvWDrBuJDIiuSSyM150ZGIot2+3psPZYq6ySA:7s1cdVmnhS/Iocup+ZYRA
MD5 SHA1 SHA512 SSDEEP

Submit Download

yoh.dat

Path /storage/emulated/0/Android/data/com.shuixin.bubulaishang/files/baidu/tempdata/yoh.dat
Size 24B
SHA256 f0f5049c51879dd7da0ce4a43349b5b34ce053d072a0ca704f62cf22ba4a8412
MD5 a936690571e9104e1922dda4a0ba5bd1
SHA1 65f49c57edde2f96be2a1dbdfc3f7351f1e66554
SHA512 3be1c3693963aebdfc04e86b1c820ee0ec3cf0b200e6a4788ef1141f39fd6c2f77f4227247ae4affa66c0a6c027df8466cc0dcec1e67ebfb953e36bee97de394
MD5 SHA1 SHA512

Submit Download

yoh.dat

Path /storage/emulated/0/Android/data/com.shuixin.bubulaishang/files/baidu/tempdata/yoh.dat
Size 24B
SHA256 9d908ecfb6b256def8b49a7c504e6c889c4b0e41fe6ce3e01863dd7b61a20aa0
MD5 1681ffc6e046c7af98c9e6c232a3fe0a
SHA1 d3399b7262fb56cb9ed053d68db9291c410839c4
SHA512 11bb994b5d2eab48b18667c7d8943e82c9011cb1d974304b8f2b6247a7e6b7f55ca2f7c62893644c3728d17dafd74ae3ba46271cf6287bb9e751c779a26fefc5
MD5 SHA1 SHA512

Submit Download

lcvif.dat

Path /storage/emulated/0/baidu/tempdata/lcvif.dat
Size 96B
SHA256 fe8beb78b7727af95d0a42365b22cf3595250006c20dbfb67fe943f4c6a9e397
MD5 fc8fa3201f56653b45dedd93358b06ad
SHA1 9931c00afba27968279917539b5da10ea5ad1c2c
SHA512 e412af7dc2ff0fac0c144784124f64f343c3cbf4a1a9e19f0fe999cf1ee98b5fe91f35961b1ea584aa38433100b5792855d95c0829b8d2eeec4903e53caa98d0
MD5 SHA1 SHA512

Submit Download

lcvif.dat

Path /storage/emulated/0/baidu/tempdata/lcvif.dat
Size 96B
SHA256 db5d330448313225ebb8d72bc5f09e68fd7aeb67bd40de7a7bc36db1ea0e58c6
MD5 2fdb59952f58d0889873ff67e3c637fe
SHA1 dd4dbedeaa590a926daa9d1258ae733beb4a61cf
SHA512 e68db3050634cec4b1e5aa99d25432c41320d049fe804646f2b3dc28032881bbd73e03b8a9ea783d7bd71ab2a8de1687fb53dbba2e539c62bf4256c8ad0e16f9
MD5 SHA1 SHA512

Submit Download

ls.db

Path /storage/emulated/0/baidu/tempdata/ls.db
Size 28KB
SHA256 a83fc55d3857fe4c4613d9641480b65ce4ce093f616ee57af50e4ad665a39a25
MD5 a9e016d93d95db28c93bc2db7406106f
SHA1 44057da4530211a737bc21449eeb70ed236ae022
SHA512 7a1879588955129cf4c784dd2adf6c01f258aa7b55f54ae098db93c33f6a07b29225bee93ab4c0e08f1222e70b14a04c64aed0c25b40f33c466352f448c7c000
SSDEEP 6:7+/l/JICv5puKx/zrAvH8i8PQtLu8iqPqqLGf2OJRHXF/XWERX4PBX4ogLugMBXr:7+t/JICCNUTN8iqPs3RmBEyPbGtOwI
MD5 SHA1 SHA512 SSDEEP

Submit Download

ls.db-journal

Path /storage/emulated/0/baidu/tempdata/ls.db-journal
Size 8KB
SHA256 485ef0c18fad785270037f5aa22f3abba575fece50bc81aa9a26058d53d046dc
MD5 ac2952254d9121ff13ffd03edbe87455
SHA1 920dd3d50ff5e905f307b05f90ac79dc635d8a4f
SHA512 55ea88354eba4692fa8aa47262046dc46f6835d66037fd3fdea6e51d34d920c7a7575717d168c62797688b4adf89365000df737f4a5c5322941411206a4e6acb
SSDEEP 6:7+/l9ImlFn1IF/kWg9bNFlEuWdOAlOERX4PBX4ogLugMBX4suuKiW:7+tAFsWqLiuWd7RmBEyPbTW
MD5 SHA1 SHA512 SSDEEP

Submit Download

ls.db-journal

Path /storage/emulated/0/baidu/tempdata/ls.db-journal
Size 8KB
SHA256 98b3905c7920ba78529591cbea21bf9ad094aa9f5d628df65f0265cfcb6b9db0
MD5 61ab74a1a829ca5cde311df5d3044532
SHA1 f8afa731d8dac71b321248f76a42ce6908b8258b
SHA512 2d5e1fc116d2a0a5996c1dbe4dd4af641c0f98474248f97dce9ff8a4c4801732e8ba5860845388f426194e4ec2012aed5309e4c72a61bec21446768adf999b73
SSDEEP 6:7+/l9OGPg9bNFlLdKEAlOERX4PBX4ogLugMBX4suuKq//RA:7+tjqLJdKBRmBEyPbNRA
MD5 SHA1 SHA512 SSDEEP

Submit Download

ls.db-journal

Path /storage/emulated/0/baidu/tempdata/ls.db-journal
Size 8KB
SHA256 ba03f11b4c5921035a46f11244c9a125f72b63807cf2798bb7391ade860d9be2
MD5 8f099086ad5dd5522ae0902c2f6a58e3
SHA1 ce962a4c6ecd60396a0e6801df58317df0b4def8
SHA512 229719082b87a33a1270dba2e83fecd7bcf9231e6acf962f2630e4aed4956cb8aadd680c2f80fe8c40b584109640cbc80b2bd43e0295126af8f2e89c7ea696d8
SSDEEP 24:7+tT3qLq7s9QW0uUduRwCJAWfLq8w7qTQ3o0h7igzD1ZHtU/TVGS7Z:7MT3qG7/W0xopA/t379y/MS7Z
MD5 SHA1 SHA512 SSDEEP

Submit Download

ls.db-journal

Path /storage/emulated/0/baidu/tempdata/ls.db-journal
Size 8KB
SHA256 343c01780a6c4ffafddd3f597a7c163ac42281ecdbb9866e8f8163acdc186ef0
MD5 7aaecddf98121efa1659101ee92b5393
SHA1 75e5053d767625a047179dfc2ac658f6c8521486
SHA512 64d59a9f0e8b3a9b46e357de4bd1fc5785e414de2452ebfbc19141ca6302e16f9fb1620443fb98a385f158a776603a5f62ae111aaf881374761ace8f16180ece
SSDEEP 24:7+tnvqL9As9QW0uUduRwCJAWfLq8w7qTQ3o0h7igzD1ZHtU/TVGSXy:7MnvqRA/W0xopA/t379y/MSC
MD5 SHA1 SHA512 SSDEEP

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads