Malware Analysis Report

2025-08-06 02:51

Sample ID 241015-yl7lxsxhpm
Target 49b6a9d41ad910ac3ac75bb575a2524a_JaffaCakes118
SHA256 f790883eb84f8b1f2b6fa833fd210f3ad3ed849833f1537368b284e99f262228
Tags
discovery evasion impact persistence collection credential_access
score
8/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Mobile Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral4

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral5

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral6

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral7

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral8

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral3

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
8/10

SHA256

f790883eb84f8b1f2b6fa833fd210f3ad3ed849833f1537368b284e99f262228

Threat Level: Likely malicious

The file 49b6a9d41ad910ac3ac75bb575a2524a_JaffaCakes118 was found to be: Likely malicious.

Malicious Activity Summary

discovery evasion impact persistence collection credential_access

Checks if the Android device is rooted.

Queries information about running processes on the device

Obtains sensitive information copied to the device clipboard

Queries information about active data network

Queries the unique device ID (IMEI, MEID, IMSI)

Domain associated with commercial stalkerware software, includes indicators from echap.eu.org

Queries information about the current Wi-Fi connection

Queries the mobile country code (MCC)

Reads information about phone network operator.

Requests dangerous framework permissions

Registers a broadcast receiver at runtime (usually for listening for system events)

Uses Crypto APIs (Might try to encrypt user data)

Checks CPU information

Checks memory information

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-10-15 19:53

Signatures

Requests dangerous framework permissions

Description Indicator Process Target
Allows read only access to phone state, including the current cellular network information, the status of any ongoing calls, and a list of any PhoneAccounts registered on the device. android.permission.READ_PHONE_STATE N/A N/A
Allows an application to write to external storage. android.permission.WRITE_EXTERNAL_STORAGE N/A N/A
Allows an application to read from external storage. android.permission.READ_EXTERNAL_STORAGE N/A N/A
Allows an app to create windows using the type LayoutParams.TYPE_APPLICATION_OVERLAY, shown on top of all other apps. android.permission.SYSTEM_ALERT_WINDOW N/A N/A
Allows access to the list of accounts in the Accounts Service. android.permission.GET_ACCOUNTS N/A N/A
Allows an application to read or write the system settings. android.permission.WRITE_SETTINGS N/A N/A

Analysis: behavioral4

Detonation Overview

Submitted

2024-10-15 19:53

Reported

2024-10-15 19:56

Platform

android-x64-20240624-en

Max time kernel

7s

Max time network

159s

Command Line

com.zqhy.btgame

Signatures

N/A

Processes

com.zqhy.btgame

Network

Country Destination Domain Proto
N/A 224.0.0.251:5353 udp
US 1.1.1.1:53 ssl.google-analytics.com udp
GB 142.250.187.232:443 ssl.google-analytics.com tcp
GB 142.250.179.238:443 tcp
US 1.1.1.1:53 android.apis.google.com udp
GB 142.250.187.238:443 android.apis.google.com tcp
GB 142.250.200.36:443 tcp
GB 142.250.200.36:443 tcp

Files

N/A

Analysis: behavioral5

Detonation Overview

Submitted

2024-10-15 19:53

Reported

2024-10-15 19:56

Platform

android-x64-arm64-20240624-en

Max time kernel

8s

Max time network

134s

Command Line

com.zqhy.btgame

Signatures

N/A

Processes

com.zqhy.btgame

Network

Country Destination Domain Proto
N/A 224.0.0.251:5353 udp
GB 142.250.180.14:443 tcp
GB 142.250.180.14:443 tcp
US 1.1.1.1:53 android.apis.google.com udp
GB 216.58.204.78:443 android.apis.google.com tcp
US 1.1.1.1:53 ssl.google-analytics.com udp
GB 172.217.169.72:443 ssl.google-analytics.com tcp
GB 142.250.179.228:443 tcp
GB 142.250.179.228:443 tcp

Files

N/A

Analysis: behavioral6

Detonation Overview

Submitted

2024-10-15 19:53

Reported

2024-10-15 19:56

Platform

android-x86-arm-20240624-en

Max time kernel

7s

Max time network

147s

Command Line

com.zqhy.safepay

Signatures

N/A

Processes

com.zqhy.safepay

Network

Country Destination Domain Proto
N/A 224.0.0.251:5353 udp
GB 216.58.213.10:443 tcp
US 1.1.1.1:53 semanticlocation-pa.googleapis.com udp
GB 142.250.200.46:443 tcp
US 1.1.1.1:53 android.apis.google.com udp
GB 142.250.180.14:443 android.apis.google.com tcp
GB 216.58.213.10:443 tcp

Files

N/A

Analysis: behavioral7

Detonation Overview

Submitted

2024-10-15 19:53

Reported

2024-10-15 19:56

Platform

android-x64-20240910-en

Max time kernel

5s

Max time network

151s

Command Line

com.zqhy.safepay

Signatures

N/A

Processes

com.zqhy.safepay

Network

Country Destination Domain Proto
N/A 224.0.0.251:5353 udp
GB 142.250.200.42:443 tcp
GB 216.58.201.110:443 tcp
GB 216.58.201.110:443 tcp
US 1.1.1.1:53 android.apis.google.com udp
GB 216.58.213.14:443 android.apis.google.com tcp
US 1.1.1.1:53 ssl.google-analytics.com udp
GB 142.250.187.232:443 ssl.google-analytics.com tcp
GB 142.250.180.14:443 tcp
GB 142.250.180.14:443 tcp
GB 216.58.213.2:443 tcp

Files

N/A

Analysis: behavioral8

Detonation Overview

Submitted

2024-10-15 19:53

Reported

2024-10-15 19:56

Platform

android-x64-arm64-20240624-en

Max time kernel

7s

Max time network

134s

Command Line

com.zqhy.safepay

Signatures

N/A

Processes

com.zqhy.safepay

Network

Country Destination Domain Proto
N/A 224.0.0.251:5353 udp
GB 142.250.187.206:443 tcp
GB 142.250.187.206:443 tcp
US 1.1.1.1:53 android.apis.google.com udp
GB 142.250.180.14:443 android.apis.google.com tcp
US 1.1.1.1:53 ssl.google-analytics.com udp
GB 172.217.16.232:443 ssl.google-analytics.com tcp
GB 142.250.187.228:443 tcp
GB 142.250.187.228:443 tcp

Files

N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-10-15 19:53

Reported

2024-10-15 19:56

Platform

android-x86-arm-20240624-en

Max time kernel

127s

Max time network

135s

Command Line

com.yuzhua.jjtf

Signatures

Checks if the Android device is rooted.

evasion
Description Indicator Process Target
N/A /system/app/Superuser.apk N/A N/A

Queries information about running processes on the device

discovery
Description Indicator Process Target
Framework service call android.app.IActivityManager.getRunningAppProcesses N/A N/A

Domain associated with commercial stalkerware software, includes indicators from echap.eu.org

Description Indicator Process Target
N/A alog.umeng.com N/A N/A

Queries information about active data network

discovery
Description Indicator Process Target
Framework service call android.net.IConnectivityManager.getActiveNetworkInfo N/A N/A

Queries information about the current Wi-Fi connection

discovery
Description Indicator Process Target
Framework service call android.net.wifi.IWifiManager.getConnectionInfo N/A N/A

Queries the mobile country code (MCC)

discovery
Description Indicator Process Target
Framework service call com.android.internal.telephony.ITelephony.getNetworkCountryIsoForPhone N/A N/A

Reads information about phone network operator.

discovery

Registers a broadcast receiver at runtime (usually for listening for system events)

persistence
Description Indicator Process Target
Framework service call android.app.IActivityManager.registerReceiver N/A N/A

Uses Crypto APIs (Might try to encrypt user data)

impact
Description Indicator Process Target
Framework API call javax.crypto.Cipher.doFinal N/A N/A

Checks CPU information

Description Indicator Process Target
File opened for read /proc/cpuinfo N/A N/A

Checks memory information

Description Indicator Process Target
File opened for read /proc/meminfo N/A N/A

Processes

com.yuzhua.jjtf

/system/bin/sh -c getprop

getprop

Network

Country Destination Domain Proto
US 1.1.1.1:53 cgi.connect.qq.com udp
HK 43.154.252.110:80 cgi.connect.qq.com tcp
US 1.1.1.1:53 btgameapp-ns1.btgame01.com udp
HK 43.154.252.110:443 cgi.connect.qq.com tcp
US 1.1.1.1:53 btgameapp-ns2.btgame01.com udp
US 1.1.1.1:53 btgameapp-ns3.btgame01.com udp
US 1.1.1.1:53 alog.umeng.com udp
CN 223.109.148.177:80 alog.umeng.com tcp
US 1.1.1.1:53 btgameapp-ns4.btgame01.com udp
US 1.1.1.1:53 btgameapp-ns5.btgame01.com udp
GB 216.58.201.110:443 tcp
US 1.1.1.1:53 android.apis.google.com udp
GB 142.250.180.14:443 android.apis.google.com tcp
CN 223.109.148.179:80 alog.umeng.com tcp
CN 223.109.148.176:80 alog.umeng.com tcp
CN 223.109.148.130:80 alog.umeng.com tcp
CN 223.109.148.141:80 alog.umeng.com tcp
CN 223.109.148.178:80 alog.umeng.com tcp
US 1.1.1.1:53 alog.umengcloud.com udp
CN 223.109.148.176:80 alog.umengcloud.com tcp
CN 223.109.148.130:80 alog.umengcloud.com tcp
CN 223.109.148.179:80 alog.umengcloud.com tcp
CN 223.109.148.178:80 alog.umengcloud.com tcp
CN 223.109.148.177:80 alog.umengcloud.com tcp
CN 223.109.148.141:80 alog.umengcloud.com tcp

Files

/data/data/com.yuzhua.jjtf/app_crashrecord/1004

MD5 66d535316c7cc9b28b60d8a934fc6b9c
SHA1 bf0e6d52c03d8ae49219ad160487ee8f0c128e9e
SHA256 9c126f0c0d667ee0ad7d3eb479e40f0ff41d1a188a4da4ed2eda564a5a70b0be
SHA512 36dc4b7ff9331e27a7a9fe1f2509cf5d53cb86e3a896cafa37899a57b734670c54169590b045580d62dd1313010e89f341f96d42e22770a0bf8f7ce3a0e5f76a

/data/data/com.yuzhua.jjtf/app_crashrecord/1004

MD5 0d210bfb2a0e1f1b4c082a6a0f79de07
SHA1 bb8ed9e364db79d1d9f2fcde3f15091893222faa
SHA256 988722c23d78a46021d0e7ca9deee7aa8bb83288269174ffacb7316f381cca1d
SHA512 536e9867b0df29b15b789f8949be6ab37fcdeccb9d39ded981da7dc2052c9533d0ec0e6f9a5444132977605d372e1463d91bdde41b528ff2ca3f65ab152325c1

/data/data/com.yuzhua.jjtf/app_crashrecord/1002

MD5 1fa9e98018e16104be73aa9d342164c3
SHA1 5a9ab4bd62ffec714a414829e0774a88f97e4a6f
SHA256 e9773394ca2f3395bc1a7e489021f59362c1bac4623188ff74fd253f42f14377
SHA512 4f034adb3dcda2f1616ead524921edc6c2a2327f260a0be8215f6a6d59c6cb968e4ed4ed4a84fc5d0b3ff36a1cbd4091f4a98c9089029ff89811cf5c06dbcde4

/data/data/com.yuzhua.jjtf/databases/bugly_db_-journal

MD5 466df2db1711c163dc0e7c231847a883
SHA1 4436f338d2d5741b1c4f8df71aa84e41a7805a78
SHA256 1a359c1c55fdacbfb6f0699afe1d0f1f5e1640a2b9b55055fb5a55045f6a6765
SHA512 17f00e61101e5972ad0837ffe9ee99a2b5176f01f6ba5366666d105a0b4ea08b4cc725bdf49adb56b6e273a2200c5d3ffeaf055451c57022f39477a7e5143e57

/data/data/com.yuzhua.jjtf/databases/bugly_db_

MD5 f2b4b0190b9f384ca885f0c8c9b14700
SHA1 934ff2646757b5b6e7f20f6a0aa76c7f995d9361
SHA256 0a8ffb6b327963558716e87db8946016d143e39f895fa1b43e95ba7032ce2514
SHA512 ec12685fc0d60526eed4d38820aad95611f3e93ae372be5a57142d8e8a1ba17e6e5dfe381a4e1365dddc0b363c9c40daaffdc1245bd515fddac69bf1abacd7f1

/data/data/com.yuzhua.jjtf/databases/bugly_db_-shm

MD5 bb7df04e1b0a2570657527a7e108ae23
SHA1 5188431849b4613152fd7bdba6a3ff0a4fd6424b
SHA256 c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479
SHA512 768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012

/data/data/com.yuzhua.jjtf/databases/bugly_db_-wal

MD5 65aeb19ed367359065a887eb8edd73be
SHA1 37813bb79d663c1bc203b4c1cc3175639f05c90d
SHA256 ebfdffb0cf5b729ce26543f65702a86a015bda77489d7c75860d16349a9967cb
SHA512 27c90a8c34fab8c6a1247e6ee7def8ecf8c86d2fb7996220e7db60bd183085970cd769a209fab7e2e0ac7acbe661fc5638a4af01e25eae926cb7cf8ab7874492

/storage/emulated/0/Android/data/com.yuzhua.jjtf/files/tbslog/tbslog.txt

MD5 9273ea1de18c6e961222457452751392
SHA1 9b182666b5b926fd952b219dcb7ff04cfa89f3fd
SHA256 385a05d69ab3c6a2f6dd48b00b7efc8770dcdeec94ec90e15600d25ed4ecbae9
SHA512 c3dccac9029673358cf15e414062c0c7fcac09802db6cfd42878c88f82a3ec74c0613c03e9df6336f9e784715fca0f88ff2c6f345a90b0dcbf0bfc38095f19d8

/data/data/com.yuzhua.jjtf/databases/okgo_server.db-journal

MD5 df80ec5edc549045b07cc8dad2098807
SHA1 96ccb02210925f4eda742bc617d9449703031a19
SHA256 bcd0d0ad6b105f249426a879092bbd8c98dcadb0d96070cab9f54b7d55259ac8
SHA512 7ce1cde8e12023199238df0b43c206b660b17675674b2dd75c949a6b081e8ba86d1d95379fde5c98eb6cf1f905fe4397659248b0c9e72fbc8fea7da8472ef1a4

/data/data/com.yuzhua.jjtf/databases/okgo_server.db

MD5 2e60a8ab0b7ef4889e09af34ff80e134
SHA1 d601ff5601bfd256a5b2a53d53019c58fe7b6726
SHA256 e0a6df61ec00a2986bc500aaae290fb9af4b77213ff10537ddb61e86b9a63a0e
SHA512 269ff57285515972b97c40d71899876f6fb6a46959ac7d17baa01ec83ee246c2cb44a87409d0c32ed829f69336a8757700f24335709d2ced7332c0bfc0f23397

/data/data/com.yuzhua.jjtf/databases/okgo_server.db-wal

MD5 8b35ad946120d42343314410284738b5
SHA1 a7e99b0083017f7583cc3d46bfdf437844f43b83
SHA256 c1f6ccfb437bc646c96df139fe84454beb34c75780f2b7d9547b2b2d33c53294
SHA512 aad91cae255ae37a173af139698a327000594327144d10e53c8250ec9ad3cbb20383ff4badbb89336f973ad08a70a64e556c23331f536ada1588d7b157f6919c

/data/data/com.yuzhua.jjtf/databases/ua.db-journal

MD5 3ef49499bbd2b8444c85cf12990b9e7a
SHA1 a72a34f18822b0a6f2b3f387b1f0c3b91e8ae921
SHA256 e0177e7b95ad69f54faa323e8e069e644b7b8c9f6aeaf460f66e4189fd231704
SHA512 ae2230b45962a577fa3a298dca5fddb4f8da00cfd41dfdda58d09fce4c5712ea5c15e443a9cec663e222aa0839b2fb808b2b8de4bd8c9be1bd3affcc808600bd

/data/data/com.yuzhua.jjtf/databases/ua.db

MD5 fa8c100e9755807fb5aff651c68a6850
SHA1 7433db0eda300deb5b545b3a8c27bb26882874ed
SHA256 a7c4b57025cae106072bb0a8ee5ee3c818c9a3c19f055a0df34aa85b2c6fd821
SHA512 c1917cf9da10bb0a9e3647ac5ae92e3f0d97ab0ec216bdd3475a11c4b36a50d12219c0a8e72037fe41bd429c40d0b2c8d5e45285128bb14cc4bf10f33fa88a7b

/data/data/com.yuzhua.jjtf/databases/ua.db-wal

MD5 0f8a95dce95a613095179b0841af1a06
SHA1 87b480b3af190092b50d5b410752cd4183cd1152
SHA256 9d78a46247db67ea0876c44cceaecfa6d82f7982fc372cc11a02c81505f66d53
SHA512 67f29ec8dc5bdfdacf61f306c4b4f3ba36199e0eba0e860fffdde771dbc1a1837b03de86023fd68e4de533daf346035ff88fe73ae45bbb8e353573e2d067b92b

/data/data/com.yuzhua.jjtf/databases/cc/cc.db-journal

MD5 ab447e4e371fdfdb5712fa39b0d4896c
SHA1 52101604be6d6e28c83e77a3f470d3a5d3b1491e
SHA256 67745370c45ac2140912e3e112190a5ea9eb9385183df65932a68df5bf07dbac
SHA512 0fb0c2c8dd9ee0ed8a7f228991a63715f1599907184e83539e70015ac214db4d16abe32a2349909495210567f05bfa4efba9855b92a50516a0d9a1d5f195d17b

/data/data/com.yuzhua.jjtf/databases/cc/cc.db

MD5 5d7ea1a23af19b4340cc8d90f28297d5
SHA1 4cfe95b23a9e98378d69c4290af81b51fbe76aea
SHA256 474c4a54534ed96beacad7cc9a805a3f53ec9c0522fc7bcc59771cf500a6a0da
SHA512 33071f4c92da0a3df01c4a61dd165df7c7e0f4f37753cafe02d19fc876a5e7fcbb01c069c804e140ab8bfa0644a55f50fd1373646d1c439f817baa5ffbd47f7b

/data/data/com.yuzhua.jjtf/databases/cc/cc.db-wal

MD5 5b2560a04d0f0cd26ed97aa3e28f2ddf
SHA1 7b44cb1e00573024b542f3ce35a1d3b68b0088c6
SHA256 521135b17b83aced5205a646036a6c56d4368ebbf487a948865aa8270dc4d969
SHA512 08bb63b2ae4e8c3e01afcb63b39dd5eb64c2c715548ed7157c1131f1f6933a4a6ec8a7669ee7fc955e261df1d685582a9f2d05f2b654eda9ba366f6743965a39

/data/data/com.yuzhua.jjtf/files/com.tencent.open.config.json.1107734485

MD5 f526172de1566b34fdcea744710d9559
SHA1 000cb54d9a008a807a1c5a3fd2b2e7cb41e7939d
SHA256 8572be02b59f4d514000939ec04a9b4e2380c55265256b724a617d8d0f4c6940
SHA512 dc81f0fe345b18c96b1638c67b9ef4c5e60059dfc4a02f3c30a23645d4847abeef46cf467d044c42597115c48052ce0e8ea24328382114a544c5dfd039a95e7d

/storage/emulated/0/.UTSystemConfig/Global/Alvin2.xml

MD5 9781ca003f10f8d0c9c1945b63fdca7f
SHA1 4156cf5dc8d71dbab734d25e5e1598b37a5456f4
SHA256 3325d2a819fdd8062c2cdc48a09b995c9b012915bcdf88b1cf9742a7f057c793
SHA512 25a9877e274e0e9df29811825bd4f680fa0bf0ae6219527e4f1dcd17d0995d28b2926192d961a06ee5bef2eed73b3f38ec4ffdd0a1cda7ff2a10dc5711ffdf03

/storage/emulated/0/.UTSystemConfig/Global/Alvin2.xml

MD5 67255f49f76ea52177f0c773f0add684
SHA1 22c1d90b2d2140e8c969b305988ac43fa12c957a
SHA256 20961ee3f63d1ac88373fed43fe4ad58713b62063da6da39512d5fe831e8e249
SHA512 447dd19c6a62a56d46497848fd590d8529f7f3aa4a5548cc2bb8070da388b90e01613221e28bc607fc126657564576efebd173150a05115502af37062dc9a204

/storage/emulated/0/.DataStorage/ContextData.xml

MD5 2a2694ea303837bb40b90c7d7b0f710e
SHA1 a48684def863d6d2f4748f49daf24efa1c550cfa
SHA256 689e83a9cc59109fb536c619fc808a4dd66f7db907ba69bf1ad8e7548a1ea446
SHA512 a11bcc6acec14882710e00162031e9ee105ec924b143d1d9a2e8ac2b64f7e884c9583f7ab399bc9e4d549f356868a9b47588586d53a5115f5d78a8b59ea9a033

/storage/emulated/0/.UTSystemConfig/Global/Alvin2.xml

MD5 dba6d7c19d24fa04ab508555432b60b4
SHA1 61720a26745a30dccceb73dccf9f83a4d9d6d845
SHA256 8fe4ef3235632a708d5397177053dce640035b37cb41c2699998dab9f65acf1b
SHA512 f477c3ddbdf5bd46c21b5896cc877bc450d3d4a50fb0cb74c71eebe9d9c3fda33475b3a34e3758fa82f7088e5f6f56b4249b7a6befb9554099f3420a45187af1

/data/data/com.yuzhua.jjtf/files/umeng_it.cache

MD5 f7d868a8b639a5c165f98846c626295b
SHA1 0e2735409d8d8d8ccb877c7794430a73cfc240fd
SHA256 b80cc6087757da6065c1b77c39ecf5a4d673ddf9ad43e30d1631bf3a5c68d87a
SHA512 21e66dabb093902f981f5022e789ab5f8ed18492c7784aeb8ad7d4de5fa1f856345c046475531bf75f48bd4d6149d8e3b6f8f5a42a3bcec4630b9e90acf7ae77

/data/data/com.yuzhua.jjtf/files/.umeng/exchangeIdentity.json

MD5 768cd6e12b86e8f7d093bc03b97d67fe
SHA1 d787c991c065b9e983fa9fc59146bdb43724359c
SHA256 f3733e3a4b198fffb054840a97aa2d58db9ee7c6a77198920d5798b5f08158b7
SHA512 30ed3e39eab17ad902911588852796aea1ee19a4b04452cf4bd6996d8c67f1a68ad928760fc72637297e1fe082238bcf32d237330ad6d0af71a6028cc0678520

/data/data/com.yuzhua.jjtf/files/exid.dat

MD5 afc9f338760d25d591b748f65ddc4cf5
SHA1 38d349bc6feb4fe62d21321d9935f19aa09d4491
SHA256 3dd12d8d824505fced0b6374dc6b13d9768ed6e5aed11718e6c1d6af5e27089c
SHA512 5bee2a02f5ebc587fcd3024c334c8e65539ba3dc9a0f9f822ee3892ac42368680c75fe03decd87ddf13ce945321a6a8273787ed0666df5608a4c1b5bda7d8851

/data/data/com.yuzhua.jjtf/databases/ua.db-wal

MD5 25d89d06ea8c3357fccc9409de8c9973
SHA1 dd41d588e6db494403674ba94c21650de98ca266
SHA256 40b6193fb4521fd929736ffdf4422511183476e7dcc5d02b34cb54b72ff70d0f
SHA512 e2e29642edaab2c9871cb373fe231863aa597f01b3f634ad6029a18e9ee11ff348b6d3563ed1720e7a4397b6704dd05d01aab9bc6fb3c540123d632dc27b4983

/data/data/com.yuzhua.jjtf/databases/ua.db

MD5 d604a3bf1f8d992cc320ea5b1f7609bd
SHA1 247f88df0b55c7d523ea5398637711a0e4a483a4
SHA256 329940b4d46326d58e73c842dd099704061d0ef7338777bf31ad895f29013c17
SHA512 67e28f6713cb5c238a9664df128f01a89a2efb7c8c9330c1e45bc0d40ebab81fa20df5166743d84d81dc0386a89ff0329f022281c098339baa2e851ff0a1e1ab

/data/data/com.yuzhua.jjtf/databases/cc/cc.db-wal

MD5 9b649d891803b765faa12cf6ccb9f839
SHA1 20ebc1b4477470dc5f739096743aecdb94f07c88
SHA256 f87f002330bc7541292f78f7dd946145d8ff401e1c32a981b44b5422fd17f733
SHA512 38e672b04fd83245b58a35e468c83b7dc663a9beeaee7729f0daefa053cdc3d35f183c6c54691dfd00f1d5ad99f3dc5b22f18e404d70fe50874db5447ab54395

/data/data/com.yuzhua.jjtf/databases/cc/cc.db

MD5 ce6135aa1b1fe4f2c2db2a546d2a5558
SHA1 79b59582154017aadab783dc266fcb158c252940
SHA256 7b45f576c08c7f78220168cca4a0e33198b13e9bdc8b1da406ddb6887412000c
SHA512 2839075fe374c8567c839ae35ce2d33ec72fdaebf170aa7d224b555e5b0e74d4a43f2f67d17ed806dae841da883e9620d788ea052d06152678afa927307c7ce4

/data/data/com.yuzhua.jjtf/files/.um/um_cache_1729022154873.env

MD5 326bfd939aeba8d8a1e692703ec22daa
SHA1 0b626f5aa3ccfa1d4ecd1cf844f72e7743f62eea
SHA256 344f96ed62e5fde7a7cd87a50d5c6d9ea26df06718c0888fbd2bdedcffc84ae5
SHA512 9762baf37a86041eafe572d9f2278e762d7f363b76cbc9e752cf50b1447af7b2020d36bb29399d8a894fdba4e528f32320ec38bbce40ff1d142cf05ffa7d0f3b

Analysis: behavioral2

Detonation Overview

Submitted

2024-10-15 19:53

Reported

2024-10-15 19:56

Platform

android-x64-20240624-en

Max time kernel

129s

Max time network

155s

Command Line

com.yuzhua.jjtf

Signatures

Checks if the Android device is rooted.

evasion
Description Indicator Process Target
N/A /system/app/Superuser.apk N/A N/A

Obtains sensitive information copied to the device clipboard

collection credential_access impact
Description Indicator Process Target
Framework service call android.content.IClipboard.addPrimaryClipChangedListener N/A N/A

Queries information about running processes on the device

discovery
Description Indicator Process Target
Framework service call android.app.IActivityManager.getRunningAppProcesses N/A N/A

Domain associated with commercial stalkerware software, includes indicators from echap.eu.org

Description Indicator Process Target
N/A alog.umeng.com N/A N/A

Queries information about active data network

discovery
Description Indicator Process Target
Framework service call android.net.IConnectivityManager.getActiveNetworkInfo N/A N/A

Queries information about the current Wi-Fi connection

discovery
Description Indicator Process Target
Framework service call android.net.wifi.IWifiManager.getConnectionInfo N/A N/A

Queries the mobile country code (MCC)

discovery
Description Indicator Process Target
Framework service call com.android.internal.telephony.ITelephony.getNetworkCountryIsoForPhone N/A N/A

Queries the unique device ID (IMEI, MEID, IMSI)

discovery

Reads information about phone network operator.

discovery

Registers a broadcast receiver at runtime (usually for listening for system events)

persistence
Description Indicator Process Target
Framework service call android.app.IActivityManager.registerReceiver N/A N/A

Uses Crypto APIs (Might try to encrypt user data)

impact
Description Indicator Process Target
Framework API call javax.crypto.Cipher.doFinal N/A N/A

Checks CPU information

Description Indicator Process Target
File opened for read /proc/cpuinfo N/A N/A

Checks memory information

Description Indicator Process Target
File opened for read /proc/meminfo N/A N/A

Processes

com.yuzhua.jjtf

Network

Country Destination Domain Proto
N/A 224.0.0.251:5353 udp
US 1.1.1.1:53 ssl.google-analytics.com udp
GB 172.217.169.8:443 ssl.google-analytics.com tcp
US 1.1.1.1:53 cgi.connect.qq.com udp
HK 43.154.252.110:80 cgi.connect.qq.com tcp
US 1.1.1.1:53 btgameapp-ns1.btgame01.com udp
HK 43.154.252.110:443 cgi.connect.qq.com tcp
US 1.1.1.1:53 btgameapp-ns2.btgame01.com udp
US 1.1.1.1:53 btgameapp-ns3.btgame01.com udp
US 1.1.1.1:53 btgameapp-ns4.btgame01.com udp
US 1.1.1.1:53 android.bugly.qq.com udp
CN 119.147.179.152:80 android.bugly.qq.com tcp
US 1.1.1.1:53 btgameapp-ns5.btgame01.com udp
US 1.1.1.1:53 alog.umeng.com udp
CN 223.109.148.178:80 alog.umeng.com tcp
GB 142.250.179.238:443 tcp
US 1.1.1.1:53 android.apis.google.com udp
GB 216.58.204.78:443 android.apis.google.com tcp
CN 223.109.148.177:80 alog.umeng.com tcp
CN 223.109.148.176:80 alog.umeng.com tcp
CN 14.22.7.140:80 android.bugly.qq.com tcp
CN 223.109.148.179:80 alog.umeng.com tcp
GB 142.250.179.228:443 tcp
GB 142.250.179.228:443 tcp
CN 223.109.148.141:80 alog.umeng.com tcp
CN 223.109.148.130:80 alog.umeng.com tcp
CN 14.22.7.199:80 android.bugly.qq.com tcp
US 1.1.1.1:53 alog.umengcloud.com udp
CN 223.109.148.178:80 alog.umengcloud.com tcp
CN 223.109.148.179:80 alog.umengcloud.com tcp
CN 223.109.148.130:80 alog.umengcloud.com tcp
CN 223.109.148.141:80 alog.umengcloud.com tcp
CN 223.109.148.176:80 alog.umengcloud.com tcp
CN 223.109.148.177:80 alog.umengcloud.com tcp
US 1.1.1.1:53 android.bugly.qq.com udp
CN 119.147.179.152:80 android.bugly.qq.com tcp

Files

/data/data/com.yuzhua.jjtf/app_crashrecord/1004

MD5 1a370361ee5f6a46248da4e140bf35c1
SHA1 ee30c85b2fd8375bebb9a2ce9a7163e07a0af70f
SHA256 6cb188cfc4517b53da75646fc0755419ddfb827e1ba744770fc2e2898ac0a72b
SHA512 f6a7ce5a124931e34564c27ef50544f2769b8bddae5c8cad29523427c85e125b812c149c2c2a7c5aabdbb5130e1732fe787314cbc8618eb5d90b139452af15cd

/data/data/com.yuzhua.jjtf/app_crashrecord/1004

MD5 0d210bfb2a0e1f1b4c082a6a0f79de07
SHA1 bb8ed9e364db79d1d9f2fcde3f15091893222faa
SHA256 988722c23d78a46021d0e7ca9deee7aa8bb83288269174ffacb7316f381cca1d
SHA512 536e9867b0df29b15b789f8949be6ab37fcdeccb9d39ded981da7dc2052c9533d0ec0e6f9a5444132977605d372e1463d91bdde41b528ff2ca3f65ab152325c1

/data/data/com.yuzhua.jjtf/databases/bugly_db_-journal

MD5 9acf80675a2b70e17bad12cf03b1849e
SHA1 6623136ff052e2769fdb78db8be7add1a2fd686d
SHA256 bcfcecbf911ebe5a38ab5cf06869ca481c1c3001d843d7e641cd19938e761c93
SHA512 1cb660e3a13facf7c2ed6591137b63c5cceb9010543ac0064acf02a666c5b87bbdf345ea622003b2ae237dd5f48eb2b6db0fcf1d043f03799ddfb5a6a8199876

/data/data/com.yuzhua.jjtf/app_crashrecord/1002

MD5 24628b229109484f3e2073f48085d529
SHA1 8cf9fd58b5114bf1c8629fdba3607753129e7ff8
SHA256 813db9f066f66ec7c9e045a0773bf3233e314aa5a0f564f3f820cbf5a5998704
SHA512 f13f15ef30c93cab18ee6b4010cdd3cffe86add12d179bc5657d2eb96ded311b13d82870da00bac028ca2518ab182ac1b80e9966f0f6b081d5938f4942d0b231

/data/data/com.yuzhua.jjtf/databases/bugly_db_

MD5 3ff01250326ef198104eb0df82ee1652
SHA1 5f42735930a40e4e65bf2dd9255b890c1f01ec18
SHA256 4b27f99199f97decf054e7f3f46797c41dfffd87170a18b83f95abbd62a74428
SHA512 81dd29884b2e39e4b318aec0b14d2f13f4022c84f5de92515cf5a8c058ac95a42da2af3925ba87397de477f5435621f1e2bc4e672406c7708d62ca08e3cb9fc3

/data/data/com.yuzhua.jjtf/databases/bugly_db_-journal

MD5 d8aad33a81c08c7a5bb2a5fe15b6959d
SHA1 b7cc73b8f7fb1d4db4746415eca539d7cbfa772f
SHA256 8648554b130c164efe0c4d2c8b3e96444d56bc394288881a63fa72602ce2b037
SHA512 d03d6e1e93e4941286f7f658ad2bd854d4041fad842e2ae3759050365f6958ca0fb50b61d7b5569d4fe598aed8fb080bb0dccc3f2f52b2aecbbd0a0c732f6675

/data/data/com.yuzhua.jjtf/databases/bugly_db_-journal

MD5 08894598a2d3eb550e3b4b393d080803
SHA1 2904e8641264d7e80398f059a5de90019162b802
SHA256 a5041d67b60484f52797c9376786ac85e63d004a813f9b867b82a50de6969df7
SHA512 a8e3f4ae47893b7525c1e0735711616d4ac3b81b8debd687ff13bc5f6eb58fd72dc93eb43503213ba29dbdfbec8bc9327e48dc74afa1e6a4ce567fdfec9a87a7

/data/data/com.yuzhua.jjtf/databases/bugly_db_-journal

MD5 0eaef12967696c06a7bf42d243f35279
SHA1 ba862693be72ddd6e9de4f5c4a252455bc84cd8b
SHA256 4c29f45628ba86283cf0bff6a0cab9be82421ef4f5e1af2f2c565cd6bad6f631
SHA512 ded36651068e798bbd921aedb08fa912b053ac37b4743e64e0f55d6d1fe70d9bcf9c728b4636b054f48d8975b39c899d31168d2e115ab37147479aa8acf57bd3

/storage/emulated/0/Android/data/com.yuzhua.jjtf/files/tbslog/tbslog.txt

MD5 1940491b59d431171496aacf37dd0a65
SHA1 6f279268f131e7263a26783a3f4d23d25c97fd21
SHA256 439a0d45770e33ff533c13ae0e223071920a3746805f47766414ad7fbff17d3b
SHA512 ca5b89558490d54bac6a0984ecb821edf443e6c61de2ec330c29357cb5bc8312981def8ec0b2f1a89692b45c2a2d7dc7c98e396f14cdfeeeede160b9f7f03e2c

/data/data/com.yuzhua.jjtf/databases/okgo_server.db-journal

MD5 17b47f67d0c278f85fee88daff106234
SHA1 cbbf02aa95062c083947b7666e16d5594f8c1f4e
SHA256 be65ba53bc5894660e8a269e30537895407fb6f9d60079fa7978814b2c02765f
SHA512 768ea74bb664d66a5bf9ee8e64618840c120900f50751a9d981c7d42df1dd3fa3bd7a70427d5c25439ee7d4b63b01eda76415d4ff60c652074f61b4b311e7c64

/data/data/com.yuzhua.jjtf/databases/okgo_server.db

MD5 17ed434da73bcfcea3def1d33048aa5b
SHA1 3e4e44477c17647921072b58d2dd8620fb38dcc0
SHA256 981024b525f8039b10d7497173e810d220a212bcdbcd5ab3aa91c318a24ad5c5
SHA512 6c0289c6f57a4b59b16bb0759782f709c0007b59acf9c07feb099918c3f052ec2f3d46ef4cbdd4a99305ec0e524e53d8296718235c38dd8ed5d4e43a104794a9

/data/data/com.yuzhua.jjtf/databases/okgo_server.db-journal

MD5 427c34179169dbdc57f73ae98036b0e4
SHA1 68016f2ee386c12b4a168864498d208516ef28b0
SHA256 c92f211ab04f3688b0dfb9d0e8c411338192f1753d2b94711fe42827e778ade5
SHA512 5a1f9f21ce293e05d74e50176be91426f607de94813038e24735092fb03a459101fa177f222dab94a547b0c1856d432e28c5efec30fa4b927868160c44380623

/data/data/com.yuzhua.jjtf/databases/okgo_server.db-journal

MD5 4003e051db74c3751dff462c8e6d4364
SHA1 39cd26401c0dfbac9d8d808d89baa20d6e351e09
SHA256 18b11edf0a846b36038439112f543417739ee4771e0a314826663982199b65a2
SHA512 397e6baa33ecf24c8696d4c4f5583f15bcc2777b3e608892656672f5081101af122561ac22d96baa537733eee00619de048f6bdc07c8a99d661253379456e1f5

/data/data/com.yuzhua.jjtf/databases/bugly_db_-journal

MD5 33b5252c02ff26493a31873870ddace8
SHA1 f138e9871adc38b915342413b1f4d7aceb240eea
SHA256 17ce30b650bc38724b1a4af886b641f0c8aa2840f7e7d507a650d51dfe39a232
SHA512 00ae94a71fce11a5fca05b5ad4ee843d588669954a2c275c192932f4a6d5cd0c01bb120d4dabf43ed4e3a509ee083641162e80da06201548fe45b31826baa5c5

/data/data/com.yuzhua.jjtf/databases/ua.db-journal

MD5 5dbc034b6ddcce62b83a99fc4789483f
SHA1 24884f4cdf17e75fee2c1e601de9d159c9709bf6
SHA256 6f5d6d79d9337990ba43984b43c79b98f8ed2426b714e4ebbb3bab0e2f19d642
SHA512 1b75ec45afee6f626fa2535e1783144edd4cd444375d4caf7db175fd4c8cbd9a529be9e507616b37fde3dc328ac60bb3cf480594bd1791019d2850cc827ae19b

/data/data/com.yuzhua.jjtf/databases/ua.db

MD5 74266e8d313013404434eeb0da165a48
SHA1 5e4ce40632553bbb48e3f1a8c7bd2c7fa8a5fa9f
SHA256 0853cfaa23f62ac5f2c06207fedd991e492b35eade37da45f55f4f66f28750c9
SHA512 df605ac99eb83f48798aa317fceac2169dfb977a370d63f85a36781bbffeec5c20f69ab0ba0ddcfe4b2a27ef3fba557fcf7f7e920fc918c0a2e2181f753365e3

/data/data/com.yuzhua.jjtf/databases/ua.db-journal

MD5 e7313e05f63595d035aadcade17f0131
SHA1 224f405d91001a1f2492bc00aff735ad5cea366f
SHA256 c122235329ef4703dc4757d20a62e3ef2431c3b8d2fbd967e7e4c68eb97eba59
SHA512 d7265e7bc098529175db221af98b8af8ad51f1455d4db4977852b0ea6b552df034de03fdcaba5b467ad931c7ff175559484c88665b0da25f0556aff7c1ec915b

/data/data/com.yuzhua.jjtf/databases/ua.db-journal

MD5 f1f4597ec12ef5751a3ff9ad13311153
SHA1 496d5b60a72708ef6cf8b46ff9794ba5d7a1f03b
SHA256 722484de5dc24832e339db3c0822ad112456ee95bdfb9109586ec18ece9fd6bd
SHA512 b061d4b8e6757457f23621e1947cf81750ae1e87648ba64f3e041dd4de95a3ad7923944690808e1a3ec98a528735454b68954b2e5a9f8d522407f6b1a460b764

/data/data/com.yuzhua.jjtf/databases/ua.db-journal

MD5 ec19fb2addffd07b57baf812aa1df782
SHA1 fd3c63a2a67a2e064e0ab073058cc6418c0c43ea
SHA256 3e8db4f8196b3faae16ea15e6641fdb4b3cf5f04ba94fbe1718e3c2f83c52486
SHA512 52e6b96e57fe42a938892939c71b6fb01941d2819829f5c35a518fbabe986e1b749af6f5119c73b9151951a9f6d88393363f460cd2e8d32e011e28a386b9576e

/data/data/com.yuzhua.jjtf/databases/cc/cc.db-journal

MD5 1697c56103d3a5d02d12d650ac20507d
SHA1 3722f792e0121036b8452d8310c1db46345d6d18
SHA256 5b5ab9fbf6e28c1f027199b7884d5457f97dfafb07ee86dc18e8ad8dcc91f1d3
SHA512 d544188e1372fed76379d2b25bb5a63f5f526008df377151ce9d57054588c338d4f8260672f484802da5457288047a66dcb051cd0458a4a64f386aa5be2379f8

/data/data/com.yuzhua.jjtf/databases/cc/cc.db

MD5 0908e924aa236931dc7166fef6e00862
SHA1 7782648d6d8f6e835bd47058d4852932c096a467
SHA256 38f8548795ca7470b449dd1de9598c07a247ba59883c0764c9c96ff0b7d31d7f
SHA512 3c16fbc5172aed04cd206e776c46d26e911732c6e3631536410a71f1d217449475727ac9b3175e827c5ce645a1da9e05900258ee6ca27c936a9060f241361dee

/data/data/com.yuzhua.jjtf/databases/cc/cc.db-journal

MD5 2bdb16113a07888a20c5d82d6c659cf8
SHA1 df98b452d6151ac5174cb9dedc95a0e95eaff276
SHA256 7ce787bf4201c8463bb3e24afc163f066d3538b87e3425340074d0e6d683aecb
SHA512 24f04e45594bf56b0c8d608271179804790715b36fcd6c4829359fb223c8a2a676961857b9ccdc48e60edf216275c58711520583ec4dfc613deba0f366e8ad9e

/data/data/com.yuzhua.jjtf/databases/cc/cc.db-journal

MD5 82e3f6784401f458cdaba9a7b541892e
SHA1 6830f5efc0ebce59176aa720f046249477e897fc
SHA256 b30981ac4d695001221390ee040dcc321bb75499549557bc466ad6f8a7a1733d
SHA512 ad337bbc638367b91822d1b7fcfaa1a437db9cc248f3d98a3e928b252fb50d6740fb62c8fe4c0aeb8b9e57bc9e7596ffe387f0e0b7ccee9cb622a28271072bc0

/data/data/com.yuzhua.jjtf/files/com.tencent.open.config.json.1107734485

MD5 f526172de1566b34fdcea744710d9559
SHA1 000cb54d9a008a807a1c5a3fd2b2e7cb41e7939d
SHA256 8572be02b59f4d514000939ec04a9b4e2380c55265256b724a617d8d0f4c6940
SHA512 dc81f0fe345b18c96b1638c67b9ef4c5e60059dfc4a02f3c30a23645d4847abeef46cf467d044c42597115c48052ce0e8ea24328382114a544c5dfd039a95e7d

/data/data/com.yuzhua.jjtf/databases/bugly_db_-journal

MD5 d0587547d9494ab36bc87efb0acf9aa1
SHA1 2b691ee397d2e6aee694524f00c863317efbe197
SHA256 dd572fb2e965139aa440ce416f1e2c067252725cd87e373a957c5671f64a7b7a
SHA512 f3468d993031d11dcb9e997270486e78b95a2c4427162bbe73b7b66d63a393ff8f5205f41377da44badb97b9bb2cbdd3be56d6836c56f5da2bb28ebfad704517

/storage/emulated/0/.UTSystemConfig/Global/Alvin2.xml

MD5 9781ca003f10f8d0c9c1945b63fdca7f
SHA1 4156cf5dc8d71dbab734d25e5e1598b37a5456f4
SHA256 3325d2a819fdd8062c2cdc48a09b995c9b012915bcdf88b1cf9742a7f057c793
SHA512 25a9877e274e0e9df29811825bd4f680fa0bf0ae6219527e4f1dcd17d0995d28b2926192d961a06ee5bef2eed73b3f38ec4ffdd0a1cda7ff2a10dc5711ffdf03

/storage/emulated/0/.UTSystemConfig/Global/Alvin2.xml

MD5 31734d3d5aee72113c6039894a23f117
SHA1 2b05ab4a57176d1d7d41d0c5e638eaead57f81f2
SHA256 b20ef81efc2a40741fb3ab31288122ac15ba9735b03725acbdcf9e89ceab59c8
SHA512 f4e3922e9b1c446cb3125edc94d7909d7b0a1c6109d93cb3900ef2346ce341b8d03b85ff1e6b5dd83dd8279ea0cf751917999c3de9e523c7ee68789d344f46dc

/storage/emulated/0/.DataStorage/ContextData.xml

MD5 07cf3421e7846de3bcd14186cdafa53b
SHA1 1c4ea9422fed0eede08c2ad67c2913d016f38450
SHA256 164d06bc58c1553c039658ecd7fa883d06df8b096ed85a1d11bec3bf2f58daf4
SHA512 b8ad8bee1a05130714fe2630b1124b8fdcf75ccadaa8960822c782b8e7100119b84582eefab0db3dd8876c11c153be4889a7345f050f8265a5232daac11d1c9d

/storage/emulated/0/.UTSystemConfig/Global/Alvin2.xml

MD5 da69480a4ab4dd7203f2abbd7d203eb7
SHA1 51f1fb06c4ded216ad86fdc5cbcfcdd61e8df7c2
SHA256 b0fac268ca2bc40542e6258c6dc6992f8d002f9e6ee826d916a5613f7bf5d2c6
SHA512 d55a41d6a6c568fc085870e08301eed314cbcc13d00f85a465eb7fc1a393a86c6167233b8a1b2687cb611d030e5874869982dd1fa9bfb526b2178a8219ba07ad

/data/data/com.yuzhua.jjtf/files/umeng_it.cache

MD5 ff6b212784a251f2d6d9232e53d1819f
SHA1 43375f0cc49e8e65953f3c1bd4716ab77f74ceb2
SHA256 dd48bb3aeb892a0a3810392faed496430e6e0c7bb8db97338000b4bd7a4f0869
SHA512 d96d82b062f958d8bf34a34444049e2a3c9908056de58e1abad15ed0afd62eefd19a0eb580b7bfbf6492feb607b3639a01b58f104d74581f12bed6f02402aabc

/data/data/com.yuzhua.jjtf/files/.umeng/exchangeIdentity.json

MD5 f1232e4c4d9d33a13b1965b1f10bc5ca
SHA1 bf5e02c016ec3241aab35203a4a2f33b2d02ea1a
SHA256 92b8fe1bf9fc08e46ee79785b94f9395b044253aa5e29878cc299e7a982a5cc1
SHA512 445f31827f3cd14bef76323bbc0c578f7cdfa6c29b1fb378a387466a4482d5b15546b651dd7c618e00d22d7dc01c641fed1a85c3160512cc0c0b75a9443cf307

/data/data/com.yuzhua.jjtf/files/exid.dat

MD5 afc9f338760d25d591b748f65ddc4cf5
SHA1 38d349bc6feb4fe62d21321d9935f19aa09d4491
SHA256 3dd12d8d824505fced0b6374dc6b13d9768ed6e5aed11718e6c1d6af5e27089c
SHA512 5bee2a02f5ebc587fcd3024c334c8e65539ba3dc9a0f9f822ee3892ac42368680c75fe03decd87ddf13ce945321a6a8273787ed0666df5608a4c1b5bda7d8851

/data/data/com.yuzhua.jjtf/databases/ua.db-journal

MD5 e5465c3795ccc9bc5a77b9587010bcfd
SHA1 b66dff0f823e6d81a987f09547c6b9f51f6ad3e2
SHA256 9524b9d613ba6e90805f931b65f7b8b8fdbf35f5ca0e6117a6cac10014e677e3
SHA512 9315c61c4c62eb2cbca09e3c6befd8b7d31955346c40d9cd15a4226243a28d15127d7cf0bf007bc10056a19bb4bc9c7ab933e7f9090f640419ea3c80d1637194

/data/data/com.yuzhua.jjtf/databases/ua.db

MD5 38564ad4c73e5619bc2264b0c44997a5
SHA1 e55f6fe1b20347ad4cd58d77af0b0feb149f63d0
SHA256 1820a909a310bf7bc4ddaab6c8be3954dedd53612749f7bd08fefbef31670ec8
SHA512 30d84731a3d8380e63bb73227623e86bd779476474269f252abe546028531c77658573874444e66b862ea049724e93a9344b1d4fd9f26c0fe02a79a4079a9a7d

/data/data/com.yuzhua.jjtf/databases/cc/cc.db-journal

MD5 7fc76492f6151b2294bbcd62aa846f98
SHA1 f460bc1fe43a2435f91b23430395c15098a3514a
SHA256 d6e381858dd9a54d3e6a0128e28a706c2c8c44d76988c388bc9517af24a15fb7
SHA512 1838602ad023179340121ffaa29dc22db6ff1ad992fd6bc8f96a01c1dc347965f18e402a21ac02f26d94c66d01be9c83037fd8e7ae610e2c6fda40bdbbcab346

/data/data/com.yuzhua.jjtf/databases/cc/cc.db

MD5 67c12933d1e0e63d9801a6aa43092ce7
SHA1 b6936908554e4a1986b8eb08289e2d3545e8ff74
SHA256 abda5dd4cc2e7dbb951637c4b49d6990f9f34411fab4dee1a387dbcc8e7eed40
SHA512 db8b818daa3ff4ec7678645f84bf8b45c809bcbb758ea78b28982d071572655bba2d20e6f1ca4f0d057ab34fa655c5bc40457dc65050180351a2fc04a47175dd

/data/data/com.yuzhua.jjtf/databases/cc/cc.db-journal

MD5 7e23f20c1d5d145c868f53fb8ed1f973
SHA1 22b327a21458d0e4b0a38a1f6bfcddee90b48abf
SHA256 06400319ef254da85a333686625411a019dee9d8ac19b87af30b6700497a7307
SHA512 d7ffcdae4436f004d21d0fb94b8daa495ae92e938b49a39cb2a20de3a6dd8849d0d911a72987d4c82b8b6255cda882f184d4894f644c905aa29a96c3e439ad2c

/data/data/com.yuzhua.jjtf/databases/cc/cc.db-journal

MD5 b7f19ae12d957384f820359e42e2ce2a
SHA1 0c71bff80e586795d40844916187efac7c65e9f6
SHA256 5f3301125e82c4abc34236ac09bf54b5815642c8f1119f5cd89cf14e7c93d720
SHA512 1365b29c8b683e09e801e811ea592ec0f2cfb201aae887faaae6f95a8599432ff2b7609637eef4304d05c2c9ea19a46f644dfa59893d65b261612482813dd41f

/data/data/com.yuzhua.jjtf/files/.um/um_cache_1729022156016.env

MD5 726f4a084ce9104b87d5444cc1deb935
SHA1 42523fe514ce1324c68f9f3a8a9096603c2a8e43
SHA256 8a0332c0cd46cc82609270a2ed409108fbf9926ff281552d4f533e134ad3e842
SHA512 24dbb97f81b73e26f285e51024345862ec68771b0e8817651262c6b97e17b61b46e39d37efb0e424b9596c2caab793cbb00732fed8074ab0bc828689dc6d1b41

Analysis: behavioral3

Detonation Overview

Submitted

2024-10-15 19:53

Reported

2024-10-15 19:56

Platform

android-x86-arm-20240624-en

Max time kernel

7s

Max time network

135s

Command Line

com.zqhy.btgame

Signatures

N/A

Processes

com.zqhy.btgame

Network

Country Destination Domain Proto
N/A 224.0.0.251:5353 udp
GB 142.250.180.10:443 tcp
US 1.1.1.1:53 semanticlocation-pa.googleapis.com udp
GB 142.250.187.206:443 tcp
US 1.1.1.1:53 android.apis.google.com udp
GB 216.58.204.78:443 android.apis.google.com tcp

Files

N/A