Analysis Overview
SHA256
06cb4152d31568bf64880fd3c8d3febf1ecc0ce7c1170ee470d55da94908c471
Threat Level: Shows suspicious behavior
The file b982fc062476e088b7a27bdd3ac52364_JaffaCakes118 was found to be: Shows suspicious behavior.
Malicious Activity Summary
Requests cell location
Reads the content of the SMS messages.
Reads the content of SMS inbox messages.
Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps)
Loads dropped Dex/Jar
Reads information about phone network operator.
Queries the mobile country code (MCC)
Requests dangerous framework permissions
Queries information about the current Wi-Fi connection
Queries information about active data network
Uses Crypto APIs (Might try to encrypt user data)
Registers a broadcast receiver at runtime (usually for listening for system events)
Checks memory information
MITRE ATT&CK
Mobile Matrix V15
Analysis: static1
Detonation Overview
Reported
2024-06-17 18:58
Signatures
Requests dangerous framework permissions
| Description | Indicator | Process | Target |
| Allows an app to access approximate location. | android.permission.ACCESS_COARSE_LOCATION | N/A | N/A |
| Allows an app to access precise location. | android.permission.ACCESS_FINE_LOCATION | N/A | N/A |
| Allows access to the list of accounts in the Accounts Service. | android.permission.GET_ACCOUNTS | N/A | N/A |
| Allows read only access to phone state, including the current cellular network information, the status of any ongoing calls, and a list of any PhoneAccounts registered on the device. | android.permission.READ_PHONE_STATE | N/A | N/A |
| Allows an application to read SMS messages. | android.permission.READ_SMS | N/A | N/A |
| Allows an application to receive SMS messages. | android.permission.RECEIVE_SMS | N/A | N/A |
| Allows an application to read from external storage. | android.permission.READ_EXTERNAL_STORAGE | N/A | N/A |
| Allows an application to send SMS messages. | android.permission.SEND_SMS | N/A | N/A |
| Allows an application to read or write the system settings. | android.permission.WRITE_SETTINGS | N/A | N/A |
| Allows an application to write to external storage. | android.permission.WRITE_EXTERNAL_STORAGE | N/A | N/A |
| Allows an application to write to external storage. | android.permission.WRITE_EXTERNAL_STORAGE | N/A | N/A |
| Allows an application to read from external storage. | android.permission.READ_EXTERNAL_STORAGE | N/A | N/A |
| Allows an application to write to external storage. | android.permission.WRITE_EXTERNAL_STORAGE | N/A | N/A |
| Allows an application to send SMS messages. | android.permission.SEND_SMS | N/A | N/A |
| Allows an application to read SMS messages. | android.permission.READ_SMS | N/A | N/A |
| Allows an application to receive SMS messages. | android.permission.RECEIVE_SMS | N/A | N/A |
| Allows read only access to phone state, including the current cellular network information, the status of any ongoing calls, and a list of any PhoneAccounts registered on the device. | android.permission.READ_PHONE_STATE | N/A | N/A |
| Allows an application to write to external storage. | android.permission.WRITE_EXTERNAL_STORAGE | N/A | N/A |
| Allows an application to write to external storage. | android.permission.WRITE_EXTERNAL_STORAGE | N/A | N/A |
| Allows an application to read SMS messages. | android.permission.READ_SMS | N/A | N/A |
| Allows an application to send SMS messages. | android.permission.SEND_SMS | N/A | N/A |
| Allows an application to receive SMS messages. | android.permission.RECEIVE_SMS | N/A | N/A |
| Allows an app to create windows using the type LayoutParams.TYPE_APPLICATION_OVERLAY, shown on top of all other apps. | android.permission.SYSTEM_ALERT_WINDOW | N/A | N/A |
| Allows read only access to phone state, including the current cellular network information, the status of any ongoing calls, and a list of any PhoneAccounts registered on the device. | android.permission.READ_PHONE_STATE | N/A | N/A |
| Allows an application to write to external storage. | android.permission.WRITE_EXTERNAL_STORAGE | N/A | N/A |
| Allows an application to send SMS messages. | android.permission.SEND_SMS | N/A | N/A |
| Allows an application to read SMS messages. | android.permission.READ_SMS | N/A | N/A |
| Allows read only access to phone state, including the current cellular network information, the status of any ongoing calls, and a list of any PhoneAccounts registered on the device. | android.permission.READ_PHONE_STATE | N/A | N/A |
| Allows an application to monitor incoming MMS messages. | android.permission.RECEIVE_MMS | N/A | N/A |
| Allows an application to receive SMS messages. | android.permission.RECEIVE_SMS | N/A | N/A |
| Allows an application to write to external storage. | android.permission.WRITE_EXTERNAL_STORAGE | N/A | N/A |
| Allows an application to write to external storage. | android.permission.WRITE_EXTERNAL_STORAGE | N/A | N/A |
| Allows an application to read SMS messages. | android.permission.READ_SMS | N/A | N/A |
| Allows an application to send SMS messages. | android.permission.SEND_SMS | N/A | N/A |
| Allows an application to receive SMS messages. | android.permission.RECEIVE_SMS | N/A | N/A |
| Allows read only access to phone state, including the current cellular network information, the status of any ongoing calls, and a list of any PhoneAccounts registered on the device. | android.permission.READ_PHONE_STATE | N/A | N/A |
| Allows an app to access approximate location. | android.permission.ACCESS_COARSE_LOCATION | N/A | N/A |
| Allows an application to read or write the system settings. | android.permission.WRITE_SETTINGS | N/A | N/A |
| Allows an app to access approximate location. | android.permission.ACCESS_COARSE_LOCATION | N/A | N/A |
| Required to be able to access the camera device. | android.permission.CAMERA | N/A | N/A |
| Allows read only access to phone state, including the current cellular network information, the status of any ongoing calls, and a list of any PhoneAccounts registered on the device. | android.permission.READ_PHONE_STATE | N/A | N/A |
| Allows an application to write to external storage. | android.permission.WRITE_EXTERNAL_STORAGE | N/A | N/A |
| Allows an application to read from external storage. | android.permission.READ_EXTERNAL_STORAGE | N/A | N/A |
| Allows an application to request installing packages. | android.permission.REQUEST_INSTALL_PACKAGES | N/A | N/A |
Analysis: behavioral1
Detonation Overview
Submitted
2024-06-17 18:58
Reported
2024-06-17 19:01
Platform
android-x86-arm-20240611.1-en
Max time kernel
54s
Max time network
160s
Command Line
Signatures
Loads dropped Dex/Jar
| Description | Indicator | Process | Target |
| N/A | /data/user/0/com.ynf.rulvvt/files/dai/jWBsAMo.jar | N/A | N/A |
| N/A | /data/user/0/com.ynf.rulvvt/files/dai/jWBsAMo.jar | N/A | N/A |
| N/A | /data/user/0/com.ynf.rulvvt/files/Plugin2.apk | N/A | N/A |
| N/A | /data/user/0/com.ynf.rulvvt/files/Plugin2.apk | N/A | N/A |
| N/A | /data/user/0/com.ynf.rulvvt/app_dex/utopay.jar | N/A | N/A |
| N/A | /data/user/0/com.ynf.rulvvt/app_dex/utopay.jar | N/A | N/A |
Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps)
Reads the content of SMS inbox messages.
| Description | Indicator | Process | Target |
| URI accessed for read | content://sms/inbox | N/A | N/A |
Reads the content of the SMS messages.
