Analysis

  • max time kernel
    10s
  • max time network
    151s
  • platform
    android-15_x64
  • resource
    android-35-x64-arm64-20260325-en
  • resource tags

    arch:arm64arch:x64image:android-35-x64-arm64-20260325-enlocale:en-usos:android-15-x64system
  • submitted
    08/05/2026, 14:28

General

  • Target
    ZoogVPN-4.1.3.apk
  • Size 179.2MB
  • Sample260508-rtatlah16s
  • SHA256 4807a71a28b296ae0b02056cef4a17ce6316257c2933a99633baf494264dcbff
  • MD5 SHA1 SHA512 SSDEEP TLSH

Malware Config

Signatures

  • Checks if the Android device is rooted. 1 TTPs 9 IoCs
  • Checks Android system properties for emulator presence. 1 TTPs 1 IoCs
  • Checks known Qemu files. 1 TTPs 3 IoCs

    Checks for known Qemu files that exist on Android virtual device images.

  • Checks known Qemu pipes. 1 TTPs 2 IoCs

    Checks for known pipes used by the Android emulator to communicate with the host.

  • Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
  • Acquires the wake lock 1 IoCs
  • Queries information about active data network 1 TTPs 1 IoCs
  • Queries the mobile country code (MCC) 1 TTPs 1 IoCs
  • Reads information about phone network operator. 1 TTPs
  • Checks the presence of a debugger
  • Listens for changes in the sensor environment (might be used to detect emulation) 1 TTPs 1 IoCs
  • Schedules tasks to execute at a specified time 1 TTPs 1 IoCs

    Application may abuse the framework's APIs to perform task scheduling for initial or recurring execution of malicious code.

  • Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs
  • Checks CPU information 2 TTPs 1 IoCs
  • Checks memory information 2 TTPs 1 IoCs

Processes

  • com.zoogvpn.android
    1⤵
    • Checks if the Android device is rooted.
    • Checks Android system properties for emulator presence.
    • Checks known Qemu files.
    • Checks known Qemu pipes.
    • Acquires the wake lock
    • Queries information about active data network
    • Queries the mobile country code (MCC)
    • Listens for changes in the sensor environment (might be used to detect emulation)
    • Schedules tasks to execute at a specified time
    • Uses Crypto APIs (Might try to encrypt user data)
    • Checks CPU information
    • Checks memory information
    PID:3348

Network

        MITRE ATT&CK Mobile v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        35f8255b27228d02319cfbe1089d6584-0.tmp

        • Path /data/data/com.zoogvpn.android/app_amplitude-disk-queue/35f8255b27228d02319cfbe1089d6584-0.tmp
        • Size 1B
        • SHA256 245843abef9e72e7efac30138a994bf6301e7e1d7d7042a33d42e863d2638811
        • MD5 SHA1 SHA512

        35f8255b27228d02319cfbe1089d6584-0.tmp

        • Path /data/data/com.zoogvpn.android/app_amplitude-disk-queue/35f8255b27228d02319cfbe1089d6584-0.tmp
        • Size 670B
        • SHA256 b00446d0c37358d3dd42953cddeb74c6e2465f14525b5fc8c2fa3ed3347d4854
        • MD5 SHA1 SHA512 TLSH

        35f8255b27228d02319cfbe1089d6584-0.tmp

        • Path /data/data/com.zoogvpn.android/app_amplitude-disk-queue/35f8255b27228d02319cfbe1089d6584-0.tmp
        • Size 684B
        • SHA256 5fd138733386811a5e310c261570af5fe2177a3a83cea008c30556ffcb1f94f3
        • MD5 SHA1 SHA512 TLSH

        35f8255b27228d02319cfbe1089d6584-0.tmp

        • Path /data/data/com.zoogvpn.android/app_amplitude-disk-queue/35f8255b27228d02319cfbe1089d6584-0.tmp
        • Size 678B
        • SHA256 8fe5411186c35649b5c929f0b299948b5f6263e14a9c497068f0a3d63a1621fe
        • MD5 SHA1 SHA512 TLSH

        35f8255b27228d02319cfbe1089d6584-0.tmp

        • Path /data/data/com.zoogvpn.android/app_amplitude-disk-queue/35f8255b27228d02319cfbe1089d6584-0.tmp
        • Size 1B
        • SHA256 cfae0d4248f7142f7b17f826cd7a519280e312577690e957830d23dcf35a3fff
        • MD5 SHA1 SHA512

        35f8255b27228d02319cfbe1089d6584-1.tmp

        • Path /data/data/com.zoogvpn.android/app_amplitude-disk-queue/35f8255b27228d02319cfbe1089d6584-1.tmp
        • Size 643B
        • SHA256 c2b19e58f22524697b1d2cc469dffad4c89f2ae75537a35bf3be62e9fb64886c
        • MD5 SHA1 SHA512 TLSH

        35f8255b27228d02319cfbe1089d6584-1.tmp

        • Path /data/data/com.zoogvpn.android/app_amplitude-disk-queue/35f8255b27228d02319cfbe1089d6584-1.tmp
        • Size 692B
        • SHA256 357ccb733d8a4b3fe11191b746e0675d09c00201c8036c44f47c40897b08b25a
        • MD5 SHA1 SHA512 TLSH

        35f8255b27228d02319cfbe1089d6584-0.tmp

        • Path /data/data/com.zoogvpn.android/app_amplitude-identify-intercept-disk-queue/35f8255b27228d02319cfbe1089d6584-0.tmp
        • Size 666B
        • SHA256 d531a8abae477de4f4ae527c1ba21ee681b31009a86ce0fa99c6873bda1e0836
        • MD5 SHA1 SHA512 TLSH

        amplitude-identity-$default_instance.properties

        • Path /data/data/com.zoogvpn.android/app_amplitude-kotlin-$default_instance/amplitude-identity-$default_instance.properties
        • Size 141B
        • SHA256 2f112380d95773de08bc63a7ae3f04cdd8577eebcdba5b9b035a76fce5f6b7ac
        • MD5 SHA1 SHA512 TLSH

        amplitude-identity-$default_instance.properties

        • Path /data/data/com.zoogvpn.android/app_amplitude-kotlin-$default_instance/amplitude-identity-$default_instance.properties
        • Size 77B
        • SHA256 9f928c09610bfa1524fba42152e2cceae0c9e513e1466733c991d81776ce9133
        • MD5 SHA1 SHA512 TLSH

        amplitude-identity-$default_instance.properties

        • Path /data/data/com.zoogvpn.android/app_amplitude-kotlin-$default_instance/amplitude-identity-$default_instance.properties
        • Size 125B
        • SHA256 6d373991867c85b091b95736a7b4c06f3551b742bad9f9b92b72b0f0abf964bb
        • MD5 SHA1 SHA512 TLSH

        CAStata19d

        • Path /data/data/com.zoogvpn.android/cache/CAStata19d
        • Size 6KB
        • SHA256 b7bcb501c36f897d2739e4237acec528faac08043629b870d360cc6d54b85610
        • MD5 SHA1 SHA512 SSDEEP TLSH

        base.3348.tmp

        • Path /data/data/com.zoogvpn.android/cache/oat_primary/x86_64/base.3348.tmp
        • Size 2.2MB
        • SHA256 6eabe3146d08961f1992c9b21ea5556896afa66c04ba20c93dd9cdbfdb14c00f
        • MD5 SHA1 SHA512 SSDEEP TLSH

        AppDatabase-journal

        • Path /data/data/com.zoogvpn.android/databases/AppDatabase-journal
        • Size 512B
        • SHA256 e46a696451cce94fbd7f0c4983367ea50716cd0f11be55ffdb9e49d770b66e56
        • MD5 SHA1 SHA512

        AppDatabase-wal

        • Path /data/data/com.zoogvpn.android/databases/AppDatabase-wal
        • Size 16KB
        • SHA256 9b2455e059c316fbb89064da2d01d56a4a2a2b21db3993e0030aeed7e7521ef3
        • MD5 SHA1 SHA512 SSDEEP TLSH

        AppDatabase-wal

        • Path /data/data/com.zoogvpn.android/databases/AppDatabase-wal
        • Size 72KB
        • SHA256 73bb72b5b5106cb6197289b8292bdd5046bd2d58c9a27d001f28f88460530970
        • MD5 SHA1 SHA512 SSDEEP TLSH

        AppDatabase-wal

        • Path /data/data/com.zoogvpn.android/databases/AppDatabase-wal
        • Size 112KB
        • SHA256 1742244e9c6c41bb7cd0bbc162ff91f0002a91b8d565a311e2953b0af4847a7d
        • MD5 SHA1 SHA512 SSDEEP TLSH

        bigo_ads_sdk.db

        • Path /data/data/com.zoogvpn.android/databases/bigo_ads_sdk.db
        • Size 44KB
        • SHA256 0f73711d0c49b3c4c8d5f92051e104c09aad74a5955dc85a5d0cd07753fccae6
        • MD5 SHA1 SHA512 SSDEEP TLSH

        bigo_ads_sdk.db-journal

        • Path /data/data/com.zoogvpn.android/databases/bigo_ads_sdk.db-journal
        • Size 12KB
        • SHA256 83dcc38128c6c395b721f1a182b7971e40c4382eea60210fecf9ea9090f449fb
        • MD5 SHA1 SHA512 SSDEEP TLSH

        bigo_ads_sdk.db-journal

        • Path /data/data/com.zoogvpn.android/databases/bigo_ads_sdk.db-journal
        • Size 512B
        • SHA256 20fe5f750a927caedbf1ee919ed30d9c0ff54095b35b89a0c228d5078e441582
        • MD5 SHA1 SHA512

        bigo_ads_sdk.db-journal

        • Path /data/data/com.zoogvpn.android/databases/bigo_ads_sdk.db-journal
        • Size 8KB
        • SHA256 4b6607176f819d191c6551538c109c9211f3acef17170472166acfa456189f36
        • MD5 SHA1 SHA512 SSDEEP TLSH

        bigo_ads_sdk.db-journal

        • Path /data/data/com.zoogvpn.android/databases/bigo_ads_sdk.db-journal
        • Size 8KB
        • SHA256 3e78dc9eefdb7d7d8f69e17fec577bc52e3eaa832aac56d7dbdef72d248ad02f
        • MD5 SHA1 SHA512 SSDEEP TLSH

        com.google.android.datatransport.events

        • Path /data/data/com.zoogvpn.android/databases/com.google.android.datatransport.events
        • Size 76KB
        • SHA256 bf05d2e17e612ddcd84efa5bbbfbdda2b6e25ea542df0dd23e2b3012808e379c
        • MD5 SHA1 SHA512 SSDEEP TLSH

        com.google.android.datatransport.events-journal

        • Path /data/data/com.zoogvpn.android/databases/com.google.android.datatransport.events-journal
        • Size 24KB
        • SHA256 752e71a3959cb8dd71ccac02089c5fcaa21361d9fdb2f30e2e3572c453e58bd0
        • MD5 SHA1 SHA512 SSDEEP TLSH

        com.google.android.datatransport.events-journal

        • Path /data/data/com.zoogvpn.android/databases/com.google.android.datatransport.events-journal
        • Size 24KB
        • SHA256 4ede67d0b8a2fdf04b8d1c52a66489cdfd58db55050ef331b16f2620ca2edbb5
        • MD5 SHA1 SHA512 SSDEEP TLSH

        com.google.android.datatransport.events-journal

        • Path /data/data/com.zoogvpn.android/databases/com.google.android.datatransport.events-journal
        • Size 24KB
        • SHA256 8b514e01e00e0417eb40a8322dffb7dcf14e7c4b2f226b5418087ea3c117b9e8
        • MD5 SHA1 SHA512 SSDEEP TLSH

        com.google.android.datatransport.events-journal

        • Path /data/data/com.zoogvpn.android/databases/com.google.android.datatransport.events-journal
        • Size 512B
        • SHA256 9598108956b40eb805b5c975e751b470e0dc33aa21d83201916e5c8bf5a5d20c
        • MD5 SHA1 SHA512

        com.google.android.datatransport.events-journal

        • Path /data/data/com.zoogvpn.android/databases/com.google.android.datatransport.events-journal
        • Size 8KB
        • SHA256 342cc3f37f83605f1676e138be53f41c4b3d9ab74e47ca75342c50d70b4f721f
        • MD5 SHA1 SHA512 SSDEEP TLSH

        com.google.android.datatransport.events-journal

        • Path /data/data/com.zoogvpn.android/databases/com.google.android.datatransport.events-journal
        • Size 8KB
        • SHA256 1b9e9c66ec8b49fcb7d205cd0d38735e1581b336cc2400b6af8da0d901225c71
        • MD5 SHA1 SHA512 SSDEEP TLSH

        component_data.db

        • Path /data/data/com.zoogvpn.android/databases/component_data.db
        • Size 40KB
        • SHA256 0ea7f56d12131abbe5aa6dcdc108f4796fa80ad129f7e13be4895cfd2d98a32f
        • MD5 SHA1 SHA512 SSDEEP TLSH

        component_data.db-journal

        • Path /data/data/com.zoogvpn.android/databases/component_data.db-journal
        • Size 16KB
        • SHA256 1cc3880e77d86b0b2fce9c9db354e251a228a44bbdfc34d22de9fd1f839ed502
        • MD5 SHA1 SHA512 SSDEEP TLSH

        component_data.db-journal

        • Path /data/data/com.zoogvpn.android/databases/component_data.db-journal
        • Size 512B
        • SHA256 12b4490a5e97f5b3513d629d13fa498b26c574a5e558f8768a90915199ba4b9e
        • MD5 SHA1 SHA512

        component_data.db-journal

        • Path /data/data/com.zoogvpn.android/databases/component_data.db-journal
        • Size 8KB
        • SHA256 8298c4fa108d4cb0412367d9964957fe07cb459587fc013d56b8a135b4867d7d
        • MD5 SHA1 SHA512 SSDEEP TLSH

        component_data.db-journal

        • Path /data/data/com.zoogvpn.android/databases/component_data.db-journal
        • Size 8KB
        • SHA256 a850b9333b8550d13cf50080158fd958d9133af1ba04e9775f1755d54abea4c8
        • MD5 SHA1 SHA512 SSDEEP TLSH

        google_app_measurement_local.db

        • Path /data/data/com.zoogvpn.android/databases/google_app_measurement_local.db
        • Size 16KB
        • SHA256 0c7f844000e9b84bca00af70bbe1f69f372850e2a972f5becf9be10464820ee5
        • MD5 SHA1 SHA512 SSDEEP TLSH

        google_app_measurement_local.db

        • Path /data/data/com.zoogvpn.android/databases/google_app_measurement_local.db
        • Size 16KB
        • SHA256 ee6c6d86d6aa5c06bdd8e528f02fe512e4bb0cb74497bc8a6ea8f5be0a0cb5bc
        • MD5 SHA1 SHA512 SSDEEP TLSH

