35c8c95c7f72872e733dfd29280df12bfe9950a760d2a346f4be6c2e399e5a4b

Analysis

user interaction
yes
max time kernel
8s
max time network
248s
platform
android-10_x64
resource
android-x64-20260325-en
resource tags

arch:x64arch:x86image:android-x64-20260325-enlocale:en-usos:android-10-x64system
submitted
25/08/2026, 15:54

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
35c8c95c7f72872e733dfd29280df12bfe9950a760d2a346f4be6c2e399e5a4b.apk
Size 43.7MB
Sample260825-tccyqsbr21
SHA256 35c8c95c7f72872e733dfd29280df12bfe9950a760d2a346f4be6c2e399e5a4b
MD5 ce49a90c0a098e8737e266471d323626
SHA1 41c4ae3e0c26cabaad90f96eaa6a6ab688560b77
SHA512 a7ef1bbc1129ad1701b5e15a208b8b868ddc7edf2d540b68a35427e2eaedf1e76807f1369ca80691a99312c417e25d0914a5f46958acfeea4df7e45a0fc639f1
SSDEEP 786432:mYkcVVbGRRqzSxmxoFV+I2M320poUNZddKWsAdQeizWy/MlaGVq:mJcjGRsWQPM2kNtHQeizWy/I1q
TLSH
T10DA73386F39AF0AEC9B3803B8B7B176413A14C8AC596CA335165F29CDD779805E44FD8
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

defense_evasion discovery impact persistence

Malware Config

Signatures

Checks if the Android device is rooted. 1 TTPs 1 IoCs

defense_evasion

System Information Discovery

T1426

ioc	Process
/system/app/Superuser.apk	com.vpn.lofun

Checks Android system properties for emulator presence. 1 TTPs 2 IoCs

defense_evasion

System Checks

T1633.001

description	ioc	Process
Accessed system property	key: ro.product.device	com.vpn.lofun
Accessed system property	key: ro.product.model	com.vpn.lofun

Checks Qemu related system properties. 1 TTPs 1 IoCs

Checks for Android system properties related to Qemu for Emulator detection.

defense_evasion

System Checks

T1633.001

description	ioc	Process
Accessed system property	key: ro.kernel.qemu	com.vpn.lofun

Queries information about active data network 1 TTPs 1 IoCs

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.IConnectivityManager.getActiveNetworkInfo	com.vpn.lofun

Queries the unique device ID (IMEI, MEID, IMSI) 1 TTPs
discovery

System Network Configuration Discovery
T1422
Deletes files using the built-in Unix rm command 1 TTPs
Android's native rm command removes files and directories directly from the device filesystem, which can be used to erase artifacts and evidence left behind by intrusion activity.
defense_evasion

File Deletion
T1630.002

Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs

persistence

Broadcast Receivers

T1624.001

description	ioc	Process
Framework service call	android.app.IActivityManager.registerReceiver	com.vpn.lofun

Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs

impact

Data Encrypted for Impact

T1471

description	ioc	Process
Framework API call	javax.crypto.Cipher.doFinal	com.vpn.lofun

Checks CPU information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/cpuinfo	com.vpn.lofun

com.vpn.lofun
1⤵
- Checks if the Android device is rooted.
- Checks Android system properties for emulator presence.
- Checks Qemu related system properties.
- Queries information about active data network
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Uses Crypto APIs (Might try to encrypt user data)
- Checks CPU information
PID:5090
- sh
  2⤵
  PID:5127
- - id
    3⤵
    PID:5148
- - killall ss-local
    3⤵
    PID:5166
- - rm -f /data/user/0/com.vpn.lofun/ss-local-nat.conf /data/user/0/com.vpn.lofun/ss-local-vpn.conf
    3⤵
    PID:5184
- - killall ss-tunnel
    3⤵
    PID:5202
- - rm -f /data/user/0/com.vpn.lofun/ss-tunnel-nat.conf /data/user/0/com.vpn.lofun/ss-tunnel-vpn.conf
    3⤵
    PID:5220
- - killall pdnsd
    3⤵
    PID:5238
- - rm -f /data/user/0/com.vpn.lofun/pdnsd-nat.conf /data/user/0/com.vpn.lofun/pdnsd-vpn.conf
    3⤵
    PID:5256

Network

MITRE ATT&CK Mobile v16

Initial Access

Execution

Persistence

Event Triggered Execution

T1624

Broadcast Receivers

T1624.001

Privilege Escalation

Defense Evasion

Indicator Removal on Host

T1630

File Deletion

T1630.002

Virtualization/Sandbox Evasion

T1633

System Checks

T1633.001

Credential Access

Discovery

System Information Discovery

T1426

System Network Configuration Discovery

T1422

System Network Connections Discovery

T1421

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Data Encrypted for Impact

T1471

Replay Monitor

Loading Replay Monitor...

