7b153be55e372db36a20534f8c484801a3acde6ef6bf030288493004c13a5e22

Resubmissions

10/07/2024, 06:51

240710-hmsldsveqf 7

10/07/2024, 06:46

240710-hjz63asgmm 7

Analysis

max time kernel
177s
max time network
134s
platform
android_x64
resource
android-33-x64-arm64-20240624-en
resource tags

androidarch:arm64arch:x64image:android-33-x64-arm64-20240624-enlocale:en-usos:android-13-x64system
submitted
10/07/2024, 06:51

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

eshop1 (1).apk
Size

52.9MB
MD5

a28c855fb79cfdbbaf6a20cfb68e6347
SHA1

47050c0eff0953f9e71f09b1a68c52fd67eea4be
SHA256

7b153be55e372db36a20534f8c484801a3acde6ef6bf030288493004c13a5e22
SHA512

34d60328237147137b11df5e241e5bb7db1fb297cd0ee014dd81dde8fd91fb283c6dad97a216d863b195fef90f5e517548fd72c744c216da29f83845e2ae6cd8
SSDEEP

786432:/Xwf1Zq5Y/EKx1YIYmVQBYoFQN4CC22mo9ZO612d8WNWtB/naFIhw9h28046pOFx:75YtssaFQuCC32dg+12nPpIIof7r

Score

7^/10

banker collection credential_access discovery evasion impact

Malware Config

Signatures

Makes use of the framework's Accessibility service 4 TTPs 2 IoCs

Retrieves information displayed on the phone screen using AccessibilityService.

collection evasion credential_access

Input Injection

T1516

Screen Capture

T1513

Keylogging

T1417.001

GUI Input Capture

T1417.002

description	ioc	Process
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId	com.caoeshopmeiapp
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByViewId	com.caoeshopmeiapp

Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
banker discovery

Security Software Discovery
T1418.001

Queries information about running processes on the device 1 TTPs 2 IoCs

Application may abuse the framework's APIs to collect information about running processes on the device.

discovery

Process Discovery

T1424

description	ioc	Process
Framework service call	android.app.IActivityManager.getRunningAppProcesses	com.caoeshopmeiapp:remote
Framework service call	android.app.IActivityManager.getRunningAppProcesses	com.caoeshopmeiapp

Reads the content of photos stored on the user's device. 1 TTPs 2 IoCs

collection

Data from Local System

T1533

description	ioc	Process
URI accessed for read	content://media/external/images/media	com.caoeshopmeiapp
URI accessed for read	content://media/external/images/media	com.caoeshopmeiapp:remote

Requests cell location 2 TTPs 4 IoCs

Uses Android APIs to to get current cell location.

collection discovery evasion

Location Tracking

T1430

Geofencing

T1627.001

description	ioc	Process
Framework service call	com.android.internal.telephony.ITelephony.getCellLocation	com.caoeshopmeiapp
Framework service call	com.android.internal.telephony.ITelephony.getCellLocation	com.caoeshopmeiapp:remote
Framework service call	com.android.internal.telephony.ITelephony.getAllCellInfo	com.caoeshopmeiapp
Framework service call	com.android.internal.telephony.ITelephony.getAllCellInfo	com.caoeshopmeiapp:remote

Acquires the wake lock 1 IoCs

description	ioc	Process
Framework service call	android.os.IPowerManager.acquireWakeLock	com.caoeshopmeiapp

Performs UI accessibility actions on behalf of the user 1 TTPs 8 IoCs

Application may abuse the accessibility service to prevent their removal.

evasion

Prevent Application Removal

T1629.001

ioc	Process
android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction	com.caoeshopmeiapp
android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction	com.caoeshopmeiapp
android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction	com.caoeshopmeiapp
android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction	com.caoeshopmeiapp
android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction	com.caoeshopmeiapp
android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction	com.caoeshopmeiapp
android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction	com.caoeshopmeiapp
android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction	com.caoeshopmeiapp

Queries information about active data network 1 TTPs 2 IoCs

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.IConnectivityManager.getActiveNetworkInfo	com.caoeshopmeiapp:remote
Framework service call	android.net.IConnectivityManager.getActiveNetworkInfo	com.caoeshopmeiapp

Reads information about phone network operator. 1 TTPs
discovery

System Network Configuration Discovery
T1422

Requests disabling of battery optimizations (often used to enable hiding in the background). 1 TTPs 1 IoCs

evasion

User Evasion

T1628.002

description	ioc	Process
Intent action	android.settings.REQUEST_IGNORE_BATTERY_OPTIMIZATIONS	com.caoeshopmeiapp

Requests enabling of the accessibility settings. 1 IoCs

description	ioc	Process
Intent action	android.settings.ACCESSIBILITY_SETTINGS	com.caoeshopmeiapp

Listens for changes in the sensor environment (might be used to detect emulation) 1 TTPs 1 IoCs

evasion

User Evasion

T1628.002

description	ioc	Process
Framework API call	android.hardware.SensorManager.registerListener	com.caoeshopmeiapp:remote

Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 2 IoCs

impact

Data Encrypted for Impact

T1471

description	ioc	Process
Framework API call	javax.crypto.Cipher.doFinal	com.caoeshopmeiapp
Framework API call	javax.crypto.Cipher.doFinal	com.caoeshopmeiapp:remote

com.caoeshopmeiapp
1⤵
- Makes use of the framework's Accessibility service
- Queries information about running processes on the device
- Reads the content of photos stored on the user's device.
- Requests cell location
- Acquires the wake lock
- Performs UI accessibility actions on behalf of the user
- Queries information about active data network
- Requests disabling of battery optimizations (often used to enable hiding in the background).
- Requests enabling of the accessibility settings.
- Uses Crypto APIs (Might try to encrypt user data)
PID:4422

com.caoeshopmeiapp:remote
1⤵
- Queries information about running processes on the device
- Reads the content of photos stored on the user's device.
- Requests cell location
- Queries information about active data network
- Listens for changes in the sensor environment (might be used to detect emulation)
- Uses Crypto APIs (Might try to encrypt user data)
PID:4609

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Execution Guardrails

T1627

Geofencing

T1627.001

Hide Artifacts

T1628

User Evasion

T1628.002

Impair Defenses

T1629

Prevent Application Removal

T1629.001

Input Injection

T1516

Credential Access

Input Capture

T1417

GUI Input Capture

T1417.002

Keylogging

T1417.001

Discovery

Location Tracking

T1430

Process Discovery

T1424

Software Discovery

T1418

Security Software Discovery

T1418.001

System Network Configuration Discovery

T1422

System Network Connections Discovery

T1421

Lateral Movement

Collection

Data from Local System

T1533

Input Capture

T1417

GUI Input Capture

T1417.002

Keylogging

T1417.001

Location Tracking

T1430

Screen Capture

T1513

Command and Control

Exfiltration

Impact

Data Encrypted for Impact

T1471

Input Injection

T1516

Replay Monitor

Loading Replay Monitor...

Downloads

/data/user/0/com.caoeshopmeiapp/databases/google_app_measurement_local.db

Filesize
16KB

MD5
2219cbb95858d09d0d1a8cd4c45ade42

SHA1
1438cf70ca418b6dbdabea35d3972341c2f74722

SHA256
b2343197a1bb3e26460abff09d73910a7a01d4ad06309beeab14b88da80e20a3

SHA512
99b3531f1a95aaa768992d362a628481eb0eccfbb7d622c7f537aa794a366d5e4e78840251eabe497cd766d2780bd9c6b364dd3c962f644888e086d8b63a8832

Download Submit
/data/user/0/com.caoeshopmeiapp/databases/google_app_measurement_local.db

Filesize
16KB

MD5
58aa61e742e9912eac6178ae7ffe8512

SHA1
e2c1dcb42508111957113bfa16a444b55f8aefec

SHA256
b76e99441f086d88e56f69e9378ed3e164c1ad98bd289360f0fc35c474ccf864

SHA512
366ff26a1ac87927ac40d61619c3d25b018e7d736b898c36e0cfa32c3bdb84b7b7df6b17382a4701c2ad350f9a0be60d0b98a949f36efde74e1b8f8c63cf7a3a

Download Submit
/data/user/0/com.caoeshopmeiapp/databases/google_app_measurement_local.db

Filesize
16KB

MD5
8843b3c728524f779738e00cb0647c46

SHA1
7f2b65d19fdc62187a09f657d35caf7cc01a8b05

SHA256
23189a2e69f04cc2c563a41ff5dce776c9e9506604235cfdb00153903b1a962e

SHA512
d4893a29adf79a68c4f314fa061abcf4963653a4ed01a18c316f1f65229d29f1bf26001df14ea9c0bb8ecab508089eeac87cfd2db756e6b4e53c5c9fd5105e62

Download Submit
/data/user/0/com.caoeshopmeiapp/databases/google_app_measurement_local.db-journal

Filesize
512B

MD5
c5584abf05c37b1cc65996b27bd3e0f4

SHA1
121804226dd90add6a71ef410b395565921d78a7

SHA256
7718c7f1f855746bd19eeb98dda5eb9897aab50fda77265c167b15f32ad4d9e1

SHA512
52388cd5b219f465a360d952c9f90f0a606afa2cfc3ef14093c9fcafb50f8663c903fc37eae398d5b4132432d4f116ed207e9727f7ac44c092166f7ad898518e

Download Submit
/data/user/0/com.caoeshopmeiapp/databases/google_app_measurement_local.db-journal

Filesize
8KB

MD5
7b6c90ab4dcd1f82330c9490da919ac4

SHA1
fb6590df195cbdf77966685ca9ad8359933a02e2

SHA256
4d8587de8645863bc65e73dc6b517ff748914b9070fefe0150999f06aad12e82

SHA512
1c875d5030f20ef32cabcd73259ea2d279f730b3dac5aa3c4c5a2a6427c30c722a86cdeedf8c287a700fae7db9531ee91d273b47200f048659298d36cf707f1c

Download Submit
/data/user/0/com.caoeshopmeiapp/databases/google_app_measurement_local.db-journal

Filesize
20KB

MD5
b9bcb163064525e983f5ba24c12ca027

SHA1
0d1a23a8aaa8bd4e4a577d9addd223bf3781129e

SHA256
a2a39f6d2b6aec06d97cd95dfc1b08d661f39d8597cf419290954b22cb640f7f

SHA512
86290ddffb11a5f567fffe211d7b7fa93c1b0a17031c9b79b0b5078571bdb1d246b168db5b70a884ce9dd0973f32c947aee9517633e9b2b5f1a8839f48760c05

Download Submit
/data/user/0/com.caoeshopmeiapp/databases/google_app_measurement_local.db-journal

Filesize
8KB

MD5
fe71e802dc2babc3e892776e14f0a83f

SHA1
fca9c22899b1781c904295e968f183b73de7c369

SHA256
777708e3353583bb225948e7a4274a63cdc29c8d0b5d0eb9cbeee6b8dc8961b3

SHA512
fda70c987bb927f365dc3b78446c662daab990635a917cee49ce3530ec7a00b5e2a1715da339f9846887961e604be94e3080a9b7dfc207b317e5731a42ec10a5

Download Submit
/data/user/0/com.caoeshopmeiapp/databases/google_app_measurement_local.db-journal

Filesize
8KB

MD5
9d9d9b7916230256594c3656c00f2af9

SHA1
1c9a2f153ec5d0a702760c6accb90a773f0f99dd

SHA256
9b14deb89e699ef4935e8c3482158dc6e815167b691c4e0dad389c4bf8c606cc

SHA512
4bc521c5acccf36231ab4f5a71b266173a0b863c42ffa2137512674fab6996bced942a2b8bcccb6fdc6831d3e52f189d671a0a2691ac777c3f16edef1161768e

Download Submit
/data/user/0/com.caoeshopmeiapp/databases/google_app_measurement_local.db-journal

Filesize
8KB

MD5
4cebb1d8c2132c4cd303b2e0496ee620

SHA1
46289f540f46a695847268881290ac3cfea8f5d2

SHA256
7ce7c19ddc9408240aba9e059b17faef7d1f6eb15183f17786e6075e3db1a4de

SHA512
5b04e492b1a47f30b9bb774bf7a8352ffbe62b3479eb338be91d218e4a1e95285de6d77168fda0b3ed88de63c6beb2ede94efb8df8ffde157201af86658a4efc

Download Submit
/data/user/0/com.caoeshopmeiapp/databases/shiku.db

Filesize
300KB

MD5
5f521de9915bcdd9c4293266609ad390

SHA1
0c5ff178abc5e20dd3f53cf61a3e8a947a9c2196

SHA256
2cb3b6d2be310c17c6365e8656899b1d02a51ea34fdc81b326dea7351d8aefe6

SHA512
00444e67ae88b9c0c87baea5f007a1fc2172d1f896f5ebbf4e70bd8fac2bcc35ad16f5c2c5a3e4ca135305e3751f6c76b2131139c37da8caf6d512c249342ac9

Download Submit
/data/user/0/com.caoeshopmeiapp/databases/shiku.db

Filesize
220KB

MD5
bdfea50a21af8b224316f247f01b6e22

SHA1
f444c8d54079e13e73e1deeaf6b90a43864e867e

SHA256
9dadc5ed9035ee564c7941369db3e5c3e19f626b5c74eaec74770c789ef380aa

SHA512
b936f65c70c468b06887f508b691ca8426c2f1f27c3ce6c7e96e0fd2e9dc6f39e3442672d98cd792e14e5e99caa4be622760b28268662f571b9b477ecd0f7088

Download Submit
/data/user/0/com.caoeshopmeiapp/databases/shiku.db-journal

Filesize
28KB

MD5
dda2d0db1f873753027aefce5f20000b

SHA1
965398d3025cadc91e2dd53c0ac44469ebd37a45

SHA256
4f67a00cdea8529d699f15761a58b0e5db9fdcce7d2cbae65ff7e3df9f988ff2

SHA512
b5ca072f5e0d9adef62480829492ebb4585d2dfa71022d1ff61e289ffcbe08f237f3bfa3e4c3018ecd2f57a5992bbc1fae6d963db831eff0b9ea68f5aa1e2c43

Download Submit
/data/user/0/com.caoeshopmeiapp/databases/shiku.db-journal

Filesize
80KB

MD5
945a0351e5b24cfaa9c7ce225506415a

SHA1
e708e66a4da088c5cf780787a9296d4ad85c43e2

SHA256
d24fef3bc5c518a46116cb78e38eff70c255a180035bb356e26fb98b7021fa02

SHA512
69551a4a4016cdfafddc6a64b87addd45fdd7dcb3c768d1a1d223c98435bcf7531a4603fcff38c929ab3905475db9259f16ff52950c83b6a15cdb4048280d6d9

Download Submit
/data/user/0/com.caoeshopmeiapp/databases/shiku.db-journal

Filesize
16KB

MD5
23d98342b62c168a43b7cb5b072fc374

SHA1
8ec4f4f908d1ea8560e249604e40f2ac0649ffff

SHA256
024e702b5a10339aca07ba87ca34bc36aeba0e30526d0c15588684e6920bdd2d

SHA512
e15fc27a4c3d9a8458479200372060799c32014d2358987f69891926ffd03f3960f323394942852a4e543ad6f592cbdd6beb734d9aff0e5a692b0b887fc526f4

Download Submit
/data/user/0/com.caoeshopmeiapp/files/libcuid.so

Filesize
512B

MD5
a65dceaf7f383bb685265ce3ed4b9d0a

SHA1
d122eb39bf47457a1cf8181471c447e9444549b3

SHA256
ad7d75d346662fbc9e4aff5d790db1a0879c413316f0210cf9baf20e658039c1

SHA512
85135cabb58fa396afe9ad7d455b6c3c13df3f1276488559cd0059e70ff9903a8a2d7d414782147496fcde6a17452af90c2e2603f82d84ea79ee8c4ceab605a9

Download Submit
/data/user/0/com.caoeshopmeiapp/files/lldt/firll.dat

Filesize
76B

MD5
c59369fe8d97bfeda7c9b6e1ad4b41a6

SHA1
8b6e9c1cca6efd3fe733900fd3f17aa0e1da429c

SHA256
5802b009bbb17363c7c16ba8b603f3040cd6e7351613646469e8d7c6dabe87c3

SHA512
bb5a9a731a2051549f58045b514f7276c28dba3d5f870c38d54cbfc93a614d28c824152ca2a5422e4a079beb933000fd4cf77af9e7d14e9c1d408a5386a974d3

Download Submit
/data/user/0/com.caoeshopmeiapp/files/lldt/firll.dat

Filesize
16B

MD5
2324a70507fc1ae648cdf4e27db8bae9

SHA1
b74a4cc93462b4a343b65c59239cc203c44238b6

SHA256
3ec8ef564f536cb86873bb57704ccf7d21f73463816785df0b4daf5b9230f28d

SHA512
1dd05e402e668f94c78db260b4aeaebaac308eebc85b334b86897c91f97898ad7563229e07ae29254797720bc7f4e2e594e6d0ea0529d1ade9e497baea2f06a3

Download Submit
/data/user/0/com.caoeshopmeiapp/files/lldt/firll.dat

Filesize
16B

MD5
1847625c15452b7e5941c3e374345be5

SHA1
a0d87a5471af676c4f038ba118d79ba7809e095f

SHA256
e1328b32540f0e49d62d023483bfc97c90f431942b39dea7a79e5a2d285fecf7

SHA512
12e89a3450aabb6fd4f9226fd7a4a36e3664614183e6d1f7f341981d262e3efec1110925253df950a165c63ab0dc569eea64bc63d61015a36fdcf41fab2e0058

Download Submit
/data/user/0/com.caoeshopmeiapp/files/lldt/gal.db

Filesize
4KB

MD5
c4911dc570610bd93ca573cdeea70ee4

SHA1
92c5d1ac294b96ee3b5b04b48f1500d6520ab087

SHA256
78dec235f5181c6ecd39f0199cd99c4641fcc728cef175870df8d6b6442c72c7

SHA512
ef11c3dfb03c41ba36b586049c5d0d67f9c44aa305f5cafda4237db7e91ae04787b15a191648016fc52ff66eca5ecbb3c26b60ddce3a097823eb4652d93a6189

Download Submit
/data/user/0/com.caoeshopmeiapp/files/lldt/gal.db-journal

Filesize
4KB

MD5
72742d4fef6b5892547e268cc9685fd1

SHA1
759ef4dd929ba8c562c98c40127ed180b47d1e4a

SHA256
4aa8c3bc2fddf10cbe6f160ca52cd4370c603a53e2d2f14f8d788c787d1b5249

SHA512
a5fa1f34be85e333130765b6779a3dcfc75bd654b2ccd5e0c21389cf64847ace108e4e8b260fcef04ca59c1e0469142bfd1189cb6122615e27fddda8e9c99691

Download Submit
/data/user/0/com.caoeshopmeiapp/files/lldt/grtcfrsa.dat

Filesize
801B

MD5
7c366ea8f849e91e3f0f3093867b5c33

SHA1
88bb005e5643134f8719895233047017afe39800

SHA256
d759d062f4eff809dc55ecf5cf8693b0e062bc1bf3301f11d907f555852b20e9

SHA512
4575109c6e7330735b5421dc6f32abec26c5e9a92fc6ceb5b0b0f360ff97ab42f6001e52ebe63199d17ad27c053deb04b26e18af0025c0462886c9576c1d63a6

Download Submit
/data/user/0/com.caoeshopmeiapp/files/lldt/grtcfrsa.dat

Filesize
206B

MD5
6d613136def26031e18f3f404299bb7e

SHA1
14a7a4a3309b932512dad59dbdb35503845e60c0

SHA256
58e28d4defb46364dd0057354a4a89f8cb726d3b696c632de04b1a707803be18

SHA512
89ac70f36ec3117b631a56d43700b4d034d6d269d4632933fdaa8cd9675c57af1df95f15271d0b45b796f56b4f89ec3d6bd4c9114d7cdd24e3a25d30e24e7ca0

Download Submit
/data/user/0/com.caoeshopmeiapp/files/lldt/hst.db

Filesize
4KB

MD5
c9e500d2adb6f1c674064a00c78e0430

SHA1
dc7d05c243b3fcc82ab853196784365e06095116

SHA256
c52350168cf27e8f18ea1219c587e9c298d4e5f5de23db4f704db92c9273f0d2

SHA512
34b1c44b9f77863ed31436eb88c283c83714646c9b5a54af6b611a31a97f58f6f96c338bd475a1e4087cd3b008c9209793128dde186566052f8c43b9c43b8dcc

Download Submit
/data/user/0/com.caoeshopmeiapp/files/lldt/hst.db-journal

Filesize
4KB

MD5
2895b916d723b5bca38ccf213938d83a

SHA1
a6823bdf1a964c7ff19f4a990c013412d30c7fd1

SHA256
4eec0e0728b51af82aa3dc2c323161d09256eeee781da605bd19b24af7a6bef9

SHA512
3fcc738637f350c56a8f62bb09a121fa0cd4cc1b3b9a254f476342aad80443294aacfe40ea8fb00bd4bab6dcefdaa99a1c96e465cf2bf86656d49d12557a03c0

Download Submit
/data/user/0/com.caoeshopmeiapp/files/lldt/hst.db-journal

Filesize
8KB

MD5
5a665feb2b71638f84a4f5295884fc38

SHA1
099b8bb0a12763fdfc7b2ccf9eaf87171f19289f

SHA256
98479b081df677e278f8a4d93ba4a5a4071d810bb99c46475192eb9ffd4fbd6e

SHA512
9e1a236a8ca90e70621ac0a2a4ec1a219a72179869d4936f7a96b92a2416b35736359067ba5c7012f39c659b7064b84b83a2f83066c230afe96f33746224c9fe

Download Submit
/data/user/0/com.caoeshopmeiapp/files/ofld/ofl_location.db

Filesize
28KB

MD5
9c7a5af15224ed7482d07904f9e7a7f4

SHA1
d17be82eeabd2a945a77ca7fb46f811c70924b7b

SHA256
4be241722aee24f320f772442215463697225d58d741972856c97944079227cf

SHA512
28f487929958f42729072e98d5d203e28b6119e57b23b126edec843dd1f36fb576e3c8bd5906f1d1dc6aa94c54b866e0c0634d6a12b8c644f33f0c81f5f78bc7

Download Submit
/data/user/0/com.caoeshopmeiapp/files/ofld/ofl_location.db-journal

Filesize
16KB

MD5
08bbc7899bacf5cab61f02750df16918

SHA1
6781cb2c92af4f88d732407abdf0e9c6bf4f508a

SHA256
8d622838afd067a86c7fc3bfd0586ac08dbb19cbb1739edefea342e6c88e03bb

SHA512
ad6619f7fc28c6a87b3d10fe9be0d260dc1dc928fa5633c5d5cfa753849689a5347b4dc36e34a3b5e3224fe8259f01cb55cfbec287ff2b8f6183d7a0b7495e7b

Download Submit
/data/user/0/com.caoeshopmeiapp/files/ofld/ofl_location.db-journal

Filesize
16KB

MD5
7b0d8e46ddbf8d95c19fc4097cbdb877

SHA1
80e449d7b63c5c02824b98f1f76c5b14ec491f13

SHA256
112cd871c70e41cf4ce8b4ed1064422043b533e47f0b6b20958dbe4213aeb106

SHA512
9a3c6ee03d8e2e4ce2943ac973efd50a6fde37da72b9a7fec44d5dc1571edc4b453ee1087bcafd46b8d5ef05ecf2eda18df49e7c5422eb8bac14503f62db4981

Download Submit
/data/user/0/com.caoeshopmeiapp/files/ofld/ofl_location.db-journal

Filesize
16KB

MD5
dab21459509b57a269f610d976e554fc

SHA1
9becd8804477ca47ef444f7d8022c66773cba397

SHA256
08ff801d52838f1c895fa243c227224f5633c4e71e47776d34f419be814841e8

SHA512
7d331bd9f5be727d9ca2e9db3f420c857cd466aa1feab4183b744490dc4e1ad2139d16ed017378e9a2753be427d1e8777cc49d8b093c36e316b22d0a48decc8c

Download Submit
/data/user/0/com.caoeshopmeiapp/files/ofld/ofl_statistics.db

Filesize
80KB

MD5
59aaa9aba73ac8d1aafe74aed254eb8c

SHA1
9ab4abb4f03caf9e70b9c39635d03f3edcf3b5cb

SHA256
0056be25c8a22451ec94b6c29846c4ba878eb8cb42c9522aa7f9d17645c7866e

SHA512
6669453faa70b8306ef34c6c84e51a8f225c0b478091c5bc77fb098dd4df1debf6b25766a5836b88b5bf8fbed8c6e445449317450a13e0c94854092aab76e651

Download Submit
/data/user/0/com.caoeshopmeiapp/files/ofld/ofl_statistics.db-journal

Filesize
512B

MD5
b6e0cde7679a6f2d01ba9db3154c2172

SHA1
538390ca0e52aeb8878a003dea00ac4edb97cc63

SHA256
37e90a970604d2e24130221a95c1d376f4710b129e7bc35f219d1ff918bdcfe0

SHA512
3214b7890733ef8093c0ce7c23c1e83d85fea4db4dd3132baef508e1878d030e359fc643426c3dfb88d844d142fa3ca7aef1562e085fc265bc985002f132fc20

Download Submit
/data/user/0/com.caoeshopmeiapp/files/ofld/ofl_statistics.db-journal

Filesize
8KB

MD5
36b0feceecfb0fa19354fb7c97f5954e

SHA1
0b801ebc40a4d60a05f19f46c07545624ae0e37c

SHA256
4e8a2f833cb18b140d3c49b02ed7da2021479bcb8b292081ccb6da93683c235b

SHA512
8719f12436ef1da63e6976b2664eedc9978442fd24ca1d334bfcf7c0f49f307cb6a9306710724bf559f607448fb5f84d5da3823fd2107d42dcb54872198b0502

Download Submit
/data/user/0/com.caoeshopmeiapp/files/ofld/ofl_statistics.db-journal

Filesize
8KB

MD5
473ccef9429e712a83ac083c2925404d

SHA1
d81f81ac873cd4aaa2cc67841e6fbf1dc45c7a50

SHA256
edab2261e9d8fffe5ed92dd2b4756a47521d300490629749aaaefcaac1dc80c9

SHA512
beba217639d6752f345699efb3dc788ec64169c87c6c88b6cb32dc7763b6eb8b8a75fd80c9bd1b1c8c22321030b749f516186decbf217a62c071801e68cdb0af

Download Submit
/data/user/0/com.caoeshopmeiapp/files/ofld/ofl_statistics.db-journal

Filesize
8KB

MD5
7f9b6e5b056a80074704a777baa843e9

SHA1
63aa68200d5e6720334a03097994fdfa1388c7bd

SHA256
5c2a7150813aaec61c551eac8174bb89d542763336bef191025d0327593b3046

SHA512
8b6eb5bd674e992c68574c4b13a8a75a564fd68a7f1a1c44ebee78adddbf7cf94ec444d6b547aa2fbebf605882b671ceb93b89a43c0c2bc4b5d3b8ac7fb1577d

Download Submit
/data/user/0/com.caoeshopmeiapp/files/ofld/ofl_statistics.db-journal

Filesize
8KB

MD5
76f2e2597713404277d9c232f6e26278

SHA1
d4e785c13ea9fd5dbb68ece1936a6684609533ce

SHA256
3abeb3134d630ebda90447087d3b43185d0f1f8b57c6ae587cfe76a91c19da13

SHA512
a72294c2e79031289a335e2b9797eb3ba88c6cac40e89cb6381dfb947dbbf1fe5e5aeab8adeb18ddc022f46a67151211b1dd96b52244d36ec2d96f5a800502ca

Download Submit
/data/user/0/com.caoeshopmeiapp/files/ofld/ofl_statistics.db-journal

Filesize
8KB

MD5
39b112b3fa9cbbc4f4192f7627f89e7e

SHA1
9da60acab1ccaf180d721facf2ef5379a807ff48

SHA256
a23ea8b589ee43d5079301ed628459db6cfa32b70300c3d592c4baa056bb7f7a

SHA512
61200df2e15e80ff8bb10f16621e6d133bea1499a8141d2f1242c473b7b46d2036f10a64a70424179efe04c282cd9ddf3f0eba22f16bfb5e7c62e9c727528551

Download Submit
/data/user/0/com.caoeshopmeiapp/no_backup/com.google.InstanceId.properties

Filesize
2KB

MD5
b4dd4531548948e4bbbf10f938e72c0f

SHA1
075aaf34222f210ac5926b93d09df1422d72d4cc

SHA256
a069017151a16f5a3577d41b4727ace1c982456d9b904a6c62f5b5bce1733a77

SHA512
f412b445346a69b8834ff44b34aacd55276433c81ba013d76c29ae3110a23b0bc8537c0103a73db331e0741b97b3ede72a26033d104bddbdaa8134756c99ca0c

Download Submit
/storage/emulated/0/Android/data/com.caoeshopmeiapp/files/tbslog/tbslog.txt

Filesize
6KB

MD5
1571ef0946c86361252d6f9fbb2050d6

SHA1
21c8930d801d826041279c786f70e5fe7a9d5f4d

SHA256
bed49b429b4093991fdcadf793da298dcb40edcab1596f92231cd9af39742ef0

SHA512
dea2e5095e011ddda992de02db13f17230d50b918985be3bf1862ac2b9cd2e47109ac4a6c223f0a64585a4c06dca7fbf169ddecf377191c807611cf6bc7e2468

Download Submit
/storage/emulated/0/Android/data/com.caoeshopmeiapp/files/tbslog/tbslog.txt (deleted)

Filesize
16KB

MD5
c5f8c4ce128c087a4fb345d4ea687c00

SHA1
5fb368fd7eeed15c5349a7d8cb48f1da3a46f2fc

SHA256
fa7f4fd22ff5d44acf6c6acaaeb49766aacd58af992110d6ce9891802db7b02b

SHA512
61aea15d1d98b530081f17c5614ddef6eee5d4853732884601774617cf6ff0010755c5b6fe87c4bc2c000eb39718afddcbc6b8a2b6f1c92c3070e1668f30d6d2

Download Submit
/storage/emulated/0/backups/.SystemConfig/.cuid2

Filesize
20KB

MD5
20497ec56b8a098d0eb2ab45c7a51a7c

SHA1
65619ce3ef7c732c838b0a2b4df4e6690b1a80f2

SHA256
d66302795267dc459276ce27fbfced420be4a78ecbb7cc10b1353d13b6b01211

SHA512
260ecb0a18e94e13baf3e489a245b07f9499c502710c114ab26b31eb5531e2ec51a6953535b65508e4f0a74ceba71c07876405b6ce17393af42211eb73f6edcc

Download Submit
/storage/emulated/0/baidu/tempdata/conlts.dat

Filesize
12B

MD5
8d80bc8ea90e9cac010d3ddf97bda5f5

SHA1
f063bc0d356e6ba9ab1eb9a851131ffbefd8fa07

SHA256
f52db31332534833414abd5e870f78c810b8ebbe5b134bbf599506beecfd1b93

SHA512
9ea732dd572a9a4ba91b70891972230a09576687ca1bc19e62d5a98b5b84e0f2ae11985108008bc9fbccf357219b8bd3dbf146bb70752f618f70dc5d0c46a7c7

Download Submit
/storage/emulated/0/baidu/tempdata/conlts.dat

Filesize
155B

MD5
c72947760b49d25b600465b35712475c

SHA1
70bce21465420943bdd0053e3ee22bce5d3c0c65

SHA256
e12c4049cfc29917b967cd52e318cc9fb423600bbb564b67de63b6a835b9679b

SHA512
825dbbd211b191750697c7070c165eafa764c9e5c35fd283743e0a68b4ad28a5ee2a47dae9c2cc7efe1fb3b58d824582d4214522af8e47a73cacc608178f372d

