ebbdad9b802cb87e34151f148d3ea98ca272c062b9709b7d5070d4606b6d3bfd

Analysis

max time kernel
149s
max time network
156s
platform
android_x86
resource
android-x86-arm-20240624-en
resource tags

androidarch:armarch:x86image:android-x86-arm-20240624-enlocale:en-usos:android-9-x86system
submitted
08/09/2024, 11:07

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

d437ca7bb5c0a672841dfda652358a61_JaffaCakes118.apk
Size

20.9MB
MD5

d437ca7bb5c0a672841dfda652358a61
SHA1

2fe085d60d90800a19da969d809d6ca6163e080f
SHA256

ebbdad9b802cb87e34151f148d3ea98ca272c062b9709b7d5070d4606b6d3bfd
SHA512

b4fccc06c482cb397e97b76cd763dbc96f1e92673206cdd67cc082732164b467578b84934ef6443a19412af6d70cb7981aa67905447e5e730172c3d666dab62b
SSDEEP

393216:3918yAExD+jqiQLC2G8FbWE9xwPVjZ+mS0axUdaIcz3iBjcC/85UT0Rm:38yPKeYJ6v9yPVF+mSEdRw3ixcAHYRm

Score

7^/10

banker collection discovery evasion impact persistence

Malware Config

Signatures

Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
banker discovery

Security Software Discovery
T1418.001

Queries information about running processes on the device 1 TTPs 3 IoCs

Application may abuse the framework's APIs to collect information about running processes on the device.

discovery

Process Discovery

T1424

description	ioc	Process
Framework service call	android.app.IActivityManager.getRunningAppProcesses	com.inpress.android.resource
Framework service call	android.app.IActivityManager.getRunningAppProcesses	com.inpress.android.resource:pushservice
Framework service call	android.app.IActivityManager.getRunningAppProcesses	com.inpress.android.resource:remote

Queries information about the current nearby Wi-Fi networks 1 TTPs 2 IoCs

Application may abuse the framework's APIs to collect information about the current nearby Wi-Fi networks.

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.wifi.IWifiManager.getScanResults	com.inpress.android.resource
Framework service call	android.net.wifi.IWifiManager.getScanResults	com.inpress.android.resource:remote

Requests cell location 2 TTPs 2 IoCs

Uses Android APIs to to get current cell location.

collection discovery evasion

Location Tracking

T1430

Geofencing

T1627.001

description	ioc	Process
Framework service call	com.android.internal.telephony.ITelephony.getCellLocation	com.inpress.android.resource
Framework service call	com.android.internal.telephony.ITelephony.getAllCellInfo	com.inpress.android.resource:remote

Acquires the wake lock 1 IoCs

description	ioc	Process
Framework service call	android.os.IPowerManager.acquireWakeLock	com.inpress.android.resource:pushservice

Domain associated with commercial stalkerware software, includes indicators from echap.eu.org 1 IoCs

flow	ioc
12	alog.umeng.com

Queries information about active data network 1 TTPs 3 IoCs

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.IConnectivityManager.getActiveNetworkInfo	com.inpress.android.resource:remote
Framework service call	android.net.IConnectivityManager.getActiveNetworkInfo	com.inpress.android.resource
Framework service call	android.net.IConnectivityManager.getActiveNetworkInfo	com.inpress.android.resource:pushservice

Queries information about the current Wi-Fi connection 1 TTPs 3 IoCs

Application may abuse the framework's APIs to collect information about the current Wi-Fi connection.

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.wifi.IWifiManager.getConnectionInfo	com.inpress.android.resource
Framework service call	android.net.wifi.IWifiManager.getConnectionInfo	com.inpress.android.resource:pushservice
Framework service call	android.net.wifi.IWifiManager.getConnectionInfo	com.inpress.android.resource:remote

Reads information about phone network operator. 1 TTPs
discovery

System Network Configuration Discovery
T1422

Listens for changes in the sensor environment (might be used to detect emulation) 1 TTPs 1 IoCs

evasion

User Evasion

T1628.002

description	ioc	Process
Framework API call	android.hardware.SensorManager.registerListener	com.inpress.android.resource:remote

Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 3 IoCs

persistence

Broadcast Receivers

T1624.001

description	ioc	Process
Framework service call	android.app.IActivityManager.registerReceiver	com.inpress.android.resource
Framework service call	android.app.IActivityManager.registerReceiver	com.inpress.android.resource:pushservice
Framework service call	android.app.IActivityManager.registerReceiver	com.inpress.android.resource:remote

Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 3 IoCs

impact

Data Encrypted for Impact

T1471

description	ioc	Process
Framework API call	javax.crypto.Cipher.doFinal	com.inpress.android.resource
Framework API call	javax.crypto.Cipher.doFinal	com.inpress.android.resource:pushservice
Framework API call	javax.crypto.Cipher.doFinal	com.inpress.android.resource:remote

Checks CPU information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/cpuinfo	com.inpress.android.resource

com.inpress.android.resource
1⤵
- Queries information about running processes on the device
- Queries information about the current nearby Wi-Fi networks
- Requests cell location
- Queries information about active data network
- Queries information about the current Wi-Fi connection
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Uses Crypto APIs (Might try to encrypt user data)
- Checks CPU information
PID:4254

com.inpress.android.resource:pushservice
1⤵
- Queries information about running processes on the device
- Acquires the wake lock
- Queries information about active data network
- Queries information about the current Wi-Fi connection
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Uses Crypto APIs (Might try to encrypt user data)
PID:4312

com.inpress.android.resource:remote
1⤵
- Queries information about running processes on the device
- Queries information about the current nearby Wi-Fi networks
- Requests cell location
- Queries information about active data network
- Queries information about the current Wi-Fi connection
- Listens for changes in the sensor environment (might be used to detect emulation)
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Uses Crypto APIs (Might try to encrypt user data)
PID:4362

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Event Triggered Execution

T1624

Broadcast Receivers

T1624.001

Privilege Escalation

Defense Evasion

Execution Guardrails

T1627

Geofencing

T1627.001

Hide Artifacts

T1628

User Evasion

T1628.002

Virtualization/Sandbox Evasion

T1633

System Checks

T1633.001

Credential Access

Discovery

Location Tracking

T1430

Process Discovery

T1424

Software Discovery

T1418

Security Software Discovery

T1418.001

System Information Discovery

T1426

System Network Configuration Discovery

T1422

System Network Connections Discovery

T1421

Lateral Movement

Collection

Location Tracking

T1430

Command and Control

Exfiltration

Impact

Data Encrypted for Impact

T1471

Replay Monitor

Loading Replay Monitor...

Downloads

/data/data/com.inpress.android.resource/databases/cc/cc.db

Filesize
36KB

MD5
d2e725c092b2ffdcf777ed8317472085

SHA1
8aa75f9430e90aa60331ca7238844b4e669b7cf7

SHA256
93211958c5b3502cbfe4ca6a1cfa9ebda115194b9e21a4641f49a1ac63f985cc

SHA512
9cc018b1ac4d4efe8c71bb91a88f8bb66e3ca103cd3bb6863a04a8184d40924f0e89a4688eaf6dce880b326f1f8c68c2caa0b44486a3c2a496e3a88089496e26

Download Submit
/data/data/com.inpress.android.resource/databases/cc/cc.db

Filesize
36KB

MD5
ce6135aa1b1fe4f2c2db2a546d2a5558

SHA1
79b59582154017aadab783dc266fcb158c252940

SHA256
7b45f576c08c7f78220168cca4a0e33198b13e9bdc8b1da406ddb6887412000c

SHA512
2839075fe374c8567c839ae35ce2d33ec72fdaebf170aa7d224b555e5b0e74d4a43f2f67d17ed806dae841da883e9620d788ea052d06152678afa927307c7ce4

Download Submit
/data/data/com.inpress.android.resource/databases/cc/cc.db-journal

Filesize
52KB

MD5
c168780cdb83658ee95f1a07ffaa5c41

SHA1
aa1f709f578263f346166c2d5af86f3ba12e0677

SHA256
f8c9e7e4f1c0574a2a6b2fc29dd2fc13bda1926dc799e07810219be80beb490f

SHA512
78e15815aabe2afa071a1ac971054ab95edf9af006f155f6197203de59cdb6676ac7b4b756de9389c4d96fe6bf6411b4da4452fde81422e1a9cb1328b6670f3c

Download Submit
/data/data/com.inpress.android.resource/databases/cc/cc.db-shm

Filesize
32KB

MD5
bb7df04e1b0a2570657527a7e108ae23

SHA1
5188431849b4613152fd7bdba6a3ff0a4fd6424b

SHA256
c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479

SHA512
768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012

Download Submit
/data/data/com.inpress.android.resource/databases/cc/cc.db-wal

Filesize
48KB

MD5
d2828700691968986c0a958566d7608e

SHA1
8765a01b1285e1519c58ce3880d3d17670b7c694

SHA256
62f60439c80df505bb368fefe658504069894fe701c8f952b5ba3876d6251dac

SHA512
3da4618fed3f8085fe4dbb8095f3a0d2dbda1eca79ed20ae6a8a649c087b69516e05e7b93c188e82b29415ec3a9ef809006478975d5ebfb104c4921f2bd91785

Download Submit
/data/data/com.inpress.android.resource/databases/cc/cc.db-wal

Filesize
16KB

MD5
80a86ae6ee3b3211149810e84b9a50a9

SHA1
1b5dbdcd73c4c93c5beca36a2ac68970c41d9567

SHA256
e02315c8b781f06d0e6849b46463bc59d334af2f4f19a8a9e52763030c427ef7

SHA512
08648d346a623c15d57ba80ce2d58166764329ebd7d462dbefac894530e5b7dc7eebb95ce030068f8a2940d4d08e1d5ba09cca297f2a5912ece063db4ef2bd73

Download Submit
/data/data/com.inpress.android.resource/databases/ua.db

Filesize
32KB

MD5
575ec3929ba77ef914a754794f94b8d4

SHA1
4438d3e123d14ed3208774b03449e5063ee0323e

SHA256
67f8ab649588a6b277e90c7f2b6a3971c33ecc70930cca4c3dda3dab2cb0ed6f

SHA512
8b91e5cd3fa961e8563df97a58a9b0f356524276feb628deee67a846e1ca37f80029ad13f19e6b3807456c49703dda5a614c61d7ca3bf6b2e2f786c49ad0439c

Download Submit
/data/data/com.inpress.android.resource/databases/ua.db

Filesize
48KB

MD5
0665c4b3f550675b80faa294f4deca5e

SHA1
7a18e3d73a666d536559f514f4366cf880586a5b

SHA256
fa2c1dd4a45e6c4c4b5ad082d710fb300c5b68b9cf0fbd898677235abd7cb28d

SHA512
a55c6299868a01fee9ade8293c3663a1cec1c0fe97f59bea6f17f7e7d4bc8f15f36bde3ad6ecd59bf307b30aae0a0dd6a644bafcda40dc134dd478b3f1e720a0

Download Submit
/data/data/com.inpress.android.resource/databases/ua.db

Filesize
32KB

MD5
d604a3bf1f8d992cc320ea5b1f7609bd

SHA1
247f88df0b55c7d523ea5398637711a0e4a483a4

SHA256
329940b4d46326d58e73c842dd099704061d0ef7338777bf31ad895f29013c17

SHA512
67e28f6713cb5c238a9664df128f01a89a2efb7c8c9330c1e45bc0d40ebab81fa20df5166743d84d81dc0386a89ff0329f022281c098339baa2e851ff0a1e1ab

Download Submit
/data/data/com.inpress.android.resource/databases/ua.db

Filesize
36KB

MD5
6130cde7b61b0a5ba7f9d492644dce85

SHA1
1513f38c7902575aa33b4b9d44bbd1b39fc9fd92

SHA256
d3341cd02fea0ab1ba26df26a9e1e8b16c3696bd50eb7ecbd8354cd176ad0d49

SHA512
b94a39d722b055e99989b00bc7e43e3a3cbecd5c3c509fe2363db472e6723298a4270a83ce11baf9ac38266f2fd785ccdcd0498d73730d27fab0ebe1b51548aa

Download Submit
/data/data/com.inpress.android.resource/databases/ua.db-journal

Filesize
32KB

MD5
315cb8dfe0c61adc6357eecb7545e610

SHA1
4ab717eb851ced8509943e846319b9de3222ee61

SHA256
6d25b5e2691fdf7f9a60fbf2933e35f7b4d1b261cbbbfab7759d3ca2c13c09d8

SHA512
82cee3f5f77ea739964ebebcd29bdd63bcf839291e3b07120409bda386eca984dec32c111ca945add023e8c59aa59851b1df2e4991f9b5622a93ca8c8fb5b780

Download Submit
/data/data/com.inpress.android.resource/databases/ua.db-shm

Filesize
32KB

MD5
0f57f1e2d0c6c31f0b2761df946e9184

SHA1
eb6c6f4b807d740161894ceeb250a594440158cb

SHA256
e137a71b4ed818b2be3e71169e6354ed4dfcc0940574b446a17ef8e26783e4dc

SHA512
39f1167a049b462c11b3fc5895f06b4f6fe4db88c9cf189f2e8a18e8913d6f0b90c6267ab552088837b700aeed38e569d9905f6414a0b53bdfdd139c9cc528b8

Download Submit
/data/data/com.inpress.android.resource/databases/ua.db-wal

Filesize
56KB

MD5
9961c2a3a3f194eab71e3c802983e09f

SHA1
b9a32a25759c97bdd56cde02b2549077e6118d36

SHA256
ba3f8fad6405c0abdcb38b81fa6b3221383c4f10fcacac3cc2b3b0b4ab7731c5

SHA512
4f6c6e58c1c338c575f7062ad6c6177282cb8ea677078f328483372556dc3a2cb9b874166b83512af5799f01606db7c01e735c97548a069ef0186ae83292cc8f

Download Submit
/data/data/com.inpress.android.resource/databases/ua.db-wal

Filesize
36KB

MD5
3bf0dcadfd57d927dc761b255e4565e2

SHA1
4ec2a8435ec645c5b2baf48a5a1a64018b9aa7fb

SHA256
673a1f16c2c9a672a7cb2669f87eb57a453141714264bd6a164901db99684173

SHA512
fec69cf211acd063cde7272f9c939c8ed8c4aa98e7161d3ee702d5fc4b31b9ae8756a13e0e3406a44154ff420395d24a6c6fd09e2aeea6ad375265c7e3878d5c

Download Submit
/data/data/com.inpress.android.resource/databases/ua.db-wal

Filesize
4KB

MD5
5798ec2bdd00ca90e59f57727aa72e92

SHA1
2ac1c243680ce2f5e4fdaef1628b2ae8d3e6ea11

SHA256
6c124cd02c3d4410790bfc3e0216f1eea7bf836f274aefee61ac3c6a36dcf003

SHA512
5670875a8f27f79e6601b5ba3053a11085bea28092322de240fa45cc4fa5b27836416600c9dda7f2be0865e2c0f46a9ef7c1f4f0cd71259f76844b590c008a28

Download Submit
/data/data/com.inpress.android.resource/databases/ua.db-wal

Filesize
32KB

MD5
5523f6c18213e3ba7a9d67f6ff75ebf5

SHA1
c0ad4f044f7cb36785f8f52522f5b25accbee74a

SHA256
761584e559ca6320502fbd1cba1c133b46f26cd872a9d48237f9c6f7247ed860

SHA512
d84bc21bf30dd413633088f15b09a8ceaaee291d4335ed3f56a54d6ff3f9addb237a3847deda7053db9647dee0286eae76839865ec45d36c1b7a8a348a79f8e5

Download Submit
/data/data/com.inpress.android.resource/databases/xbdysbd.release

Filesize
4KB

MD5
f2b4b0190b9f384ca885f0c8c9b14700

SHA1
934ff2646757b5b6e7f20f6a0aa76c7f995d9361

SHA256
0a8ffb6b327963558716e87db8946016d143e39f895fa1b43e95ba7032ce2514

SHA512
ec12685fc0d60526eed4d38820aad95611f3e93ae372be5a57142d8e8a1ba17e6e5dfe381a4e1365dddc0b363c9c40daaffdc1245bd515fddac69bf1abacd7f1

Download Submit
/data/data/com.inpress.android.resource/databases/xbdysbd.release-journal

Filesize
512B

MD5
c1861231296bedcf069a3238dd068c03

SHA1
8356060fe0385fba1da79d1b02a2adff4d28def0

SHA256
33ea8dca2e5072a99e50ad94cda79bb9b9af520a8c9f09571991df9ac8050e6a

SHA512
8f1c4671ec25d4b33b881f72b94c6d5324a0a2e130f3d0525063a1fb7aab40264b5db720af73f22f8ed6362db72fd3d6ce58659e7215306c05407c6947c71045

Download Submit
/data/data/com.inpress.android.resource/databases/xbdysbd.release-shm

Filesize
257KB

MD5
9a833f4cc25e660ce7e918faea86361d

SHA1
fd2058b6b4dd87e827adda376399ac3739130dd8

SHA256
b730150b43f74638a73362f5b2079010adc66d749286e76cccd05b12b87b3e2c

SHA512
5cdd25d59aef6aae044b99d3fee8725a3781f7b584202a2cb1436fd73bc59a1b991930dccca50e713769a6458de2842428b3e0a0f2287e1bb34987d02b32dd30

Download Submit
/data/data/com.inpress.android.resource/databases/xbdysbd.release-wal

Filesize
52KB

MD5
37ba890b61b8db4a9530be2da30e393e

SHA1
912a638eeb0c9724f58ff704114181003e22c777

SHA256
32f7653aa1aa5fc37166d420dfbc3eea241f17d98cf29e0c7475525262f800e7

SHA512
b75aae6e5ea9e6e2df13af9b01d065aa818a12a02287f50b3d2c1f1d19c38fa7b92db1217beacaaee649d6534b90d1101527bf9e56840c33d2d4c04466b4e6aa

Download Submit
/data/data/com.inpress.android.resource/files/exid.dat

Filesize
156KB

MD5
4d00f2ade0c30d9500a3ec2f9b4406f5

SHA1
94db80d1f7b154fbac4ab65426b91611a39fe818

SHA256
08f30819ad193dec8e430e7a29c7509e4115f7c2672a77f99739c142c2558512

SHA512
e09d94c35c6ade412ffa583b0193e3a08bc6ff0e877e3cd6a987a88db61d40fc76d171439b873570049d2e606b8b08eae5993e8e337a796083e14ce0f9a10753

Download Submit
/data/data/com.inpress.android.resource/files/libcuid.so

Filesize
512B

MD5
c248c60359abd3777a270553ff823409

SHA1
51b2544e17d13f29c158cd61ba8ed94be5c9e9ed

SHA256
8c503c432b39d74c24d627bf1ef5799413cf3030a5157ae3ee72dc74e549222b

SHA512
fbbb14d43526497ee2a334cc572d10cdbbcb258634759a7dedbdc10d599d2c096fe19341c8d909209a6f6ba47e0ac5fd79639cf1086230d239ca20430b72a28f

Download Submit
/data/data/com.inpress.android.resource/files/libs/libBaiduMapSDK_base_v4_2_0.so

Filesize
257KB

MD5
812f4ad52ea3a68870379bc280c45f80

SHA1
b46e7f9614c1823b2c39e9b2065f1093f9dd04f3

SHA256
dd65c175c40529a1a40560bc99128d5792c05241f6bafcb46088d2976c00cefd

SHA512
d1e4b676af5f1c8d22aa413915a99661fcc063d914ac42a5166de02b194c8fa3c70676431df7f3f9abc0d3fb87b35577ef2475e6067ab7faa548f9d41bf220a4

Download Submit
/data/data/com.inpress.android.resource/files/lldt/firll.dat

Filesize
16B

MD5
b2ccdaadac45c664a8cd2e1156c4e730

SHA1
a5ec739c6041dacb55368c29e8438dbab497b18b

SHA256
ba0a2287fecd3eb5c4f6b999decf44458330a8c6dd4a86c91a89d56d009e571e

SHA512
9d613d72762b125c23e4c9d0b5ef39bf42d2252ef3761e47b3dac54bacaf6694e40ca026195c2ace56ef396d816fac0e488520678766c1e8aaa9a5dbcb031c32

Download Submit
/data/data/com.inpress.android.resource/files/lldt/grtcfrsa.dat

Filesize
801B

MD5
7c366ea8f849e91e3f0f3093867b5c33

SHA1
88bb005e5643134f8719895233047017afe39800

SHA256
d759d062f4eff809dc55ecf5cf8693b0e062bc1bf3301f11d907f555852b20e9

SHA512
4575109c6e7330735b5421dc6f32abec26c5e9a92fc6ceb5b0b0f360ff97ab42f6001e52ebe63199d17ad27c053deb04b26e18af0025c0462886c9576c1d63a6

Download Submit
/data/data/com.inpress.android.resource/files/lldt/grtcfrsa.dat

Filesize
206B

MD5
6d613136def26031e18f3f404299bb7e

SHA1
14a7a4a3309b932512dad59dbdb35503845e60c0

SHA256
58e28d4defb46364dd0057354a4a89f8cb726d3b696c632de04b1a707803be18

SHA512
89ac70f36ec3117b631a56d43700b4d034d6d269d4632933fdaa8cd9675c57af1df95f15271d0b45b796f56b4f89ec3d6bd4c9114d7cdd24e3a25d30e24e7ca0

Download Submit
/data/data/com.inpress.android.resource/files/umeng_it.cache

Filesize
512B

MD5
624610084bae5024f01836bf72930ab2

SHA1
95bfb2c589953eaac96157535fff09bd62049dd6

SHA256
d7a464cbbbbec48003eb9ffe3eea5472f7aae2ce3cb4b6e80b5434be4bb9e7a4

SHA512
de29f553f656c6e1b1ea7255586047d3d880235f75283066b75cfe140b57258baac1eb5250365499dc5c2ebc71120c876700048a66cd00ffae6512a591de20ea

Download Submit
/storage/emulated/0/.DataStorage/ContextData.xml

Filesize
65B

MD5
9781ca003f10f8d0c9c1945b63fdca7f

SHA1
4156cf5dc8d71dbab734d25e5e1598b37a5456f4

SHA256
3325d2a819fdd8062c2cdc48a09b995c9b012915bcdf88b1cf9742a7f057c793

SHA512
25a9877e274e0e9df29811825bd4f680fa0bf0ae6219527e4f1dcd17d0995d28b2926192d961a06ee5bef2eed73b3f38ec4ffdd0a1cda7ff2a10dc5711ffdf03

Download Submit
/storage/emulated/0/.DataStorage/ContextData.xml

Filesize
213B

MD5
daec34466a6aec42cbbea897f900539e

SHA1
ef331b004d2cfbb88322cb71fc000c80aa0cf770

SHA256
474923a4c9f828607548b47687d8fcc9abd8b3165c2a7520a7d1807990172723

SHA512
d848191db442cf07954d131ff36e6a7046a7fe09272c2dfac0d0d1a772b3bc68e5319e78ea83c5af0d8ec2f4da705554fd7532b2e360db2708df8a408b39749c

Download Submit
/storage/emulated/0/.UTSystemConfig/Global/Alvin2.xml

Filesize
512B

MD5
3e758b360df90a070b24ec8282a52560

SHA1
9a5b1ff9a3012d20d57b8622c366fe38cd44fd36

SHA256
5c71f8f09023a3929c7422211653dbec06de2e8df7405aa1af03603382cb26d7

SHA512
298e615c50fe94232370811e61c90c896947075b62f082e59205d7b8fd8ef9fd035e2651ee5fb88f6a42c0b35650a9bf03c95f9ab613d15ab5497487067a2843

Download Submit
/storage/emulated/0/.UTSystemConfig/Global/Alvin2.xml

Filesize
32KB

MD5
6b42cbd508180fb70cb45d9899f4ccbb

SHA1
06c4aee85d5c4cd17c256fa2fc8577536d8a74b2

SHA256
b0d1b4c7cc8cf971de4e79b5029d6025c780539cce6bcfe3978ef8a3dc4aaa8e

SHA512
6d32c76c43a079d885b24042280568924f43ee9a17ff25db5e72d02265d01f7419b37c5ed25baee00f8ca5ecfcfbc2556e4b1a7769c763613bb23388f48d2d98

Download Submit
/storage/emulated/0/backups/.SystemConfig/.cuid2

Filesize
80KB

MD5
6f089a5546ec1f9aa60040d0b0b183a9

SHA1
3e221a9862c0a25a4cf8e719cabc1aa3e10f9079

SHA256
b50b3106c16403105ed8107186f502da33c9117512a6ef91ca27ce385d034326

SHA512
19ee70fd3905efb8ee8c0b5d731e7ad008c34b5c4a034289c9306257a4b0ed0acebfebafdeb09e00cc50ac52a4eabdb007e33868fcdceb0e0cef8cdf47efbd80

Download Submit
/storage/emulated/0/baidu/tempdata/lcvif.dat

Filesize
1KB

MD5
64a0a49f3a123d8247cd2e9d7072c590

SHA1
f8ce8c670e5a72d5baa0bc25caa5b8782f54c86b

SHA256
f6a5688a8ab7f249af7adc8ec51ca221715c9db11bbbc20b1219e871785d41e5

SHA512
378da986f64fcdaa093e8cf01d694bc2478053035dbc3308f4ed179eac45b89fe51de4801f873ee98448ad9140056b6420833b34251cee7d3a2969119a02ef61

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads