7b153be55e372db36a20534f8c484801a3acde6ef6bf030288493004c13a5e22

Resubmissions

10/07/2024, 06:51

240710-hmsldsveqf 7

10/07/2024, 06:46

240710-hjz63asgmm 7

Analysis

max time kernel
61s
max time network
130s
platform
android_x86
resource
android-x86-arm-20240624-en
resource tags

androidarch:armarch:x86image:android-x86-arm-20240624-enlocale:en-usos:android-9-x86system
submitted
10/07/2024, 06:46

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

eshop1 (1).apk
Size

52.9MB
MD5

a28c855fb79cfdbbaf6a20cfb68e6347
SHA1

47050c0eff0953f9e71f09b1a68c52fd67eea4be
SHA256

7b153be55e372db36a20534f8c484801a3acde6ef6bf030288493004c13a5e22
SHA512

34d60328237147137b11df5e241e5bb7db1fb297cd0ee014dd81dde8fd91fb283c6dad97a216d863b195fef90f5e517548fd72c744c216da29f83845e2ae6cd8
SSDEEP

786432:/Xwf1Zq5Y/EKx1YIYmVQBYoFQN4CC22mo9ZO612d8WNWtB/naFIhw9h28046pOFx:75YtssaFQuCC32dg+12nPpIIof7r

Score

7^/10

banker collection credential_access discovery evasion impact persistence

Malware Config

Signatures

Makes use of the framework's Accessibility service 4 TTPs 2 IoCs

Retrieves information displayed on the phone screen using AccessibilityService.

collection evasion credential_access

Input Injection

T1516

Screen Capture

T1513

Keylogging

T1417.001

GUI Input Capture

T1417.002

description	ioc	Process
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId	com.caoeshopmeiapp
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByViewId	com.caoeshopmeiapp

Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
banker discovery

Security Software Discovery
T1418.001

Queries information about running processes on the device 1 TTPs 2 IoCs

Application may abuse the framework's APIs to collect information about running processes on the device.

discovery

Process Discovery

T1424

description	ioc	Process
Framework service call	android.app.IActivityManager.getRunningAppProcesses	com.caoeshopmeiapp
Framework service call	android.app.IActivityManager.getRunningAppProcesses	com.caoeshopmeiapp:remote

Queries information about the current nearby Wi-Fi networks 1 TTPs 2 IoCs

Application may abuse the framework's APIs to collect information about the current nearby Wi-Fi networks.

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.wifi.IWifiManager.getScanResults	com.caoeshopmeiapp
Framework service call	android.net.wifi.IWifiManager.getScanResults	com.caoeshopmeiapp:remote

Reads the content of photos stored on the user's device. 1 TTPs 2 IoCs

collection

Data from Local System

T1533

description	ioc	Process
URI accessed for read	content://media/external/images/media	com.caoeshopmeiapp
URI accessed for read	content://media/external/images/media	com.caoeshopmeiapp:remote

Acquires the wake lock 1 IoCs

description	ioc	Process
Framework service call	android.os.IPowerManager.acquireWakeLock	com.caoeshopmeiapp

Queries information about active data network 1 TTPs 2 IoCs

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.IConnectivityManager.getActiveNetworkInfo	com.caoeshopmeiapp
Framework service call	android.net.IConnectivityManager.getActiveNetworkInfo	com.caoeshopmeiapp:remote

Queries information about the current Wi-Fi connection 1 TTPs 2 IoCs

Application may abuse the framework's APIs to collect information about the current Wi-Fi connection.

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.wifi.IWifiManager.getConnectionInfo	com.caoeshopmeiapp
Framework service call	android.net.wifi.IWifiManager.getConnectionInfo	com.caoeshopmeiapp:remote

Requests cell location 1 TTPs 2 IoCs

Uses Android APIs to to get current cell information.

collection discovery

Location Tracking

T1430

description	ioc	Process
Framework service call	com.android.internal.telephony.ITelephony.getAllCellInfo	com.caoeshopmeiapp
Framework service call	com.android.internal.telephony.ITelephony.getAllCellInfo	com.caoeshopmeiapp:remote

Requests disabling of battery optimizations (often used to enable hiding in the background). 1 TTPs 1 IoCs

evasion

User Evasion

T1628.002

description	ioc	Process
Intent action	android.settings.REQUEST_IGNORE_BATTERY_OPTIMIZATIONS	com.caoeshopmeiapp