Download Submit
/storage/emulated/0/baidu/tempdata/lcvif.dat

Filesize
96B

MD5
a8f12ba0e9fc2f0b537a8a0f9b53e5d2

SHA1
f7353f7981d78004d9c4242e4399c3aa216d6ac0

SHA256
bf69d836826025701ac380216ed5c84cf6fef86ba99fd46cff94ab1e5fa12977

SHA512
fcd5610e80f711f08895eaebb896402b2d18b0156e55ff97003170c30b88e463152acaf1f24d767f9533c3ce7f9119faa1fe62636933be8ba66f0aeba898a01c

Download Submit
/storage/emulated/0/baidu/tempdata/lcvif.dat

Filesize
96B

MD5
f7acb29510e6b9c33a3598b3636d1b97

SHA1
2acac0bf07b33d5a18a6385221164634ac0a3fe2

SHA256
f3b64d6d5385ffce6a5f24df56e0c91f756a6f48990ad953cce92e366a832038

SHA512
61650f737bbf5b667f0640b31557d65930d02246a3b0b9718c33dbe4b225b491223ea7eecc3ca5d2c7451eb97796082006defc260f5dd8df7b72f0384cf70286

Download Submit
/storage/emulated/0/baidu/tempdata/lcvif.dat

Filesize
96B

MD5
3975846d4e5277063ef53077c8fd6c83

SHA1
fa0c239a2c7bda2623eb46528a91bfad565d61f6

SHA256
f3e09d883a3c4f6d05617432e5cfeadac6123d1f8c8b5c892a872814f570666e

SHA512
153656626968f847e708a4e4076fff58cdd33fea672dfb27f043404cbf2383a4f361c34fcc2ab492dc0f6383d87f14b576b0cd137dadbd4e0e3e318796328b9f

Download Submit
/storage/emulated/0/baidu/tempdata/ls.db-journal

Filesize
8KB

MD5
0b1c95f26be6bc58c5f232e505c18082

SHA1
fb0d1423dd90902ef82952f1ca8b6b4395831b9f

SHA256
74fcd62419189d065bb1aa54de03eec09c576808d16c2e425e029d3636e68102

SHA512
4fc501d3e66f7ff5efdefc68aca6d51bfbb4a2403ea69c74f59bacc1204e764d3c88dae46c09783f4201e4cbcafc890849917b540b22aabac0d86d725a4cf9ab

Download Submit
/storage/emulated/0/baidu/tempdata/ls.db-journal

Filesize
8KB

MD5
75bebaae0cb02131081b82854fb83d6a

SHA1
02b56102ce96d5ea6775079e68d9b374b568c6aa

SHA256
0d0e402f19526e3cb0cdbeb292f4e37bce5e721ab92c8a245801ce5ab73f63c7

SHA512
ea1c8055db441464cae06a06be08f7b5cfcb44dc8c4be4d443a90dd83f0e8ed736105ecdff3bac467d8429b5af9a93172cf3c6fd8ca9db09d4016fb0452c5984

Download Submit
/storage/emulated/0/baidu/tempdata/yoh.dat

Filesize
24B

MD5
a936690571e9104e1922dda4a0ba5bd1

SHA1
65f49c57edde2f96be2a1dbdfc3f7351f1e66554

SHA256
f0f5049c51879dd7da0ce4a43349b5b34ce053d072a0ca704f62cf22ba4a8412

SHA512
3be1c3693963aebdfc04e86b1c820ee0ec3cf0b200e6a4788ef1141f39fd6c2f77f4227247ae4affa66c0a6c027df8466cc0dcec1e67ebfb953e36bee97de394

Download Submit
/storage/emulated/0/baidu/tempdata/yoh.dat

Filesize
24B

MD5
1681ffc6e046c7af98c9e6c232a3fe0a

SHA1
d3399b7262fb56cb9ed053d68db9291c410839c4

SHA256
9d908ecfb6b256def8b49a7c504e6c889c4b0e41fe6ce3e01863dd7b61a20aa0

SHA512
11bb994b5d2eab48b18667c7d8943e82c9011cb1d974304b8f2b6247a7e6b7f55ca2f7c62893644c3728d17dafd74ae3ba46271cf6287bb9e751c779a26fefc5

Download Submit
/storage/emulated/0/baidu/tempdata/yoh.dat

Filesize
20B

MD5
441018525208457705bf09a8ee3c1093

SHA1
6768033e216468247bd031a0a2d9876d79818f8f

SHA256
de47c9b27eb8d300dbb5f2c353e632c393262cf06340c4fa7f1b40c4cbd36f90

SHA512
d296b892b3a7964bd0cc882fc7c0be948b6bbd8eb1eff8c13942fcaabf1f38772dd56ba4d8ecd0b626ff5cef1cd045a1b0a76910396f3c7430b215a85950e9c3

Download Submit

Resubmissions

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads