962cd44167327a1e65201ef3ef151fc5f6134daf63a579a754b8bff03d50046f

Analysis

max time kernel
69s
max time network
150s
platform
android-9_x86
resource
android-x86-arm-20240910-en
resource tags

arch:armarch:x86image:android-x86-arm-20240910-enlocale:en-usos:android-9-x86system
submitted
08/09/2024, 21:59

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

d528d5b1a22504b83d91bae233ab586a_JaffaCakes118.apk
Size

26.7MB
MD5

d528d5b1a22504b83d91bae233ab586a
SHA1

07433d49a2b386a9620ee8216962cac30e597fd9
SHA256

962cd44167327a1e65201ef3ef151fc5f6134daf63a579a754b8bff03d50046f
SHA512

9523619f3c118e1ce97533cf3f187f292a3462f4b2810caa9a7653dd63073ee2fe6c84f3d1f3955705a21c111b4362431c08aded6703b0b484fd8685f5cb49eb
SSDEEP

393216:kmoVFh4rF0BtHpEsOehoty2EYSuYHrRyNsnBHpDAhknwV1J77IkD0d9cVA:kXFhm0LHpwec4HyNOHpDhnwVfWd9Z

Score

7^/10

collection discovery evasion impact persistence

Malware Config

Signatures

Loads dropped Dex/Jar 1 TTPs 9 IoCs

Runs executable file dropped to the device during analysis.

evasion

Download New Code at Runtime

T1407

ioc	pid	Process
/data/user/0/com.jiuzun.minikp.yyh/code_cache/secondary-dexes/base.apk.classes2.zip	4361	/system/bin/dex2oat --debuggable --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --debuggable --generate-mini-debug-info --dex-file=/data/user/0/com.jiuzun.minikp.yyh/code_cache/secondary-dexes/base.apk.classes2.zip --output-vdex-fd=47 --oat-fd=48 --oat-location=/data/user/0/com.jiuzun.minikp.yyh/code_cache/secondary-dexes/oat/x86/base.apk.classes2.odex --compiler-filter=quicken --class-loader-context=&
/data/user/0/com.jiuzun.minikp.yyh/code_cache/secondary-dexes/base.apk.classes2.zip	4329	com.jiuzun.minikp.yyh
/data/user/0/com.jiuzun.minikp.yyh/code_cache/secondary-dexes/base.apk.classes3.zip	4386	/system/bin/dex2oat --debuggable --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --debuggable --generate-mini-debug-info --dex-file=/data/user/0/com.jiuzun.minikp.yyh/code_cache/secondary-dexes/base.apk.classes3.zip --output-vdex-fd=47 --oat-fd=48 --oat-location=/data/user/0/com.jiuzun.minikp.yyh/code_cache/secondary-dexes/oat/x86/base.apk.classes3.odex --compiler-filter=quicken --class-loader-context=&
/data/user/0/com.jiuzun.minikp.yyh/code_cache/secondary-dexes/base.apk.classes3.zip	4329	com.jiuzun.minikp.yyh
/data/user/0/com.jiuzun.minikp.yyh/code_cache/secondary-dexes/base.apk.classes4.zip	4410	/system/bin/dex2oat --debuggable --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --debuggable --generate-mini-debug-info --dex-file=/data/user/0/com.jiuzun.minikp.yyh/code_cache/secondary-dexes/base.apk.classes4.zip --output-vdex-fd=47 --oat-fd=48 --oat-location=/data/user/0/com.jiuzun.minikp.yyh/code_cache/secondary-dexes/oat/x86/base.apk.classes4.odex --compiler-filter=quicken --class-loader-context=&
/data/user/0/com.jiuzun.minikp.yyh/code_cache/secondary-dexes/base.apk.classes4.zip	4329	com.jiuzun.minikp.yyh
/data/user/0/com.jiuzun.minikp.yyh/code_cache/secondary-dexes/base.apk.classes2.zip	4454	com.jiuzun.minikp.yyh:remote
/data/user/0/com.jiuzun.minikp.yyh/code_cache/secondary-dexes/base.apk.classes3.zip	4454	com.jiuzun.minikp.yyh:remote
/data/user/0/com.jiuzun.minikp.yyh/code_cache/secondary-dexes/base.apk.classes4.zip	4454	com.jiuzun.minikp.yyh:remote

Queries information about running processes on the device 1 TTPs 2 IoCs

Application may abuse the framework's APIs to collect information about running processes on the device.

discovery

Process Discovery

T1424

description	ioc	Process
Framework service call	android.app.IActivityManager.getRunningAppProcesses	com.jiuzun.minikp.yyh
Framework service call	android.app.IActivityManager.getRunningAppProcesses	com.jiuzun.minikp.yyh:remote

Queries information about the current nearby Wi-Fi networks 1 TTPs 2 IoCs

Application may abuse the framework's APIs to collect information about the current nearby Wi-Fi networks.

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.wifi.IWifiManager.getScanResults	com.jiuzun.minikp.yyh
Framework service call	android.net.wifi.IWifiManager.getScanResults	com.jiuzun.minikp.yyh:remote

Queries the phone number (MSISDN for GSM devices) 1 TTPs
discovery

System Network Configuration Discovery
T1422

Requests cell location 1 TTPs 2 IoCs

Uses Android APIs to to get current cell information.

collection discovery

Location Tracking

T1430

description	ioc	Process
Framework service call	com.android.internal.telephony.ITelephony.getAllCellInfo	com.jiuzun.minikp.yyh:remote
Framework service call	com.android.internal.telephony.ITelephony.getCellLocation	com.jiuzun.minikp.yyh

Domain associated with commercial stalkerware software, includes indicators from echap.eu.org 1 IoCs

flow	ioc
5	alog.umeng.com

Queries information about active data network 1 TTPs 2 IoCs

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.IConnectivityManager.getActiveNetworkInfo	com.jiuzun.minikp.yyh
Framework service call	android.net.IConnectivityManager.getActiveNetworkInfo	com.jiuzun.minikp.yyh:remote

Queries information about the current Wi-Fi connection 1 TTPs 2 IoCs

Application may abuse the framework's APIs to collect information about the current Wi-Fi connection.

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.wifi.IWifiManager.getConnectionInfo	com.jiuzun.minikp.yyh
Framework service call	android.net.wifi.IWifiManager.getConnectionInfo	com.jiuzun.minikp.yyh:remote

Queries the mobile country code (MCC) 1 TTPs 1 IoCs

discovery

System Network Configuration Discovery

T1422

description	ioc	Process
Framework service call	com.android.internal.telephony.ITelephony.getNetworkCountryIsoForPhone	com.jiuzun.minikp.yyh

Reads information about phone network operator. 1 TTPs
discovery

System Network Configuration Discovery
T1422

Listens for changes in the sensor environment (might be used to detect emulation) 1 TTPs 1 IoCs

evasion

User Evasion

T1628.002

description	ioc	Process
Framework API call	android.hardware.SensorManager.registerListener	com.jiuzun.minikp.yyh:remote

Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs

persistence

Broadcast Receivers

T1624.001

description	ioc	Process
Framework service call	android.app.IActivityManager.registerReceiver	com.jiuzun.minikp.yyh:remote

Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 2 IoCs

impact

Data Encrypted for Impact

T1471

description	ioc	Process
Framework API call	javax.crypto.Cipher.doFinal	com.jiuzun.minikp.yyh:remote
Framework API call	javax.crypto.Cipher.doFinal	com.jiuzun.minikp.yyh

Checks CPU information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/cpuinfo	com.jiuzun.minikp.yyh

com.jiuzun.minikp.yyh
1⤵
- Loads dropped Dex/Jar
- Queries information about running processes on the device
- Queries information about the current nearby Wi-Fi networks
- Requests cell location
- Queries information about active data network
- Queries information about the current Wi-Fi connection
- Queries the mobile country code (MCC)
- Uses Crypto APIs (Might try to encrypt user data)
- Checks CPU information
PID:4329
- /system/bin/dex2oat --debuggable --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --debuggable --generate-mini-debug-info --dex-file=/data/user/0/com.jiuzun.minikp.yyh/code_cache/secondary-dexes/base.apk.classes2.zip --output-vdex-fd=47 --oat-fd=48 --oat-location=/data/user/0/com.jiuzun.minikp.yyh/code_cache/secondary-dexes/oat/x86/base.apk.classes2.odex --compiler-filter=quicken --class-loader-context=&
  2⤵
  - Loads dropped Dex/Jar
  PID:4361
- /system/bin/dex2oat --debuggable --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --debuggable --generate-mini-debug-info --dex-file=/data/user/0/com.jiuzun.minikp.yyh/code_cache/secondary-dexes/base.apk.classes3.zip --output-vdex-fd=47 --oat-fd=48 --oat-location=/data/user/0/com.jiuzun.minikp.yyh/code_cache/secondary-dexes/oat/x86/base.apk.classes3.odex --compiler-filter=quicken --class-loader-context=&
  2⤵
  - Loads dropped Dex/Jar
  PID:4386
- /system/bin/dex2oat --debuggable --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --debuggable --generate-mini-debug-info --dex-file=/data/user/0/com.jiuzun.minikp.yyh/code_cache/secondary-dexes/base.apk.classes4.zip --output-vdex-fd=47 --oat-fd=48 --oat-location=/data/user/0/com.jiuzun.minikp.yyh/code_cache/secondary-dexes/oat/x86/base.apk.classes4.odex --compiler-filter=quicken --class-loader-context=&
  2⤵
  - Loads dropped Dex/Jar
  PID:4410

com.jiuzun.minikp.yyh:remote
1⤵
- Loads dropped Dex/Jar
- Queries information about running processes on the device
- Queries information about the current nearby Wi-Fi networks
- Requests cell location
- Queries information about active data network
- Queries information about the current Wi-Fi connection
- Listens for changes in the sensor environment (might be used to detect emulation)
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Uses Crypto APIs (Might try to encrypt user data)
PID:4454

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Event Triggered Execution

T1624

Broadcast Receivers

T1624.001

Privilege Escalation

Defense Evasion

Download New Code at Runtime

T1407

Hide Artifacts

T1628

User Evasion

T1628.002

Virtualization/Sandbox Evasion

T1633

System Checks

T1633.001

Credential Access

Discovery

Location Tracking

T1430

Process Discovery

T1424

System Information Discovery

T1426

System Network Configuration Discovery

T1422

System Network Connections Discovery

T1421

Lateral Movement

Collection

Location Tracking

T1430

Command and Control

Exfiltration

Impact

Data Encrypted for Impact

T1471

Replay Monitor

Loading Replay Monitor...

Downloads

/data/data/com.jiuzun.minikp.yyh/code_cache/secondary-dexes/base.apk.classes2473801783364598997.zip

Filesize
28KB

MD5
0d3e99204c6401ea499fe9e6d9855497

SHA1
09829f00ca458eab7374d5079393a2cd69a2348a

SHA256
63ad014cb50908591939d6a1536f85eece807425af4f4e8a1f9b9eeab13cc5ca

SHA512
8d9a50aa9abd17e508ed3ac35a3033e8f9e550d1088baa951f53e6c4697c5ac026d22b90e36e27341d64baa3f0202bd89ca97583e99feb25f8c26b5776c59c68

Download Submit
/data/data/com.jiuzun.minikp.yyh/code_cache/secondary-dexes/base.apk.classes3817236651601902551.zip

Filesize
3KB

MD5
e5ec4e4642abe500c22b9db318380acf

SHA1
c68c6ddd295a0fe355d4237646f170abb59912f9

SHA256
2e9931ab7b126ad16ea1bb9e311ec89564001e362b4f4472338f89dfd189dc67

SHA512
6f8db660653ecd04e2f6660079ef52e708193739d10627fed118e079849b87cb4af1facd28ca2eccaf3d09c83a451bd95d10125fc6057c7b4de562d7ea59c15c

Download Submit
/data/data/com.jiuzun.minikp.yyh/code_cache/secondary-dexes/base.apk.classes5803108981751461391.zip

Filesize
65KB

MD5
7cc09b3e6236116cfd2f8110f5c9e026

SHA1
a5a8e1a8b6042ca74bf3ef1d7137aa8654937a02

SHA256
9f785054b664cb28d68cd68e86367d1708aae810f4c605bb5c6738e698a04aaa

SHA512
c00239acf8945f09a99419e21f9eadf47ca1aef75b3dd40414329014b2dba507ffd2ce6f5663b24f22b7aa10d9dba3020df28dbad1ca1575b8d837ab21519b86

Download Submit
/data/data/com.jiuzun.minikp.yyh/databases/cc/cc.db

Filesize
36KB

MD5
fd348517c53cc0123970ce8e62ef4e7c

SHA1
8bc6f0795a1760379c4798f7ba42dc205e5d7268

SHA256
228f6e9064a054413346021406992e4b7986c0ba194e0d8e05952073de5b811d

SHA512
424dbb895a064bec378dcbc99227166721c51cf416ac2d5edc522725d281895977af66b530fbf4e142f41ec30422748c5a239ebd859dba34143447b6fc67a94a

Download Submit
/data/data/com.jiuzun.minikp.yyh/databases/cc/cc.db

Filesize
36KB

MD5
bc058ed0d25fec6a31747fa197fdd5ec

SHA1
e1c062444098c4c2ee34c3a147f6f054d996c004

SHA256
df4bd0c5fdb1e3d1b82eeec2daee1483a31789d62fcea46b8f4d69fec30c01ea

SHA512
ca710b055e406fc2088c2d5f0e8b8058683968d3ee54492482620ba0a4a903d663b3d42904adf85aac8ca992f831756343cf05bfc019365439d5a16719546709

Download Submit
/data/data/com.jiuzun.minikp.yyh/databases/cc/cc.db-journal

Filesize
156KB

MD5
b41bbf11122eaebb7c277af3660d66f5

SHA1
8359ca8500877a073927bdd3b12f64d337a7fa59

SHA256
92e9a0db717efa343877ca8d1bfade5962bd6e9cfd816ff321caa245ba2633b5

SHA512
3dc22d84bdb02494262cf7112d3dfea492e3349b0c5a7d5251fd52c8429b6711390a12f38bb56b966cdd5c4d49d9ae1af443417af024a000a4aad3ae9db4f571

Download Submit
/data/data/com.jiuzun.minikp.yyh/databases/cc/cc.db-shm

Filesize
32KB

MD5
bb7df04e1b0a2570657527a7e108ae23

SHA1
5188431849b4613152fd7bdba6a3ff0a4fd6424b

SHA256
c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479

SHA512
768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012

Download Submit
/data/data/com.jiuzun.minikp.yyh/databases/cc/cc.db-wal

Filesize
48KB

MD5
a3d9710110b24f310b3806ae42c36129

SHA1
9691f994040d503f45747538ac367912c3abaeb8

SHA256
a294ab2d697ec8eb6137d8d491d354c1d1f84e696075eea8deac9b4ed9b2d37f

SHA512
dc5164a2052247fe478369d975536de0a0628c795cf3c9343c40206ddb5e9669dc35545decdfd0a744c8590db970fd2e0f38989c9d6c638bcfd1facd40791ef8

Download Submit
/data/data/com.jiuzun.minikp.yyh/databases/cc/cc.db-wal

Filesize
16KB

MD5
f0d2319ccbf4de9e7e13ade80cf87c92

SHA1
84ecf8291edc3e4c2359c4c9b8182d5e48f9a0a5

SHA256
d73c17e6738cc1727b65bf3c5832983dcfbdf7a3c1f639fa214e5bdb2e1b544d

SHA512
f29b88c4b33d00f6e55f766a84d3ebfc8bf50be5134abd28cf1b1cbba75fb80a0af69a0b4be0786ed45af64f71c7767285eec03e1ab80ef080a75db023b61ad0

Download Submit
/data/data/com.jiuzun.minikp.yyh/files/.umeng/exchangeIdentity.json

Filesize
162B

MD5
91bd77ac8be34836177c46a0f1afd728

SHA1
6aa9c82cb9b48109081f36593bb791d642bfc3f2

SHA256
aac2dc80f4af914496ac84773bd25894491cd4e29f0835d6c4d4132c21560b34

SHA512
02cbc2000f7e672440039f975177726b729fc28680716202a80c5da53f055db12086f14cd5e0a321b25504d864530904b9d0f06256230ea8910766ca4545cb44

Download Submit
/data/data/com.jiuzun.minikp.yyh/files/libcuid.so

Filesize
129B

MD5
4b6c237371502bbccfb017708c80e2f3

SHA1
32584bf1adffeb717a28221da45f92acb9c2dfbf

SHA256
33e831991beda7d2de29d9902c11b80bd041f6bb87a93281821e89a3cd58e818

SHA512
d979724c0199705f17095b27cacf0d4e4f3e5c4b3bdcf8fed09e12730e263e73497350a3759ad868dab639132e010241a0acad30c4b637f99fcb1c329dcc8910

Download Submit
/data/data/com.jiuzun.minikp.yyh/files/ofld/ofl_location.db

Filesize
4KB

MD5
f2b4b0190b9f384ca885f0c8c9b14700

SHA1
934ff2646757b5b6e7f20f6a0aa76c7f995d9361

SHA256
0a8ffb6b327963558716e87db8946016d143e39f895fa1b43e95ba7032ce2514

SHA512
ec12685fc0d60526eed4d38820aad95611f3e93ae372be5a57142d8e8a1ba17e6e5dfe381a4e1365dddc0b363c9c40daaffdc1245bd515fddac69bf1abacd7f1

Download Submit
/data/data/com.jiuzun.minikp.yyh/files/ofld/ofl_location.db-journal

Filesize
512B

MD5
daa003396f9ef24f528795eb6ab6705e

SHA1
9e652380f9e1cdbe24f0647440337d4548ac2138

SHA256
dbd8b6f862618c0e604278ed07f0f52af6e3375e17c29b9c87896744fb259a10

SHA512
d68a512b339365f01acb6771bc0cef9ca1336dd737731dc44ed7e6700db7b09e53c8c36820f7ad0bdc98b4503ab3672fc97cb3c0f32a0aeea69b8cd172e4e966

Download Submit
/data/data/com.jiuzun.minikp.yyh/files/ofld/ofl_location.db-wal

Filesize
48KB

MD5
86fac01cc4c69fde525300afb933546b

SHA1
3a1a70d95550832389a51d1cbc737ffd0a980498

SHA256
2e41d8098563613eb77bad37784a8e47939c3ac7bb978642b7134ab5a1508847

SHA512
4497ec8ff32604f1eedfe499adb6b6ccdd1bef14d5587fa0715499a69d0f893218d4c060cbc780da50f29bf91de2df9cb85ee0bd5b9694f1868c63055a917965

Download Submit
/data/data/com.jiuzun.minikp.yyh/files/ofld/ofl_statistics.db-journal

Filesize
512B

MD5
5bb09d912a81c8026cc69a6fe817f6d3

SHA1
159c029f72ca29c2710484d7a8541efcf1096707

SHA256
e4ca965f2b22828fac848c117c71dd3052b89cd795c796c84202aadbccfb39c6

SHA512
c2429ec9a4669153e170b62f971af0ab14a4e42397cea84a692a326f8eb5d4b1b56f9ad1cf6fff7adb7088b7c436e3e347b7cfaeba8b7078c7630bcf93271d75

Download Submit
/data/data/com.jiuzun.minikp.yyh/files/umeng_it.cache

Filesize
502B

MD5
37ec1bae6ceeb00addf489a9aed30211

SHA1
6658f62f9d4ffde366a119f39cba8ea579e978cc

SHA256
8d41f942210ca1f55ce8a7759d07ba91626e282eb728c5d07964543206d9375e

SHA512
4510c628a6e1646754bcc6f77f5b17e47f4bcd4d8cce527bb1209ec7fa193d7ee7b11f6f0cca715bdb1c692b6afdc7bf1b5b5d6e3249fbff90ead99fe43df253

Download Submit
/data/user/0/com.jiuzun.minikp.yyh/code_cache/secondary-dexes/base.apk.classes2.zip

Filesize
6KB

MD5
1e0102c08ae97218d4de5faf9b2cd486

SHA1
572fe0d3ed39f7dc86c67209566eb81c1e0341ba

SHA256
a04ad489e82ba6ba6c7e598d852d497c092f41e006257b05698ae885f4fb7ee7

SHA512
efab3df9691996a696596747c491f2378208d81301e4004608711d06c27197d47485597a0008b022f7c7c87339e351ad69e4ff6353674b603a060219defff8f4

Download Submit
/data/user/0/com.jiuzun.minikp.yyh/code_cache/secondary-dexes/base.apk.classes3.zip

Filesize
153KB

MD5
40abc3a1425d89bbf4f523aeb8105964

SHA1
bd976a4a759a6414b530b6e511d417bd3f738c1e

SHA256
6a8243cb3d0847d93b27de15362af32e86e853fd0ee702701ee10601e9ff9ea8

SHA512
83d8d09627c33be7dbe4b48cb39a8308855443dfa8c388c5b6f3eb037d8bfd08f60970f91e6a86ca037c4467686ee35c9b1173c359b0cba50a12072c7ca5656a

Download Submit
/data/user/0/com.jiuzun.minikp.yyh/code_cache/secondary-dexes/base.apk.classes4.zip

Filesize
37KB

MD5
69a39e1b2d8ccc9deeed3595b2be08b8

SHA1
33553521a689c94dda21225ee54896b1c0262171

SHA256
b511700120c69c9a577c08583f90329653fda5b112585e131da9dcf5f8baefed

SHA512
e4228edec16aca9437965632668574af348b8a17fb6ab5facd568ffba0aac13ba170b199ed122684b67e54994a1fa43a8dff245a781a7d16031b323243599121

Download Submit
/storage/emulated/0/.DataStorage/ContextData.xml

Filesize
158B

MD5
9ef8862313d774c60c904395cb33e759

SHA1
820352ba2e7231e32b163c9b24e953b8832c4b2b

SHA256
513e679aba3224a47d9a9f2719d67d617e9249fb5095ad348d88464be00efaf6

SHA512
4fc7e05c249af2ebf51d519042b49f3b7110de04604b43aa7eb472272cb468a9ab7c765faa09e1c8159afa36c1733b55201f2e99b8e9ba23bc3d513ee87bd8de

Download Submit
/storage/emulated/0/.DataStorage/ContextData.xml

Filesize
111B

MD5
fca7dd9e252b87b0ef5e2289a02af9bb

SHA1
8d54434d85944725ae8a1e3f1b6dc4b1460c2540

SHA256
05aecdc37d24eb957426b0f0e92774c7a02d0583729347ce93640c76f8684a8a

SHA512
86fdc59739d0f366b3d23ee2278016597b78b601edd52c167394a937878a7c8f0e9636e8f1a52d17e0343ab8b88406a61b168169108218ecb09e6d6086808917

Download Submit
/storage/emulated/0/.UTSystemConfig/Global/Alvin2.xml

Filesize
65B

MD5
9781ca003f10f8d0c9c1945b63fdca7f

SHA1
4156cf5dc8d71dbab734d25e5e1598b37a5456f4

SHA256
3325d2a819fdd8062c2cdc48a09b995c9b012915bcdf88b1cf9742a7f057c793

SHA512
25a9877e274e0e9df29811825bd4f680fa0bf0ae6219527e4f1dcd17d0995d28b2926192d961a06ee5bef2eed73b3f38ec4ffdd0a1cda7ff2a10dc5711ffdf03

Download Submit
/storage/emulated/0/.UTSystemConfig/Global/Alvin2.xml

Filesize
111B

MD5
aa5b2a06716e219f45bfe36a9d402a30

SHA1
bf45a9f9b064332cf8fd3b16245fe9ea3c169eb7

SHA256
e137ba4502d8306f87fdbafea11eb5dcbd1af160d717430813833f75584d9895

SHA512
7400c7ba764c282079d45a3bed99e537804db13dd41dcbc1ae4f40fde8b5f735ccab1fb45d5562512278f6acfdfe1b5ed45abc9c964243c300ba534681cf656f

Download Submit
/storage/emulated/0/.UTSystemConfig/Global/Alvin2.xml

Filesize
381B

MD5
295060bbe436f999e71f08e3e0433fa4

SHA1
0a2b621ba988215177d2cc145d38fe082483be58

SHA256
dd92835e29ab3c615cf128f9977bbceb5bd5a01940290f84d9f43b9c793f05c6

SHA512
339869e064615cf544b7d152da73219cdb5ef6876600cb1714a5567bd86db9dcfb7418c47db70d6b865b067d6ead8d5a1a45e8435f319729d8b09b042a5c889f

Download Submit
/storage/emulated/0/Android/data/com.jiuzun.minikp.yyh/cache/carsh/crash-2024-09-10-13-25-52-1725974752734.log

Filesize
3KB

MD5
d7901c740caf5f2d49a70b9dd11b6992

SHA1
f935bced2be5f91ae08df2c608fdc02b7becd800

SHA256
9de9ac461e7fb6479d23dd9e6f8fdf228204493e258b8a0d5beaefdb7cb0fd35

SHA512
35e63cdd0e330fc0f84c2108a46f2ed85ce952bb06f820b0fa6c47339ebe0c07f75e580970d4a7ccb8f05a400eb7787bfe0e35d3f479eb94068693d30726e3f6

Download Submit
/storage/emulated/0/Android/data/com.jiuzun.minikp.yyh/files/baidu/tempdata/yoh.dat

Filesize
1KB

MD5
2966bdc7a056c391f2e794862327a2d2

SHA1
8d745d8795f1dc89c9c0cb003c3e66e40d1f9df2

SHA256
1f7e8580acdd1e71c460fb93a1d51aa0629eb381e5ba2c259ff98ad30de9711d

SHA512
b4d1816c8215a11d7535bed210089b1f80194b70b21a9615b4434c2d46617fa4d9cd29d90e4e8a1ca1ce6f82053b0f0a39321c43b5b3cf29bec21fadae06db29

Download Submit
/storage/emulated/0/Android/data/com.jiuzun.minikp.yyh/files/baidu/tempdata/yoh.dat

Filesize
5KB

MD5
36a4a13e76964c47a613d305faed1f9e

SHA1
99c869dd0b97e7b166c854f468e504468ae079c0

SHA256
f19118a0f6882c8c0dbc3d385e730d473733d1f4175bc099c0f31ca288860385

SHA512
e0a997ca8f3ce988186c996c40d1e83057d16ba7afacd0e325dff0fef9692b8a907560cbb504aa4d01fabe5758a61bcf2d179b3fa84c276bc603d2ab8f191fb3

Download Submit
/storage/emulated/0/Android/data/com.jiuzun.minikp.yyh/files/baidu/tempdata/yom.dat

Filesize
24B

MD5
a936690571e9104e1922dda4a0ba5bd1

SHA1
65f49c57edde2f96be2a1dbdfc3f7351f1e66554

SHA256
f0f5049c51879dd7da0ce4a43349b5b34ce053d072a0ca704f62cf22ba4a8412

SHA512
3be1c3693963aebdfc04e86b1c820ee0ec3cf0b200e6a4788ef1141f39fd6c2f77f4227247ae4affa66c0a6c027df8466cc0dcec1e67ebfb953e36bee97de394

Download Submit
/storage/emulated/0/Android/data/com.jiuzun.minikp.yyh/files/baidu/tempdata/yom.dat

Filesize
24B

MD5
1681ffc6e046c7af98c9e6c232a3fe0a

SHA1
d3399b7262fb56cb9ed053d68db9291c410839c4

SHA256
9d908ecfb6b256def8b49a7c504e6c889c4b0e41fe6ce3e01863dd7b61a20aa0

SHA512
11bb994b5d2eab48b18667c7d8943e82c9011cb1d974304b8f2b6247a7e6b7f55ca2f7c62893644c3728d17dafd74ae3ba46271cf6287bb9e751c779a26fefc5

Download Submit
/storage/emulated/0/backups/.SystemConfig/.cuid

Filesize
96B

MD5
b68e436dbec19073d07b353f5559093e

SHA1
b315e2dae534471f23a5b3d4048d3dd341980698

SHA256
6b26ad68c52243d6572fd778c24ffb1974c4207ab4b0d0c3ae9a47e5d36dd12b

SHA512
d525071f5efabfc8a3d65aa9bca4794080e80f96cfcdf6c3e29a26ac96c9e263e203dd6cb7c5f6e83c3658552a9a45ba87ebc13bc46ac6ca9d7458ef6009d8ba

Download Submit
/storage/emulated/0/backups/.SystemConfig/.cuid2

Filesize
129B

MD5
a9b64e03d23f9d2b971b06449aa46e2a

SHA1
a8d23b2da7db3f9d5747d49cef937729102d0ec3

SHA256
7163574660fbe8aa1e619f66a3c9f222b6cf0a7428bd7981d20df297d4277312

SHA512
057275024f13d72d4d1a37b1ec52b4413054805f56935ede5bb8b9f4222780aa0f13d285d9a9a24384d459640309ea0b51ff7601d90cb96967d778a9ee0285be

Download Submit
/storage/emulated/0/baidu/tempdata/ls.db-journal

Filesize
512B

MD5
8a57158c652da823c50931b7b4a7dc05

SHA1
86df8f3c8376012a9912cd2639f882037a37c62a

SHA256
009e3ccb63642895a14960fd755757a3edfbfa8392fb2f4ae10a2a0753811a20

SHA512
51d5c74ac94521697a0383d8b843816574667f9f268ae55437a623a1eebd843f3d1732f5a934f241f32840e82a1d4b56fe7e91d46f37828e48294a033efdd696

Download Submit
/storage/emulated/0/baidu/tempdata/ls.db-shm

Filesize
28KB

MD5
cf845a781c107ec1346e849c9dd1b7e8

SHA1
b44ccc7f7d519352422e59ee8b0bdbac881768a7

SHA256
18619b678a5c207a971a0aa931604f48162e307c57ecdec450d5f095fe9f32c7

SHA512
4802861ea06dc7fb85229a3c8f04e707a084f1ba516510c6f269821b33c8ee4ebf495258fe5bee4850668a5aac1a45f0edf51580da13b7ee160a29d067c67612

Download Submit
/storage/emulated/0/baidu/tempdata/ls.db-wal

Filesize
52KB

MD5
4a4912169c399158b30d3d2aa4b03ed9

SHA1
9abe862b61ecc923ee31c750d769caf849310f77

SHA256
948a122f05d8a83a2246068a9531341cff7e837e87ede36dc26131fe40c35def

SHA512
84f3311669f0e50c2799c9a3e3af4b51b2cd63c9c2bdd217890e870192f48f67c4aba9093acdf506af51a052fd19ba68bb4418320bc0b1ce2b47592f5cbe352f

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads