Malware Analysis Report

2024-07-28 11:25

Sample ID 240613-3b2edaydrn
Target a71538e5240f666240fb94340fc94a39_JaffaCakes118
SHA256 9363dc423cac7f2dbd89e3b899065954ef3786e594f9e22841f92a61de576756
Tags
banker collection discovery evasion impact persistence
score
8/10

Table of Contents

Analysis Overview

MITRE ATT&CK Matrix

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
8/10

SHA256

9363dc423cac7f2dbd89e3b899065954ef3786e594f9e22841f92a61de576756

Threat Level: Likely malicious

The file a71538e5240f666240fb94340fc94a39_JaffaCakes118 was found to be: Likely malicious.

Malicious Activity Summary

banker collection discovery evasion impact persistence

Checks if the Android device is rooted.

Queries information about the current nearby Wi-Fi networks

Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps)

Requests cell location

Queries information about running processes on the device

Requests cell location

Loads dropped Dex/Jar

Queries information about the current Wi-Fi connection

Queries the unique device ID (IMEI, MEID, IMSI)

Queries information about active data network

Reads information about phone network operator.

Declares services with permission to bind to the system

Requests dangerous framework permissions

Domain associated with commercial stalkerware software, includes indicators from echap.eu.org

Queries the mobile country code (MCC)

Listens for changes in the sensor environment (might be used to detect emulation)

Registers a broadcast receiver at runtime (usually for listening for system events)

Uses Crypto APIs (Might try to encrypt user data)

Checks memory information

Checks CPU information

MITRE ATT&CK Matrix

N/A

Analysis: static1

Detonation Overview

Reported

2024-06-13 23:21

Signatures

Declares services with permission to bind to the system

Description Indicator Process Target
Required by accessibility services to bind with the system. Allows apps to access accessibility features. android.permission.BIND_ACCESSIBILITY_SERVICE N/A N/A
Required by VPN services to bind with the system. Allows apps to provision VPN services. android.permission.BIND_VPN_SERVICE N/A N/A

Requests dangerous framework permissions

Description Indicator Process Target
Allows an app to create windows using the type LayoutParams.TYPE_APPLICATION_OVERLAY, shown on top of all other apps. android.permission.SYSTEM_ALERT_WINDOW N/A N/A
Allows an application to record audio. android.permission.RECORD_AUDIO N/A N/A
Allows an application to write to external storage. android.permission.WRITE_EXTERNAL_STORAGE N/A N/A
Allows an application to read or write the system settings. android.permission.WRITE_SETTINGS N/A N/A
Allows an app to access approximate location. android.permission.ACCESS_COARSE_LOCATION N/A N/A
Allows an app to access precise location. android.permission.ACCESS_FINE_LOCATION N/A N/A
Required to be able to access the camera device. android.permission.CAMERA N/A N/A
Allows access to the list of accounts in the Accounts Service. android.permission.GET_ACCOUNTS N/A N/A
Allows read only access to phone state, including the current cellular network information, the status of any ongoing calls, and a list of any PhoneAccounts registered on the device. android.permission.READ_PHONE_STATE N/A N/A
Allows an application to record audio. android.permission.RECORD_AUDIO N/A N/A
Allows an app to create windows using the type LayoutParams.TYPE_APPLICATION_OVERLAY, shown on top of all other apps. android.permission.SYSTEM_ALERT_WINDOW N/A N/A
Allows an application to write to external storage. android.permission.WRITE_EXTERNAL_STORAGE N/A N/A
Allows an application to read or write the system settings. android.permission.WRITE_SETTINGS N/A N/A
Allows an application to request installing packages. android.permission.REQUEST_INSTALL_PACKAGES N/A N/A
Allows an application to collect component usage statistics. android.permission.PACKAGE_USAGE_STATS N/A N/A
Allows an application to read from external storage. android.permission.READ_EXTERNAL_STORAGE N/A N/A
Allows an application to request installing packages. android.permission.REQUEST_INSTALL_PACKAGES N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-06-13 23:21

Reported

2024-06-13 23:24

Platform

android-x86-arm-20240611.1-en

Max time kernel

178s

Max time network

183s

Command Line

com.lion.market

Signatures

Checks if the Android device is rooted.

evasion
Description Indicator Process Target
N/A /data/local/bin/su N/A N/A
N/A /data/local/xbin/su N/A N/A
N/A /sbin/su N/A N/A
N/A /data/local/su N/A N/A

Loads dropped Dex/Jar

evasion
Description Indicator Process Target
N/A /data/data/com.lion.market/.jiagu/classes.dex N/A N/A
N/A /data/data/com.lion.market/.jiagu/classes.dex!classes2.dex N/A N/A
N/A /data/data/com.lion.market/.jiagu/tmp.dex N/A N/A
N/A /data/data/com.lion.market/.jiagu/tmp.dex N/A N/A
N/A /data/data/com.lion.market/.jiagu/tmp.dex N/A N/A

Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps)

banker discovery

Queries information about running processes on the device

discovery
Description Indicator Process Target
Framework service call android.app.IActivityManager.getRunningAppProcesses N/A N/A

Requests cell location

collection discovery
Description Indicator Process Target
Framework service call com.android.internal.telephony.ITelephony.getAllCellInfo N/A N/A
Framework service call com.android.internal.telephony.ITelephony.getCellLocation N/A N/A

Domain associated with commercial stalkerware software, includes indicators from echap.eu.org

Description Indicator Process Target
N/A s.appjiagu.com N/A N/A
N/A b.appjiagu.com N/A N/A

Queries information about active data network

discovery
Description Indicator Process Target
Framework service call android.net.IConnectivityManager.getActiveNetworkInfo N/A N/A

Queries information about the current Wi-Fi connection

discovery
Description Indicator Process Target
Framework service call android.net.wifi.IWifiManager.getConnectionInfo N/A N/A

Queries the mobile country code (MCC)

discovery
Description Indicator Process Target
Framework service call com.android.internal.telephony.ITelephony.getNetworkCountryIsoForPhone N/A N/A

Reads information about phone network operator.

discovery

Listens for changes in the sensor environment (might be used to detect emulation)

evasion
Description Indicator Process Target
Framework API call android.hardware.SensorManager.registerListener N/A N/A

Registers a broadcast receiver at runtime (usually for listening for system events)

persistence
Description Indicator Process Target
Framework service call android.app.IActivityManager.registerReceiver N/A N/A

Uses Crypto APIs (Might try to encrypt user data)

impact
Description Indicator Process Target
Framework API call javax.crypto.Cipher.doFinal N/A N/A

Checks CPU information

Description Indicator Process Target
File opened for read /proc/cpuinfo N/A N/A

Checks memory information

Description Indicator Process Target
File opened for read /proc/meminfo N/A N/A

Processes

com.lion.market

/system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/data/com.lion.market/.jiagu/tmp.dex --output-vdex-fd=42 --oat-fd=43 --oat-location=/data/data/com.lion.market/.jiagu/oat/x86/tmp.odex --compiler-filter=quicken --class-loader-context=&

getprop

sh -c ps

ps

ps

Network

Country Destination Domain Proto
N/A 224.0.0.251:5353 udp
US 1.1.1.1:53 cloud.xdrig.com udp
US 1.1.1.1:53 i.tddmp.com udp
CN 116.196.71.30:80 i.tddmp.com tcp
CN 116.198.14.27:443 cloud.xdrig.com tcp
US 1.1.1.1:53 android-api.ccplay.com.cn udp
CN 203.107.44.252:80 android-api.ccplay.com.cn tcp
CN 203.107.44.252:80 android-api.ccplay.com.cn tcp
CN 203.107.44.252:80 android-api.ccplay.com.cn tcp
US 1.1.1.1:53 conf.xdrig.com udp
CN 114.67.244.173:443 conf.xdrig.com tcp
US 1.1.1.1:53 cgi.connect.qq.com udp
HK 43.154.252.110:80 cgi.connect.qq.com tcp
HK 43.154.252.110:443 cgi.connect.qq.com tcp
US 1.1.1.1:53 s.jpush.cn udp
CN 121.36.193.140:19000 s.jpush.cn udp
CN 203.107.44.252:80 android-api.ccplay.com.cn tcp
GB 142.250.187.206:443 tcp
US 1.1.1.1:53 android.apis.google.com udp
GB 142.250.187.206:443 android.apis.google.com tcp
US 1.1.1.1:53 sis.jpush.io udp
CN 124.71.159.41:19000 sis.jpush.io udp
US 1.1.1.1:53 av1.xdrig.com udp
CN 116.198.14.37:443 av1.xdrig.com tcp
US 1.1.1.1:53 easytomessage.com udp
CN 123.60.89.60:19000 easytomessage.com udp
CN 113.31.17.108:19000 udp
GB 216.58.212.202:443 tcp
US 1.1.1.1:53 s.appjiagu.com udp
US 104.192.110.60:80 s.appjiagu.com tcp
CN 113.31.17.106:7000 tcp
US 1.1.1.1:53 im64.jpush.cn udp
CN 1.94.2.18:3000 im64.jpush.cn tcp
CN 121.36.193.140:19000 easytomessage.com udp
CN 124.71.159.41:19000 easytomessage.com udp
CN 123.60.89.60:19000 easytomessage.com udp
CN 113.31.17.108:19000 udp
US 1.1.1.1:53 b.appjiagu.com udp
CN 180.163.249.208:80 b.appjiagu.com tcp
CN 116.198.14.26:443 cloud.xdrig.com tcp
CN 113.31.17.106:7000 tcp
CN 106.63.25.33:80 b.appjiagu.com tcp
CN 1.94.2.18:3000 im64.jpush.cn tcp
CN 116.198.14.36:443 av1.xdrig.com tcp
US 1.1.1.1:53 s.jpush.cn udp
CN 121.36.193.140:19000 s.jpush.cn udp
CN 124.71.159.41:19000 s.jpush.cn udp
CN 123.60.89.60:19000 s.jpush.cn udp
CN 113.31.17.108:19000 udp
CN 113.31.17.106:7000 tcp
CN 1.94.2.18:3000 im64.jpush.cn tcp
CN 121.36.193.140:19000 s.jpush.cn udp
CN 116.198.14.10:443 cloud.xdrig.com tcp
CN 124.71.159.41:19000 s.jpush.cn udp
CN 123.60.89.60:19000 s.jpush.cn udp
CN 116.198.14.35:443 av1.xdrig.com tcp
CN 113.31.17.108:19000 udp
CN 113.31.17.106:7000 tcp
US 1.1.1.1:53 im64.jpush.cn udp
CN 1.94.137.47:3000 im64.jpush.cn tcp
CN 121.36.193.140:19000 s.jpush.cn udp

Files

/data/data/com.lion.market/.jiagu/libjiagu.so

MD5 6e8ea47d2d8500b7fb8855394fdf0526
SHA1 d3c719bda605cd787c4acf30507edb76b7fb6070
SHA256 cc3b55086867ed7136d474a21b1359f49e6afed3b74fbb4ba5f11b36ce1f4d46
SHA512 385241f905c46ead517e4e0bcaf2fe00160ba0f7f40c6926ba288bf41d46e77a8bd63ec0a97d57a5b65cf6fb1f93b5f86f51d9cb24809ae934ebdb2fd49c0b70

/data/data/com.lion.market/.jiagu/classes.dex

MD5 f631dc0a46e9abc5dbd9149b7ba65e93
SHA1 67e0e892abfd00fa9bd344dadf0e5de198436206
SHA256 880428cc8c7ee66b1b2afce6f5fee197846cd2b4018046bb55f052aabc979ea6
SHA512 5164ef8df0c1dbcf862a9e35a7c0f99ff473becd36cc8ccc349e0a2cf18bdc197a9a45705a8d078c6dc2a4559cc3a26539fe05a0312b694a7d14eb2f21b6adc2

/data/data/com.lion.market/.jiagu/classes.dex!classes2.dex

MD5 00e9cf8089669bf9899eab2eb3bbcd1b
SHA1 df0bd0f320b7de42496802ef3ee57fd39084f673
SHA256 007bb9d4e5aaf942e54751f512750845f5d116016a990f58b02abd2ad7f52d0f
SHA512 900421d1033948b04d37b40d12d9c07bda3db777783d4776f4f0b71a9b71a89bf3092c2bc0a3669bbf7f775a8bafda7affe710eca82ccaf4d8701bbc46b4bc00

/data/data/com.lion.market/.jiagu/tmp.dex

MD5 f1771b68f5f9b168b79ff59ae2daabe4
SHA1 0df6a835559f5c99670214a12700e7d8c28e5a42
SHA256 9f8898ce35a47aeafced99ea0d17c33e73037bb2307c7688e50819966f4ae939
SHA512 dae27d19727b89bec49398503baa6801640540355688dfabbe689c97545295c2c2d9b0f0dcd7cbc4cfbf701d0c0c3289e647a152f49ff242d1ecc741efe4145d

/data/data/com.lion.market/files/.jglogs/.jg.ri

MD5 24c63cffedad60371bd20b631569af8c
SHA1 cd50e9ce731b07f241449f5339fda2c0b684a043
SHA256 811543a994f94b265ce4a80f79f82d5ef499359903a927870b2ff54e7abd2323
SHA512 4eb935102a2b134942e9fe914dda88910968543f017bc304d3288b1748d61e21f8bc8180e12d5aea466052ff3fa4edeb47356e3369a0e601ab83f8ecdb2884e9

/data/data/com.lion.market/files/.jiagu.lock

MD5 ad4cd77c8f86ca0e5a52a8e2ae0ea0aa
SHA1 cdde20cee16d7bcef64861e502fa005764f187ac
SHA256 30808b5b9b87ed8a611130ddb45ca3eae46527e73c588ce53e914c24dd546db9
SHA512 13ddbba077f849351aa3cecb7dac14d5e4b949428f2c38325074c6ce39450f22cda8db3302f5cae0141ab5d4366ff53706a72d7f70b4fae9e0be86deda51056b

/data/data/com.lion.market/files/.jglogs/.jg.rd

MD5 ea0a3a7420519af687c4a20646ffe288
SHA1 e57e99aec8cee67d14dd31f2ccbcf89fe87b2324
SHA256 a77cc35e61273a1855916fe47d6085ba84f304b94170806f8ec9a90959dc6ba1
SHA512 c34c04126e566311dc67cd3476f471eb63b8c8744646a58f4f9ebfb9fb188d10a2a665644a305fe19de9d8712e9885114757f3701ce62b17c016010c6d060188

/data/data/com.lion.market/files/.jglogs/.jg.store

MD5 448e391c59eef34ee1defbe4dee4c41f
SHA1 df1f890987371d7d8e6963c68b787856e42bc146
SHA256 55612e17689f4bb05f27e18b4f6d06ffef92a6a8893a5cfdd3d5b99a6028b549
SHA512 ce336ce895ba861dda7da27e8869dea065eb3c3403cac55cdf1935409e5ebc95b495370f87ed7416af20af533b15615472e333ae9f2fd2713040f526835399b7

/data/data/com.lion.market/files/.jglogs/.jg.ac

MD5 8f632a777046aa743ceb67a2ebe202de
SHA1 162d2fb178efb212f58324a9999c963b14c22874
SHA256 abd17c5676d8fe20fe81bd6e3f1f6242ef2cfc9fb6381117d050db682e9e0036
SHA512 42bf535190d866a32929d3b00dde6db5470c270b84a40ca9199fa029c60d9535e49cea1ed0d95a2f29d221ac574c87949f556b630bed0b9080655e78bbb93025

/data/data/com.lion.market/files/.jglogs/.jg.ic

MD5 185a4b6230e3d976f769df86587970bf
SHA1 d26bd6bfccc0fd69941417528d736c698b5050a3
SHA256 eef43e18add619bc438deb4c76e6250523f797cb53756f119cd395ccd1cd6efa
SHA512 197d154ebebf42296c6ad07daca397c875e7c98c62fccf33786ffd4800d41dc4934c27ab79f288fcbb521decadcf343fe74c5b050763c3c8f6c6be7a641cdace

/data/data/com.lion.market/files/.jglogs/.jg.di

MD5 217e7d61778fa04ecb34feae20f98c73
SHA1 e1dad5828394daf2eda78f23df68c851760e728d
SHA256 fa2a58d4ed633d4c0be8ea36d953030952cc4bda2046af383cf14cffaa8e7a88
SHA512 77b18800cc68a7c49434a3b4a5d38a376862799a615f9dedb813d8992d055d224c465226ea3f140204109eb40cc298e5e64cc5c4b8a9980edf22ced6ad361390

/storage/emulated/0/360/.iddata

MD5 448d747d11e328f1ca9ddb2ed560379b
SHA1 696962e3a66f4f56f0ae962920b324c0c185b6f5
SHA256 ec0ff8d242f65a6d7f68fa7e6251263d7fc4a10c4c9da538d998586ee90c8ac8
SHA512 e2a2d9fd70f028d7b8daf892bd17809151075f5e6143bab7525821b8285b93d89a2e3df354f85c7c3a4dd322acb8900e0ad6dbc59c3d513d3da7ffa0b324a451

/storage/emulated/0/360/.deviceId

MD5 1d8d16c4e3b19ebf18988530d9b9a757
SHA1 bc94c1cce05cd848a53271ecb9c5311e27ffebf5
SHA256 abd87140da8de3d0aa39a24a8d52bfe7b2eb28f7a3d505f205471c7e8f4964d7
SHA512 4562d1eedbc5c2dd7f25cd1c70343053fd451026403585182b142a64f17016c1bd0bf6ad51667b439b220e425640e55fbbda08517e7106376cdc220a4555da82

/data/data/com.lion.market/files/TDAntiCheating_Switch_Value

MD5 55a54008ad1ba589aa210d2629c1df41
SHA1 bf8b4530d8d246dd74ac53a13471bba17941dff7
SHA256 4bf5122f344554c53bde2ebb8cd2b7e3d1600ad631c385a5d7cce23c7785459a
SHA512 7b54b66836c1fbdd13d2441d9e1434dc62ca677fb68f5fe66a464baadecdbd00576f8d6b5ac3bcc80844b7d50b1cc6603444bbe7cfcf8fc0aa1ee3c636d9e339

/data/data/com.lion.market/databases/com.lion.market.db-journal

MD5 edfd0aca5945eefaf0c3520d9dd1dd94
SHA1 5cc08df79574d03610e2a5f1a122a287e0b8c6cd
SHA256 e1f9d36c289662c123a558951648d4f7575b734648a0330e83e1a84771df749d
SHA512 657a5e84c39f5e318d10a59584b32667a8ff4023b9997ed23e651d300055d394016ed15f159aaf8437de1706047bef83d8b227037c2d2e5eda7b2c397997a2fb

/data/data/com.lion.market/databases/com.lion.market.db

MD5 f2b4b0190b9f384ca885f0c8c9b14700
SHA1 934ff2646757b5b6e7f20f6a0aa76c7f995d9361
SHA256 0a8ffb6b327963558716e87db8946016d143e39f895fa1b43e95ba7032ce2514
SHA512 ec12685fc0d60526eed4d38820aad95611f3e93ae372be5a57142d8e8a1ba17e6e5dfe381a4e1365dddc0b363c9c40daaffdc1245bd515fddac69bf1abacd7f1

/data/data/com.lion.market/databases/com.lion.market.db-shm

MD5 bb7df04e1b0a2570657527a7e108ae23
SHA1 5188431849b4613152fd7bdba6a3ff0a4fd6424b
SHA256 c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479
SHA512 768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012

/data/data/com.lion.market/databases/com.lion.market.db-wal

MD5 470d8936d6b2e6478fb3cae578a910d6
SHA1 dc383b509ea9276b946e3527f3735397937a826c
SHA256 dd00df4a6f7c963f07e86ed6410ccd596e059aed086e074580e2135a04c9799a
SHA512 fc2ad24d84d49db1bf64f844b69d4e159ab2e6a907b1224520bc0fd560bffd733d255df07a6674ec98bc80535e60fff8c8e6b009ea99340dd7bbe036b56b63e8

/storage/emulated/0/.tcookieid

MD5 2764e0550361020629755065771bef89
SHA1 1e38936d895b653dea9081951e792d1de02c9caf
SHA256 2f8f093853ca2a0fb58a548cf158e7742a8c03d6c9750984f591a23e11bab027
SHA512 b731840c0ec261241d39ddcbdf5b001f55b59bb908b9ac2ac7eb57336d7aff7cd13180a0730534653a5db385f4b14448e825c640b741be5e80637a642cfb2304

/data/data/com.lion.market/files/jpush_stat_cache.json

MD5 5bc54e35af684bb877e1eee21c46c8b5
SHA1 e46d7520ea6ed926b07489da904e289caacb33ac
SHA256 474ef521ba2651af765ac5f7317033c8bc8bbae87c50c5ecad9f0e243b12b635
SHA512 b6edb35a2c4d853c1687322f9d4400e142f678bf863b2d8590fd858aae2cc645b9353374959278bcf2cd1730eafe6a63e47b6e883cb71feb360f20229db1ebcf

/data/data/com.lion.market/files/com.tencent.open.config.json.1101491790

MD5 f526172de1566b34fdcea744710d9559
SHA1 000cb54d9a008a807a1c5a3fd2b2e7cb41e7939d
SHA256 8572be02b59f4d514000939ec04a9b4e2380c55265256b724a617d8d0f4c6940
SHA512 dc81f0fe345b18c96b1638c67b9ef4c5e60059dfc4a02f3c30a23645d4847abeef46cf467d044c42597115c48052ce0e8ea24328382114a544c5dfd039a95e7d

/data/data/com.lion.market/files/TDCloud_Control_Cache_Param1

MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd

/data/data/com.lion.market/files/_Ladder_Project/Archimedes_p1

MD5 94687aa050764451d43e920700e022cf
SHA1 bf0ed83c4fa2b21b2df9911268bc62805c49cf3f
SHA256 a0f912b0109821c20d19cb6933aaea36d5596206572782b2cd8176819fa58022
SHA512 1fabb5c20d3ba5369f905f7f19552e6504f5b9d0a0efaf756a407624364bee7eb7495a67c6b9e2e15e4a087452ca5bedf933c1ae6921e3498c057c69598971eb

/data/data/com.lion.market/files/_Ladder_Project/Archimedes_p2

MD5 82e1da685bc1894c84a0cba51b6cdd64
SHA1 21e0a51364f2fed4775bf57f2044769df3928665
SHA256 39e046e97939a9c5380d7f8c84843a5422118c3ce4ce92f5e82fada63844107a
SHA512 937833cf00688fb2642c799c17562bf0df2a3b3b6444b481b58ce4212cf94a009a26803bbee140bbcbd5d005063d3af40ea4eee1b193c388d5c44997e53dacc9

/data/data/com.lion.market/files/_Ladder_Project/Archimedes_p3

MD5 16d1a55dea41b1af4d44c9a47a87a184
SHA1 209e1785f262382482a2d751c2a185fceedf1277
SHA256 337b4dbc9552e429fdb20b710ad998077f16a2cb2872632913a8a0c8ffdc47c7
SHA512 eb327d70e7e3c23e8e2e1824862190bfd7443f5456b0ba16a062f9bb86f164d671fdffffbff5afc501ed2807b4488772b2cdb5377b3f12989af7d7241dbad2e7

/data/data/com.lion.market/files/Archimedes_p4

MD5 889685e33746b0187aa70a3e4f84df3a
SHA1 b23d86da61b650456a03e71dea41c5bf57195ef8
SHA256 20d683ddd6c7af77f221ac69a9cf0a7e208e7baae7fc38e951297ed4656010e0
SHA512 c93eb13cd7c6b9930bfa930c4c0c698e2aa9eb67fcf42144514c09f10e5b7edfc9aafba2f01f199701821820fcf6b812bfb19b31a47c0bf135e35e26ccf94820

/data/data/com.lion.market/files/Archimedes_p5

MD5 eb247d07d1c7294c5568574b337d07b0
SHA1 d4be99a34ba47baec926dc6299a79ff7a4ec6ade
SHA256 19451010d6e3fb484ba62dd73349547af83503b3b05fe95e3c48012a92040b3b
SHA512 329558cb4fa3d92b4fc4dda3b72c235c7788e2284e8b8cee6597352a7cc25f0d674139530a87e1f558daa4dc8d210fd161ee8e11b6706ee37db1087a35dc35df

/data/data/com.lion.market/files/mPBE/salt

MD5 17cca02f1a639239b82df9b16edab772
SHA1 6a7bf35e20bc0f4786aa9b74d0d532848cbfbf9b
SHA256 eb61c12221ca703156497ef1697a9ed4a9d171b985926c75b050cb88efbbe947
SHA512 965b6c36a3c5e62b2426a8e3e65132e257ddebb9863e80fcda3f666c6e3245bbbd362fbd715b079ef0235acc016fb3871eb373bfda8a4e2ca916b08c60c77175

/data/data/com.lion.market/files/mPBE/iv

MD5 2ca97f69a13e6db3e4925a9025e5ab9e
SHA1 76cf463e17aa60b29569fa9ed0b5936a0710c8cd
SHA256 3772a1e53642a3205bc8b68733ce1d7aa6d6230d0f90999be4959d98838ba34a
SHA512 1e2d5616e7a2eaa6900ce1ffd729e1ff624eb2b5b46f6acb794e92289f884f2d0a73c8e983aef77d724a7bee1b5baf6030ca9fddd17e28511751ab5514dc0ea2

/data/data/com.lion.market/files/__database_reborn_January_one__/td_database2SaaS/1718320896684_4271

MD5 83cf349f6b62cdb3a5c6f09b71481f53
SHA1 f4f55439a9ca4a64b0a876b1e0ff6ec7ad0059ef
SHA256 4de09b237bfbf4a37009913ae61ee5f14a81839d8a9375cbebf352258147624d
SHA512 83584a4edc2b745058f4f5abcf7922f591ffdaa4cd795ce8139784d0dcb925b4ed40efe387355f64b99d47e7c62c96c0bf16d2df0a4af89c771539b4f2198264

/data/data/com.lion.market/files/__database_reborn_January_one__/td_database2SaaS/1718320896899_4271

MD5 b5b9bdfa1496f0dbe1ea8fdfc74f3504
SHA1 4f7e89bcb36d97f9dcd9959b315aea278b95d800
SHA256 784935e6f20ab8bdb447c007681f73a19bf2d1b6540af7f1c9567274eec0cca4
SHA512 897319d1605d81eea0bc87736738d9363976a74d1950055acd07ec62f436b3f592c3a80e6126fa9618476d93259e08b34e698b2572990a2f7ddf038f74d82ccf

/data/data/com.lion.market/files/__database_reborn_January_one__/td_database2SaaS/1718320897096_4271

MD5 1997641953200a4cc55c857de4f4b2f9
SHA1 d430e5b979788a4ab07221a781ca13bfdb3a9fe2
SHA256 ec25a0f972369478089ed8b074cb0b88763ba0e3b339e5fdd090c052eb89c82f
SHA512 f8bf68f83482702a025ea92b5b5d0609030ed55ac04f09a4913ca84650852846b583915745d93e5aa901727497203634ce1f87670ed908598d122ac8297056f4

/data/data/com.lion.market/files/__database_reborn_January_one__/td_database2SaaS/1718320897349_4271

MD5 ac22cf9e545e20ff15537940fa07f494
SHA1 15a6fd1314e16f2f2e0e109dea3f0e3b09d80a20
SHA256 6d47bdf64a9430bfc4563c2c8f5c8ce373c8624711b5abdc56959e71b62ef154
SHA512 5b4565d374b7a7e1d1aae59e400b7ea95471eb667b29dd003d614003f06ee4c674e281bd1bec9eb07b1516c964aa9e47ca7f784a4052675b62cd7bac802c88d9

/data/data/com.lion.market/files/__database_reborn_January_one__/td_database0SaaS/1718320898071_4271

MD5 7ab6a512e0e1f2a1538f0424a953ef09
SHA1 1de22fe3f6d3116bb86fa9baf0803ca1cd80316d
SHA256 f76e6e49620cef87065bafc7ff64d5f33d5d5022f87456d2d8df89e00e136ec8
SHA512 3b73fd92268cb25dbb6449d8844fcfb0d0911fba15a47ee4e175ddf243b8205e2d5241bd239c0efa7b2ec7285166515d322c45c2d09939f249d80f3762e166fe

/data/data/com.lion.market/files/__database_reborn_January_one__/td_database2SaaS/1718320898692_4271

MD5 2b8643310bc3bedab963f706f52c9948
SHA1 3eb5a14564feab9864cdc52165333b3a8d82d863
SHA256 114a3628841285613a2df5535fdefbe9af00c387e45f1021982e05901fdfe392
SHA512 19354a727db609d574133c249a527df9e82e87a29ebe4f74616e8932f1f0272652b5807e072830d8fce67c01f6187407491b2b9400563c30f4419a56c43dfd63

/data/data/com.lion.market/files/__database_reborn_January_one__/td_database2SaaS/1718320906361_4271

MD5 4d3fbaa3623e2b6170ac5289680e1567
SHA1 15fdb45e191349f092e56075138660ce1ed0c6fc
SHA256 59c63175039b544fb963260e8337f7aa2034f231ef444f7e785645a891fa4949
SHA512 6eca8e5d6f8dbf686aef9593342251f0b42806286f8188b28dc7df7dc402c3b57045a430719b894ddb88bfca77c9ea4400cdb727df059d70828dbd83043dd717

/data/data/com.lion.market/files/__database_reborn_January_one__/td_database0SaaS/1718320906744_4271

MD5 c28d5344b009a2f950667fb700976327
SHA1 c5720c0f86aacce8cd1e309b9ecb50055cc34608
SHA256 0b60061c856ccdf47b133279294373f28c0836d73e8e7a2f8dcf4b5a8d5c4b34
SHA512 4f9d0ceb55ac91cee9ac7e5a523ec84848c3480f7f74a974e008e3e817bb42677654322f3470b532624c3c22f3936d81ab32bba7eee79783f40c9ca488d269aa

/data/data/com.lion.market/files/__database_reborn_January_one__/td_database0SaaS/1718320907057_4271

MD5 18a7610cc36c0b1be1cd17db04e93462
SHA1 fae494aad466e94dea72720a186ed2a093e6c4a6
SHA256 f0ee35114acc402b6e65f82f63f6634589a5efd4ecff7004e849af4c1684cfd4
SHA512 f6f490f912f1ad7e3c45a5730da18357b4892aa0c87933573e26280566aede041bbae3e1699b3daf5cef8d0cd0bcbfde7bb2e19889ec25b15d5bc9334c1417af

/data/data/com.lion.market/files/__database_reborn_January_one__/td_database0SaaS/1718320907303_4271

MD5 874aad186cc1329832ebf8002397ea32
SHA1 bf698e41dd651f815784463bcb4b1633a4a53a4b
SHA256 0c51892aeb36f58655d8abd6479896f79a52daf4463ee42a887baad9020f9c36
SHA512 857abc02c7253fa333dbd347d832be1f7a392b956c23e7c249b34ba9897843914c434c76f81577f2d58976b5afecae10637bcac38212b3e918924483a11b12dc

/data/data/com.lion.market/files/__database_reborn_January_one__/td_database0SaaS/1718320907606_4271

MD5 084b38a574b084024850d5cfdaadffcd
SHA1 8521d5408c80ce0a0de55e07fa96435672015a26
SHA256 c90c8dfa3a59503a4e1ced3e9e6438b7c2607e24e83767bf027fa3818d436e45
SHA512 bb968b56dabd28d55230ab5cac2a78687cf19bd1e490062dafff5536ca878bfea06dc8a10183257e6c198384f4a1df42d7c978d0fbda5289c3536db2e873325d

/data/data/com.lion.market/files/__database_reborn_January_one__/td_database0SaaS/1718320907825_4271

MD5 d082a22cdfb6a78b59814089f892245f
SHA1 8aeda6abc515421545045a2448f529f0087e3143
SHA256 7068595bed6298971a551759c3c6c763afe8f56be8e2506b8c04a90a58facdc3
SHA512 d491be771adb48162160e2003dbaf8131feaab98d7e47dd8148af98e4367d501ade2a52a7b7fd4ca36e04eb7bf049e310b709fb1af16823a0395acaf0be457ef

/data/data/com.lion.market/files/.jglogs/.jg.di

MD5 e98c5441d9f8d0d3ae1eb059f203d245
SHA1 113b9809c740484d8b076f7e3fab75a4b335468c
SHA256 12d13ec9feef7ec6c71dc9bdde12c26db5c713573200c25f3ba70b0a87a32286
SHA512 178b966bee53a510c303e700d6692db4c89f8ca5e883969be4803940e1952868f42737a492a08a9d4099c5dcf0f82e73c4902bdbbd42787551e9644aa4493db8

/data/data/com.lion.market/files/.jglogs/.jg.store

MD5 f57082906580062208e80126bd53077d
SHA1 0390aea272f07c2aeeb25bfde4c29191162f1cf0
SHA256 6a08f5841a5df61ecedd0a30c308b779340563810872eb7a56518e588ae2bd8e
SHA512 42b35597b51306f1eaff628acaafe7a71e50592aadf75ca8f5a08962e146d75b59b86d9655d426a64597bbf04e2d5ac309296cf299dbc4a19cb65093c9b33c68

/data/data/com.lion.market/files/.jglogs/.jg.ac

MD5 95d79ac372c5d460b24a7afcdad7e749
SHA1 f9db042ce82b97703037a9eacee58e3287dd2fcd
SHA256 2f4d901e54b6d220c1da7dd78349b68a6eefabe8288e3e53cc503b17cab9f5c7
SHA512 c88ed259f5e6658fc75371392ca09b52f1978c63cac059168c769336637cdb43acede6b18d7f79b627472c1001944d2699c5dc8be4831276a8375b51c7f458d9

/data/data/com.lion.market/files/__database_reborn_January_one__/td_database2SaaS/1718320947639_4271

MD5 7c458de9a4e8a9cd2abd3f2c28e212e6
SHA1 29c6c346562859312f0496143555b4036849e762
SHA256 8573aad384dfe10a54fd271cdc1279ebc2e01b152b8fb1354a4117525795eae5
SHA512 6cef555825f834fe4220f3f885c4e0d26184eedae880c1b8dc4e2610ceb1f30617cd84785d0a3bd284c6eb63e3402e95a242a1550b0cb717f8b278e7138b13be

/data/data/com.lion.market/files/__database_reborn_January_one__/td_database2SaaS/1718320949818_4271

MD5 b2bb3ffe51408cf9eb08642950bc614a
SHA1 e8731e1d139d3edefcb71be803e7f094138f05d0
SHA256 c7f461b1a19b2caafea5cef54a797b43e55a09cfca694109a7edada2a4bd9b3e
SHA512 72ec42a21c38c1805d1efb5a69cb2627ae496d97a18780706430ec628da3f20d6f2b961a595e1aab3df62399716f8983753b1da222e6e01518ca34e5eeaf639d

/data/data/com.lion.market/files/__database_reborn_January_one__/td_database2SaaS/1718321007843_4271

MD5 42ed875f2559e430e27c7f54090191d6
SHA1 e8c64a3d06886b2af1b4922d6d7be26367ef0f52
SHA256 1d296d24187e3d5ddd0a04ce0017adffbe2e3a7fc62b36dadfaea7c3d2e5bb15
SHA512 789d55c33a7c9b6bdb40808aeb7c96cc0be3d8df9d7bcc93713fa01fb4fbdfe0414b4e51cf58e94de5f1894015f621bd2b9f61050a120f84464ebe4b2c33a950

Analysis: behavioral2

Detonation Overview

Submitted

2024-06-13 23:21

Reported

2024-06-13 23:24

Platform

android-x64-20240611.1-en

Max time kernel

177s

Max time network

184s

Command Line

com.lion.market

Signatures

Checks if the Android device is rooted.

evasion
Description Indicator Process Target
N/A /data/local/su N/A N/A
N/A /data/local/bin/su N/A N/A
N/A /data/local/xbin/su N/A N/A
N/A /sbin/su N/A N/A

Loads dropped Dex/Jar

evasion
Description Indicator Process Target
N/A /data/user/0/com.lion.market/[email protected] N/A N/A
N/A /data/user/0/com.lion.market/[email protected]!classes2.dex N/A N/A

Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps)

banker discovery

Queries information about running processes on the device

discovery
Description Indicator Process Target
Framework service call android.app.IActivityManager.getRunningAppProcesses N/A N/A

Queries information about the current nearby Wi-Fi networks

discovery
Description Indicator Process Target
Framework service call android.net.wifi.IWifiManager.getScanResults N/A N/A

Requests cell location

collection discovery evasion
Description Indicator Process Target
Framework service call com.android.internal.telephony.ITelephony.getCellLocation N/A N/A
Framework service call com.android.internal.telephony.ITelephony.getAllCellInfo N/A N/A

Domain associated with commercial stalkerware software, includes indicators from echap.eu.org

Description Indicator Process Target
N/A s.appjiagu.com N/A N/A
N/A b.appjiagu.com N/A N/A

Queries information about active data network

discovery
Description Indicator Process Target
Framework service call android.net.IConnectivityManager.getActiveNetworkInfo N/A N/A

Queries information about the current Wi-Fi connection

discovery
Description Indicator Process Target
Framework service call android.net.wifi.IWifiManager.getConnectionInfo N/A N/A

Queries the mobile country code (MCC)

discovery
Description Indicator Process Target
Framework service call com.android.internal.telephony.ITelephony.getNetworkCountryIsoForPhone N/A N/A

Queries the unique device ID (IMEI, MEID, IMSI)

discovery

Reads information about phone network operator.

discovery

Listens for changes in the sensor environment (might be used to detect emulation)

evasion
Description Indicator Process Target
Framework API call android.hardware.SensorManager.registerListener N/A N/A

Registers a broadcast receiver at runtime (usually for listening for system events)

persistence
Description Indicator Process Target
Framework service call android.app.IActivityManager.registerReceiver N/A N/A

Uses Crypto APIs (Might try to encrypt user data)

impact
Description Indicator Process Target
Framework API call javax.crypto.Cipher.doFinal N/A N/A

Checks CPU information

Description Indicator Process Target
File opened for read /proc/cpuinfo N/A N/A

Checks memory information

Description Indicator Process Target
File opened for read /proc/meminfo N/A N/A

Processes

com.lion.market

Network

Country Destination Domain Proto
N/A 224.0.0.251:5353 udp
US 1.1.1.1:53 ssl.google-analytics.com udp
GB 142.250.200.40:443 ssl.google-analytics.com tcp
US 1.1.1.1:53 i.tddmp.com udp
CN 116.196.71.30:80 i.tddmp.com tcp
US 1.1.1.1:53 cloud.xdrig.com udp
CN 116.198.14.43:443 cloud.xdrig.com tcp
US 1.1.1.1:53 android-api.ccplay.com.cn udp
US 1.1.1.1:53 conf.xdrig.com udp
CN 203.107.44.252:80 android-api.ccplay.com.cn tcp
CN 203.107.44.252:80 android-api.ccplay.com.cn tcp
CN 203.107.44.252:80 android-api.ccplay.com.cn tcp
CN 114.67.244.173:443 conf.xdrig.com tcp
US 1.1.1.1:53 cgi.connect.qq.com udp
HK 43.154.252.110:80 cgi.connect.qq.com tcp
HK 43.154.252.110:443 cgi.connect.qq.com tcp
US 1.1.1.1:53 s.jpush.cn udp
CN 121.36.193.140:19000 s.jpush.cn udp
CN 203.107.44.252:80 android-api.ccplay.com.cn tcp
US 1.1.1.1:53 android.apis.google.com udp
GB 142.250.187.206:443 android.apis.google.com tcp
US 1.1.1.1:53 sis.jpush.io udp
CN 139.159.137.254:19000 sis.jpush.io udp
US 1.1.1.1:53 av1.xdrig.com udp
CN 116.198.14.30:443 av1.xdrig.com tcp
US 1.1.1.1:53 easytomessage.com udp
CN 123.60.89.60:19000 easytomessage.com udp
CN 113.31.17.108:19000 udp
CN 113.31.17.106:7000 tcp
US 1.1.1.1:53 s.appjiagu.com udp
GB 142.250.200.46:443 tcp
GB 142.250.179.226:443 tcp
US 104.192.110.60:80 s.appjiagu.com tcp
US 1.1.1.1:53 im64.jpush.cn udp
CN 124.70.211.119:3000 im64.jpush.cn tcp
CN 121.36.193.140:19000 easytomessage.com udp
GB 142.250.179.228:443 tcp
GB 142.250.179.228:443 tcp
CN 139.159.137.254:19000 easytomessage.com udp
GB 142.250.200.46:443 tcp
US 1.1.1.1:53 easytomessage.com udp
CN 110.41.162.127:19000 easytomessage.com udp
CN 113.31.17.108:19000 udp
CN 116.198.14.42:443 cloud.xdrig.com tcp
CN 113.31.17.106:7000 tcp
CN 124.70.211.119:3000 im64.jpush.cn tcp
US 1.1.1.1:53 b.appjiagu.com udp
CN 180.163.249.208:80 b.appjiagu.com tcp
CN 106.63.25.33:80 b.appjiagu.com tcp
US 1.1.1.1:53 s.jpush.cn udp
CN 139.159.137.254:19000 s.jpush.cn udp
CN 116.198.14.25:443 av1.xdrig.com tcp
CN 139.159.137.254:19000 s.jpush.cn udp
CN 110.41.162.127:19000 s.jpush.cn udp
CN 113.31.17.108:19000 udp
CN 113.31.17.106:7000 tcp
CN 124.70.211.119:3000 im64.jpush.cn tcp
CN 139.159.137.254:19000 s.jpush.cn udp
CN 116.198.14.3:443 cloud.xdrig.com tcp
CN 139.159.137.254:19000 s.jpush.cn udp
CN 110.41.162.127:19000 s.jpush.cn udp
CN 113.31.17.108:19000 udp
CN 116.198.14.22:443 av1.xdrig.com tcp
CN 113.31.17.106:7000 tcp
CN 124.70.211.119:3000 im64.jpush.cn tcp
CN 139.159.137.254:19000 s.jpush.cn udp

Files

/data/data/com.lion.market/.jiagu/libjiagu.so

MD5 6e8ea47d2d8500b7fb8855394fdf0526
SHA1 d3c719bda605cd787c4acf30507edb76b7fb6070
SHA256 cc3b55086867ed7136d474a21b1359f49e6afed3b74fbb4ba5f11b36ce1f4d46
SHA512 385241f905c46ead517e4e0bcaf2fe00160ba0f7f40c6926ba288bf41d46e77a8bd63ec0a97d57a5b65cf6fb1f93b5f86f51d9cb24809ae934ebdb2fd49c0b70

/data/user/0/com.lion.market/[email protected]

MD5 f631dc0a46e9abc5dbd9149b7ba65e93
SHA1 67e0e892abfd00fa9bd344dadf0e5de198436206
SHA256 880428cc8c7ee66b1b2afce6f5fee197846cd2b4018046bb55f052aabc979ea6
SHA512 5164ef8df0c1dbcf862a9e35a7c0f99ff473becd36cc8ccc349e0a2cf18bdc197a9a45705a8d078c6dc2a4559cc3a26539fe05a0312b694a7d14eb2f21b6adc2

/data/user/0/com.lion.market/[email protected]!classes2.dex

MD5 00e9cf8089669bf9899eab2eb3bbcd1b
SHA1 df0bd0f320b7de42496802ef3ee57fd39084f673
SHA256 007bb9d4e5aaf942e54751f512750845f5d116016a990f58b02abd2ad7f52d0f
SHA512 900421d1033948b04d37b40d12d9c07bda3db777783d4776f4f0b71a9b71a89bf3092c2bc0a3669bbf7f775a8bafda7affe710eca82ccaf4d8701bbc46b4bc00

/data/data/com.lion.market/files/.jglogs/.jg.ri

MD5 1f7c07a872c0262d97ef4c5de574c3df
SHA1 e092018f7126f35e9dc5b6a8d445d860dd9048f9
SHA256 bcc7cbaa16deabf426b3031396b39db956a4ebca09e24e32072f9f0cf6fc2a80
SHA512 6a97f56324a0aea5f92363c85ea0c372a2361b6ce73f78a92c3aac967e316d7086fad5d1b883d466751499263cfb979de03b8b2a88195f8e4d711dd60e909630

/data/data/com.lion.market/files/.jiagu.lock

MD5 a467f91ed1cdfd8516921db7a0c7441e
SHA1 11494cbf39a6e1cb2a2e25abc3a2c4f044834a5b
SHA256 7d0de25db7ee32c7d2c474aff33e489ba1174790cabff4e216ca87527fc7b6d1
SHA512 8d2cac453867f1e3a46462e7b455911a24c844a15231a8c0c4dd2b2012034d473653f2b507fe3fce7f584a3f9f67490726d9ab86be490a80ad28fad4dd7316ff

/data/data/com.lion.market/files/.jglogs/.jg.rd

MD5 d78cde5ee6d4d626d2eaba970956ba69
SHA1 712716f57403a907e21a48c525403449c5520b56
SHA256 adc19bc7f833755a9a792cfe919659297ad05ac2568a61f826aef336eb8b4f2a
SHA512 76cb61fdba8097ead20a3f8b8121988aca9b5c996882501f6e9c68dfb88821fe02d92f24053430e4320096b66abca430a0c7bb82e6939914de78046332220ac5

/data/data/com.lion.market/files/.jglogs/.jg.store

MD5 448e391c59eef34ee1defbe4dee4c41f
SHA1 df1f890987371d7d8e6963c68b787856e42bc146
SHA256 55612e17689f4bb05f27e18b4f6d06ffef92a6a8893a5cfdd3d5b99a6028b549
SHA512 ce336ce895ba861dda7da27e8869dea065eb3c3403cac55cdf1935409e5ebc95b495370f87ed7416af20af533b15615472e333ae9f2fd2713040f526835399b7

/data/data/com.lion.market/files/.jglogs/.jg.ac

MD5 8f632a777046aa743ceb67a2ebe202de
SHA1 162d2fb178efb212f58324a9999c963b14c22874
SHA256 abd17c5676d8fe20fe81bd6e3f1f6242ef2cfc9fb6381117d050db682e9e0036
SHA512 42bf535190d866a32929d3b00dde6db5470c270b84a40ca9199fa029c60d9535e49cea1ed0d95a2f29d221ac574c87949f556b630bed0b9080655e78bbb93025

/data/data/com.lion.market/files/.jglogs/.jg.ic

MD5 185a4b6230e3d976f769df86587970bf
SHA1 d26bd6bfccc0fd69941417528d736c698b5050a3
SHA256 eef43e18add619bc438deb4c76e6250523f797cb53756f119cd395ccd1cd6efa
SHA512 197d154ebebf42296c6ad07daca397c875e7c98c62fccf33786ffd4800d41dc4934c27ab79f288fcbb521decadcf343fe74c5b050763c3c8f6c6be7a641cdace

/data/data/com.lion.market/files/.jglogs/.jg.di

MD5 a4a36bcfcfce03afe9ca3e6d6272aa8e
SHA1 e5a91b6a9ba0cfdf41f2b51f6e7afcf082be9b47
SHA256 c858e3ce66e4adfbf783315cec078b04e6d0254397e578feecd2474a1b60c1a7
SHA512 66a3d31721f28f633ae5304d440d2297f10de41a3638fce5347df7f551ec2ed86f6c7d64f01a15e0afc76c26aa748648210be9651fbf39133a0803d7f39a927d

/storage/emulated/0/360/.iddata

MD5 f0845f91ebce6bba9aade658a053893b
SHA1 5e0d6317c01ec9d4090dbc71cb02a5883c758722
SHA256 700e09fd787ef118796426c19cf6da72f921c117f874e53556f53b7a2bb15383
SHA512 1d84fe48dda0e9799be4e4254f53d38b17110f8fbef0842e92e467982aaba9e60cb363accac7e09f815116152e0a6f7f67707fbbd40a665e89cf325faf1a699b

/storage/emulated/0/360/.deviceId

MD5 4c4c5285293d5141f582aefa4e038669
SHA1 e01852a72e5a8e6f7d63a21426b515118196047b
SHA256 36c5c63f39ddf7a6a9c01946e4f78b95790aa734176802e793e95724a1b5b731
SHA512 097aa673273e307f7bfb7c08861ad389d4b5f7fae55d972a5c1636aa66d0b8d23b5eb9b696cefe0e5b942f23969dabf0147397aeca85fb9a4d75e0473104e399

/data/data/com.lion.market/files/TDAntiCheating_Switch_Value

MD5 55a54008ad1ba589aa210d2629c1df41
SHA1 bf8b4530d8d246dd74ac53a13471bba17941dff7
SHA256 4bf5122f344554c53bde2ebb8cd2b7e3d1600ad631c385a5d7cce23c7785459a
SHA512 7b54b66836c1fbdd13d2441d9e1434dc62ca677fb68f5fe66a464baadecdbd00576f8d6b5ac3bcc80844b7d50b1cc6603444bbe7cfcf8fc0aa1ee3c636d9e339

/data/data/com.lion.market/databases/com.lion.market.db-journal

MD5 8f920d179e02c2b50452c427569e1408
SHA1 ef742fb3a7583b77d16f7232d6ce263fd507622b
SHA256 5c8b61a12fe30f113ebe90c10caa3dc942af2a084f87130ca340967e6c6f6b98
SHA512 85345727b2fec4405be211bbc260c17c1eb152faa5af27e8b637923b26df1f8116105bdd5ea1934abc84d8a322a5d72228ec320e244f7660b344418793d2b038

/data/data/com.lion.market/databases/com.lion.market.db

MD5 59189d2e95c170e4c712afbb96410885
SHA1 be65f4dd291117568d70a5aef361f1823632f424
SHA256 161c0d439bce8e9b5d07639b7ac9f089a6c5b9cfa327cefd49c3876ce8dd4c67
SHA512 07b47b425b18f8d80d9f079f06312ecbe607a9fb306592ce35ba806bf1cbd429a63f65d9855cd0df7146bd9550657a1b2d2def7aaf36e2e4a275f39903a21595

/data/data/com.lion.market/databases/com.lion.market.db-journal

MD5 e1b0de595bf5c06d2a4b3eab205d3f43
SHA1 540ba3e449be00dd57c96d7c678210d15c6071ff
SHA256 aeedfd824d9dc0da457549a2f362f097db60cff6376ccf6a26de9c220acb0b14
SHA512 92dfc63ad60cfd152babb72b588aa6190e1b80fbe72019aedccc0b26f957cc57c0be9a5cc100a9a4f701cc4532fe130174022d7cac1adc7bc31695c4b5cd083c

/data/data/com.lion.market/databases/com.lion.market.db-journal

MD5 113c4a10b3a800249d9757712d7f52c0
SHA1 99f139a8ba965feeb929287140ed1341bd9a9e0f
SHA256 171cd42b62e848041e66ee215e45823f9b5e13acac84cb596b4cf6f1c68d1e32
SHA512 f20c88afd5b46443aaa8cdad195f0a5dd81bc04786835a41ae7301331251f49cb43baf2fe34bad469787aa895b89c8180edb03cb290460ef0edef65cb9ae73e9

/storage/emulated/0/.tcookieid

MD5 2fa893eac85d85c7349e08dc5e9a5fc0
SHA1 1538059b42170de621302d4d4e5091ee4d000bca
SHA256 d931810ac064d0467b355f9fb2376005f7b06c433f1750e3cfedadd110f1bfbc
SHA512 f5c937ec8637761762efc52a758b495fc3fb0d48936a3cd029ed81b0675fe5c24dbb701dd205b09b02b7713d668c68e8e7c3e86d9f9c09cf3c23e58799cc7409

/data/data/com.lion.market/files/jpush_stat_cache.json

MD5 a6fba64247fabf7a0023d128f05cbcdf
SHA1 311a1c8d4e0d71d935718e05708c0cc72f806cb1
SHA256 9f736d93b342108f9d8d08cfe54890d2f0c7f607eada1490d5d16c94724fdbb5
SHA512 3e90ff0d4137a8b25f53e1288849ac5e6c90d2169a2b4e615fb7870469f12aedc1022e2bbc124610746174423da2376c6ee9664fde969441fc17819d03c01160

/data/data/com.lion.market/files/com.tencent.open.config.json.1101491790

MD5 f526172de1566b34fdcea744710d9559
SHA1 000cb54d9a008a807a1c5a3fd2b2e7cb41e7939d
SHA256 8572be02b59f4d514000939ec04a9b4e2380c55265256b724a617d8d0f4c6940
SHA512 dc81f0fe345b18c96b1638c67b9ef4c5e60059dfc4a02f3c30a23645d4847abeef46cf467d044c42597115c48052ce0e8ea24328382114a544c5dfd039a95e7d

/data/data/com.lion.market/files/TDCloud_Control_Cache_Param1

MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd

/data/data/com.lion.market/files/_Ladder_Project/Archimedes_p1

MD5 5071ab09371e7711712be4183b9fd51e
SHA1 ae645bf75ca0c41b05d52245a190f948069d7758
SHA256 dd20f1e43bf0cecf82a973c74f582464dfb89d2a0f7bf2245594b8297536ac51
SHA512 b329297d7000d2050ea86dc1b4f001b27bf9ff7c079fc980f18ec65fee093d1428326c1a0dfe0d9eb92fa46bc5ff569d619cf5df246147b302b08a0661d1c2a5

/data/data/com.lion.market/files/_Ladder_Project/Archimedes_p2

MD5 89776a67d56e788185570d47913e76bc
SHA1 df5a3137adff9af033339e01fe9bd3cc5a499c86
SHA256 dfe6cf558451da1a3eae2b64139ae66d19ab1308c18c82c9c8073d6d35404a0d
SHA512 1da6dbaefb1845ca197cece4cd132fbe7c55869e7b0f4caa7991b05a18154a02cf047de01345769f92793c9e4575359abad4fb0d7ca63279627f1588d36a48ee

/data/data/com.lion.market/files/_Ladder_Project/Archimedes_p3

MD5 b3f10456e8eadf771dd831b48d8bb75a
SHA1 eb10fe26f2d4c5ad47bc37d3063d4ca9428af884
SHA256 cc00a2db6c6287efd6c1d1926d788c10d8df2e9f9fc3b8365b367b252ed7d630
SHA512 df2b406ef4e4c0bc31ff02e1dec268e099d95c16e8c037689cb59acb90de5021159386d4814c726ca68a7180c8c26760bad6946e64bbee8097f6643d91345dd0

/data/data/com.lion.market/files/Archimedes_p4

MD5 c458031fce9a3fa10dab53eb92d09f64
SHA1 4fe6e0150c56bd78b3d287bdc973cb164d8fe30a
SHA256 89a55ff7688e980c5cf1a400f909c20521d51f55f5a110e4a2d2a9fa1f6d31f9
SHA512 8e1196e6ba5e3b2a0196d229d2b066e1eee52a5b6b8e34e1deda53d4497fcf8e87b25e601f524f85c2b54621730ca964a596aaa29a1b377319af79d6d44e0d3a

/data/data/com.lion.market/files/Archimedes_p5

MD5 2ff502614cf7f07fb2de0e58307192f5
SHA1 3b81257b9caa0d4c601a509db355ad5637de8519
SHA256 c7589558aa8e9c1298262cc72065a671eef001fcaa8ac028ee15526f25096a65
SHA512 801d8a7171023ec397bc592f130d82c9e0da43dff6945cb05af35248cecae21b88d424c723ab4563e7410ee0540fc13a6e78b513bb2cf425675b573abf7ee7f9

/data/data/com.lion.market/files/mPBE/salt

MD5 4fb6360b973c655a432d476d95e17f0d
SHA1 6e1b62cb6ba5abf4d618c4a48a07ba471a1cf322
SHA256 6f0a0e69619a38bb98bae2399544fc3a1d5e1d937737307a3e66c4c31e1e2bf3
SHA512 3299446b89fa62ea166e4f37e5411ffd47d146c1595a9f2fdc312d513f55e3d983ced685963fde9f5a7a100f192f6c9f2c2e4448cca46efe7282b88247e2b2d8

/data/data/com.lion.market/files/mPBE/iv

MD5 71d4e02d5b50217659b2ac2aeee57ee0
SHA1 40bd8d9352996a0a93aab0827de9094a7a9e8af8
SHA256 ddf8b448e74b73e6f7a57bdb5ecff7f86502b229ae6224a1985f8377ab7f10bf
SHA512 310109f2d3e14286d371310a492641a80c33e334149aa96ac51073b5c546de8e844921c55ff940acfd8b95fdaa286658806ce0956aedf1f526ee786e962b6f1f

/data/data/com.lion.market/files/__database_reborn_January_one__/td_database2SaaS/1718320901855_5029

MD5 c3471cc933713102d06538d5f2d8053f
SHA1 358ac0176e1f99c0e626a2fef29d59f13aa7105f
SHA256 4b713edae4d0ff44062e5e71f7326a35a30822cdfff642c20e883135d41ad3ec
SHA512 5cf880de453c9c76d69756f2db2127ff7abfdbd7cb6ec67d220d18f9fbab99c0e31341f1fff9b0b9df2482c75c903bc538eec2e39e3eb56a963cf1ac5206805f

/data/data/com.lion.market/files/__database_reborn_January_one__/td_database2SaaS/1718320902365_5029

MD5 61238d1b75f095e0d320052fae845962
SHA1 799c1e836bf2d260b48610c784b0bc15d2545b0f
SHA256 165f4c767e31eef4c0fe70a646f789ae212aeb9e1d0f0406e36bf28238f1d928
SHA512 0f04cdcd959f76275c091e8f30aede40276211c6f017138b2ee1188f9a93c4b787cd37d3c509835f1998a20077ec1e901c0cfc5f2f13f5563dce3170680132b6

/data/data/com.lion.market/files/__database_reborn_January_one__/td_database2SaaS/1718320902688_5029

MD5 3bc3906de5af3bc3146db3efa2a05681
SHA1 1c5e698d6163d91da45494ed11d3414dd5770924
SHA256 f0dffedcafcca2fcb9441b56319bea785d59f689de89dbc3a3e32dda9c053773
SHA512 39905d79836734fd028bfc43b12bf2f2f975881bff4426f523c26a6eb7129629b07f92aa7ca00a0b8251f0d648924d743b15ab11f30395972ea47ce99a23fa43

/data/data/com.lion.market/files/__database_reborn_January_one__/td_database2SaaS/1718320902942_5029

MD5 8e935d38119accb46e4c749f8f34464e
SHA1 4f3bdd6cb81a6773027610dab7afd3523656f87d
SHA256 bda54e1639e8792e0e8163d2b954dd3436aba1124c58f585bdf148af973762f3
SHA512 26c27ec062a393c235b8e2251686c3ee05b480d7ab78ce238db8956476d0b486aa94d2f682bb4ac4623e94b0a1df3a18f25bfcf04823cd8d911ad1c40f71643e

/data/data/com.lion.market/files/__database_reborn_January_one__/td_database0SaaS/1718320903298_5029

MD5 134a5c4aec2b1861d180fb03fef2c3be
SHA1 4efe9a6d52a5df35d600b3b538bc7e0a008858e7
SHA256 1acb6035c3b1e888796072fb280f2b55b2776faf54d5b669884f0e549ceab89c
SHA512 9a1d64c5108ffe23b92bb1196b6b19a0dbd2130bd2325486077a85ccd9cb2296782a693b406ac1aac915ac929f1ef86297399ae052654fd948a447eab22cc5fa

/data/data/com.lion.market/files/__database_reborn_January_one__/td_database2SaaS/1718320903685_5029

MD5 155c5c46847165206d3109d8363b4fa8
SHA1 ff2b6631e6763d32fa97cef43eff5186d751bf01
SHA256 803e92b0c65325d7a85606bf547961503f5c1dd9209050da223d5f86ec476a35
SHA512 58225a43fd8b0f461646e22e967060005b92cd4a582e3ee1fe6c013de3c7c117f6dc30cfc74c3ba9544df410bf8da99c5f1c2d181e8616166f1404ed190a15c2

/data/data/com.lion.market/files/__database_reborn_January_one__/td_database2SaaS/1718320904139_5029

MD5 bc100f843bb384a8bdc9fa7c87581a7e
SHA1 e5cb058472578f139aa81c970e70d65ed7f73786
SHA256 fdd3188a606b39a27d045d00742ca457cf1c5b2cbcb35505ce79dd63339ca176
SHA512 7b3a2ce481b4cbf8ec39f67914fc58315c123afba19962ca3fe35161a4c06853ff5fcea7b943d19452fa1c55692a24ab760433fd732d06983e5d9ec6264685d2

/data/data/com.lion.market/files/__database_reborn_January_one__/td_database0SaaS/1718320904477_5029

MD5 e9d4c41488929cab7148273baf422100
SHA1 71aacacada261017e49b5bbcd9a8cbff632738a6
SHA256 cac726f076059217011fa4948a20f3632dfeabc37529b2db71e34e86f3ddbc37
SHA512 be6d8947bd243171a398ddf050081c628db81def8b3ab255fa8401c3c476e88d86185c7cd4c5aef85897e623589fb8dd1604492ec4dddfe33f727fcae9e68f21

/data/data/com.lion.market/files/__database_reborn_January_one__/td_database0SaaS/1718320904802_5029

MD5 776a5ba35277a59336b7f46607e8908b
SHA1 cee687bd7c742868e5571339ef47a13507d27079
SHA256 0b8204a8e8c0ce94357d0cee3b43e1e138b1484584c1f545d50082b10ae6cd7e
SHA512 9cc2fbeea6f42a852b31d12224ed1691c416e07683492c8dc83771f77f25af48d3cd4efeab28d3cb999ada745cf1f9cb70f64855e1118e811360694da7395e04

/data/data/com.lion.market/files/__database_reborn_January_one__/td_database0SaaS/1718320905054_5029

MD5 e441554bc0d01df522855860b375143f
SHA1 50aa014b261ec5e065be48f99ed40ef73db5fee9
SHA256 4fab4cc15b01d66407fa25d5ce1252750edd9e3ac3ecb05d72141840789f1ba6
SHA512 dd6bc7cace1db57b4d86d015db11329730018b5f435da8582eeb88a986c4acc19d8270feaf42523e9ec107af9fb80f0973d77428bfd9979e095f5d8435792014

/data/data/com.lion.market/files/__database_reborn_January_one__/td_database0SaaS/1718320905312_5029

MD5 fc0cf3aaeca83a0c3f957610a25f6543
SHA1 8a6f56f6c39785c8efed465065a6bdf1111f8eaf
SHA256 2ba331f2a01217213b92343fef1fb02e0d2e73b222d146dacb80319d3ebadb27
SHA512 7a56def49d4deda5e72b438df90fd0314238ca093ada6a6bd61bd0804ef0a8a695d9854200081c91728947ee1d6f52d8c21f05442a0866cebdf8c043738b588d

/data/data/com.lion.market/files/__database_reborn_January_one__/td_database0SaaS/1718320905552_5029

MD5 70e807c816de3733868c4e5977bf799d
SHA1 996901f9047d3c0da6385efede56090354504879
SHA256 1b781ed23f6472f3d3934bb198d973462d2cb2aa6b42fd465c6b4e34b1d6ef7c
SHA512 0ba3d6aba8c5f2d6bcd71149dca4eaf57edf549fc961a33c6908f6d45795509cafdb4cb8333428a2f83899e5b5f69f85b7f1d827aabe9181f5ba5fba07b9d066

/data/data/com.lion.market/files/.jglogs/.jg.di

MD5 65c6a03faa9553487efe5b9221c953a6
SHA1 4b112c54e68c46f9f3f6914042d660cd212106a3
SHA256 134fa09be41048b4971f29836128f84826ec248c8a8c5fb2c1fc4d04b7f6a974
SHA512 1284d772438f9ac1224209e228a8641bb282d384fa57515277b3515b66b0a570947d89cdfb433b4c41d177902141a6df4c03ac06417ac1e95d2a99e914ca947d

/data/data/com.lion.market/files/.jglogs/.jg.store

MD5 be0dd646d8d8a9bea2fb58974e6f41ff
SHA1 f56f00751a2f0396c3833fe52aceb045deba8ad9
SHA256 46a284feb47f2398ad801b99f25a449d990c3d8bff2d21fde8f2f3ccd0595ee1
SHA512 f3c1c59fec02f3616f565c17238ddca3cbced72af2564e824595aac497fcd473bf6a66c4e928580837eda984a0c8cde9bcb978ff2f7cd370dc36cdc820604f0a

/data/data/com.lion.market/files/.jglogs/.jg.ac

MD5 95d79ac372c5d460b24a7afcdad7e749
SHA1 f9db042ce82b97703037a9eacee58e3287dd2fcd
SHA256 2f4d901e54b6d220c1da7dd78349b68a6eefabe8288e3e53cc503b17cab9f5c7
SHA512 c88ed259f5e6658fc75371392ca09b52f1978c63cac059168c769336637cdb43acede6b18d7f79b627472c1001944d2699c5dc8be4831276a8375b51c7f458d9

/data/data/com.lion.market/files/__database_reborn_January_one__/td_database2SaaS/1718320936292_5029

MD5 99d580555d8f0104e08529a158821342
SHA1 19eae084d428397e57fd14b6852fc27d026f9b54
SHA256 312f5317ecc892c0e95d292078ecd9ea8052687e41b88de69e45386ad2d5b1eb
SHA512 b828d5160f26aec0cfccc48be39424267cbeb53740df300fdd148dd0e504a7419cddf6a35cd9ecdcf452fb910d589f0ace51fe3ca0b37eaffa306d39ae315b19

/data/data/com.lion.market/files/__database_reborn_January_one__/td_database2SaaS/1718320936613_5029

MD5 93556c6cf026d9c69431e1eef6490396
SHA1 fad60cec186cc28d5dfe88628bc1c42688908832
SHA256 a926abdeaabfa022c7282a41a7ddf70d83ec7125c56abfc4218641a07dd1645e
SHA512 b775a451b57ae16e546e7aa7e85567c376697aaf2e54d004d27d69cec920d4eb71b547277bf1f4b4c9c3ffb4488d5ef4ee736f1831fde26a0a9ab4f98a8e49b1

/data/data/com.lion.market/files/__database_reborn_January_one__/td_database2SaaS/1718320949275_5029

MD5 3ea22ad189e286c90212f378349191c4
SHA1 c94181aa92f2aebeb73fbc550ab0d4f3df171d09
SHA256 9d286009b6e40571254ff11c2de5dc0240221ad2b4d92ce27ca8b68aa74c0273
SHA512 660af6b0b909cb926202baf9edd60555603e622d96b69f35dc200d22fc5e191ad993147e5ab5bab2d00ecea22aa9380e6b5d3a50fd38fee461fc3a81a3c250f7

/data/data/com.lion.market/files/__database_reborn_January_one__/td_database2SaaS/1718320951095_5029

MD5 3f25139aa72b5f74bc59608838603226
SHA1 056ebc4fa4d8c9db66352b5431a7f3e509232752
SHA256 71f3f3ddaf97987ee9c2cb832318c57c1ff8aa5eb92c91b5e9b0308ee5d2f249
SHA512 a7343af7e627c29feaa42d19551d6c604757e871008792613a27bd968d2b82700f31bc123a744a7deb5130d9314fab38a382134447cee1b562db4f6a6e50dbf3

/data/data/com.lion.market/files/__database_reborn_January_one__/td_database2SaaS/1718321009384_5029

MD5 a7d3fa3d4cd14579085d2a1c102fb44a
SHA1 523965f7b8ee1528dcc6162fec5a95a9bf81c6c4
SHA256 fe4fcdba762fd79f619347f5e9e5fe97786ba3e42eed46d1d422fd59bb0055d2
SHA512 847491fd01a6883f9f7f2297f1f86d01efe7a315e0eb01dbc9a9a34cc0b8ce7eb3e1faa4c05147aa3c82ac112dc9b71b17c85565f69c66a945872864acaba05e