Malware Analysis Report

2025-01-19 05:05

Sample ID 240605-schzbaac3s
Target 98745ddc24c93395c7165689b50a4746_JaffaCakes118
SHA256 67da077db096688229e084e18148019c4095ab6bb7f8eaec1914a501dbd89491
Tags
banker collection discovery evasion impact persistence
score
7/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Mobile Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral3

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral4

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
7/10

SHA256

67da077db096688229e084e18148019c4095ab6bb7f8eaec1914a501dbd89491

Threat Level: Shows suspicious behavior

The file 98745ddc24c93395c7165689b50a4746_JaffaCakes118 was found to be: Shows suspicious behavior.

Malicious Activity Summary

banker collection discovery evasion impact persistence

Queries information about running processes on the device

Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps)

Requests cell location

Reads the content of the SMS messages.

Reads the content of SMS inbox messages.

Loads dropped Dex/Jar

Queries the mobile country code (MCC)

Queries information about active data network

Requests dangerous framework permissions

Queries information about the current Wi-Fi connection

Registers a broadcast receiver at runtime (usually for listening for system events)

Uses Crypto APIs (Might try to encrypt user data)

Checks CPU information

Checks memory information

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-06-05 15:00

Signatures

Requests dangerous framework permissions

Description Indicator Process Target
Allows an app to access approximate location. android.permission.ACCESS_COARSE_LOCATION N/A N/A
Allows an app to access precise location. android.permission.ACCESS_FINE_LOCATION N/A N/A
Allows access to the list of accounts in the Accounts Service. android.permission.GET_ACCOUNTS N/A N/A
Allows read only access to phone state, including the current cellular network information, the status of any ongoing calls, and a list of any PhoneAccounts registered on the device. android.permission.READ_PHONE_STATE N/A N/A
Allows an application to read SMS messages. android.permission.READ_SMS N/A N/A
Allows an application to receive SMS messages. android.permission.RECEIVE_SMS N/A N/A
Allows an application to read from external storage. android.permission.READ_EXTERNAL_STORAGE N/A N/A
Allows an application to send SMS messages. android.permission.SEND_SMS N/A N/A
Allows an application to read or write the system settings. android.permission.WRITE_SETTINGS N/A N/A
Allows an application to write to external storage. android.permission.WRITE_EXTERNAL_STORAGE N/A N/A
Allows an application to write to external storage. android.permission.WRITE_EXTERNAL_STORAGE N/A N/A
Allows an application to read from external storage. android.permission.READ_EXTERNAL_STORAGE N/A N/A
Allows an application to write to external storage. android.permission.WRITE_EXTERNAL_STORAGE N/A N/A
Allows an application to send SMS messages. android.permission.SEND_SMS N/A N/A
Allows an application to read SMS messages. android.permission.READ_SMS N/A N/A
Allows an application to receive SMS messages. android.permission.RECEIVE_SMS N/A N/A
Allows read only access to phone state, including the current cellular network information, the status of any ongoing calls, and a list of any PhoneAccounts registered on the device. android.permission.READ_PHONE_STATE N/A N/A
Allows an application to write to external storage. android.permission.WRITE_EXTERNAL_STORAGE N/A N/A
Allows an application to write to external storage. android.permission.WRITE_EXTERNAL_STORAGE N/A N/A
Allows an application to read SMS messages. android.permission.READ_SMS N/A N/A
Allows an application to send SMS messages. android.permission.SEND_SMS N/A N/A
Allows an application to receive SMS messages. android.permission.RECEIVE_SMS N/A N/A
Allows an app to create windows using the type LayoutParams.TYPE_APPLICATION_OVERLAY, shown on top of all other apps. android.permission.SYSTEM_ALERT_WINDOW N/A N/A
Allows read only access to phone state, including the current cellular network information, the status of any ongoing calls, and a list of any PhoneAccounts registered on the device. android.permission.READ_PHONE_STATE N/A N/A
Allows an application to write to external storage. android.permission.WRITE_EXTERNAL_STORAGE N/A N/A
Allows an application to send SMS messages. android.permission.SEND_SMS N/A N/A
Allows an application to read SMS messages. android.permission.READ_SMS N/A N/A
Allows read only access to phone state, including the current cellular network information, the status of any ongoing calls, and a list of any PhoneAccounts registered on the device. android.permission.READ_PHONE_STATE N/A N/A
Allows an application to monitor incoming MMS messages. android.permission.RECEIVE_MMS N/A N/A
Allows an application to receive SMS messages. android.permission.RECEIVE_SMS N/A N/A
Allows an application to write to external storage. android.permission.WRITE_EXTERNAL_STORAGE N/A N/A
Allows an application to write to external storage. android.permission.WRITE_EXTERNAL_STORAGE N/A N/A
Allows an application to read SMS messages. android.permission.READ_SMS N/A N/A
Allows an application to send SMS messages. android.permission.SEND_SMS N/A N/A
Allows an application to receive SMS messages. android.permission.RECEIVE_SMS N/A N/A
Allows read only access to phone state, including the current cellular network information, the status of any ongoing calls, and a list of any PhoneAccounts registered on the device. android.permission.READ_PHONE_STATE N/A N/A
Allows an app to access approximate location. android.permission.ACCESS_COARSE_LOCATION N/A N/A
Allows an application to read or write the system settings. android.permission.WRITE_SETTINGS N/A N/A
Allows an app to access approximate location. android.permission.ACCESS_COARSE_LOCATION N/A N/A
Required to be able to access the camera device. android.permission.CAMERA N/A N/A
Allows read only access to phone state, including the current cellular network information, the status of any ongoing calls, and a list of any PhoneAccounts registered on the device. android.permission.READ_PHONE_STATE N/A N/A
Allows an application to write to external storage. android.permission.WRITE_EXTERNAL_STORAGE N/A N/A
Allows an application to read from external storage. android.permission.READ_EXTERNAL_STORAGE N/A N/A
Allows an application to request installing packages. android.permission.REQUEST_INSTALL_PACKAGES N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-06-05 14:58

Reported

2024-06-05 15:03

Platform

android-x86-arm-20240603-en

Max time kernel

26s

Max time network

183s

Command Line

com.rmm.bysbhb

Signatures

Loads dropped Dex/Jar

evasion
Description Indicator Process Target
N/A /data/user/0/com.rmm.bysbhb/files/dai/wqOFeituq.jar N/A N/A
N/A /data/user/0/com.rmm.bysbhb/files/dai/wqOFeituq.jar N/A N/A
N/A /data/user/0/com.rmm.bysbhb/files/Plugin2.apk N/A N/A
N/A /data/user/0/com.rmm.bysbhb/app_dex/utopay.jar N/A N/A
N/A /data/user/0/com.rmm.bysbhb/app_dex/utopay.jar N/A N/A

Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps)

banker discovery

Queries information about running processes on the device

discovery
Description Indicator Process Target
Framework service call android.app.IActivityManager.getRunningAppProcesses N/A N/A

Reads the content of SMS inbox messages.

collection
Description Indicator Process Target
URI accessed for read content://sms/inbox N/A N/A

Reads the content of the SMS messages.

collection
Description Indicator Process Target
URI accessed for read content://sms/ N/A N/A

Requests cell location

collection discovery evasion
Description Indicator Process Target
Framework service call com.android.internal.telephony.ITelephony.getCellLocation N/A N/A

Queries information about active data network

discovery
Description Indicator Process Target
Framework service call android.net.IConnectivityManager.getActiveNetworkInfo N/A N/A

Queries information about the current Wi-Fi connection

discovery
Description Indicator Process Target
Framework service call android.net.wifi.IWifiManager.getConnectionInfo N/A N/A

Queries the mobile country code (MCC)

discovery
Description Indicator Process Target
Framework service call com.android.internal.telephony.ITelephony.getNetworkCountryIsoForPhone N/A N/A

Requests dangerous framework permissions

Description Indicator Process Target
Allows read only access to phone state, including the current cellular network information, the status of any ongoing calls, and a list of any PhoneAccounts registered on the device. android.permission.READ_PHONE_STATE N/A N/A
Allows an application to write to external storage. android.permission.WRITE_EXTERNAL_STORAGE N/A N/A
Allows an application to read from external storage. android.permission.READ_EXTERNAL_STORAGE N/A N/A
Allows an application to read SMS messages. android.permission.READ_SMS N/A N/A
Allows an application to receive SMS messages. android.permission.RECEIVE_SMS N/A N/A
Allows an application to send SMS messages. android.permission.SEND_SMS N/A N/A
Allows an app to access approximate location. android.permission.ACCESS_COARSE_LOCATION N/A N/A
Allows an app to create windows using the type LayoutParams.TYPE_APPLICATION_OVERLAY, shown on top of all other apps. android.permission.SYSTEM_ALERT_WINDOW N/A N/A
Allows an application to initiate a phone call without going through the Dialer user interface for the user to confirm the call. android.permission.CALL_PHONE N/A N/A
Required to be able to access the camera device. android.permission.CAMERA N/A N/A
Allows read only access to phone state, including the current cellular network information, the status of any ongoing calls, and a list of any PhoneAccounts registered on the device. android.permission.READ_PHONE_STATE N/A N/A
Allows an application to write to external storage. android.permission.WRITE_EXTERNAL_STORAGE N/A N/A
Allows an application to read from external storage. android.permission.READ_EXTERNAL_STORAGE N/A N/A
Allows an application to read SMS messages. android.permission.READ_SMS N/A N/A
Allows an application to send SMS messages. android.permission.SEND_SMS N/A N/A
Allows an application to receive SMS messages. android.permission.RECEIVE_SMS N/A N/A
Allows an app to access approximate location. android.permission.ACCESS_COARSE_LOCATION N/A N/A

Registers a broadcast receiver at runtime (usually for listening for system events)

persistence
Description Indicator Process Target
Framework service call android.app.IActivityManager.registerReceiver N/A N/A

Uses Crypto APIs (Might try to encrypt user data)

impact
Description Indicator Process Target
Framework API call javax.crypto.Cipher.doFinal N/A N/A

Checks CPU information

Description Indicator Process Target
File opened for read /proc/cpuinfo N/A N/A

Checks memory information

Description Indicator Process Target
File opened for read /proc/meminfo N/A N/A

Processes

com.rmm.bysbhb

/system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.rmm.bysbhb/files/dai/wqOFeituq.jar --output-vdex-fd=44 --oat-fd=45 --oat-location=/data/user/0/com.rmm.bysbhb/files/dai/oat/x86/wqOFeituq.odex --compiler-filter=quicken --class-loader-context=&

/system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.rmm.bysbhb/app_dex/utopay.jar --output-vdex-fd=117 --oat-fd=120 --oat-location=/data/user/0/com.rmm.bysbhb/app_dex/oat/x86/utopay.odex --compiler-filter=quicken --class-loader-context=&

getprop ro.product.cpu.abi

getprop ro.product.cpu.abi2

Network

Country Destination Domain Proto
N/A 224.0.0.251:5353 udp
US 1.1.1.1:53 app.jtmtht.com udp
US 104.155.138.21:89 app.jtmtht.com tcp
US 104.155.138.21:89 app.jtmtht.com tcp
GB 142.250.187.206:443 tcp
US 1.1.1.1:53 android.apis.google.com udp
GB 142.250.187.206:443 android.apis.google.com tcp
US 104.155.138.21:89 app.jtmtht.com tcp
US 104.155.138.21:89 app.jtmtht.com tcp
US 104.155.138.21:89 app.jtmtht.com tcp
US 104.155.138.21:89 app.jtmtht.com tcp
CN 120.55.89.238:8977 tcp
US 1.1.1.1:53 passport.migu.cn udp
CN 112.25.126.116:80 passport.migu.cn tcp
US 1.1.1.1:53 sdk.qipagame.cn udp
US 1.1.1.1:53 jx.hamofo.com udp
US 1.1.1.1:53 xiafa.hamofo.com udp
US 1.1.1.1:53 zyin.bjmcmj.cn udp
US 1.1.1.1:53 pay.91mgame.com udp
US 1.1.1.1:53 vpay.api.eerichina.com udp
CN 47.114.40.15:80 pay.91mgame.com tcp
CN 116.62.54.183:9004 tcp
US 104.155.138.21:89 app.jtmtht.com tcp
CN 116.62.54.183:9004 tcp

Files

/data/data/com.rmm.bysbhb/files/dai/wqOFeituq.jar

MD5 a337285c81f61bd46b6c078aebb47018
SHA1 e189f2124b3ee8fb939f450362de3f63422cc468
SHA256 36c87c02c7bd2a01dc4bcf8b8353d028be2fc9174d725ab0ca04481e287d82ca
SHA512 e75eb0ea036bae20506f6d08ae680daa6c4a07e233ade047967a5d15faadc1382964ebae9f35a74682f9a854a70eaecf8bd38584feb1946d9d73c441d120b803

/data/user/0/com.rmm.bysbhb/files/dai/wqOFeituq.jar

MD5 7da43715b5fb47665228a9d6751333d1
SHA1 f76a9b30a8143976d959eaa607065bc486021eee
SHA256 990ba254972f086221348ade4dd91b2b675fcba3b36b2c960ce4a81ac232ebb4
SHA512 620307201feb6cf3704cf4700b2fefd27410b12dbe2081647e10847dc3348dcb49d2c7b8d4e7197f8a755f3174764fb9944411d180a55f5e854df8419c038e0c

/data/user/0/com.rmm.bysbhb/files/dai/wqOFeituq.jar

MD5 4650564a3d35fadaa8fc9fd067879069
SHA1 2fbf3cb57eb081bb2f13a025eafffb41fad2cf62
SHA256 8f372151a38329f94cc03e97cb0f659f952f98310f5f5baf7ef5f34518894948
SHA512 675f0005328bf1530ea862b6dea0ab07c162545905fb35e9ae3ba1704f7a9a01aca2eef861970112496048384d3e7c35953a762a3d124ea9be550771e31eae59

/data/data/com.rmm.bysbhb/databases/740410100062013-journal

MD5 a14d833a7b6028b83db29cc91994ddac
SHA1 d6620626775d389891fa91572ac2e85dbaa3abe0
SHA256 fe879daf28d612e613c32ffa7bbef6d0eacb35a1a03be1eb7d89ee31c23c38a3
SHA512 1c8336b139f502f6554a7f570bdfbc4ac33b1f044fc89980e372e8dda6cf2caa01ba095357799a207358a824db3ff1c17a57bcc27f653d4405c2c7363f62c4bf

/data/data/com.rmm.bysbhb/databases/740410100062013

MD5 f2b4b0190b9f384ca885f0c8c9b14700
SHA1 934ff2646757b5b6e7f20f6a0aa76c7f995d9361
SHA256 0a8ffb6b327963558716e87db8946016d143e39f895fa1b43e95ba7032ce2514
SHA512 ec12685fc0d60526eed4d38820aad95611f3e93ae372be5a57142d8e8a1ba17e6e5dfe381a4e1365dddc0b363c9c40daaffdc1245bd515fddac69bf1abacd7f1

/data/data/com.rmm.bysbhb/databases/740410100062013-shm

MD5 bb7df04e1b0a2570657527a7e108ae23
SHA1 5188431849b4613152fd7bdba6a3ff0a4fd6424b
SHA256 c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479
SHA512 768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012

/data/data/com.rmm.bysbhb/databases/740410100062013-wal

MD5 f1cbdfdd7b959f9f503e62ed2c8d7fef
SHA1 67a19d6d15331090a8672a34a8e076cc3a70777d
SHA256 595ee18245859fee095327c9204d4df9f75d237048f09e3eedfd27ff3a43b4a9
SHA512 00b4936b3ee122b0262e437275ea2997bb0a3ab082e6a656cadd2c4dd5b4ed9de0fc79cd43fbc1fe0b7d74ed4208cb3d955ac7c6a21fc833869f953b60265395

/data/data/com.rmm.bysbhb/files/Plugin2.apk

MD5 3d216f8fddb9705a6720a285475837f1
SHA1 f053d23b284bfe2faf6e76d353ff052471e2de2c
SHA256 de7bf40574754a5144fa5cf3bc5e97f7adc7f5abebb18c41e8f0631917db4c0c
SHA512 38be39da8f96abc87109cfd57b2d63ddfa72971f023024a5b4ce1f97cd905a96a94e19eea19ae9b745f28d02c6689a4473627ce57ec85dce2018a77e699620cb

/data/user/0/com.rmm.bysbhb/files/Plugin2.apk

MD5 2a425e0fae74f20a2c475da937a619a2
SHA1 4d701c7e6d828aa96ba8a493720e7282c49ec741
SHA256 2c61a25f1ad5783bf82eea9faa2536cac4788ed3147bc1864d9ef17ea01be6a7
SHA512 44c8d2a837b606de99055badbd4b5e708424ca9809b1583d13aefadc4d4af974658dc3a3f179fc3047eef7167151c638ff66dd6c8d38121b6ecdfb464d2a5a60

/data/data/com.rmm.bysbhb/databases/wochi_v4.db-journal

MD5 b0ceadf19d15e17ba658d8615c4957c1
SHA1 94a191501651ecb38d53a620b8cbe39ed17e6eea
SHA256 789a02050bb041bec0df3f7c8f365f068201b62ce15b8a9b70c9ca52cc35b69f
SHA512 453754325cd2e96b274a1cdf8090e95be6b8a8a877cea828cbfe601bf87f545c18aaf4d23b6b8133f4ba48d79bcbacfd100d2b46f4164cebbca69429cebc89c2

/data/data/com.rmm.bysbhb/databases/wochi_v4.db-shm

MD5 cf845a781c107ec1346e849c9dd1b7e8
SHA1 b44ccc7f7d519352422e59ee8b0bdbac881768a7
SHA256 18619b678a5c207a971a0aa931604f48162e307c57ecdec450d5f095fe9f32c7
SHA512 4802861ea06dc7fb85229a3c8f04e707a084f1ba516510c6f269821b33c8ee4ebf495258fe5bee4850668a5aac1a45f0edf51580da13b7ee160a29d067c67612

/data/data/com.rmm.bysbhb/databases/wochi_v4.db-wal

MD5 c9596362b554cd44cf4d6e3f29ad0426
SHA1 52f3ee5bb91528b86da4ad9ca8d0913227f93b5f
SHA256 2f34d3da90f22bf91ed1e27051ae9acf650f1c1f3e6af9e76ea8039a8d4e281d
SHA512 5e9a481ea33822fc21dc63ca8b74f9b7859fb55e70aa673171efa4efcd2bb24e27e3db05fe0dc96290cb5e53352495a1a2078604e224e328ab3cb5fdf1ea3963

/data/data/com.rmm.bysbhb/app_dex/utopay.jar

MD5 eb6089c1acfa9f12535e533aebee845e
SHA1 165e39ee07dcd9ed00fc2dc1ff466bc1d6b813c9
SHA256 b825cde84e3dddfc147c71265d2259c422d51a7e56d1dcdba1321e3119b1df07
SHA512 5b1bc26bcbcf05fc331865fb4dd572b673a52650d68ab4d9b028ea15219e0d93c1ec17996953436801913388d78e25c67ea33aa93544d65e96a799eb06cc70f5

/data/data/com.rmm.bysbhb/files/log.dat

MD5 ff9229f8e7c92d44d48e25206d43b021
SHA1 be3d75050c16c5b7484652ba292fdd6510f205d3
SHA256 77fc3599be409f7e73e643de843c0ebcfa20662964c498fc59e245c7f5e003a2
SHA512 be7b3aa8d670a2873c6b7bfd4ca93121fd2450723cbbc36d9d06d152fafa3ce90451f0a60ab56bc96bccb81cf5aae0167b404073db14dc17b9513ac73d455c58

/data/user/0/com.rmm.bysbhb/app_dex/utopay.jar

MD5 5220524411d0bacd600da60814d1ee9f
SHA1 fef7210ff44e757328bc0ff7aae7bb2191cbf634
SHA256 6286a800597b845785eb664710253ebd20771737dddd5b80067e0e9d37c804b2
SHA512 b2d8af5019c176d682634747d83320e609fb6122ef850f4069a0c78c2415d242087099cf60ecb03039a9ab71902a4e3b22e9cf144de89e506991fb93280f6a5f

/data/user/0/com.rmm.bysbhb/app_dex/utopay.jar

MD5 3b8bb9a8679ac8c24e8d179fc5bae999
SHA1 e6ea7a1095524087f481ba04321c4cb6fd2426f3
SHA256 83c996c0d067b5f516897480f427dfffdcfb49ab7654dac9b805376bbd49e1db
SHA512 abf1cbed7a8cf4a29d7a32a83f15aa0a6c9e2be8484c2dd8d9bf16a76e337b17b9c05efa0773598806b3d3da4fe3a9217b583abb9aaf5e3dc054dc77b10cae63

/data/data/com.rmm.bysbhb/files/yl_plugin.apk

MD5 5a4c666b43ee7f2b6995aaf3527e4a4d
SHA1 b205bcb022797f3b16635db139c7524c0c388adc
SHA256 05eb3e1ca331b8c6a1f60f92abb2bddbac54a7b2c229ac07bf26c756297fe72a
SHA512 c84fceddbf9928110fc3b85e0989b9cedd06383007ff99dea5a25096d8f892ab52d30ed9b52b72211449041f1274ead85bb42929ec269b58b6b0e616a8545e17

/data/data/com.rmm.bysbhb/files/shunpay_config

MD5 d112c4550d2a47f7a14aabbd54684038
SHA1 4f00dcd278cbff34d271d9fb585e40d3e61c17d6
SHA256 7bac135c329f2894a84a305cbace4b15e524dfc9f7dd079aa8f462fc93caec18
SHA512 4c280162f5f72ba4e7f2eea683573bd6f304bf2f20c1cf238f15d36849b7bd0cdf2e5afd7c912378086f4b7a25f83347c435d3bec4bbd18f61c15288cff4055b

/data/data/com.rmm.bysbhb/files/log.dat

MD5 b8e3e563645ec8358d3aa43d9f253096
SHA1 90f2b998476308b9946ead7447b362b1ba1b89ec
SHA256 10ce4df89f64d1d01be84bd6a434c8f26f68653a630c4d349ed978547fb4c96c
SHA512 68086450a1b2d85dc5138d13286ba1940652b912dff73fd417616a4463684849862c4f04d5182b241a08aa0e65fe7be977c325ec317f1a16d5dd38da3ccf9ca9

/data/data/com.rmm.bysbhb/files/umeng_it.cache

MD5 358ee211ccb236b31a7f7b5d0a723897
SHA1 d3ddf653908b162f9f0a8e46c62ebe8ca3d5164e
SHA256 2688440565febae85a1476ea7a14f794bfbc0b36b9c6664a2faf3e2789579168
SHA512 2c4707230d8c4ad2a612b794c9a2facaec33089c94d2ff2952702858bfa9b3bd3c4d349f957ca6fe6dd445f3a95eb5ccdfce4b59f708255a8f4d125f8abd6905

/data/data/com.rmm.bysbhb/files/log.dat

MD5 39d2a8b768614ba881f3e34144565edb
SHA1 c2f04e2840fe4751cc32f0026899ab2c903b3f8e
SHA256 4b4d85d924728a38f0e2415b4cfa2202fb6b74de014e3ec595971ec47687eef1
SHA512 534506b20217725c4f6302f5b3b703e5c078b1541664a56fadcac446c7654e71b7a1b83e1fefb4dcc90038cca613897144c412583ccf02a6a2f392621daaf7da

/storage/emulated/0/.twservice/3001/qshp_3001_2340.zip

MD5 f761a5b44c74603c8f62200046e11703
SHA1 bd0852f5c77d552cbaf6d089f057123c14680068
SHA256 410a77372ead847ce5820bddcf8a670b91a88181544e1466907bed7e86255715
SHA512 29ce3b7037c84d8bfd5aaca9282f7ee812df6bccf6e8e112e088cc8340ce6bc5fd5e78213a7464bc760c1972ed811e87182a99eb13eaeff524ed670ee91e3110

/data/data/com.rmm.bysbhb/files/mobclick_agent_cached_com.rmm.bysbhb1

MD5 86f47b01e1e57ce072375905ab6d2fb3
SHA1 346d14086824335c6ae1ed0482621b598a44f525
SHA256 8577c1f84b4569d7356e4537cf5401cda91dad7cd37004904decc4546a048f59
SHA512 d1a5b53b62ed7d342363738bada0b6fe9eafeafb6a86aa03ba08263bdaaa1f123c1adde5f7dfbd1d857c41b686f2a6a932d3144e94031d684036a6c0a4c7af4d

Analysis: behavioral2

Detonation Overview

Submitted

2024-06-05 14:58

Reported

2024-06-05 15:00

Platform

android-x86-arm-20240603-en

Max time network

5s

Command Line

N/A

Signatures

N/A

Processes

N/A

Network

Country Destination Domain Proto
N/A 224.0.0.251:5353 udp

Files

N/A

Analysis: behavioral3

Detonation Overview

Submitted

2024-06-05 14:58

Reported

2024-06-05 15:00

Platform

android-x64-20240603-en

Max time network

6s

Command Line

N/A

Signatures

N/A

Processes

N/A

Network

Country Destination Domain Proto
N/A 224.0.0.251:5353 udp

Files

N/A

Analysis: behavioral4

Detonation Overview

Submitted

2024-06-05 14:58

Reported

2024-06-05 15:00

Platform

android-x64-arm64-20240603-en

Max time network

6s

Command Line

N/A

Signatures

N/A

Processes

N/A

Network

Country Destination Domain Proto
N/A 224.0.0.251:5353 udp

Files

N/A