Listens for changes in the sensor environment (might be used to detect emulation) 1 TTPs 1 IoCs

evasion

User Evasion

T1628.002

description	ioc	Process
Framework API call	android.hardware.SensorManager.registerListener	com.caoeshopmeiapp:remote

Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 2 IoCs

persistence

Broadcast Receivers

T1624.001

description	ioc	Process
Framework service call	android.app.IActivityManager.registerReceiver	com.caoeshopmeiapp
Framework service call	android.app.IActivityManager.registerReceiver	com.caoeshopmeiapp:remote

Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 2 IoCs

impact

Data Encrypted for Impact

T1471

description	ioc	Process
Framework API call	javax.crypto.Cipher.doFinal	com.caoeshopmeiapp
Framework API call	javax.crypto.Cipher.doFinal	com.caoeshopmeiapp:remote

com.caoeshopmeiapp
1⤵
- Makes use of the framework's Accessibility service
- Queries information about running processes on the device
- Queries information about the current nearby Wi-Fi networks
- Reads the content of photos stored on the user's device.
- Acquires the wake lock
- Queries information about active data network
- Queries information about the current Wi-Fi connection
- Requests cell location
- Requests disabling of battery optimizations (often used to enable hiding in the background).
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Uses Crypto APIs (Might try to encrypt user data)
PID:4283
- getprop ro.product.cpu.abi
  2⤵
  PID:4361

com.caoeshopmeiapp:remote
1⤵
- Queries information about running processes on the device
- Queries information about the current nearby Wi-Fi networks
- Reads the content of photos stored on the user's device.
- Queries information about active data network
- Queries information about the current Wi-Fi connection
- Requests cell location
- Listens for changes in the sensor environment (might be used to detect emulation)
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Uses Crypto APIs (Might try to encrypt user data)
PID:4390

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Event Triggered Execution

T1624

Broadcast Receivers

T1624.001

Privilege Escalation

Defense Evasion

Hide Artifacts

T1628

User Evasion

T1628.002

Input Injection

T1516

Credential Access

Input Capture

T1417

GUI Input Capture

T1417.002

Keylogging

T1417.001

Discovery

Location Tracking

T1430

Process Discovery

T1424

Software Discovery

T1418

Security Software Discovery

T1418.001

System Network Connections Discovery

T1421

Lateral Movement

Collection

Data from Local System

T1533

Input Capture

T1417

GUI Input Capture

T1417.002

Keylogging

T1417.001

Location Tracking

T1430

Screen Capture

T1513

Command and Control

Exfiltration

Impact

Data Encrypted for Impact

T1471

Input Injection

T1516

Replay Monitor

Loading Replay Monitor...

Downloads

/data/data/com.caoeshopmeiapp/databases/google_app_measurement_local.db

Filesize
48KB

MD5
82a9756babcc28de622e5ae884eb2559

SHA1
c5144cbad049052224b84e62c62da2e00b2a1153

SHA256
28cfdd2c64a4ec9c6ccc5d709d7211dd5a179af5d50e94e698e09755ebe62abc

SHA512
308db755d2699b705d9675b50720551ac4b8800384207bac98f1f74f769c3ff4aa0c4426285fc935259aab8202e901780f683045013030a6d93ef68b18f8164c

Download Submit
/data/data/com.caoeshopmeiapp/databases/google_app_measurement_local.db

Filesize
16KB

MD5
c057b52527254bf56cc4e90ba742c60a

SHA1
bc1fe07ba9ebe8752902239a8482216c500fd214

SHA256
080f4bf2c77bb39a8883195fa818c49fc8c98ce31a8737061debd10d0d3e36dc

SHA512
e631ccedcc9f31bb0880a41ef4c0b0d483001c21351570335db7ef43503cb56e4183cc1cb10ef326221185bacec032f211c10cb610fa8c17004b716cc825bdd3

Download Submit
/data/data/com.caoeshopmeiapp/databases/google_app_measurement_local.db

Filesize
16KB

MD5
7ad6cc561ebf50139f0e3c1ff860b4e9

SHA1
8f6bc3feebcaa63e1dbb9c10334dcbf8e8101857

SHA256
c44fa34cbecb8411ee7f87831b884ea88438f47afb8d59a7de6267a85dde665c

SHA512
39f9329225534c6bacf18fa17776c8e74b8a22895e99fb609372473bd48f13670f080f00810ff6e097fe8a0935f9762355767f32f8c8f1b2636f7e503be5bdd1

Download Submit
/data/data/com.caoeshopmeiapp/databases/google_app_measurement_local.db

Filesize
32KB

MD5
b30b48954e9f1df7bf7081f4ba032a16

SHA1
c069d94fad3d4af533f794cd40c6846f7c4dc297

SHA256
5ac82ba93558016a37af0c36ac3185ef34235a196169f654517496bc2bd18fd3

SHA512
95bb8f78cd252ac609810bb049cac76471e315582f7c4f9ca5258057022c01c8feb888191b33f1bb49d29e2253cf83fcdcc100f08443ec2759bba83569e65afc

Download Submit
/data/data/com.caoeshopmeiapp/databases/google_app_measurement_local.db

Filesize
16KB

MD5
7c793a787b43108f5a49751bd489fd3b

SHA1
d9943a365ca9c90d56509b9128b30332a7899c9b

SHA256
48d21f010d923f2420441d3f76ca0b6d1de98bacbeb6f9dd07968a78ea00c866

SHA512
7e33fff634b57bb25561a0472b804ec007c6871063ef8c40c1c2b0493901f00ac035ccddad26b5e0e2d2c34369045d9803db1661cabe51230c3f6e33bd8b0111

Download Submit
/data/data/com.caoeshopmeiapp/databases/google_app_measurement_local.db

Filesize
16KB

MD5
7a33e38979cbb039e9d9e6dae3535232

SHA1
bd3b8614c2a5da2733f2b10b23a4f8a0f5ca7817

SHA256
efc9fc7752b6d40e2af8a51e841e3f8b35af61800f4fbbdcf49ae15e8c760fd9

SHA512
371344c2f677b4e50222bf5764c9df632699165cb0d5d2a3392dfad1135ed9223bac5fa60af94766b13a9715cf3e43cfac63c38627932f59eedb7f12ade070c3

Download Submit
/data/data/com.caoeshopmeiapp/databases/google_app_measurement_local.db-journal

Filesize
28KB

MD5
4dc813c84371fa9e062750b86224b06e

SHA1
5c416a2980328ef817f0f8cad8fb02fd8718538b

SHA256
5e0a875284469fd44e3924e50fe351e39dfbec24e716a9f79ee8ecf4ce2ee6ce

SHA512
99d0858c9548ae215ce7b41178748af91ce56edbe6bafe23b7669d513efeec4a58710fa3f614820ac4e42f00e49b5209edaf44665c0299e2f3e3081255489a16

Download Submit
/data/data/com.caoeshopmeiapp/databases/google_app_measurement_local.db-shm

Filesize
32KB

MD5
bb7df04e1b0a2570657527a7e108ae23

SHA1
5188431849b4613152fd7bdba6a3ff0a4fd6424b

SHA256
c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479

SHA512
768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012

Download Submit
/data/data/com.caoeshopmeiapp/databases/google_app_measurement_local.db-wal

Filesize
52KB

MD5
76b64510d8e4fb6478e2c4f450244f95

SHA1
e72f9b8f82267f0a316624e3f7ea92dab4fdc6e6

SHA256
14e3b4232e6d857f9e31eecc98311dd7119bac8b2ca7f9d5b9463846ebf5e112

SHA512
eb18cb9bc9feea9c4297f0765e8af200f4178abab195d876ca08c143cc5649b303b1e350b954c3fd36ab40b00a94e6d16bcbf7952458659d661efb32a93dfd4f

Download Submit
/data/data/com.caoeshopmeiapp/databases/google_app_measurement_local.db-wal

Filesize
4KB

MD5
7eb7288bbac5b1ea909518a15426f9ed

SHA1
2bea6bc549282e285f462fc50a20646488b2e7df

SHA256
287eda647c5031ce405de053a1b292eebdedaf83901c01381db8206d19facae1

SHA512
bd11124a881f84cbf6db49f7ef5f066b25a91015905420a5ec26dd6c7f8ffa018b50f8ea991fa69c8504d6ff2efb13ccc50effe224f2339330ac996d6c46485e

Download Submit
/data/data/com.caoeshopmeiapp/databases/google_app_measurement_local.db-wal

Filesize
32KB

MD5
347a094c552d1209ab0b1aecefc492d7

SHA1
5ab73efc30b39b443645bc921adb438ede020192

SHA256
c2c08a376667e4f8008420468793a7dc3596160fb8e0df5411d38b8711df633b

SHA512
f2170849971c3b45be72aa99ec0a4d1f2c494ff28bf677c76004f56454b42d0605851e414272c75948e6b7e6e8521e362e5961efb092511e8f25a58c89b3c459

Download Submit
/data/data/com.caoeshopmeiapp/databases/google_app_measurement_local.db-wal

Filesize
4KB

MD5
404d3fa191308fca6410310ed78f9601

SHA1
154042f8acb440715ad1af4e97fd0aae2c4ebf85

SHA256
e6b457266b9fe7b0bebac688b2c889fad1b42e7c299dc87b43d26e40aaba288c

SHA512
e6f6cd18c616e52ac2dd09106580761799b95cfeb384a4f181547843472f2515884ef6b553f9e5f56c0d21d7a1e47642676bc25a4d94bb1f3e9c8224a2bd3218

Download Submit
/data/data/com.caoeshopmeiapp/databases/google_app_measurement_local.db-wal

Filesize
156KB

MD5
d47a0d5fae38614d28bbe7d5a7e50d54

SHA1
322bf2572ee0bf47dd3be77cbfe8723a52ddd6ba

SHA256
608f558102089098351da2a031802123d90dd22de5379e725b9979be6f3e0fdf

SHA512
e6202b081c76c36e1ce95434727dff897bf26d250f9d597261b8a24fab591cb3a2a1bfeea00ca035261339b01b60a110af57a10618a027a638f06c9a15b30dd0

Download Submit
/data/data/com.caoeshopmeiapp/databases/google_app_measurement_local.db-wal

Filesize
4KB

MD5
84e2472a2293f0d16cc23265813c92d1

SHA1
01c52945f9b76248ff1d643a73364fff62672154

SHA256
0d0e3a0ee4b99aad80505914bc351490fc312753fde0c318b0f8694c212aa93d

SHA512
73ff09cc32dd71ce953b220ec2c619db9c17e05bfd2705ac07cddaf87cb7a75a8c8ddbdcd5a17437328d6eaa3f1b7fc3ece288307df7d0582bbd8176d8340b27

Download Submit
/data/data/com.caoeshopmeiapp/databases/shiku.db

Filesize
36KB

MD5
f96428c2bdb0b43a535e939d55363cb6

SHA1
1e25f147606dd1a956e349203a4796011befee93

SHA256
a7f04992a342fc6323785721302d29db033f175f2738973b02e8aff2b77e9b08

SHA512
8aace841be02486b4c107ab547283e771df63bb843536c2d9e5884b002078599d80f44ef10445ea5c59f5380909346600ea55b789f9a619247b51de825cfc8ea

Download Submit
/data/data/com.caoeshopmeiapp/databases/shiku.db

Filesize
220KB

MD5
ed0362176230e3fc033313aa126885e0

SHA1
701a6032f03d7bd61ecd62d27cf2b25c67c8cd52

SHA256
8174748249428d0bc14b30f2eb46e8146319cbeeeafb72066e685664af123cf2

SHA512
cba8c7e0d7dcd152145436981083b2919fa68fbb48926229064cfffe7a1a210a420e77e6ef7d0a56396ff3a1962645aa245e71c8b4b9754992f5de9fa678ae75

Download Submit
/data/data/com.caoeshopmeiapp/databases/shiku.db-journal

Filesize
20KB

MD5
d28bff742fd555a00513316b7919466e

SHA1
32bf03b5a5964f08d01e024a5e1e369ae8ff1ea3

SHA256
783622879994bf599fc7bf3335c8074d6cc6fece0d3c4cce479fb2b073d275a2

SHA512
12bd63ec198453ee7161574b3b319e9cb919b10c2939f8e1407c3f27b2ec2bd08b3834e94cbae417790dcacba2e1a66b688f688446dfabf24453ec2a4d26d137

Download Submit
/data/data/com.caoeshopmeiapp/databases/shiku.db-wal

Filesize
181KB

MD5
96a93bbc3d1f8378d4d93a36718fbcc7

SHA1
741ad9c402a4aaa33ab9d3eff00adfe691d66755

SHA256
77161fa52ff1dce8a51ae3de9e12f59be6a0c4492eeb3fbeaac6e041f5439293

SHA512
345d40cb0af274463d53a1b1f57d37979d0cde3f99cae3c56685380b0e43ad136013627c7a853cd326460aab2a2ecfbed4de4ba0a50ce183290515e1b95eece6

Download Submit
/data/data/com.caoeshopmeiapp/files/libcuid.so

Filesize
129B

MD5
bf58558fc4327d564b5ff82b6a2866f7

SHA1
46ba97350a0ed61176f740299afc81a47dfd0ddb

SHA256
9d80194c9d175ac475a7823375f075ba226dcd0eba99c7496ad9c3981cb7128a

SHA512
6984f9ab9172e158b4d678e62394eb5e7f298bee3b0d74449c73ec6959ddce675bf45dc7b37719107d746620d4d8f76b1c52c6a793af5fac3a43fd88a7d6a8d2

Download Submit
/data/data/com.caoeshopmeiapp/files/lldt/firll.dat

Filesize
16B

MD5
611fcedb9fa211e441ee58c342279066

SHA1
b541b0e94b4e95833757783119d50ae5f11da7f6

SHA256
b96c1644fb66e1d71222b9ff3fa7f93a622e13fe53f2b32e52a7446b68a3565c

SHA512
bbbc07f42f0f9f309f42cb63238e77fda8827e3dde2f91b12c0bbeadad73d88c30e628f22aa12522dfd862a4aad960e76a490de31dee60f6a13a02417155ff56

Download Submit
/data/data/com.caoeshopmeiapp/files/lldt/firll.dat

Filesize
16B

MD5
33525de11a9b068001210768950abdfc

SHA1
3cf1c86605935afd6540fca650c9d682b655b7ed

SHA256
6aef26fdc4d7cb320bcd868e8eba4249ceb5a9d01b81e1bb94ddecb9af9efdfc

SHA512
9836bb4e927a9dd6a60d23c68e8849586f678a4c07cdfb725d108e0a0cb7a0ef2007deca14fb1f4023ef8ff3bd6f8858dbdc323218c369986f0213e32de1c588

Download Submit
/data/data/com.caoeshopmeiapp/files/lldt/gal.db

Filesize
4KB

MD5
d5f97f53cee00330f54e6e08540a961f

SHA1
5934dd1eefd507826f2f7c9430bd6f5fa519ef55

SHA256
b5d20d56264a3aaefb32cb9c927b8f5cb77dab1bcfc5d4a5ef51da07c78a8f33

SHA512
e6db2f33f029b9140316094e01914c6f580573124fac6102683a24d89dd81579e3b76a3f2984f9047df3c3d2ac4b9b75464f85bcc7a28a319dddf6d691eacdfd

Download Submit
/data/data/com.caoeshopmeiapp/files/lldt/gal.db

Filesize
4KB

MD5
e859c7411e968f753f726fe11718bbfd

SHA1
991b0725acd803bdaff14b88f7ba9f2d4ca7e2fb

SHA256
f5b43844b270c481892e45ff06488588de02e387ea2175582bc8b18ee953c88e

SHA512
fed9e80489a58593335f7fed9f4f33d9e13a2ad47299254a172275138e359860a69089e514b6aebb8a0f12d164c523b53651c592c95b7842d45a9f7d8a91b043

Download Submit
/data/data/com.caoeshopmeiapp/files/lldt/gal.db-journal

Filesize
512B

MD5
50af8145e6869b69f6cbbc4ecf02920f

SHA1
40c8dcc7f54d648a7426b7464252266f1de78722

SHA256
70556d0f24c1a6ea6eebdb6a561578dce9f9f67b08f79fd3f90c665259326113

SHA512
df31cb9fad1daca20027932f464b50ed9307be6f7dc036836b50e39b216d589247fc08a37529a1770b4706a3e6c7a678e4a80063869abfde47905ea4adb144ab

Download Submit
/data/data/com.caoeshopmeiapp/files/lldt/gal.db-wal

Filesize
4KB

MD5
30c445e377dd3647ddaa2544ad5f780b

SHA1
7e78b69adb4b3cecd4474181457d2b5a444f6a51

SHA256
7b6de7d6bdeceb8f3ea10d4dd1e0cd5e70306862091a92da03523a107eb35c2c

SHA512
077dcabc5ab682e9cba8ae2ba6497a332d4abe46ce551a0ccf710d44b3af75999e7484edeac514d6be2c9bd739b1330291e68c3a9b483079e0e3d5bfc77c2f7e

Download Submit
/data/data/com.caoeshopmeiapp/files/lldt/gal.db-wal

Filesize
4KB

MD5
7a6e6fb6025e8022366978fb075dfe13

SHA1
72ddcea880853b4ae5d8c34c5c995fee3a220735

SHA256
25ffe1a0f02f4191682c53fea791a7e9fae4c2772affd2d53e7e62bd8fb117db

SHA512
3d010b5b534abfebf94bd73c71790383a58c688af31d70908c8838fc6a8b0cb495aca269a1f42e35b02589b8657131a173fb50e14611b1ae4040a264ddd11294

Download Submit
/data/data/com.caoeshopmeiapp/files/lldt/grtcfrsa.dat

Filesize
801B

MD5
7c366ea8f849e91e3f0f3093867b5c33

SHA1
88bb005e5643134f8719895233047017afe39800

SHA256
d759d062f4eff809dc55ecf5cf8693b0e062bc1bf3301f11d907f555852b20e9

SHA512
4575109c6e7330735b5421dc6f32abec26c5e9a92fc6ceb5b0b0f360ff97ab42f6001e52ebe63199d17ad27c053deb04b26e18af0025c0462886c9576c1d63a6

Download Submit
/data/data/com.caoeshopmeiapp/files/lldt/grtcfrsa.dat

Filesize
206B

MD5
6d613136def26031e18f3f404299bb7e

SHA1
14a7a4a3309b932512dad59dbdb35503845e60c0

SHA256
58e28d4defb46364dd0057354a4a89f8cb726d3b696c632de04b1a707803be18

SHA512
89ac70f36ec3117b631a56d43700b4d034d6d269d4632933fdaa8cd9675c57af1df95f15271d0b45b796f56b4f89ec3d6bd4c9114d7cdd24e3a25d30e24e7ca0

Download Submit
/data/data/com.caoeshopmeiapp/files/lldt/hst.db

Filesize
20KB

MD5
81f8ab4bdf9784e6a1305cc4679866d6

SHA1
aa57dc4d8cb6dc35c68ca6f00f753c1df17cb75a

SHA256
865cdaf9acfbb927648e3df13aeeec1719860b9324dbf27707683a869181cd37

SHA512
2894bc050805e4b29e2b64f7388c86460fcec048e9b6f2161c62b8e766715d09b95620525b0f8514b81815f10dab685b2d1bc7dc6ec891e3a794295326683d59

Download Submit
/data/data/com.caoeshopmeiapp/files/lldt/hst.db

Filesize
4KB

MD5
b44267d8479a981113430a06414e347a

SHA1
b496a2706ed52e5c4c759bb6ff89861f8dc908dc

SHA256
1b8fcdec1738f3d507c523f8f140c8f757c67263ebb1108d292e5c23c32841a7

SHA512
88e5296a16b13a4601e2b950769f027fa7fd7438f5920f61c918075e1897b1425dac21a37a7a26dfb47b54463bc8ca31dab131c6bd130d3a871ddbb454a6df85

Download Submit
/data/data/com.caoeshopmeiapp/files/lldt/hst.db

Filesize
4KB

MD5
70c945153b42c56653438353d22f6552

SHA1
3434446df0ba5a538dfe37088c93e6b9a73d79bb

SHA256
d9900382c3cce3e09a59f3b51f71dffa3359be8bfb211ed59ac659a9d67b70bb

SHA512
edc36bebd62a3abe7bb6c94dfaa8bc37b7012a458c01c129115499a4a6476c01f2f658711aef187a55573a88fe157631f8c4bcf41970b08f8af2dc3a764de650

Download Submit
/data/data/com.caoeshopmeiapp/files/lldt/hst.db-wal

Filesize
4KB

MD5
f6ed934e9e32fc5cb928aeac813da6e9

SHA1
71b5ad6949c0e523d4554ffc636552295bd07b3d

SHA256
d2f87e38ab5689b801e481aaebd7cf18294ea8245aaf78a4b051f1779afa3ca4

SHA512
91808023164d65913f0c51205b56211e53ee9ec50a2f82a0f061b40c2eeaf3e57c0d1412c36ee1af1ff04b333dc0aa0aa8c66c482eec4f5c9dc9bdb8eeed69a3

Download Submit
/data/data/com.caoeshopmeiapp/files/lldt/hst.db-wal

Filesize
4KB

MD5
a8576567a8b8235ae21d22e8eb5ddb69

SHA1
1d8b616ff2b54f777031e7ec49b224b65e2340f7

SHA256
102c712e3d2cca63fe02aa08fa92dce9be0160ad46998d691a1e88a33b0ce8f3

SHA512
25517cb5a6ef7c57221b88ae4c636d8328dd235a9d2ee2bbca5420ca968def53b93168a9066c5849b37d7dfa156d61d02e4cc76f1777c457b2f9f2e118d1a1d1

Download Submit
/data/data/com.caoeshopmeiapp/files/ofld/ofl.config

Filesize
248B

MD5
548dcc11151e6b8f212c229f1107f880

SHA1
0adcbb2232da1aeb4bf5e393b46dd7a64881ddb5

SHA256
5955b4889177f8a8f1c813d2f40cf73ce921e302a4973c43c1fcebb508e6c7e1

SHA512
2c76e5f8b43696605932dd21632746a0dc978f892c71b344ab3ab98e54a57686a5f7b43acfa6fc64e83ded87751d0f127cb362101bdab2e74b6082ae376e76fd

Download Submit
/data/data/com.caoeshopmeiapp/files/ofld/ofl_location.db-journal

Filesize
512B

MD5
e7f87fb3faca5dae1a5083f6ab52d5e7

SHA1
ad1ef639d70600905fc7eaebbe27a3fdd8f28b67

SHA256
3c51ef94ae9942baf3860745e7b95f6d5dff9f21ca769ace63258aeb94323aac

SHA512
29f9529689102fb2f5a94d0089126662cf8dd91bbdd3672be8c94bd781821e6913535c6b7ac30dab87e61f7cf7948694f6bcf42018aec4ff0878167809189f72

Download Submit
/data/data/com.caoeshopmeiapp/no_backup/com.google.InstanceId.properties

Filesize
36KB

MD5
5a9164c261d49ec2954724e97bf3afbb

SHA1
25f0a2258c9d4563d726821e16fba9f82f5fcb6d

SHA256
d4666e02f43029fc0f37d5de6316520031066bd2d6d1a4e4c7eece840f2d8654

SHA512
9f4ff0bb57dc048a04f25abb79ee17aba5968820455e7280295fae62b13520d23c47f099a4d70d3e38945aca980de5e51483e4f3d5d263f3e803157832564e81

Download Submit
/storage/emulated/0/Android/data/com.caoeshopmeiapp/files/tbslog/tbslog.txt

Filesize
15KB

MD5
1715c4a6329a70226dc28c89c3b73d46

SHA1
d5ffb3293d842c59a2671d73ebb49552ffbd571b

SHA256
040091b713570e7a290809e4a3f64471c995421a51ff26ca68d2c4107ded81a3

SHA512
0ce8d773dab224fbc52ab9fb21661d7254956863643a879688da64da26f12258e004d7264f6dfcaf016b81f5f0f7bd1aa71e697138da62bc6bfd986cc8e3f063

Download Submit
/storage/emulated/0/Android/data/com.caoeshopmeiapp/files/tbslog/tbslog.txt

Filesize
9KB

MD5
e969adc71aa84d59137db1597a7e6789

SHA1
08a60eb3d074fe33daa74a5a714511d840b7e130

SHA256
f67a431cc0deab70ee71a09e84101f7d4cbad3bfa86979ee112bc5e123a08990

SHA512
c4ac3b74547a541d5ec87d732ca6a99c0efa25f507d9c05a31a9c695c5dc4337794bb1db06b4eebe8c65d3c1880fa2866d213cb584e5a50bac316df8f5251be1

Download Submit
/storage/emulated/0/backups/.SystemConfig/.cuid2

Filesize
512B

MD5
da3d9f5148b08a4a05156975175651e8

SHA1
734f7770d69d1b507db28edbabdad79277b7c17a

SHA256
09c5d0df3a81bc74b7817d48b7105958123aee9ec7ff39022a77ad56020b085f

SHA512
538060df92ef876c8e9d77a5c19f2b51270ee6570eb08e0c2e44ed5d87dd37d802e0c3c6ac9e81af0c6ab385818ed1636feda83d41481ab118bfb9d8562d6828

Download Submit
/storage/emulated/0/baidu/tempdata/conlts.dat

Filesize
12B

MD5
8d80bc8ea90e9cac010d3ddf97bda5f5

SHA1
f063bc0d356e6ba9ab1eb9a851131ffbefd8fa07

SHA256
f52db31332534833414abd5e870f78c810b8ebbe5b134bbf599506beecfd1b93

SHA512
9ea732dd572a9a4ba91b70891972230a09576687ca1bc19e62d5a98b5b84e0f2ae11985108008bc9fbccf357219b8bd3dbf146bb70752f618f70dc5d0c46a7c7

Download Submit
/storage/emulated/0/baidu/tempdata/conlts.dat

Filesize
155B

MD5
c72947760b49d25b600465b35712475c

SHA1
70bce21465420943bdd0053e3ee22bce5d3c0c65

SHA256
e12c4049cfc29917b967cd52e318cc9fb423600bbb564b67de63b6a835b9679b

SHA512
825dbbd211b191750697c7070c165eafa764c9e5c35fd283743e0a68b4ad28a5ee2a47dae9c2cc7efe1fb3b58d824582d4214522af8e47a73cacc608178f372d

Download Submit
/storage/emulated/0/baidu/tempdata/lcvif.dat

Filesize
96B

MD5
d74c2145029d48182149d8c8821f7c2c

SHA1
b092d08a7315242e2d6fbcf466da41e98d4dc9bd

SHA256
5b5c5933abcd19560cf82a43a49d17e5f8aa1d73b87e640aca0de309d328a46a

SHA512
c1825f21156795a4f2a96ab6c842ee57c7afb1bb353027ba7fc0ecdf2120f5d630f7f39ca35ef61d4c36950a30644a561fafa3b5f8789e8e3cba55ee9afd4b3d

Download Submit
/storage/emulated/0/baidu/tempdata/lcvif.dat

Filesize
96B

MD5
d6cf068e448c7337dd5e233bf504af32

SHA1
eccce62718142a060f93f7c52c9c526f4b9964b3

SHA256
93a8d4cc60aac86b7c33f95da9cde639a0d745ed86b7f7c85b90bdabbc117e6c

SHA512
279fe72322afd36f4008ef20b0231d430befb952ad0db6c43fdb5d4b0971d004f6de5a9d596e24128690684b600774385051140c26e962fb241257e439d6b4ce

Download Submit
/storage/emulated/0/baidu/tempdata/lcvif.dat

Filesize
96B

MD5
b62c27403d7125d0ba45f5ea377b114b

SHA1
853fddafc6a9235df184eb9ed8a63a249ca99747

SHA256
4d9bc56626131b48bb88f7c7fa7f7617208e9956a393c4b67ad8d24ab3e8ca8f

SHA512
9db17ba1cb90f57943bf9b8bc11f1ae25e02c2ae96f1fdd84c8a4fef3689c07a37d522b5dd5e4e79d4ef2aae3ba49f366c1cdebca8941dae390afca9987d97d4

Download Submit
/storage/emulated/0/baidu/tempdata/lcvif.dat

Filesize
96B

MD5
a02c000ea4ae6976aba2af1f6ff71d72

SHA1
7f5152582f4a94919ea742b371f218ab5ba702ef

SHA256
21beb6c434db3fee93ff0c5f5ed9cbed08bb70dda94f64ae111d2a09d19a649c

SHA512
7d69c4db4e76c5dcc38a47a38ad97c67dc5ba4ed15be93603e776202cfc5bdc022614a5503b54e9f50dae908431483937ecc6b79e8431c8ea205412376a6ac68

Download Submit
/storage/emulated/0/baidu/tempdata/yoh.dat

Filesize
24B

MD5
a936690571e9104e1922dda4a0ba5bd1

SHA1
65f49c57edde2f96be2a1dbdfc3f7351f1e66554

SHA256
f0f5049c51879dd7da0ce4a43349b5b34ce053d072a0ca704f62cf22ba4a8412

SHA512
3be1c3693963aebdfc04e86b1c820ee0ec3cf0b200e6a4788ef1141f39fd6c2f77f4227247ae4affa66c0a6c027df8466cc0dcec1e67ebfb953e36bee97de394

Download Submit
/storage/emulated/0/baidu/tempdata/yoh.dat

Filesize
24B

MD5
1681ffc6e046c7af98c9e6c232a3fe0a

SHA1
d3399b7262fb56cb9ed053d68db9291c410839c4

SHA256
9d908ecfb6b256def8b49a7c504e6c889c4b0e41fe6ce3e01863dd7b61a20aa0

SHA512
11bb994b5d2eab48b18667c7d8943e82c9011cb1d974304b8f2b6247a7e6b7f55ca2f7c62893644c3728d17dafd74ae3ba46271cf6287bb9e751c779a26fefc5

Download Submit
/storage/emulated/0/baidu/tempdata/yoh.dat

Filesize
20B

MD5
441018525208457705bf09a8ee3c1093

SHA1
6768033e216468247bd031a0a2d9876d79818f8f

SHA256
de47c9b27eb8d300dbb5f2c353e632c393262cf06340c4fa7f1b40c4cbd36f90

SHA512
d296b892b3a7964bd0cc882fc7c0be948b6bbd8eb1eff8c13942fcaabf1f38772dd56ba4d8ecd0b626ff5cef1cd045a1b0a76910396f3c7430b215a85950e9c3

Download Submit

Resubmissions

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads