80b9784d175997e558bd5aa2409e32a533c85d92e6ec30196acfc9591a7188e3

Analysis

max time kernel
179s
max time network
162s
platform
android_x64
resource
android-x64-20240624-en
resource tags

androidarch:x64arch:x86image:android-x64-20240624-enlocale:en-usos:android-10-x64system
submitted
26/08/2024, 05:14

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

c25a7d27e92153f6f1893c650f5df8d6_JaffaCakes118.apk
Size

18.2MB
MD5

c25a7d27e92153f6f1893c650f5df8d6
SHA1

f7d810ac72449cc8fad556140d5097fea2ec77d4
SHA256

80b9784d175997e558bd5aa2409e32a533c85d92e6ec30196acfc9591a7188e3
SHA512

c5066e6b5bf7f3cb1021d05fa7c92020ed63768aff2602a01eb9c788168df0d3b671fae5909c4fe7047e643e53136b4b27fc194b3ff182c672080379474df92e
SSDEEP

393216:Jm6R30bOHipGBbbJpUdcONDq/xHGRojmjtnaFr4Zr2j:N3oOHxbbJCdNDAmRAIaFV

Score

7^/10

collection discovery evasion impact persistence

Malware Config

Signatures

Loads dropped Dex/Jar 1 TTPs 8 IoCs

Runs executable file dropped to the device during analysis.

evasion

Download New Code at Runtime

T1407

ioc	pid	Process
/product/framework/com.google.android.maps.jar	5061	com.xhl.wulong
/product/framework/com.google.android.maps.jar	5061	com.xhl.wulong
/data/user/0/com.xhl.wulong/[email protected]	5061	com.xhl.wulong
/data/user/0/com.xhl.wulong/[email protected]!classes2.dex	5061	com.xhl.wulong
/product/framework/com.google.android.maps.jar	5225	com.xhl.wulong:remote
/product/framework/com.google.android.maps.jar	5225	com.xhl.wulong:remote
/data/user/0/com.xhl.wulong/[email protected]	5225	com.xhl.wulong:remote
/data/user/0/com.xhl.wulong/[email protected]!classes2.dex	5225	com.xhl.wulong:remote

Queries information about running processes on the device 1 TTPs 1 IoCs

Application may abuse the framework's APIs to collect information about running processes on the device.

discovery

Process Discovery

T1424

description	ioc	Process
Framework service call	android.app.IActivityManager.getRunningAppProcesses	com.xhl.wulong:remote

Queries information about the current nearby Wi-Fi networks 1 TTPs 2 IoCs

Application may abuse the framework's APIs to collect information about the current nearby Wi-Fi networks.

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.wifi.IWifiManager.getScanResults	com.xhl.wulong
Framework service call	android.net.wifi.IWifiManager.getScanResults	com.xhl.wulong:remote

Requests cell location 2 TTPs 2 IoCs

Uses Android APIs to to get current cell location.

collection discovery evasion

Location Tracking

T1430

Geofencing

T1627.001

description	ioc	Process
Framework service call	com.android.internal.telephony.ITelephony.getCellLocation	com.xhl.wulong
Framework service call	com.android.internal.telephony.ITelephony.getAllCellInfo	com.xhl.wulong:remote

Domain associated with commercial stalkerware software, includes indicators from echap.eu.org 4 IoCs

flow	ioc
13	alog.umeng.com
24	s.appjiagu.com
26	d.appjiagu.com
34	b.appjiagu.com

Queries information about active data network 1 TTPs 2 IoCs

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.IConnectivityManager.getActiveNetworkInfo	com.xhl.wulong
Framework service call	android.net.IConnectivityManager.getActiveNetworkInfo	com.xhl.wulong:remote

Queries information about the current Wi-Fi connection 1 TTPs 2 IoCs

Application may abuse the framework's APIs to collect information about the current Wi-Fi connection.