| Description | Indicator | Process | Target |
| URI accessed for read | content://sms/ | N/A | N/A |
Requests cell location
| Description | Indicator | Process | Target |
| Framework service call | com.android.internal.telephony.ITelephony.getCellLocation | N/A | N/A |
Queries information about active data network
| Description | Indicator | Process | Target |
| Framework service call | android.net.IConnectivityManager.getActiveNetworkInfo | N/A | N/A |
Queries information about the current Wi-Fi connection
| Description | Indicator | Process | Target |
| Framework service call | android.net.wifi.IWifiManager.getConnectionInfo | N/A | N/A |
Queries the mobile country code (MCC)
| Description | Indicator | Process | Target |
| Framework service call | com.android.internal.telephony.ITelephony.getNetworkCountryIsoForPhone | N/A | N/A |
Reads information about phone network operator.
Requests dangerous framework permissions
| Description | Indicator | Process | Target |
| Allows read only access to phone state, including the current cellular network information, the status of any ongoing calls, and a list of any PhoneAccounts registered on the device. | android.permission.READ_PHONE_STATE | N/A | N/A |
| Allows an application to write to external storage. | android.permission.WRITE_EXTERNAL_STORAGE | N/A | N/A |
| Allows an application to read from external storage. | android.permission.READ_EXTERNAL_STORAGE | N/A | N/A |
| Allows an application to read SMS messages. | android.permission.READ_SMS | N/A | N/A |
| Allows an application to receive SMS messages. | android.permission.RECEIVE_SMS | N/A | N/A |
| Allows an application to send SMS messages. | android.permission.SEND_SMS | N/A | N/A |
| Allows an app to access approximate location. | android.permission.ACCESS_COARSE_LOCATION | N/A | N/A |
| Allows an app to create windows using the type LayoutParams.TYPE_APPLICATION_OVERLAY, shown on top of all other apps. | android.permission.SYSTEM_ALERT_WINDOW | N/A | N/A |
| Allows an application to initiate a phone call without going through the Dialer user interface for the user to confirm the call. | android.permission.CALL_PHONE | N/A | N/A |
| Required to be able to access the camera device. | android.permission.CAMERA | N/A | N/A |
| Allows read only access to phone state, including the current cellular network information, the status of any ongoing calls, and a list of any PhoneAccounts registered on the device. | android.permission.READ_PHONE_STATE | N/A | N/A |
| Allows an application to write to external storage. | android.permission.WRITE_EXTERNAL_STORAGE | N/A | N/A |
| Allows an application to read from external storage. | android.permission.READ_EXTERNAL_STORAGE | N/A | N/A |
| Allows an application to read SMS messages. | android.permission.READ_SMS | N/A | N/A |
| Allows an application to send SMS messages. | android.permission.SEND_SMS | N/A | N/A |
| Allows an application to receive SMS messages. | android.permission.RECEIVE_SMS | N/A | N/A |
| Allows an app to access approximate location. | android.permission.ACCESS_COARSE_LOCATION | N/A | N/A |
Registers a broadcast receiver at runtime (usually for listening for system events)
| Description | Indicator | Process | Target |
| Framework service call | android.app.IActivityManager.registerReceiver | N/A | N/A |
Uses Crypto APIs (Might try to encrypt user data)
| Description | Indicator | Process | Target |
| Framework API call | javax.crypto.Cipher.doFinal | N/A | N/A |
Checks memory information
| Description | Indicator | Process | Target |
| File opened for read | /proc/meminfo | N/A | N/A |
Processes
com.ynf.rulvvt
/system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.ynf.rulvvt/files/dai/jWBsAMo.jar --output-vdex-fd=44 --oat-fd=45 --oat-location=/data/user/0/com.ynf.rulvvt/files/dai/oat/x86/jWBsAMo.odex --compiler-filter=quicken --class-loader-context=&
/system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.ynf.rulvvt/files/Plugin2.apk --output-vdex-fd=113 --oat-fd=115 --oat-location=/data/user/0/com.ynf.rulvvt/files/oat/x86/Plugin2.odex --compiler-filter=quicken --class-loader-context=&
/system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.ynf.rulvvt/app_dex/utopay.jar --output-vdex-fd=122 --oat-fd=123 --oat-location=/data/user/0/com.ynf.rulvvt/app_dex/oat/x86/utopay.odex --compiler-filter=quicken --class-loader-context=&
Network
| Country | Destination | Domain | Proto |
| N/A | 224.0.0.251:5353 | udp | |
| US | 1.1.1.1:53 | app.jtmtht.com | udp |
| US | 104.155.138.21:89 | app.jtmtht.com | tcp |
| GB | 216.58.212.238:443 | tcp | |
| US | 1.1.1.1:53 | android.apis.google.com | udp |
| GB | 216.58.204.78:443 | android.apis.google.com | tcp |
| US | 104.155.138.21:89 | app.jtmtht.com | tcp |
| US | 104.155.138.21:89 | app.jtmtht.com | tcp |
| US | 104.155.138.21:89 | app.jtmtht.com | tcp |
| US | 104.155.138.21:89 | app.jtmtht.com | tcp |
| US | 104.155.138.21:89 | app.jtmtht.com | tcp |
| CN | 120.55.89.238:8977 | tcp | |
| US | 1.1.1.1:53 | passport.migu.cn | udp |
| CN | 112.25.126.116:80 | passport.migu.cn | tcp |
| US | 1.1.1.1:53 | sdk.qipagame.cn | udp |
| US | 1.1.1.1:53 | jx.hamofo.com | udp |
| US | 1.1.1.1:53 | xiafa.hamofo.com | udp |
| US | 1.1.1.1:53 | vpay.api.eerichina.com | udp |
| CN | 120.55.89.238:8977 | tcp | |
| CN | 112.25.126.116:80 | passport.migu.cn | tcp |
| CN | 120.55.89.238:8977 | tcp | |
| CN | 112.25.126.116:80 | passport.migu.cn | tcp |
| CN | 120.55.89.238:8977 | tcp | |
| CN | 112.25.126.116:80 | passport.migu.cn | tcp |
| CN | 120.55.89.238:8977 | tcp | |
| CN | 112.25.126.116:80 | passport.migu.cn | tcp |
| CN | 120.55.89.238:8977 | tcp | |
| CN | 112.25.126.116:80 | passport.migu.cn | tcp |
| CN | 120.55.89.238:8977 | tcp | |
| CN | 112.25.126.116:80 | passport.migu.cn | tcp |
| CN | 120.55.89.238:8977 | tcp | |
| CN | 112.25.126.116:80 | passport.migu.cn | tcp |
| CN | 120.55.89.238:8977 | tcp | |
| CN | 112.25.126.116:80 | passport.migu.cn | tcp |
| CN | 120.55.89.238:8977 | tcp | |
| CN | 112.25.126.116:80 | passport.migu.cn | tcp |
| CN | 120.55.89.238:8977 | tcp | |
| CN | 112.25.126.116:80 | passport.migu.cn | tcp |
| CN | 120.55.89.238:8977 | tcp | |
| CN | 112.25.126.116:80 | passport.migu.cn | tcp |
| CN | 116.62.54.183:9004 | tcp | |
| US | 1.1.1.1:53 | zyin.bjmcmj.cn | udp |
| US | 104.155.138.21:89 | app.jtmtht.com | tcp |
| US | 1.1.1.1:53 | pay.91mgame.com | udp |
| CN | 116.62.54.183:9004 | tcp | |
| CN | 47.114.40.15:80 | pay.91mgame.com | tcp |
| US | 1.1.1.1:53 | p1.ilast.cc | udp |
| US | 1.1.1.1:53 | semanticlocation-pa.googleapis.com | udp |
Files
/data/data/com.ynf.rulvvt/files/dai/jWBsAMo.jar
| MD5 | 970bbfd3c1511b595f49901bbb52005e |
| SHA1 | 7b0738e87500a339ebd55d0ee989816097292ad0 |
| SHA256 | dba084e77db37a013162f555f7001286ef3d142ac0fdf85d77c44429542828bf |
| SHA512 | be4f0a6768f4595bfca9e0dd6740fca6aae914eced10bdfc99e5f417279cc8dfcf10dff93deac4834331fa131d7d2a316445080cfbb440b9d4008a02bd5e4a32 |
/data/user/0/com.ynf.rulvvt/files/dai/jWBsAMo.jar
| MD5 | 8e424d81225e58e3505c4b24a4336517 |
| SHA1 | a6f41220d710c4b233631ac190bd15fd535e82fa |
| SHA256 | feb16ea6a9c7af998d389b1702d961deda982a7b1866efb541113a45669a009d |
| SHA512 | 106cb3f8376ddd83fb88e66e06b96f843dd6ae15c8c6eaba642229161395d424c15a36003de243451fd0f64a022152bb70107fc05f72564d8e1cd2b6b434ee2e |
/data/user/0/com.ynf.rulvvt/files/dai/jWBsAMo.jar
| MD5 | 826183baf47eb9637c154d45ac7bcf23 |
| SHA1 | 036e53f6930e1da2adf7b58dde9344773cf130ed |
| SHA256 | 6374928e1d6d1e953de613fc39ed8b0633b9709663a621a3bfab15a52739782e |
| SHA512 | 93a45d51a6e0ce2e5a25b3c76a5107923f840b4aaba64a9b624882e1f51ba6c1e5e96bf180cf7508df588ec744f3ba6a89ce8386379405fead1a91393eef2c25 |
/data/data/com.ynf.rulvvt/databases/740410100062013-journal
| MD5 | 126301cc8230923821247d3152db2c80 |
| SHA1 | 9c2b738f12a8ec0065c980886957ff2151475587 |
| SHA256 | db21ed16a24aa81e09c4b46a70c9af7428c495d5729672045083e118c065bcaf |
| SHA512 | dc081338d6d55122e9fcac61104da3ac1c68509cba5902a602c92ab46668293652e504a5e2c4fd5fa6a0b3cc23c4de780083007c7b4637dc9e0dc9eb9d59668e |
/data/data/com.ynf.rulvvt/databases/740410100062013
| MD5 | f2b4b0190b9f384ca885f0c8c9b14700 |
| SHA1 | 934ff2646757b5b6e7f20f6a0aa76c7f995d9361 |
| SHA256 | 0a8ffb6b327963558716e87db8946016d143e39f895fa1b43e95ba7032ce2514 |
| SHA512 | ec12685fc0d60526eed4d38820aad95611f3e93ae372be5a57142d8e8a1ba17e6e5dfe381a4e1365dddc0b363c9c40daaffdc1245bd515fddac69bf1abacd7f1 |
/data/data/com.ynf.rulvvt/databases/740410100062013-shm
| MD5 | bb7df04e1b0a2570657527a7e108ae23 |
| SHA1 | 5188431849b4613152fd7bdba6a3ff0a4fd6424b |
| SHA256 | c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479 |
| SHA512 | 768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012 |
/data/data/com.ynf.rulvvt/databases/740410100062013-wal
| MD5 | 664de15356ec5c8315e96b2bd2a33395 |
| SHA1 | 3aca9931537344801f29c2ee1fe3c173ca41b48d |
| SHA256 | ba09416cdd6f37a016005e0fb0f589f64714f3b06cb5fc65361760ff7879a6ad |
| SHA512 | 8728443c76e4c1af2c9973ed77eabe4b27b1b86c912d550cbea3a963bbfe3959a6c2b409d36d2da6e1b6ca7875dac160c17f8c1123b352b883f00995b25b0d01 |
/data/data/com.ynf.rulvvt/files/Plugin2.apk
| MD5 | 3d216f8fddb9705a6720a285475837f1 |
| SHA1 | f053d23b284bfe2faf6e76d353ff052471e2de2c |
| SHA256 | de7bf40574754a5144fa5cf3bc5e97f7adc7f5abebb18c41e8f0631917db4c0c |
| SHA512 | 38be39da8f96abc87109cfd57b2d63ddfa72971f023024a5b4ce1f97cd905a96a94e19eea19ae9b745f28d02c6689a4473627ce57ec85dce2018a77e699620cb |
/data/user/0/com.ynf.rulvvt/files/Plugin2.apk
| MD5 | 2a425e0fae74f20a2c475da937a619a2 |
| SHA1 | 4d701c7e6d828aa96ba8a493720e7282c49ec741 |
| SHA256 | 2c61a25f1ad5783bf82eea9faa2536cac4788ed3147bc1864d9ef17ea01be6a7 |
| SHA512 | 44c8d2a837b606de99055badbd4b5e708424ca9809b1583d13aefadc4d4af974658dc3a3f179fc3047eef7167151c638ff66dd6c8d38121b6ecdfb464d2a5a60 |
/data/user/0/com.ynf.rulvvt/files/Plugin2.apk
| MD5 | ef019d14367b7346b1ae2419e9d445c8 |
| SHA1 | 23d81fcf81f3a9f2a991ba4d0d135fe2a28aa188 |
| SHA256 | 1d83642ede6b16a071676e895f547d056543b5b4622bbc9b9b4ab45e47bf9ba0 |
| SHA512 | ea582f21c6054c37c679c798e93116c9c18c9544c0feb78fb949bed7b2cd3122c8d7bb8ecef329829c2531764abeb6200f0af49ede97c3b0b7448bdb65a34a60 |
/data/data/com.ynf.rulvvt/databases/wochi_v4.db-journal
| MD5 | 258a8d47ccf6e75b4c4da14d6b7eec6d |
| SHA1 | f71a35b246b7b31ceadd8dd44e4841e2b35c0c59 |
| SHA256 | aab50be19f073f50bcd4e220f8aae880e246cb24b67499f72f8129b6ffdb386b |
| SHA512 | ae974a7d5b30447949bb3c88886c0d199ce4ee50a0f9db6897032b8d345ebc76b39947c026bd1cb93a2c15c21cf8b4ab93e3d3cee1b07d12d3a75bcf818ae199 |
/data/data/com.ynf.rulvvt/databases/wochi_v4.db-shm
| MD5 | cf845a781c107ec1346e849c9dd1b7e8 |
| SHA1 | b44ccc7f7d519352422e59ee8b0bdbac881768a7 |
| SHA256 | 18619b678a5c207a971a0aa931604f48162e307c57ecdec450d5f095fe9f32c7 |
| SHA512 | 4802861ea06dc7fb85229a3c8f04e707a084f1ba516510c6f269821b33c8ee4ebf495258fe5bee4850668a5aac1a45f0edf51580da13b7ee160a29d067c67612 |
/data/data/com.ynf.rulvvt/databases/wochi_v4.db-wal
| MD5 | 63d1f7d05b4e08674872b982b6763ddf |
| SHA1 | b51669be7f244b5bceab14f31ca41df6038fbacd |
| SHA256 | 132ece09ca889727cfeafa6b169881b5ec5a3040b9e4783a0889b8a846d547fb |