        google_app_measurement_local.db

        • Path /data/data/com.zoogvpn.android/databases/google_app_measurement_local.db
        • Size 16KB
        • SHA256 c86b1fd6eb2ec13a79ca8ca3cb4d5c0f02cbaa52fd0ea598a84dc0988021bc7b
        • MD5 SHA1 SHA512 SSDEEP TLSH

        google_app_measurement_local.db

        • Path /data/data/com.zoogvpn.android/databases/google_app_measurement_local.db
        • Size 16KB
        • SHA256 cdc0c67b00bf252d8a8a55b73e1067ebb0b01794794eb5fd479fd6fea3ed96d7
        • MD5 SHA1 SHA512 SSDEEP TLSH

        google_app_measurement_local.db

        • Path /data/data/com.zoogvpn.android/databases/google_app_measurement_local.db
        • Size 16KB
        • SHA256 65e560c9cd787ec50dabc2893a24e9ab26cfea41110bd14a7aa8b2b1d756015e
        • MD5 SHA1 SHA512 SSDEEP TLSH

        google_app_measurement_local.db

        • Path /data/data/com.zoogvpn.android/databases/google_app_measurement_local.db
        • Size 16KB
        • SHA256 04d53f422d4a428a505fb3aa1a11d7195e684ffe19f9dc51424b2dd8c1250600
        • MD5 SHA1 SHA512 SSDEEP TLSH

        google_app_measurement_local.db-journal

        • Path /data/data/com.zoogvpn.android/databases/google_app_measurement_local.db-journal
        • Size 512B
        • SHA256 6788fe2a7b2c3b3e42e5b060c9b46016a27fd27bc81cde2f97f6225499793fa7
        • MD5 SHA1 SHA512

        google_app_measurement_local.db-journal

        • Path /data/data/com.zoogvpn.android/databases/google_app_measurement_local.db-journal
        • Size 8KB
        • SHA256 9e897e6bde889cbc1cf14e354e21ec8d6ee29761a8544b843aeebfd68b13133a
        • MD5 SHA1 SHA512 SSDEEP TLSH

        google_app_measurement_local.db-journal

        • Path /data/data/com.zoogvpn.android/databases/google_app_measurement_local.db-journal
        • Size 4KB
        • SHA256 a1bc4a78cd47b5be94c34878d3cf27e74f90248ab4cad4c399b2bd458fcdeb73
        • MD5 SHA1 SHA512 SSDEEP TLSH

        google_app_measurement_local.db-journal

        • Path /data/data/com.zoogvpn.android/databases/google_app_measurement_local.db-journal
        • Size 8KB
        • SHA256 56aeb7bfc3ebafba738beeb6c2e0d555b2f121d0af38c6632d2f7dc34856d53d
        • MD5 SHA1 SHA512 SSDEEP TLSH

        google_app_measurement_local.db-journal

        • Path /data/data/com.zoogvpn.android/databases/google_app_measurement_local.db-journal
        • Size 8KB
        • SHA256 17d70ccc32ebb858e6a3d3b4e02f9fa0d984e280d758235254322d243313c268
        • MD5 SHA1 SHA512 SSDEEP TLSH

        google_app_measurement_local.db-journal

        • Path /data/data/com.zoogvpn.android/databases/google_app_measurement_local.db-journal
        • Size 8KB
        • SHA256 166b87519cd4c4687567cf085f073fa76e208cd8b655bd927d8657a037b48129
        • MD5 SHA1 SHA512 SSDEEP TLSH

        mbridge.msdk.db

        • Path /data/data/com.zoogvpn.android/databases/mbridge.msdk.db
        • Size 12KB
        • SHA256 3f3b66364a1158003fc217f8040394a03625dc927dd495ac7a9b6e53f5cf22ce
        • MD5 SHA1 SHA512 SSDEEP TLSH

        mbridge.msdk.db-journal

        • Path /data/data/com.zoogvpn.android/databases/mbridge.msdk.db-journal
        • Size 512B
        • SHA256 660186618cd8dbbea188574893a5b6a506e881f0cccec66188edc959299eeb2f
        • MD5 SHA1 SHA512

        mbridge.msdk.db-journal

        • Path /data/data/com.zoogvpn.android/databases/mbridge.msdk.db-journal
        • Size 8KB
        • SHA256 4cc3e2163fb4291e241c03174f3152d56c91c7df405b883dec33a4c42d149dba
        • MD5 SHA1 SHA512 SSDEEP TLSH

        supersonic_sdk.db

        • Path /data/data/com.zoogvpn.android/databases/supersonic_sdk.db
        • Size 16KB
        • SHA256 9d314501d4bef77dd902d07c78b692a4b8ca6f8b8bd5ee6df5504365b538a3d9
        • MD5 SHA1 SHA512 SSDEEP TLSH

        supersonic_sdk.db

        • Path /data/data/com.zoogvpn.android/databases/supersonic_sdk.db
        • Size 16KB
        • SHA256 4b84536d5f71e1beb453e711ed845c7abbd70e37c42138c519a6a968f5b20d0d
        • MD5 SHA1 SHA512 SSDEEP TLSH

        supersonic_sdk.db

        • Path /data/data/com.zoogvpn.android/databases/supersonic_sdk.db
        • Size 16KB
        • SHA256 0b649db6ee8192340d6350bab27c79c2e69ecabbba345710ce1aaebfd6b1dcd7
        • MD5 SHA1 SHA512 SSDEEP TLSH

        supersonic_sdk.db

        • Path /data/data/com.zoogvpn.android/databases/supersonic_sdk.db
        • Size 16KB
        • SHA256 6e242107dfeecd1ff5ec3508283ce70fcc7f96c4c391a2474794a004cccc3e5a
        • MD5 SHA1 SHA512 SSDEEP TLSH

        supersonic_sdk.db

        • Path /data/data/com.zoogvpn.android/databases/supersonic_sdk.db
        • Size 16KB
        • SHA256 6b41e8187bd2d8796c5d59db7e00cbd8547f2b82c7624e16b1c1caf0fad39390
        • MD5 SHA1 SHA512 SSDEEP TLSH

        supersonic_sdk.db-journal

        • Path /data/data/com.zoogvpn.android/databases/supersonic_sdk.db-journal
        • Size 512B
        • SHA256 dcc6af4a5de9e633f7fe8d01e2660297702e1be8d53922177ec92efd799fa142
        • MD5 SHA1 SHA512

        supersonic_sdk.db-journal

        • Path /data/data/com.zoogvpn.android/databases/supersonic_sdk.db-journal
        • Size 8KB
        • SHA256 24e287bb33849d67e9ad32c7947a5e1bcf05578a2c148cc1dfb13d21e555d56a
        • MD5 SHA1 SHA512 SSDEEP TLSH

        supersonic_sdk.db-journal

        • Path /data/data/com.zoogvpn.android/databases/supersonic_sdk.db-journal
        • Size 8KB
        • SHA256 1dfa68b6b85b25e93c71edf097073e1a16240885f0426fe97aa200458591a638
        • MD5 SHA1 SHA512 SSDEEP TLSH

        supersonic_sdk.db-journal

        • Path /data/data/com.zoogvpn.android/databases/supersonic_sdk.db-journal
        • Size 8KB
        • SHA256 b478297b505c10ee900847f20452d835a4c24d6f3587411baf89a746fb337e44
        • MD5 SHA1 SHA512 SSDEEP TLSH

        supersonic_sdk.db-journal

        • Path /data/data/com.zoogvpn.android/databases/supersonic_sdk.db-journal
        • Size 8KB
        • SHA256 4747efd64edb470f5d860e109e8c57ff31a2c1c2b6d88e702df14e75c80661cb
        • MD5 SHA1 SHA512 SSDEEP TLSH

        supersonic_sdk.db-journal

        • Path /data/data/com.zoogvpn.android/databases/supersonic_sdk.db-journal
        • Size 8KB
        • SHA256 f9355f61613bcabe031ef8bc00470c5558d6890ff57078f52d062446697b024a
        • MD5 SHA1 SHA512 SSDEEP TLSH

        track_manager_metrics_sdk.db

        • Path /data/data/com.zoogvpn.android/databases/track_manager_metrics_sdk.db
        • Size 40KB
        • SHA256 f86b2551033418161068188f5a195a0939651218b4c459ef4dd1bf0aa5b56df6
        • MD5 SHA1 SHA512 SSDEEP TLSH

        track_manager_metrics_sdk.db-journal

        • Path /data/data/com.zoogvpn.android/databases/track_manager_metrics_sdk.db-journal
        • Size 12KB
        • SHA256 79ce951dc39d44ab381a2ca3e9fde758adb27f9ed7e88536d310d9ecb3d28011
        • MD5 SHA1 SHA512 SSDEEP TLSH

        track_manager_metrics_sdk.db-journal

        • Path /data/data/com.zoogvpn.android/databases/track_manager_metrics_sdk.db-journal
        • Size 512B
        • SHA256 30e1d25a84da13722cf00d530dc40878862218d7c83af11216c91bc966e4f6d7
        • MD5 SHA1 SHA512

        track_manager_metrics_sdk.db-journal

        • Path /data/data/com.zoogvpn.android/databases/track_manager_metrics_sdk.db-journal
        • Size 8KB
        • SHA256 cbaf680c57454b9ebd9a90ecafd339c11ff595cadd2de0152e41999548509c26
        • MD5 SHA1 SHA512 SSDEEP TLSH

        track_manager_metrics_sdk.db-journal

        • Path /data/data/com.zoogvpn.android/databases/track_manager_metrics_sdk.db-journal
        • Size 8KB
        • SHA256 c19083a0056a6bfa772d27b40b174cfac6df3ac3151e582ca117b0a62a7b4b48
        • MD5 SHA1 SHA512 SSDEEP TLSH

        track_manager_metrics_sdk.db-journal

        • Path /data/data/com.zoogvpn.android/databases/track_manager_metrics_sdk.db-journal
        • Size 8KB
        • SHA256 729535c92d00faa62525c3333628730678c3c54b33eb65198a90c355635df38d
        • MD5 SHA1 SHA512 SSDEEP TLSH

        track_manager_metrics_sdk.db-journal

        • Path /data/data/com.zoogvpn.android/databases/track_manager_metrics_sdk.db-journal
        • Size 8KB
        • SHA256 4e5f6a9e299d801277d6334c1ad6951f2ee443f415ddcd4b0d20a8620daadba2
        • MD5 SHA1 SHA512 SSDEEP TLSH

        report

        • Path /data/data/com.zoogvpn.android/files/.com.google.firebase.crashlytics.files.v2:com.zoogvpn.android/open-sessions/69FDF38503D000010D145A8547A627FE/report
        • Size 797B
        • SHA256 410e764bf1e6767a1848bfba1bab7ef0a2de151a5704009c69f3fed395d7ed4a
        • MD5 SHA1 SHA512 TLSH

        user-data

        • Path /data/data/com.zoogvpn.android/files/.com.google.firebase.crashlytics.files.v2:com.zoogvpn.android/open-sessions/69FDF38503D000010D145A8547A627FE/user-data
        • Size 20B
        • SHA256 8d5e68672d0e5e302ae1b588034b0918232cf6dd14276f87c59a7a47b1ac89a6
        • MD5 SHA1 SHA512

        1778250633584

        • Path /data/data/com.zoogvpn.android/files/AFRequestCache/1778250633584
        • Size 2KB
        • SHA256 e23b1cd43423652f6406515376deeffabe65521fb1e9e3ad040518cf65e15273
        • MD5 SHA1 SHA512 TLSH

        1778250635129

        • Path /data/data/com.zoogvpn.android/files/AFRequestCache/1778250635129
        • Size 3KB
        • SHA256 5c63c8cac131677d242453324ae266d1f52b8a984ac63526da785027fe7c90b2
        • MD5 SHA1 SHA512 TLSH

        1778250635610

        • Path /data/data/com.zoogvpn.android/files/AFRequestCache/1778250635610
        • Size 2KB
        • SHA256 2b0aa050735a38e5c1f5411e6bba9bbc1dc19586136cb8ac1ecb8c302539cf74
        • MD5 SHA1 SHA512 TLSH

        1778250637127

        • Path /data/data/com.zoogvpn.android/files/AFRequestCache/1778250637127
        • Size 2KB
        • SHA256 7cf9ad5e1be3af1ae36fc5213d6ab8ae25709f1c827fe9fbbd03613e132f8cc1
        • MD5 SHA1 SHA512 TLSH

        1778250638085

        • Path /data/data/com.zoogvpn.android/files/AFRequestCache/1778250638085
        • Size 3KB
        • SHA256 78dddd0fe70264446c3d98a406eafcc8ad6feb29ec7fed12323b1dc76f8141de
        • MD5 SHA1 SHA512 TLSH

        mraid.js

        • Path /data/data/com.zoogvpn.android/files/PBMJSLibraries/mraid.js
        • Size 15KB
        • SHA256 2f57ae0b88893dce902954681fe254e64a5b57c31bf4c928fa9045cc716530c8
        • MD5 SHA1 SHA512 SSDEEP TLSH

        omsdk.js

        • Path /data/data/com.zoogvpn.android/files/PBMJSLibraries/omsdk.js
        • Size 37KB
        • SHA256 af85febe4c19b3929a412b33d3dc6c2acd601b8cd774873ab68b296e05bc5434
        • MD5 SHA1 SHA512 SSDEEP TLSH

        PersistedInstallation2743989245969619949tmp

        • Path /data/data/com.zoogvpn.android/files/PersistedInstallation2743989245969619949tmp
        • Size 90B
        • SHA256 187ae91e8dae649ffb8615699955fb85242ace8fedecbd4cd21091d90fdab9b2
        • MD5 SHA1 SHA512 TLSH

        PersistedInstallation449936121723208786tmp

        • Path /data/data/com.zoogvpn.android/files/PersistedInstallation449936121723208786tmp
        • Size 569B
        • SHA256 f2f866a70b99d2b38a5677aa579a9273adae6517f3ad2c56e3c5c5e800972e65
        • MD5 SHA1 SHA512 TLSH

        UnityAdsStorage-public-data.json

        • Path /data/data/com.zoogvpn.android/files/UnityAdsStorage-public-data.json
        • Size 2B
        • SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
        • MD5 SHA1 SHA512

        UnityAdsStorage-public-data.json

        • Path /data/data/com.zoogvpn.android/files/UnityAdsStorage-public-data.json
        • Size 105B
        • SHA256 15d0c90f1d95903071b3d358e7faba54a9da7832ed1ffa38e8cdf942c806dd8d
        • MD5 SHA1 SHA512 TLSH

        UnityAdsStorage-public-data.json

        • Path /data/data/com.zoogvpn.android/files/UnityAdsStorage-public-data.json
        • Size 105B
        • SHA256 cf0c5fc7e954b7a8d6a75ca37de1308aaccadffe28f0b228a8bfc8c0166d3af8
        • MD5 SHA1 SHA512 TLSH

        2026-05-08

        • Path /data/data/com.zoogvpn.android/files/app_logs/2026-05-08
        • Size 2KB
        • SHA256 6f05cf08f7514895ad4f9afd09c7498a6d710b2e7398ff17d5b9081056e94277
        • MD5 SHA1 SHA512 TLSH

        frc_1:380845370489:android:a122dcb3aa16103b43f8a8_firebase_fetch.json

        • Path /data/data/com.zoogvpn.android/files/frc_1:380845370489:android:a122dcb3aa16103b43f8a8_firebase_fetch.json
        • Size 140B
        • SHA256 44e4e9714abf556f3a6652fcc39402589925fa86536a96b94269dc545c703a39
        • MD5 SHA1 SHA512 TLSH

        profileInstalled

        • Path /data/data/com.zoogvpn.android/files/profileInstalled
        • Size 24B
        • SHA256 f5b348994818cf3b185ca6d748df2fd86e708db6205469262b1fa71ff930b307
        • MD5 SHA1 SHA512

        bigo_app.dat

        • Path /data/data/com.zoogvpn.android/files/sg_bigo_ad/bigo_app.dat
        • Size 32B
        • SHA256 8d7ac482ed444695b50796ea9994b42357fc5be6cb4dd8dd84ffa795ba0d5080
        • MD5 SHA1 SHA512

        bigoad_antiban_config.dat

        • Path /data/data/com.zoogvpn.android/files/sg_bigo_ad/bigoad_antiban_config.dat
        • Size 1KB
        • SHA256 fea19fa3165b8c130b7360fb3df87283ad078102eac17eef17d81826762f1928
        • MD5 SHA1 SHA512 TLSH

        bigoad_antiban_config.dat

        • Path /data/data/com.zoogvpn.android/files/sg_bigo_ad/bigoad_antiban_config.dat
        • Size 1KB
        • SHA256 d3f9e6d9ae3a03c93ce7bb76553cd0435264294d940d78f1dce8b339ce98cf56
        • MD5 SHA1 SHA512 TLSH

        bigoad_antiban_config.dat

        • Path /data/data/com.zoogvpn.android/files/sg_bigo_ad/bigoad_antiban_config.dat
        • Size 1KB
        • SHA256 7d300c74a4cca391069e281e724cb167a02e33104636f4fb187b215afa293c64
        • MD5 SHA1 SHA512 TLSH

        bigoad_antiban_config.dat

        • Path /data/data/com.zoogvpn.android/files/sg_bigo_ad/bigoad_antiban_config.dat
        • Size 1KB
        • SHA256 07a49539cfc931cc2ad70667c138189631f11704a6745c92bd7ce53b786e925d
        • MD5 SHA1 SHA512 TLSH

        bigoad_antiban_config.dat

        • Path /data/data/com.zoogvpn.android/files/sg_bigo_ad/bigoad_antiban_config.dat
        • Size 1KB
        • SHA256 d81181857e5712d14e259d2e214d6b760f42898e5fa039ee593f6e5659253404
        • MD5 SHA1 SHA512 TLSH

        bigoad_config.dat

        • Path /data/data/com.zoogvpn.android/files/sg_bigo_ad/bigoad_config.dat
        • Size 560B
        • SHA256 7fc1e5c5f343125d974e03f2afc83afafb4e644d37aee915c627d84d072b77f3
        • MD5 SHA1 SHA512 TLSH

        bigoad_config.dat

        • Path /data/data/com.zoogvpn.android/files/sg_bigo_ad/bigoad_config.dat
        • Size 9KB
        • SHA256 75892785baef1806b789d8eb0b1ba5dc6da973223093da93f9f7dcd628e42447
        • MD5 SHA1 SHA512 SSDEEP TLSH

        bigoad_slots.dat

        • Path /data/data/com.zoogvpn.android/files/sg_bigo_ad/bigoad_slots.dat
        • Size 16KB
        • SHA256 25a23cfd11bd43164997d40198b2135b5c0de3a0dbe036ec4545f40d8353608c
        • MD5 SHA1 SHA512 SSDEEP TLSH

        androidx.work.workdb

        • Path /data/data/com.zoogvpn.android/no_backup/androidx.work.workdb
        • Size 4KB
        • SHA256 bfaef8fac18709034d1b023086575733ab2f5ba0628478989b5e704180ca2513
        • MD5 SHA1 SHA512 TLSH

        androidx.work.workdb-journal

        • Path /data/data/com.zoogvpn.android/no_backup/androidx.work.workdb-journal
        • Size 512B
        • SHA256 fc9dca40632d5d9561df149b6ea3701c827cab4c070456723dd5272a21cfed22
        • MD5 SHA1 SHA512

        androidx.work.workdb-shm

        • Path /data/data/com.zoogvpn.android/no_backup/androidx.work.workdb-shm
        • Size 32KB
        • SHA256 c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479
        • MD5 SHA1 SHA512 SSDEEP

        androidx.work.workdb-wal

        • Path /data/data/com.zoogvpn.android/no_backup/androidx.work.workdb-wal
        • Size 16KB
        • SHA256 c217b4ef338ba7f71dd21c7216c12ed76e7b6d5b7c8579b8706e45d3b31573b9
        • MD5 SHA1 SHA512 SSDEEP TLSH

        androidx.work.workdb-wal

        • Path /data/data/com.zoogvpn.android/no_backup/androidx.work.workdb-wal
        • Size 108KB
        • SHA256 bdeaca15f61a3dad8a3bd9231761f1b4258dd0990261e662c3fff4ee08a3309c
        • MD5 SHA1 SHA512 SSDEEP TLSH

        settings_vungle

        • Path /data/data/com.zoogvpn.android/no_backup/settings_vungle
        • Size 137B
        • SHA256 357195aca5835975ed71320222b9d9f0fe584b705cbfc9bc5181f3f4a911bea9
        • MD5 SHA1 SHA512 TLSH

        settings_vungle

        • Path /data/data/com.zoogvpn.android/no_backup/settings_vungle
        • Size 165B
        • SHA256 980ec4fa40ac956bd609fbf8e3ea788d08b4c608dbdbb8b0b470f9ff3adffb97
        • MD5 SHA1 SHA512 TLSH

        settings_vungle

        • Path /data/data/com.zoogvpn.android/no_backup/settings_vungle
        • Size 257B
        • SHA256 4c95b4b78bfb118911500cd8a688008272216508c623994a521c107799314d48
        • MD5 SHA1 SHA512 TLSH

        settings_vungle

        • Path /data/data/com.zoogvpn.android/no_backup/settings_vungle
        • Size 3KB
        • SHA256 584bbae851d2776d34a1c13afbeae5d663932b45a160387396011c905bb80290
        • MD5 SHA1 SHA512 TLSH
        • Path /data/data/com.zoogvpn.android/oat/x86_64/[email protected]
        • Size 156B
        • SHA256 f1ba205b38972c8252115e378d5b2f3d04d8c4522b436e250eaab15c2afcff72
        • MD5 SHA1 SHA512 TLSH
        • Path /data/data/com.zoogvpn.android/oat/x86_64/[email protected]
        • Size 304B
        • SHA256 12aac4751b73aea836fee5ee7222aa4173279308bfef0b7bd8ae46e49b881abd
        • MD5 SHA1 SHA512 TLSH
        • Path /data/data/com.zoogvpn.android/oat/x86_64/[email protected]
        • Size 136B
        • SHA256 e7bec15b36a4b55270f2f880fc5d80aab0b081ab5befaddb58728b1deba64b26
        • MD5 SHA1 SHA512 TLSH
        • Path /data/data/com.zoogvpn.android/oat/x86_64/[email protected]
        • Size 156B
        • SHA256 1b78a9132fb2816d9bb3e6e516b3975b984f5e6d4ccbf8e8fa234782b41360d0
        • MD5 SHA1 SHA512 TLSH
        • Path /data/data/com.zoogvpn.android/oat/x86_64/[email protected]
        • Size 69KB
        • SHA256 4dd1590a3f1cf4409267a6b339b28f80ef4f3bc0a013de327d9a35c8012601bc
        • MD5 SHA1 SHA512 SSDEEP TLSH

        mraid_js.txt

        • Path /storage/emulated/0/Android/data/com.zoogvpn.android/files/mb/other/mraid_js.txt
        • Size 12KB
        • SHA256 61779e5e9b63efdceca3492897e0b02063c9c8f87cd1335cc735a3e56a1dd2c4
        • MD5 SHA1 SHA512 SSDEEP TLSH

        om_js_content.txt

        • Path /storage/emulated/0/Android/data/com.zoogvpn.android/files/mb/other/omsdk/om_js_content.txt
        • Size 38KB
        • SHA256 70bb8f51e8554a2dcf42e9e97205f0bab3623190ead9bdbeb4ec8c77cdc347f0
        • MD5 SHA1 SHA512 SSDEEP TLSH

        f6374b4fc46569e6e23545f2ffe6891e.tmp

        • Path /storage/emulated/0/Android/data/com.zoogvpn.android/files/mb/res/.mbridge700/mb/config/mbridge/f6374b4fc46569e6e23545f2ffe6891e.tmp
        • Size 7KB
        • SHA256 44ed10f5555b049b9d0ec75289dc093293b0858b9755a9b7ec03ecba4c822620
        • MD5 SHA1 SHA512 SSDEEP TLSH

        share_kv_date.tmp

        • Path /storage/emulated/0/Android/data/com.zoogvpn.android/files/mb/res/.mbridge700/mb/config/share_kv_date.tmp
        • Size 50B
        • SHA256 08494b341133bb612b6d0c52f35d59070e4bbc4b400fe6e3202b651a87ab714c
        • MD5 SHA1 SHA512 TLSH