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.wifi.IWifiManager.getConnectionInfo	com.xhl.wulong:remote
Framework service call	android.net.wifi.IWifiManager.getConnectionInfo	com.xhl.wulong

Queries the unique device ID (IMEI, MEID, IMSI) 1 TTPs
discovery

System Network Configuration Discovery
T1422

Listens for changes in the sensor environment (might be used to detect emulation) 1 TTPs 1 IoCs

evasion

User Evasion

T1628.002

description	ioc	Process
Framework API call	android.hardware.SensorManager.registerListener	com.xhl.wulong:remote

Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 2 IoCs

persistence

Broadcast Receivers

T1624.001

description	ioc	Process
Framework service call	android.app.IActivityManager.registerReceiver	com.xhl.wulong:remote
Framework service call	android.app.IActivityManager.registerReceiver	com.xhl.wulong

Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 2 IoCs

impact

Data Encrypted for Impact

T1471

description	ioc	Process
Framework API call	javax.crypto.Cipher.doFinal	com.xhl.wulong
Framework API call	javax.crypto.Cipher.doFinal	com.xhl.wulong:remote

Checks CPU information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/cpuinfo	com.xhl.wulong

Checks memory information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/meminfo	com.xhl.wulong

com.xhl.wulong
1⤵
- Loads dropped Dex/Jar
- Queries information about the current nearby Wi-Fi networks
- Requests cell location
- Queries information about active data network
- Queries information about the current Wi-Fi connection
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Uses Crypto APIs (Might try to encrypt user data)
- Checks CPU information
- Checks memory information
PID:5061

com.xhl.wulong:remote
1⤵
- Loads dropped Dex/Jar
- Queries information about running processes on the device
- Queries information about the current nearby Wi-Fi networks
- Requests cell location
- Queries information about active data network
- Queries information about the current Wi-Fi connection
- Listens for changes in the sensor environment (might be used to detect emulation)
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Uses Crypto APIs (Might try to encrypt user data)
PID:5225

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Event Triggered Execution

T1624

Broadcast Receivers

T1624.001

Privilege Escalation

Defense Evasion

Download New Code at Runtime

T1407

Execution Guardrails

T1627

Geofencing

T1627.001

Hide Artifacts

T1628

User Evasion

T1628.002

Virtualization/Sandbox Evasion

T1633

System Checks

T1633.001

Credential Access

Discovery

Location Tracking

T1430

Process Discovery

T1424

System Information Discovery

T1426

System Network Configuration Discovery

T1422

System Network Connections Discovery

T1421

Lateral Movement

Collection

Location Tracking

T1430

Command and Control

Exfiltration

Impact

Data Encrypted for Impact

T1471

Replay Monitor

Loading Replay Monitor...

Downloads

/data/data/com.xhl.wulong/.jiagu/libjiagu.so

Filesize
482KB

MD5
a0d81e5e7f04ba7e35038378ac527de0

SHA1
a275f1012dff7779655d7c31b04c03e26239a528

SHA256
0430302c2caa7eae573da7efe2bd7090ec644e287e55b987917366340e35bfd0

SHA512
2e5f355c1376270ec83470593553b27aa4ebd95fe3c878795d576bcfea7c47b31d00428d1a332ef75616fe5c05e1719072676b1d56f78d04ef2b69aee251d7f5

Download Submit
/data/data/com.xhl.wulong/databases/cc/cc.db

Filesize
36KB

MD5
0908e924aa236931dc7166fef6e00862

SHA1
7782648d6d8f6e835bd47058d4852932c096a467

SHA256
38f8548795ca7470b449dd1de9598c07a247ba59883c0764c9c96ff0b7d31d7f

SHA512
3c16fbc5172aed04cd206e776c46d26e911732c6e3631536410a71f1d217449475727ac9b3175e827c5ce645a1da9e05900258ee6ca27c936a9060f241361dee

Download Submit
/data/data/com.xhl.wulong/databases/cc/cc.db

Filesize
36KB

MD5
67c12933d1e0e63d9801a6aa43092ce7

SHA1
b6936908554e4a1986b8eb08289e2d3545e8ff74

SHA256
abda5dd4cc2e7dbb951637c4b49d6990f9f34411fab4dee1a387dbcc8e7eed40

SHA512
db8b818daa3ff4ec7678645f84bf8b45c809bcbb758ea78b28982d071572655bba2d20e6f1ca4f0d057ab34fa655c5bc40457dc65050180351a2fc04a47175dd

Download Submit
/data/data/com.xhl.wulong/databases/cc/cc.db-journal

Filesize
512B

MD5
07e24f6d4e13b0e81a76e5e6e4df4685

SHA1
62694df7590634ce5a372c3e1c39ac212f4a996a

SHA256
10ebe32ada85becc941d302e756dcab202ea1588f4f25a5a5a7e3c9f9cf3e19e

SHA512
5f7e121741c06bd2e15dfc44e5e60202836dbdbb110f80e1296456341ad1d27b5f339024b5a05a232467bcc352a31ce9c6fe85d5024e34849017ce4a249ad302