| SHA512 | 7a1c717c22ee773316bff4a88a57aafe6c8a62990934f29d1187f071deeee377dd5093b1603dd8f07899d67205c0d119652c9425ea6321bf8e078384264e573c |
/data/data/com.ynf.rulvvt/app_dex/utopay.jar
| MD5 | eb6089c1acfa9f12535e533aebee845e |
| SHA1 | 165e39ee07dcd9ed00fc2dc1ff466bc1d6b813c9 |
| SHA256 | b825cde84e3dddfc147c71265d2259c422d51a7e56d1dcdba1321e3119b1df07 |
| SHA512 | 5b1bc26bcbcf05fc331865fb4dd572b673a52650d68ab4d9b028ea15219e0d93c1ec17996953436801913388d78e25c67ea33aa93544d65e96a799eb06cc70f5 |
/data/data/com.ynf.rulvvt/files/log.dat
| MD5 | ff9229f8e7c92d44d48e25206d43b021 |
| SHA1 | be3d75050c16c5b7484652ba292fdd6510f205d3 |
| SHA256 | 77fc3599be409f7e73e643de843c0ebcfa20662964c498fc59e245c7f5e003a2 |
| SHA512 | be7b3aa8d670a2873c6b7bfd4ca93121fd2450723cbbc36d9d06d152fafa3ce90451f0a60ab56bc96bccb81cf5aae0167b404073db14dc17b9513ac73d455c58 |
/data/user/0/com.ynf.rulvvt/app_dex/utopay.jar
| MD5 | 5220524411d0bacd600da60814d1ee9f |
| SHA1 | fef7210ff44e757328bc0ff7aae7bb2191cbf634 |
| SHA256 | 6286a800597b845785eb664710253ebd20771737dddd5b80067e0e9d37c804b2 |
| SHA512 | b2d8af5019c176d682634747d83320e609fb6122ef850f4069a0c78c2415d242087099cf60ecb03039a9ab71902a4e3b22e9cf144de89e506991fb93280f6a5f |
/data/user/0/com.ynf.rulvvt/app_dex/utopay.jar
| MD5 | 3b8bb9a8679ac8c24e8d179fc5bae999 |
| SHA1 | e6ea7a1095524087f481ba04321c4cb6fd2426f3 |
| SHA256 | 83c996c0d067b5f516897480f427dfffdcfb49ab7654dac9b805376bbd49e1db |
| SHA512 | abf1cbed7a8cf4a29d7a32a83f15aa0a6c9e2be8484c2dd8d9bf16a76e337b17b9c05efa0773598806b3d3da4fe3a9217b583abb9aaf5e3dc054dc77b10cae63 |
/data/data/com.ynf.rulvvt/files/yl_plugin.apk
| MD5 | 5a4c666b43ee7f2b6995aaf3527e4a4d |
| SHA1 | b205bcb022797f3b16635db139c7524c0c388adc |
| SHA256 | 05eb3e1ca331b8c6a1f60f92abb2bddbac54a7b2c229ac07bf26c756297fe72a |
| SHA512 | c84fceddbf9928110fc3b85e0989b9cedd06383007ff99dea5a25096d8f892ab52d30ed9b52b72211449041f1274ead85bb42929ec269b58b6b0e616a8545e17 |
Analysis: behavioral2
Detonation Overview
Submitted
2024-06-17 18:58
Reported
2024-06-17 18:58
Platform
android-x86-arm-20240611.1-en
Max time network
4s
Command Line
Signatures
Processes
Network
| Country | Destination | Domain | Proto |
| GB | 172.217.169.74:443 | tcp | |
| N/A | 224.0.0.251:5353 | udp |
Files
Analysis: behavioral3
Detonation Overview
Submitted
2024-06-17 18:58
Reported
2024-06-17 18:58
Platform
android-x64-20240611.1-en
Max time network
6s
Command Line
Signatures
Processes
Network
| Country | Destination | Domain | Proto |
| N/A | 224.0.0.251:5353 | udp |
Files
Analysis: behavioral4
Detonation Overview
Submitted
2024-06-17 18:58
Reported
2024-06-17 18:58
Platform
android-x64-arm64-20240611.1-en
Max time network
7s
Command Line
Signatures
Processes
Network
| Country | Destination | Domain | Proto |
| GB | 172.217.16.238:443 | tcp | |
| N/A | 224.0.0.251:5353 | udp | |
| GB | 172.217.16.238:443 | tcp |