Downloads

bypass-china.acl

Path /data/data/com.vpn.lofun/bypass-china.acl
Size 198KB
SHA256 ca23e4ac7900d90781749447a26555431aee3422454175efac45a92e0c47f64e
MD5 0f998459988dd814771a6a80051c3a06
SHA1 8be300862f840f88ea78c739ceecb9649edc054f
SHA512 153b39ba7fc61dca92091b60084bf4f4be6792498c694826e309732c4e8547e89f81183b5379889198c8f3a7b1e09f48aeba879e462f4eda18a89dbf07c3d60a
SSDEEP 1536:hjxFKFhuNc4imBQ+hNmkg+qPUe7IpPrP98BR1UVxsaChjbryfiogwPnXSJo8O2pF:2UTNYb+E1W4r2ho
TLSH
T1C81464712FD4D7B4F18EEBEEA2EF4624396712F244A0FDE07B9B23101506643B96E851
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

bypass-lan-china.acl

Path /data/data/com.vpn.lofun/bypass-lan-china.acl
Size 198KB
SHA256 c773beeeaa2ad45e6dcc3a32b0fc2a258d880a6d2d012611665b175539fd96ed
MD5 7fffde3be1e1a3e239f2900b3d92e509
SHA1 2940b5585ff5c1cd249ab96427d219cf01115320
SHA512 cc8c3ac97f8cd129c405d6221c4c57181b3d1c378c638e1edb85a6631497567c9129665a5348e15b2800e234dff83ae9bd5b6a5785ef42800404475aa99b611b
SSDEEP 1536:vjxFKFhuNc4imBQ+hNmkg+qPUe7IpPrP98BR1UVxsaChjbryfiogwPnXSJo8O2pF:wUTNYb+E1W4r2ho
TLSH
T1A01464712FD4D7B4F18EEBEEA2EF4624396712F244A0FDE07B9B23101506643B96E851
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

bypass-lan.acl

Path /data/data/com.vpn.lofun/bypass-lan.acl
Size 264B
SHA256 0864047518157be4ecb8807c6036e3f378ca985144e137939c2554611da4e335
MD5 fe97ae180bcdb14b4479af1a53fe7542
SHA1 998022b6cf5903ba403f89de46027dddea2de24a
SHA512 26392758104bcfb40eb1f570973302db11e435bc37c3cb4b93645b260945ee1a7556bb804368722c756360109cdce9dd4741efe850fca8262131da695c16f13d
TLSH
T1ADD05E24354C11F0CC85B7D3A0EFC234F58A408721F2B504435FD1204D01948741CE20
MD5 SHA1 SHA512 TLSH

Submit Download

china-list.acl

Path /data/data/com.vpn.lofun/china-list.acl
Size 81KB
SHA256 df81788859fc6158eb3562b6366a0bdbc649e874d7acada39545af94dc56bc31
MD5 addb0e4c9fbb673d72681df80a0d9c54
SHA1 59c7450dc79c5ceae0d05834489d364e85f3a368
SHA512 f26e4ec049fded4451a515aa436f3663830004e4467d412c72f55df62dd136c34e628dda1f3cd49d58f3bba8161b127f2393fdb0c322b0edec07e810b9440906
SSDEEP 384:DFPRL6ktky6Vc/CmmOR3xMUSRE+thfNx2AjA9xKvG/EpO1Eu0H/gVyC0tVHkFScZ:JHjOxPXjVkFmRZWkTFrdlDGn8IBAXt4H
TLSH
T1D683F67513E92AF895C0F3AAD3E786343DAB15DA51E6F1A0BFEF23605D07081BA54D20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssr_client.db

Path /data/data/com.vpn.lofun/databases/ssr_client.db
Size 24KB
SHA256 9fa7a8b8e529aac1fbed248f1abc80b281c82de63c58b3ee2f87d40a04f32713
MD5 99cfc5b40bb235db4f9b0c2a4ba4fd4f
SHA1 b655542986b12a272f4b48a6e0de0d0dacd24546
SHA512 ad2e635ce768b2e3d8a5b8246597af61898ea28bd7027f4b531f8b92a4acda49695f92f3acf07744c5d8a50b68ca6be37646af6013902a765e3d675bf553bb28
SSDEEP 24:TL4lDaiaolS0RiYvivlXPaoloVHB+0dQHVl19CAU6NUdGSzGQ:T4xzlTiYKvNpEQHVdCl6aIS
TLSH
T1CBB221FA4EA07B28C604687A2E6233B2407F6E6E8573A7845DB450623C63574F6209FD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssr_client.db-journal

Path /data/data/com.vpn.lofun/databases/ssr_client.db-journal
Size 512B
SHA256 996dcbb174ae684f184a92d779f157def367ab88c0530ef11cedd65817f4a718
MD5 2ef15a4f39a82be02ee11279840d2292
SHA1 56a8b3e11a04e9599ec493bfb89f7591187b21ab
SHA512 56bf1391ca45cc52e5fe3b80eca08533c3570eab0fa51be7c01f620965cf0a805153be820f58f388713eeebf93a28099407dee01ab8ff748d2c41b42a96d6b88
MD5 SHA1 SHA512

Submit Download

ssr_client.db-journal

Path /data/data/com.vpn.lofun/databases/ssr_client.db-journal
Size 8KB
SHA256 96c1d8c741fe5227796ad87d5d4479dfed4bae64f28e895eec1b1ce252d9ded5
MD5 6d2ab2c8d1b16a9a90f88f733cbc49c0
SHA1 8bd2a7b61b0073d3e775f6242b78577879672646
SHA512 be4cdd6538f76e762e5820bcdb9742cda0a0fcfe644350f50c22b1e1d2e588e11d152386efb66cb95843b1815ebfe517e66b4ea8b2f6992d735a6016b91bfbf2
SSDEEP 6:7+/l95t/gn1Png9bNFlEuWdOlOERX4PBX4ogLugMBX4suuKi/:7+txuqLiuWdwRmBEyPbT/
TLSH
T1B202229E67801822C91916B790F583540D40FBD9C1E5CB0B256018AD3C034CDA4E0D2C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssr_client.db-journal

Path /data/data/com.vpn.lofun/databases/ssr_client.db-journal
Size 8KB
SHA256 8eda3e8ded735e032d2bd50ff8dbcbaf568447a339c82b77bcd9d3e3b2c89b4f
MD5 d6ab3d15142a339776cc711751dec7c4
SHA1 e219d9f061e9cb9ded3fab075dfba4929b795e51
SHA512 30a037381c44c4e16a77435ea0eab759553377d52dafce7829fd587d8db3afb007e4d7a5b2018618347917fd7079c443bb7346059bdc2236e487125f84151705
SSDEEP 6:7+/l9UJOPg9bNFlLdrlOERX4PBX4ogLugMBX4suuKK//Kn:7+t7qLJdTRmBEyPbFK
TLSH
T12D022289A3400813C02D17B790C883602E56A7148223CB1B556008983C826CCA890D80
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ua.db

Path /data/data/com.vpn.lofun/databases/ua.db
Size 40KB
SHA256 94355f90aaf35f2af46c71222edf9f1c9f05e4ce75c7c59b265d1800abcc4449
MD5 3505ef67a153aff7a46e904e62fbb849
SHA1 b4815c26fdc5adf74c746f4ae9871e41043dcffc
SHA512 9168f526190cbbffdd9403c5c4556e4c45217c85959db81c5037ba166ab3cb42fd5169d81bf58795f0e9a6e8c8707793cf0c03a48091c62a22fc48127fdf2460
SSDEEP 24:TLwMqRrL4PDiP/b+cLglJWcKbEGSvXR4pfJNr0:TkXpwDeT+EsebTS52J1
TLSH
T151031EC7B31912A9C42C5132D8A7E2210BB85D1D5A9A9BB716F100D1BDEB600A83CD6C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ua.db

Path /data/data/com.vpn.lofun/databases/ua.db
Size 24KB
SHA256 3cb11b4d7d12db08e92b459874c8454ce02d2c7194919264e9b20ea661d9124d
MD5 dd93881d969026084664126fd557a54d
SHA1 c8ccad6ffcbe34874ec9919bc4d29a39b05c4aad
SHA512 cdbeccc716b461197baf4cb3a7b4d67661c9e632a8176b11d9b86d8ab0a760b90a122b43c6dde49e2eaceec9c47ba9f4bdd2091ff7e7d9da66ec0cb5fd4d3989
SSDEEP 24:TL1rqRrL4PDiP/b+cLglJWcKbEGSP/T1zojzOBiGQ:T0pwDeT+EsebTSP/TUh
TLSH
T157B2CCD7B11823D9D258603ADC63A2614D7D1D1E86AA8BB91BF104C2FD97600B07DDAD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ua.db

Path /data/data/com.vpn.lofun/databases/ua.db
Size 32KB
SHA256 1bded1219b90c87df8c8db87059d49b2e40f1c954dc9ed74be08783b10db5cfe
MD5 e8e398903eb0a9129f80c1b6f5e5ed02
SHA1 15f4467701dddccac7cb4691e5c39460c927e96b
SHA512 f9c80c932d8bec7b7b266fd2f132cc2f774ed2d6a446dcb808a22d8024fd010657d17a6f7e8c7cfcba3a87be117de7729b256c26e10cd8797470e5d6b41e6b49
SSDEEP 24:TLJqRrL4PDiP/b+cLglJWcKbEGSP/hv0GqNojzOc:TEpwDeT+EsebTSP/hO4J
TLSH
T13DE2F0D7751C2395C208603ADC5362610D7D1D1E96A98BB60BB104C1FD53A00B07CDAD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ua.db

Path /data/data/com.vpn.lofun/databases/ua.db
Size 36KB
SHA256 aaeafda2e0c43ac512600b1f3c215d63eac0f1d77662ed61350199a6c066e773
MD5 ebe7e19312e8fcc0d2ac143c32548fdd
SHA1 e124d96ffa076a44600c61b6b57496a91b9ac63a
SHA512 e95744dc1cb4dae403da4ffe449492cab09b51ae35a939d7b1dac07707b6ad91cec10057f50e314e245191c49e16231adec34cf9d92e51ef30392d5e7a796329
SSDEEP 24:TL5qRrL4PDiP/b+cLglJWcKbEGSP/1uR4pfJNrb:TUpwDeT+EsebTSP/O2J1b
TLSH
T1E7F242C7F21D1396C52C5136DCA7A1210DBD2D0D9AAA9BB617F114D1FDD7601A03CD6C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ua.db

Path /data/data/com.vpn.lofun/databases/ua.db
Size 32KB
SHA256 399ef40e563b816d94559035a17c681f3b985f672c5a9650334ebb0db5381769
MD5 d07d8283deb2f6eefb5de33f827a2433
SHA1 2b6e15b9bec12ca80faf2277ce22f4f2f6aa7d4f
SHA512 0f49a9c98ef8c42605e3f2f3fa5461e0dbc2f9a60153fc5b756bc7f563bcc5f2a1299282cae92ebdf4c9fd5533539c87568a57ee943647173b5531936bc09530
SSDEEP 12:TLpSQwRr+o4PD65N5PPJhb9gBcIkJbglTSF7VAWWpNtI7MJ+bvRmBEyPbP/W:TLpqRrL4PDiP/b+cLglJWcKbEGSP/W
TLSH
T1F8E2DCD7B11C13A8C21C5037DC6791210A7C2D5E96AE8BB61AF100C2FDA7A00A03CDAD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ua.db-journal

Path /data/data/com.vpn.lofun/databases/ua.db-journal
Size 512B
SHA256 640ca7a29452b7bbea2178d87ec57fae1a42257a4f0ae69a5d129d2dbc61a6d2
MD5 bcfabf2c728f860543297b3310ba4a45
SHA1 b038b0ba45133922fb37c762a0a7e9e84f30a1ff
SHA512 541921fcfe9384c2da3e0eee94889227ecf6d448e19f9ddae893fa20e06f0a69c171a953ba2fde19fa7c998524a57cb162ecef3bc18a6dd10b6ebe6ee70655ed
MD5 SHA1 SHA512

Submit Download

ua.db-journal

Path /data/data/com.vpn.lofun/databases/ua.db-journal
Size 8KB
SHA256 3b039cf5e599d932c313e497fde69001ebdefe63e9242fd8bb1b1b8950041b6e
MD5 d116bdb9d6960eab7b234735221529d3
SHA1 13b234c568735dc16ec8ba3b54992727a3ee9b34
SHA512 83aeedd36d7cf47b5d0f20bccbfe1dcd9e126128dbf0e83cda8fab3ad0485e9d0cc6f7b021e29d24c61f4e77cd506174c0e8f58f0c3b7df730cf506ae1e3cb71
SSDEEP 6:7+/l9y/gn1a/vg9bNFlEuWdOlOERX4PBX4ogLugMBX4suuKn:7+t0/rnqLiuWdwRmBEyPbE
TLSH
T1A302228A73800822C82916BBB0D583420E00E72A82A1CB4715A00C98FC038CCA4A0E04
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ua.db-journal

Path /data/data/com.vpn.lofun/databases/ua.db-journal
Size 8KB
SHA256 04b1de7123f5b8ed89a52e9ce85c6df83038ffc55fe0685fbc1d700ab8ecc8e3
MD5 14e37c6b7ae849424de8716e98c3d325
SHA1 3c88d25f63e453ad77350cae1cfa618a30742e30
SHA512 c7776af7d54b4d1e111889dae86b4d0aa30649288ff0159c10f1a2c55b55fda77502e30129b0525aa28f8a0ec250bca1a2be5944fe9a0a58192b0d93a510dac6
SSDEEP 6:7+/l9x/gPg9bNFlLdrlOERX4PBX4ogLugMBX4suuKtMM/D:7+tP4qLJdTRmBEyPbMMsD
TLSH
T1EF02228A63400813C819A7B790C883522E10A7148263CB17196008983C026CCAC9DF40
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ua.db-journal

Path /data/data/com.vpn.lofun/databases/ua.db-journal
Size 12KB
SHA256 991e1bbff0b2e92184c9d4f7583564804cd9f219a5cbbfeec4b432a30c136af4
MD5 ff1fa941b8f0a90511893e08389938cf
SHA1 c2f78f389568c6b2b6b16654f8129d2704e1c4da
SHA512 32f54b9bfc0ddfaf75f50fecda98da7a30ea98e94cadbe796ef49d8ca28edafc3a9c35f53904d1bfe858e721a2cd05ec8d0d1a004a62b37d55316602d0367bf2
SSDEEP 24:7+tTQqL5qRrL4PDiP/b+cLglJWcKbEGSPF:7MTQqUpwDeT+EsebTSPF
TLSH
T1E9429BD7711D23A8C21C5037DC6751211A7C2D5E86EA9BB65AB100D6BD97A00E07CDAD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ua.db-journal

Path /data/data/com.vpn.lofun/databases/ua.db-journal
Size 16KB
SHA256 19bbb262dfa737a4e7b383f2f748387accaf86702921df34c59851e380c9ce9c
MD5 d4c85f46c583fbc8dbc31481d69886f6
SHA1 d508c2035b6a25abf5174f381ce228191b5d1af6
SHA512 d28f443f7955c31703f7edda8159ea56c3f49d9c56ac8545704b312d45992de6e868e2c19ec53a0c04f16564110dc8b2c15410c04d3d1586b83384a306d9e389
SSDEEP 24:7+t5gaqLwMqRrL4PDiP/b+cLglJWcKbEGSXN:7M5gaqkXpwDeT+EsebTS9
TLSH
T13E72CEEB711C13A8C15C5037DC6391102A7C1D5D96EE4BB61AB100C2FD67600A43DEAD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ua.db-journal

Path /data/data/com.vpn.lofun/databases/ua.db-journal
Size 16KB
SHA256 e83be0d44669082248ee3638f01cd078e9ac6c4bda06bef428882cbd317a5518
MD5 663403b7a4c86272d7e5f3fd96c27b77
SHA1 0bd1231934f726ca1028393a3bbfef4856b70a63
SHA512 58b8d11761757a048b22e213b1c7cebaeb9497f56a83631a147b6edc6d412e080c3590b799bc78991c0197b5a5a8a6a629c60e5eb9717734e8c5d45a3279da52
SSDEEP 48:7MUka5fqUpwDeT+EsebTSPgq0pwDeT+EsebTSd:75fBpwyiERbWPghpwyiERbWd
TLSH
T11672CADBB10D1394C2186037DC63912049BD2D1E96AA8BB65BF100C2FDA7A00A07DDBD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

umeng_zero_cache.db

Path /data/data/com.vpn.lofun/databases/umeng_zero_cache.db
Size 20KB
SHA256 76c997f5feb47235c8a5f5f2bf369011fd89ad24fb822a9a67dc5929bb8e7bf6
MD5 ac735e42a1a24b05b650c3645d13bfdc
SHA1 3f8aed293561d5164c245f202ccc83918059d1d6
SHA512 c0086cf93c525645c2edfe569cf3e51f78df296e14c2bcb5980eddce27018126eb555be3d0155727bb4223c569a235b3f0f69e4f4b359cfd9b3e91b3d6fc6897
SSDEEP 12:TLmtWyNTSFbyEKMFUvL9TtL4+qRmBEyPbAVOwG:TLo9M2xTtLlGSEG
TLSH
T18592ABC7A780138AC60C45B1D8BB73A119B0961EC3918B9779F114809C43AC854B2D3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

umeng_zero_cache.db-journal

Path /data/data/com.vpn.lofun/databases/umeng_zero_cache.db-journal
Size 512B
SHA256 aaa578d03c3ceee7db71cf5011287532203f3352ec7f0fdb7f9138378a17fe56
MD5 e94184da2bce490022b4518b9a4e90a3
SHA1 e7366cbca7cb8c8842a16caed6c8df6da17257c7
SHA512 ccc06bae509a7104933e3bf7d675592fdd5670f9a016c346260a81d705174876030c2ffaec3b2780268a5b664a2f85e51f6554c1a06d9e91cb41687a88ff9b24
MD5 SHA1 SHA512

Submit Download

umeng_zero_cache.db-journal

Path /data/data/com.vpn.lofun/databases/umeng_zero_cache.db-journal
Size 8KB
SHA256 7d76ad1655217e88f57707aa050931716c06802da88924f4e2126d9b87adbc32
MD5 44c56257a9e1c5eb52b5c6ede81025f3
SHA1 ef4e8d78a580e43bcb851d4e0e81c060ee3050bd
SHA512 1983ab95eb4fb68621e3061a528a349bcb862255ff442290f32de91700f3b440349c7ef22f3ce81df1567721a2acf92d8e0b956bec1182b059d3295416a12e1c
SSDEEP 6:7+/l9ZluHn1AWg9bNFlEuWdOlOERX4PBX4ogLugMBX4suuKOBn:7+tEBqLiuWdwRmBEyPbJB
TLSH
T1D502228963820922C81F2AB790DB83400D20E71989F1CB07196008983C034CCE8A0D2C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

umeng_zero_cache.db-journal

Path /data/data/com.vpn.lofun/databases/umeng_zero_cache.db-journal
Size 8KB
SHA256 7070b376d838b312eeda7afd0997d38e9eb990cb4fc927a41525dd07e6af2baa
MD5 7a4025e4e67d614347bc110553817b8b
SHA1 d9008e3cb0854399e17e323297bf274bda424fee
SHA512 9f79f2d440284e78764a68ddf625ffadbc5e39aae0292eba651aae946a4c91aeb02929b170edb4d420016ae2b6447e6b7e880952e04140a1db491a9da0cf8cb0
SSDEEP 6:7+/l9iHtgPg9bNFlLdrlOERX4PBX4ogLugMBX4suuKhns//q4K:7+tcHt4qLJdTRmBEyPbksW
TLSH
T1B402C08963811D13C31D1BB7A0D983E02E51E714C333CB071D600CB83C036CCE890E00
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

default-server.acl

Path /data/data/com.vpn.lofun/default-server.acl
Size 149KB
SHA256 ea782bf9398be26029b18eff89b6bb81197f71e1afa8046cb61614f9d3edd96d
MD5 dc05f34f4d07c4df3646e9faea3eeffd
SHA1 ac161b4f5194c1b737a20262b3e76b67a2cfe5c4
SHA512 5124226fe029e4c7595c167da71aaa2f1f3e9e11be0761a6e8ccf153a4a39940855c191d4aca5e20f5c0917cb4758fce437fd20864d3d6aca336ec8f37663e2a
SSDEEP 1536:TYyGynrt+q7D53Bxe6YIyi24GD3ZpAeXwJG/8RL68F6T9yKJff1LWg:ywt+ITe6dvATKg
TLSH
T13DE377341BD9DBF4E589FBDE93EF813439AB11E610E5FDE07B9F22605906282B95C810
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i==1.2.0&&2.0.13_1787673301857_dW5pZnlfbG9ncw== .log

Path /data/data/com.vpn.lofun/files/.envelope/i==1.2.0&&2.0.13_1787673301857_dW5pZnlfbG9ncw== .log
Size 1KB
SHA256 754e92a6b61ec85893cdea7962bec3df9d0570eaa53ef69cbb3e0562f5a82ad1
MD5 c490ea6b6c3a5243b930d7ba1485791b
SHA1 011420fff7489cccb9a6c97ba8dc582d6caaf77a
SHA512 0f93a21608aada6aea3f892712de11cfd8b907f7794bcb4c8c94e7a17de497d24dbf9e72f3ecf65b5bd340b5d1618dfca7dae8534971ed54ef20a41ef3d589cc
TLSH
T1E3310C42D42557026A7C05996C01FC0D35B9673F2FFBE3FC508BB1490AD6365BE024D9
MD5 SHA1 SHA512 TLSH

Submit Download

t==9.4.7&&2.0.13_1787673301960_dW5pZnlfbG9ncw== .log

Path /data/data/com.vpn.lofun/files/.envelope/t==9.4.7&&2.0.13_1787673301960_dW5pZnlfbG9ncw== .log
Size 1KB
SHA256 f4b7b6e0d842da22cc4e3f20918abbab83a915b4b931d1963b186963cbf98063
MD5 be4fcfccf6ec242dab2fd360b33d1c78
SHA1 5f19133fcaa9ec8e974945c413775404c6a3eaea
SHA512 3ac66a937df268fc94481644e2de8f27266af42402154e12bc81a222f34144a1e4bdc396ddcb155837941e4ae747c83cec127fa2bce2de042e5cf5e546c10057
TLSH
T10821C8E5E6F120F495AFDB0B9A83B11FCE2D1260C11A747860FEB68021A60254356E71
MD5 SHA1 SHA512 TLSH

Submit Download

z==1.2.0&&2.0.13_1787673300319_emNmZw== .log

Path /data/data/com.vpn.lofun/files/.envelope/z==1.2.0&&2.0.13_1787673300319_emNmZw== .log
Size 287B
SHA256 5c8488f09a7f7e4af7ab8f70ebec73eaec6ceacc29cb182e4a47978fc95b0bc3
MD5 d99bb56cbcd7e9fc99457e90651b5918
SHA1 be046b276b9ca104aa6ece06003aada9cb0d1c3d
SHA512 2ccd4d5b1bb8a982b2d6b94f54800bc3ff5d73c527f89107b5950f9fc1985a9064f1f67e9b97b2f7196827e126af18620864c233f73431501a657dcdbf7442fb
TLSH
T189D027C811540703D7AD1E05E5C4903601143B554FD653DE765FF38943DDD644355DF1
MD5 SHA1 SHA512 TLSH

Submit Download

.imprint

Path /data/data/com.vpn.lofun/files/.imprint
Size 91B
SHA256 be0f94fa47f6ff685950c8800e1671118c69931e50ebd25d74b398c0d9cc7f71
MD5 75b8c549af2f4474278d80dd63d83ba6
SHA1 f01d8058f7aa74a048ff1cd13d84c377fa507e07
SHA512 f831450ee29ddca5959d6fdb0c7ec6655eb5e3e8435cecac6cc78b9bceed6b16dea2aeb43292e39a95668b7b6469742ae0c55b874074ac54c4d97708d0829edd
TLSH
T166B012E03D2652B1554D491C1AC4CA1152F3D10640403338791090605227944761E214
MD5 SHA1 SHA512 TLSH

Submit Download

.imprint

Path /data/data/com.vpn.lofun/files/.imprint
Size 239B
SHA256 1cd0ab51723ad87760c2335f5e805516b3508e77b281f7a8d40fc9d1cd1e3d85
MD5 be36b11e624d508bb4826cb0a0dc38ff
SHA1 6efbe3ffcbfd0136bef678ead999d4257b15dc3d
SHA512 4bede9b37b7399cbb65158f09fbdd71ba3212c9ba40231aeb3d3821e1ea9e641657124d414ab5574f63cb4cd7f773cee226992d17536e8dfc766564820729e48
TLSH
T17CD095E1797481D4610D8B8010D6770D43149153F80059659C515E511715EC77C3D514
MD5 SHA1 SHA512 TLSH

Submit Download

.imprint

Path /data/data/com.vpn.lofun/files/.imprint
Size 330B
SHA256 970a34f8ecb9f0b3a70c1cced06a619a628a97599c2c5736de40b30ce984c39b
MD5 4521bb037d0e9adf7119287af5c99bbe
SHA1 6cdd6734cf37295b79df8254f9eebe80ce9adb8c
SHA512 5d7b56a18d8d5b9f2ec5a0944cf9faed2828a3254370215c951a75c2432ea40bca5821ba9c2913dabf508c7bbeb5471293eaff501c2c8688862fcf176984cdfb
TLSH
T151E078D569F481913E4D574401C3E705135852529C00C4355EA3ED415777C4E757E914
MD5 SHA1 SHA512 TLSH

Submit Download

exchangeIdentity.json

Path /data/data/com.vpn.lofun/files/.umeng/exchangeIdentity.json
Size 162B
SHA256 5f7c2c3479d4f17c9bd077be19240ef9d060e37604e4d0b847347b395e01ffb8
MD5 b7d817456c25fd5ba20785f5d8f07208
SHA1 9c6582dc06e9049878c52e23fdbeb5769712efa1
SHA512 e3fba6e34b55e3e6b4615019c652121a89ad6f19e2e1488f9cb1732187585318880a3c4f971e4bd3bba23462b9633bf5a8185ae569f8cdef4b3397c173d0716d
TLSH
T1AFC08CCF81A1DE10092E4A06848A9A352699B9E1CEAD78C54986B789CA898651362112
MD5 SHA1 SHA512 TLSH

Submit Download

exid.dat

Path /data/data/com.vpn.lofun/files/exid.dat
Size 54B
SHA256 907189c8dc45bdcd6c917a1c23ce1b90fe62cf66a7fa70b0a12029851bfa08dc
MD5 7d574f8e603d4f09a29f59d398bd2161
SHA1 850f67cf31883a0226c23244f6fc94d32164d274
SHA512 721e9c23e12af4ce4e81bd6a8e18a60ffefb6fba494ea6e3c841278f67c794b856f9ce0815d0617de1255f56231a6809061f605e989c346ab46a3c77106e3de6
TLSH
T12A9002C7D49EC5716215E48B1E8B986215F965E38D6A6512405C1140D0958054044515
MD5 SHA1 SHA512 TLSH

Submit Download

umeng_it.cache

Path /data/data/com.vpn.lofun/files/umeng_it.cache
Size 285B
SHA256 a53b8f2734eac6a74a111b3f7c521648f1e9aa5e82560792723c99387a08650a
MD5 b38210e485d1931a99a115c2941b1ce7
SHA1 dfa8345b672f643a0aeb43ab1f6c23b8fed686a7
SHA512 d2db81c535c9a48aa591abd5c5900ec7b388c70456906ad45121a2b21d7e8b9d13ba3639dca6a17a92c8dcda5ea7474ed459bca1dc053b2615cf2ef619cc9338
TLSH
T169D0C21EC29472CB694C9EE9234C1C0F5F4D20BCF02809D0FDB0E7D05629A80AE90D08
MD5 SHA1 SHA512 TLSH

Submit Download

umeng_it.cache

Path /data/data/com.vpn.lofun/files/umeng_it.cache
Size 145B
SHA256 85fccd090bca1f0ae49f3a453baf9fd5297ffb5a30c56f648f581cf74d8d8cfe
MD5 e10cf517db2c2568b4da6a3688ec85b2
SHA1 25884c1ec09ea3b185ef9712a24b33b393f23670
SHA512 936f66c19cbeb167fa6bac1c218229a47cc400e9066fde7f82a76c05062b9618fb0f339825753d2453a83f3bc2118941571982f9c2a550e6a06b270d2a17d3e0
TLSH
T144C02B2EC25471CB6D4C4EE4334C5C4E5F4C20BCF01009D06C60E3C0067AD80DD80C48
MD5 SHA1 SHA512 TLSH

Submit Download

gfwlist.acl

Path /data/data/com.vpn.lofun/gfwlist.acl
Size 116KB
SHA256 b40ccc93bf545b4c2b7143c09c8c3bfa6c82ac00638fc6e979e96a71fd2c978c
MD5 9ee1d0fadb81ef6f1e3fb3f8c2a28edd
SHA1 ad75dc9cbe69357bac1305a3b9daf95c06d5aaff
SHA512 51129dd92a7491f40518c3c4484d1092fa6faeadb92caa2343fac85269c1aa182063af3f672e190beca71091a980e7d6077f4c0cbb3acb90f7ec0a314ca5c81d
SSDEEP 1536:EmBQ+hNmkg+qPUe7IpPrP98BR1UVxsaChjbryfiogwPnXSJo8O2pr2cSQziI:EUTNYb+E1W4r2ho
TLSH
T1B6C3B7B27FD0E770F64FCCEF652F0A485D2316B18854FDE262A6620801A6B57B57F092
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Mobile v16

Replay Monitor

Loading Replay Monitor...

Downloads