Download Submit
/data/data/com.xhl.wulong/databases/cc/cc.db-journal

Filesize
8KB

MD5
e3085b0fda431a32a3a3baaf5f1c90d8

SHA1
e482c02b7997ea93c11ba39a2a73a8cb03c647d2

SHA256
9387ab762259ee194ec3b9e3742abca25b58329e3ed89efa0c2254e316acbfc6

SHA512
c0c1f18f1b1fc6f53691ddaff89cd497d13cab685a478f3470a6bd86b4e0879c05689bee8e7401d6c80787521fa250f75fa08e7715aa035d6bfeb0265ea2a27b

Download Submit
/data/data/com.xhl.wulong/databases/cc/cc.db-journal

Filesize
8KB

MD5
fdcb68a7d369daf65aa0f9c33cc906ed

SHA1
4bf721cb047dbe002d52c84cdef05b0809e95b97

SHA256
022d3c1b6e4d4219c9f9232f24b26acc65b5fd0d6f23aedb086411538e71fba6

SHA512
1c6c174d864e298564d0d4b1ed5a4b6edd0d7d4755a3003f08e3f9c78b92ff63ba90a96613d72fc12b5ddd529e49ced126d4217fb4f24a8b897408317607a8bb

Download Submit
/data/data/com.xhl.wulong/databases/cc/cc.db-journal

Filesize
8KB

MD5
10c9c5b6fe7defc22bb7d8d3f5743fe2

SHA1
731f8c2d013916d73a9b22e8dd27b7f8f2f91991

SHA256
484d06b16d2f618ea82e5a900c6b4088ef8d1f9c9b4a87c4d45eef1518a4b35e

SHA512
51d724c4c18b8af7f87552582e178351fe67f08c4cf103972aec577ee1c9d79a17a0d78a53ab7c40ac1f140eac088073c06ac891900d57332799db12e20e7b94

Download Submit
/data/data/com.xhl.wulong/databases/cc/cc.db-journal

Filesize
8KB

MD5
8ce388d7bc28fde4fa610e9dc2afbfbb

SHA1
dde5021077feda7c056047f55d842bf83c8de9ee

SHA256
e758ca5fa2482abb1426e4325fffa750ab50edd4ed218d9f0b8511f5c3395d95

SHA512
fe2e9b114d6894bdb1aac80f67159afac754730f6b821f1e16562187370c3a898b46be4b833dfe1b03dde200f96e118d9841549e7ace512e999d04dd762e9978

Download Submit
/data/data/com.xhl.wulong/databases/cc/cc.db-journal

Filesize
12KB

MD5
9f2ac316395bcadaea7a079ff1266f9f

SHA1
fe6c48b46150b954dbb351349d1905640cf63d77

SHA256
46e36db30b5b57b53faf1b364a37c4c409a763a2779bcad86fe4dde97dc158a6

SHA512
35e2fbe74c15756266c20c3c0f936150f56d34db2dc091fbb8bf1b27246a8f0cba745b585a12a0d7f5dbb4506cf8f34a7ca1e6175efe35fb598c48cbd66355ca

Download Submit
/data/data/com.xhl.wulong/databases/cqliving.db

Filesize
48KB

MD5
194b1deb51cc94d49876c72187221fae

SHA1
3332f1e9459a88359c8c64e8a79a69df742cce4e

SHA256
3f98c88160febbf5b405925f4e3b5b5f1fd9c5cc91f407511d75acda2f5edf5b

SHA512
434484fea0547f064080dc8b40ff5b3ad01c9c4b25f3bdfe2aff973a29ea1d823ab7385f95c53bab1ff27a6b566e9732128615af323d4f11fafe579b106c10e0

Download Submit
/data/data/com.xhl.wulong/databases/cqliving.db-journal

Filesize
512B

MD5
95b036ef594e1bd2ef51ff1d3472ba9d

SHA1
78233ae61325bec51b79e065ded1726a29a08cb8

SHA256
4cc54648bda0c91c2c95d026446727680f89c7b4ad20d65ddadb83d51b4cd4fa

SHA512
0b087d6ecce821aac24712d2c95334d886976ff7296d70df1a30462af67dfed9114e2ad0a39350faa2ae074004397e89416fc56976e313dea49ff1ff592a00e0

Download Submit
/data/data/com.xhl.wulong/databases/cqliving.db-journal

Filesize
8KB

MD5
a39e328d4a1fd3411c9c8b812120cd2e

SHA1
47b3977c2acb71c405def1e99291898a44b4c165

SHA256
bf942c60ff53eef5f4fe96b10052f499952cd761b956415dd5e210c3fabd22de

SHA512
79736a0596a6f4d626f34b13b78e123015554aef7f0a97ba1648df7fcd06c6b62bf5e9de6bc05f16ce8f9065a3e06bff7ae153211fe3aa67619bb49ffb8572d1

Download Submit
/data/data/com.xhl.wulong/databases/cqliving.db-journal

Filesize
8KB

MD5
d4843e1f32d3dd177d03670ce8e707a4

SHA1
1178b3576a6cb74fbce12535368b559b2900cbcc

SHA256
18408425eabf8c6ce075939bc01660fb420e0deba6d943cd54525fa53041d21b

SHA512
d9d2c15afa1e6719e99b76c251815bb1d231a5bab64ec49e06c48c0743afeb2604564f9253922ae01710a7f28db1a2850bf84db6e855062db0a7c65183b8fea0

Download Submit
/data/data/com.xhl.wulong/databases/cqliving.db-journal

Filesize
12KB

MD5
972d3432a56870e051018197f4df6efc

SHA1
127de5cfdd90f82acedb14e8103afc5b4063e2a3

SHA256
ab4088b504b2639edc8bde290444b5e95443d420394cd3b940fce7751300f29f

SHA512
346a126146105a8dc39655aa23182c6bcd89920998213849510268aa1186770a37afdfbd461dd07bcecd43905efabca378d3eeea7b85d6d12d69d67739602c87

Download Submit
/data/data/com.xhl.wulong/databases/cqliving.db-journal

Filesize
12KB

MD5
d116aa5739974f130a95091401527795

SHA1
41ff0fb8c97fe47f1192de228340b783af695f13

SHA256
596da96673e1ca983f3860f7e72230d91bc27cc4c3a612494f0c26c74a284be6

SHA512
7320b9a758b87d331bceb22d44b283cbf88f5a27c69e7c35911c30a4e90a18aa046861ef24352d051aa6d4911998539eb49bc30dc3f193d794e86343e45aa105

Download Submit
/data/data/com.xhl.wulong/databases/cqliving.db-journal

Filesize
12KB

MD5
8b5206fa1f26ce20ab723f21f340b0f3

SHA1
8b6a047a3a855d466c92ff01c37afd24c65a7397

SHA256
c4d3b675e8476afeca08782a904c1e7802b6fef0dca29feb170440693eb12194

SHA512
4b6788758ff5e306a20bf751d985758818f1c288780bca5051cc8b4ea1b84ac973978bd6b337877fae3ca3042c6c6e1c21a31a0f34ff2a2d0efdfb35c950b161

Download Submit
/data/data/com.xhl.wulong/databases/xUtils_http_cookie.db

Filesize
12KB

MD5
ea628e04765adaf4238a5dcdff4bbd51

SHA1
a801947619ea8c368efe9c006a324dc6339ac60b

SHA256
885e337c2156e4dbf2176a9677ade50418740532d222ccae5ad4aa371b54c6a4

SHA512
c0287b0e7b690a7231a37d1745c49f3d861b22aa65dd769ba6a8b5ab9da55443f749957781ee05a405019c39e1be45d37a971b821bffd62a1d5620bc39119abe

Download Submit
/data/data/com.xhl.wulong/databases/xUtils_http_cookie.db

Filesize
4KB

MD5
28322998fd5d3911c5c892e19daf9b83

SHA1
67ff2566bc9e0377570856d21bfb8f3cf5c9bfc2

SHA256
edfa4ae4b326ad2b092ea797a2d596bd23b01ee2c47cea9cb9a451e6001a912f

SHA512
80e08b3e20d45aa0986c08ae8a5c3483c067b4aeb1365a29c480226e7251b63ce1e07aa56ec4b214ccac85c36c865b1d1eb328b83eeca1b3fbc2c3610a925c4a

Download Submit
/data/data/com.xhl.wulong/databases/xUtils_http_cookie.db-journal

Filesize
512B

MD5
799d3ad034d03f1564178622ccf2ff8e

SHA1
69e119dcab928a5bf6acaf94711385e824fe29a8

SHA256
16edf3f3d4958419cda0f912f3294ecbfe76b85fee09194fb7c6c59478ec3418

SHA512
c2147693eaab33627e1fefc13dbb0c01659a325a091a5531f54d9a49139fa6d36aff569cd1d725a6758d84515250ee9cc5a8a1ddc7a49a64f21b1497c8aeb97d

Download Submit
/data/data/com.xhl.wulong/databases/xUtils_http_cookie.db-journal

Filesize
8KB

MD5
c338b4e4b117f24ae3a23fb6c2bcf3b6

SHA1
decd4a36452c6a849c30a70705de7bd0bb227df5

SHA256
6c7c106d19e942ef1179e4ce4fd1abe8627f97f2b692682c1881f43005c1889f

SHA512
1899ee10a82399e9f765b8c5a24304b99bf53fe62dbb3eca4988268fbfc4409b949ae07f386e72cf9600a9f345df84a41c01a438fb7f0064dab031664f586a26

Download Submit
/data/data/com.xhl.wulong/databases/xUtils_http_cookie.db-journal

Filesize
4KB

MD5
d03484e8d5a08fb55b516d57ab830e2f

SHA1
8ae1de6ed691e125eb9a49c198fd905bb4dce2ac

SHA256
10ab947fff01859303dc1a55f5f1855c9a70909933078d876804f1bd599c4cc1

SHA512
01b6363907db8e7ad2c62e2831d6a6f3097218a11edf6cfc81c623cc999c2104e29991996afa7c664bebe52c3828a06067a28e83542b7849bc3c0e66b4298d26

Download Submit
/data/data/com.xhl.wulong/databases/xUtils_http_cookie.db-shm

Filesize
32KB

MD5
bb7df04e1b0a2570657527a7e108ae23

SHA1
5188431849b4613152fd7bdba6a3ff0a4fd6424b

SHA256
c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479

SHA512
768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012

Download Submit
/data/data/com.xhl.wulong/databases/xUtils_http_cookie.db-wal

Filesize
4KB

MD5
214a427c561b4ddac9f3f461b2c01a29

SHA1
9239e1ac57e3a88c71c15c588a8a5729e32e9eeb

SHA256
fb5a46326fa9ef23494f6e9e6d19813414b5b768baf3566f3b1dd4f86c00cae7

SHA512
6680c072f2f02b90af19f9c1d196f318f1318e96342b9ab0a0d960e8ebee5c271d89db5622fcb131dd7edd044e6cb2215ee1be77b26eed6059a0125bbe0bfcfd

Download Submit
/data/data/com.xhl.wulong/files/.imprint

Filesize
921B

MD5
c20e92399b926f6f42dbc1395f7d8e58

SHA1
5f51a40d75b83d5af2d75c605e530f2da6bbdace

SHA256
de284fe688004e5faa2446e96d5c768ed273a9a81531ead29a45dbf8ecf70f29

SHA512
ecb994442c80535c574a9ead2da65640e8f82df41a790f012b195ea36d3aa020071e0716b6f61aa97ff2733eca7a2e0c44da62b6f317e028e16ade2675f417e2

Download Submit
/data/data/com.xhl.wulong/files/.jglogs/.jg.ac

Filesize
40B

MD5
449f2feeea1c77ff0ae0a68ec57cb884

SHA1
58755ace9d13d5010d2a110f3c8c6324a04f93ae

SHA256
0acacfad0ce1c8ba4678eae5b4f26fe880f9652631a09d2a91fceec6d6245f2d

SHA512
ec191254067770b1fb3fa72396d4416e6b108adf9a0c2e67fc8244a754febd9d7e42b4222b93b6cb6dbbbd712b25c5959a1a1da47c807464f5888d8244bbcaf0

Download Submit
/data/data/com.xhl.wulong/files/.jglogs/.jg.ac

Filesize
40B

MD5
806905ae8cd220682b30d7a91a48f658

SHA1
e5e716965526b32a3e2632afe3ff3e88fee85b88

SHA256
6aebeb63aef11bc7df3f0dc47413d37c08ca69a0c0f922c2a8cedc1ea1658898

SHA512
8f8c51af3b3501f5ccb1a6e4f8c4abf4068b3dba2a24989a94661202d7b9d1437d7420787e90c1643c9d3108c04b5e0a7b6600d7691e8f623c2283e2e6d8dd8c

Download Submit
/data/data/com.xhl.wulong/files/.jglogs/.jg.di

Filesize
340B

MD5
95312f537374b007ff2c1077519d9a0a

SHA1
3eb00bcfaa3f92b65b0337ca3d931e460f070a0d

SHA256
70f289efc65475db250db7676c8e1edca2fb82ffd6201a7c17aa50be64920ef5

SHA512
187cd663529be3ac31b17b77331082c27967530d84308f019ac2b9314ebedf84baef92929ba1f4deacb1914ede3d1ca75134a964d4f31cce5d528b64ec3c9f62

Download Submit
/data/data/com.xhl.wulong/files/.jglogs/.jg.di

Filesize
340B

MD5
d1f39f1f939230c9a3bc4d5b1dd9d2b7

SHA1
b8b59908b70b80595addd9f191f18be2bbf48256

SHA256
c9ca50db564e955aca1e870a7810b1cdc06f958bd2f5e57df244898e73003d5b

SHA512
a89c83f66abce1f07c60ab0430cbd878e9debc74d879427bda9776f153b37bb3504c8821dc13e233ee9a1fe42d788ba2d209892616c310b0902aab933798c8b9

Download Submit
/data/data/com.xhl.wulong/files/.jglogs/.jg.ic

Filesize
96B

MD5
09d1c432714804ba791e32910bfac751

SHA1
d1632859460e71a1bb48f2e9c3918dc74ade66c7

SHA256
398880df839a1128aa5e58a1b7590e085b368a8fac8844897691b6ce34c1d5aa

SHA512
a5b4183aff9a521a92edf0f5839fae79e3de26dde0088fcbf7f4eb197b3c30dbc59009e09d4860d6cb2d203080bcb256530c85b0976795f854967bc9c0788450

Download Submit
/data/data/com.xhl.wulong/files/.jglogs/.jg.rd

Filesize
32B

MD5
0361317f2069b6bf8ec3ab58d0dcfead

SHA1
b76d6327f1406cc8dd80cfc678afe50c738d1b29

SHA256
e24c0a0ed56d852caab58560ee6f8c05aad42797efdd07c276ade584ea74214d

SHA512
098df5c236f449f6d25dff65a09dcc06ae00e0552e67f711d337da54744ca4c2a59b61c87b71bc8c268664dd2fdfef50700c427b41ede8e5478364cdc0fc65f0

Download Submit
/data/data/com.xhl.wulong/files/.jglogs/.jg.ri

Filesize
314B

MD5
d5e4cc56e32ed65d74fcab40eee5b5b4

SHA1
aadca0e3ae773a1b4d8c8494439809b58d760975

SHA256
2b85ad7d3c36623fe2c09eeab272bf50e55ffe9b83ecf62d122768af5ab26a8c

SHA512
e16fc97cd47307820448419ac8c0ebd59eca4412197f3ce352777af7c91d2b7194afae12d629624abaffbf6419d1b6afbd7d6d65bad8d6dbdc53d1c9694f0f10

Download Submit
/data/data/com.xhl.wulong/files/.jglogs/.jg.store

Filesize
127B

MD5
57916c11c54dd81889ec5fd17f792d86

SHA1
4f588e33c51d9720f4484d51bfe0e9c4458e9483

SHA256
f60325c373d0bb3df68305a954dae7646312b3554c965a3fa8b531f56b5596a2

SHA512
4e988663c97c70ea994cef012572d5c233c82b87cee386288975f21157878c824b4b66401ce48e21606b2c9ca4248f224206f5addd1c3885eb205a3bcff38673

Download Submit
/data/data/com.xhl.wulong/files/.jglogs/.jg.store

Filesize
32B

MD5
448e391c59eef34ee1defbe4dee4c41f

SHA1
df1f890987371d7d8e6963c68b787856e42bc146

SHA256
55612e17689f4bb05f27e18b4f6d06ffef92a6a8893a5cfdd3d5b99a6028b549

SHA512
ce336ce895ba861dda7da27e8869dea065eb3c3403cac55cdf1935409e5ebc95b495370f87ed7416af20af533b15615472e333ae9f2fd2713040f526835399b7

Download Submit
/data/data/com.xhl.wulong/files/.jiagu.lock

Filesize
27B

MD5
331fd2ed1496fbb9adeca4e987b0b4c3

SHA1
9e099b0bcaa89d0aea0c0bbc467ca28a235fe27e

SHA256
4aea61d827efd690c5da111f6ec63106f77a69541e68638c3ae8a389ba95819d

SHA512
4d44182f3fed722e8a943616d7185fb2a966c39562deee5f7d450155d387fc0fc9b5a4e3f724d42a1800472954aa38f3f3e16227589a24e7ba8d66ce1677a6f8

Download Submit
/data/data/com.xhl.wulong/files/.umeng/exchangeIdentity.json

Filesize
162B

MD5
36e9c6ecbcc3953f92b12cf142631b2e

SHA1
50361d627844e707e463a4178706aa149aa3997a

SHA256
7e68a7aeb4e3f44a04d674c30a369ddd04faaf247d26d55b9d610047662a195f

SHA512
4a04c8fe989fc95eb3cbc3246e06ba780a8f8084e373e63898619de6639f567ad6c45a249f6b834d6d83dd5317e9dac831507751bb2be68d36e25a89c1161660

Download Submit
/data/data/com.xhl.wulong/files/umeng_it.cache

Filesize
429B

MD5
b448c2e49f4072c1237fd0919670e81f

SHA1
831f0bea66adef7fec74350d4418eba1f2bdf808

SHA256
a00cb13f996c3688f7349cbd0ee5bc53fe5210db18a3ac66298e6e90b754d7ac

SHA512
ff42f2658d819dee49dd9040ccbf8d9770b0676b407eaeeea5a642d51493ea00766b85b27b53beeb459cf6e04618da769cd8ad383b26e216b15f93d7819f2e37

Download Submit
/data/data/com.xhl.wulong/files/umeng_it.cache

Filesize
218B

MD5
8586dac46f42260ae664f08ab44215a5

SHA1
2e474b53669d1180430199c0acca143e4c6b75e4

SHA256
9962eee593c80967912d57b1ded13eef03fcf06108baeb00d726fad59ee6357a

SHA512
8d64f32ae2fc8357a0edc953383b9e953d61533e5417aae25f979da81e60f325be5724c21e0f7bfd19e9da82cf8403c6c133e4a393ed47f2ba367769ef7c613e

Download Submit
/data/user/0/com.xhl.wulong/[email protected]

Filesize
6.6MB

MD5
5683c9fb0edda63649f9ee04673cfd4d

SHA1
fc24e292236c502ebab996af68c3a52766b6a1f3

SHA256
93e78ead6c5d6b6e4200f94444692a7140dbae94d5bd191a02719d2f2a0c3b39

SHA512
dbd9d43fe21aa2af5de9ba60e9a27670d35ec919f22069ef1f2adb86936a235fea3aaa7ffd87675cdf1634391141b4e8c480d04e7b97f000722c5f7f81a5cb3a

Download Submit
/data/user/0/com.xhl.wulong/[email protected]!classes2.dex

Filesize
3.7MB

MD5
9219052240759060479bd6f0fb88c763

SHA1
b0f6f4087aa7becbd74f5f0ba8b5f9d4e0fbc87d

SHA256
b06efc4e5fa1239f5ed95088534a7e125afa458a38491f06b7f9cd8302c4183e

SHA512
d6c3b326f885e72fa743eb63b5d725235712d28b1b0e82e108fe4723aa02eaf79f1bd9167c28f8609a6cac4bc8c1de782459d394392a08a7638032563f8dd4bd

Download Submit
/product/framework/com.google.android.maps.jar

Filesize
315KB

MD5
4899aca36d1ed747a447dcac0d101a62

SHA1
32e43edc0bf3e036683ea8639472e6cd31ab9929

SHA256
67a651acd867e046fb4463b31ea584c1468f7243a9d1e2efd34059e8ee2f130f

SHA512
50b23dd279a9efba566c6a6523c7537723c0cd6dd3e4871f1cbdb8d5bc355caa3ddea99452b1c8e5356802f812b3768066a9848b93d715bb8bdfa455b704285f

Download Submit
/storage/emulated/0/.DataStorage/ContextData.xml

Filesize
111B

MD5
db14b1544168dde8c4806dd835a60fa4

SHA1
1971a0f1acf92b0d50681bc0664a372ca6444dd3

SHA256
c4d511fa65b1bd38eca73a09f4eb164a4bff0a0b30eef2c09323d97e172b7c24

SHA512
eb82303137b0d9c14202d89d42aa8b6831ba8c4dd0a4b4d36a196dab0f8ac421e2df47327ac1cf394b291d8ab95e6a0928ee3219d972e67dd220e486dbac15bf

Download Submit
/storage/emulated/0/.UTSystemConfig/Global/Alvin2.xml

Filesize
65B

MD5
9781ca003f10f8d0c9c1945b63fdca7f

SHA1
4156cf5dc8d71dbab734d25e5e1598b37a5456f4

SHA256
3325d2a819fdd8062c2cdc48a09b995c9b012915bcdf88b1cf9742a7f057c793

SHA512
25a9877e274e0e9df29811825bd4f680fa0bf0ae6219527e4f1dcd17d0995d28b2926192d961a06ee5bef2eed73b3f38ec4ffdd0a1cda7ff2a10dc5711ffdf03

Download Submit
/storage/emulated/0/.UTSystemConfig/Global/Alvin2.xml

Filesize
111B

MD5
e1ee63c9c2f50a6dce59d9463c5ac094

SHA1
b3d9bbdb9453303a4c03a81ddee031765e6e5799

SHA256
07f4cecbb1360218640511279417fd91181a653c4f6e46d22cacc2624361b0ea

SHA512
e7410b05e8ab5b05cf484d49a19e870ba1e1bc033e3179590f5212d975590f6129aca8abf2d66104fb447c5dfc29c54cad378460dcae8fa4146ea3bf0b6c2ed7

Download Submit
/storage/emulated/0/.UTSystemConfig/Global/Alvin2.xml

Filesize
408B

MD5
93c86bc0bf5c823bed51c1c90153113d

SHA1
8676e62b898e3fc2dd85135c68b67fd50e50dc6f

SHA256
34c7e99fcbad719b7315bb2e3c60e9d80291cc02dd95a61b638dfd4a9b564121

SHA512
f1f688c7c9ede0c111b76fd4841d7206f15eeaa7c1fa91f1e0db7ba95f084fa484cb32d16976490193baa19131b6faa808e29ebe3c3816644139ba3e7da1f79d

Download Submit
/storage/emulated/0/360/.deviceId

Filesize
206B

MD5
f4dccb46dc008f674752112cf828546d

SHA1
630b28eaf122312279ddb068c42286261e0351bd

SHA256
a02cd7346c5c43d1371f7ca40e812633f99003bd19291d48d59c2a61bb6ccdc9

SHA512
56911bca97094ef4981157ead45cfd829e40bcd298fdebe8f216d1e63da0ffc84e98e5ca1de2c30133b628ed34fb22fff680a71e19225a3139248682b3f73926

Download Submit
/storage/emulated/0/360/.iddata

Filesize
801B

MD5
a6962a895232cd428edbc27b576b4aaf

SHA1
c72978328c96dd3d7dc0f10386811710635bafa3

SHA256
9776b1d787f1744df9ba68403f4d1e6976506e3826b196b07d125d2863503f91

SHA512
4b69046138d39c17cb6201d72fa89ba7bcb13e97dff8c55563e6d8956cfb730f5763350a3ee644e43cfd062a01de380f3c4d296f7a998bf2d22ea5eb3fa608e7

Download Submit
/storage/emulated/0/Android/data/com.xhl.wulong/files/tbslog/tbslog.txt

Filesize
2KB

MD5
fa0a35a4427da41960788a6a796397f4

SHA1
966e7360a7238f9c0d28f3c7d4441ffc867a7875

SHA256
831ba38bc7a833c7a8a06c6dd627fe1a6ed2aff18cd0a52286f39c87dd5feb19

SHA512
7f7a7d7c79413624bc7e5c1195e64402d485c17b5ccf2be73c0e8287a152dab01d51fb4f504a3385f836aa7f7c758a33eb0d69f2a2096be632a0338dcebf9dc7

Download Submit
/storage/emulated/0/backups/.SystemConfig/.cuid2

Filesize
109B

MD5
b5ec6a314f28a72542c2f4f4d072e16b

SHA1
f7216bd3ef22589b58b33bf6aaebb2a92d57d498

SHA256
f3dce3e0d32f50aaed69e000083ce517dfb4405faecaa8b5e3e82c6353656c43

SHA512
c46b4cb634281e0a59e18bef90b482703480223f98cc982f01507d20d65b6d5a2a781ea49e82c280a6e1545c9994ce23e173dad4fc53e645d43d58ac2c376249

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads