35c8c95c7f72872e733dfd29280df12bfe9950a760d2a346f4be6c2e399e5a4b

Analysis

user interaction
yes
max time kernel
225s
max time network
304s
platform
android-11_x64
resource
android-x64-arm64-20260325-en
resource tags

arch:armarch:arm64arch:x64arch:x86image:android-x64-arm64-20260325-enlocale:en-usos:android-11-x64system
submitted
25/08/2026, 15:54

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
35c8c95c7f72872e733dfd29280df12bfe9950a760d2a346f4be6c2e399e5a4b.apk
Size 43.7MB
Sample260825-tccyqsbr21
SHA256 35c8c95c7f72872e733dfd29280df12bfe9950a760d2a346f4be6c2e399e5a4b
MD5 ce49a90c0a098e8737e266471d323626
SHA1 41c4ae3e0c26cabaad90f96eaa6a6ab688560b77
SHA512 a7ef1bbc1129ad1701b5e15a208b8b868ddc7edf2d540b68a35427e2eaedf1e76807f1369ca80691a99312c417e25d0914a5f46958acfeea4df7e45a0fc639f1
SSDEEP 786432:mYkcVVbGRRqzSxmxoFV+I2M320poUNZddKWsAdQeizWy/MlaGVq:mJcjGRsWQPM2kNtHQeizWy/I1q
TLSH
T10DA73386F39AF0AEC9B3803B8B7B176413A14C8AC596CA335165F29CDD779805E44FD8
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

defense_evasion discovery impact

Malware Config

Signatures

Checks if the Android device is rooted. 1 TTPs 1 IoCs

defense_evasion

System Information Discovery

T1426

ioc	Process
/system/app/Superuser.apk	com.vpn.lofun

Checks Android system properties for emulator presence. 1 TTPs 2 IoCs

defense_evasion

System Checks

T1633.001

description	ioc	Process
Accessed system property	key: ro.product.model	com.vpn.lofun
Accessed system property	key: ro.product.device	com.vpn.lofun

Checks Qemu related system properties. 1 TTPs 1 IoCs

Checks for Android system properties related to Qemu for Emulator detection.

defense_evasion

System Checks

T1633.001

description	ioc	Process
Accessed system property	key: ro.kernel.qemu	com.vpn.lofun

Queries information about active data network 1 TTPs 1 IoCs

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.IConnectivityManager.getActiveNetworkInfo	com.vpn.lofun

Queries the unique device ID (IMEI, MEID, IMSI) 1 TTPs
discovery

System Network Configuration Discovery
T1422
Reads information about phone network operator. 1 TTPs
discovery

System Network Configuration Discovery
T1422
Deletes files using the built-in Unix rm command 1 TTPs
Android's native rm command removes files and directories directly from the device filesystem, which can be used to erase artifacts and evidence left behind by intrusion activity.
defense_evasion

File Deletion
T1630.002

Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs

impact

Data Encrypted for Impact

T1471

description	ioc	Process
Framework API call	javax.crypto.Cipher.doFinal	com.vpn.lofun

Checks CPU information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/cpuinfo	com.vpn.lofun

com.vpn.lofun
1⤵
- Checks if the Android device is rooted.
- Checks Android system properties for emulator presence.
- Checks Qemu related system properties.
- Queries information about active data network
- Uses Crypto APIs (Might try to encrypt user data)
- Checks CPU information
PID:4800
- sh
  2⤵
  PID:4836
- - id
    3⤵
    PID:4857
- - killall ss-local
    3⤵
    PID:4875
- - rm -f /data/user/0/com.vpn.lofun/ss-local-nat.conf /data/user/0/com.vpn.lofun/ss-local-vpn.conf
    3⤵
    PID:4893
- - killall ss-tunnel
    3⤵
    PID:4911
- - rm -f /data/user/0/com.vpn.lofun/ss-tunnel-nat.conf /data/user/0/com.vpn.lofun/ss-tunnel-vpn.conf
    3⤵
    PID:4929
- - killall pdnsd
    3⤵
    PID:4947
- - rm -f /data/user/0/com.vpn.lofun/pdnsd-nat.conf /data/user/0/com.vpn.lofun/pdnsd-vpn.conf
    3⤵
    PID:4965
- - killall redsocks
    3⤵
    PID:4983

Network

MITRE ATT&CK Mobile v16

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Indicator Removal on Host

T1630

File Deletion

T1630.002

Virtualization/Sandbox Evasion

T1633

System Checks

T1633.001

Credential Access

Discovery

System Information Discovery

T1426

System Network Configuration Discovery

T1422

System Network Connections Discovery

T1421

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Data Encrypted for Impact

T1471

Replay Monitor

Loading Replay Monitor...

Downloads

bypass-china.acl

Path /data/data/com.vpn.lofun/bypass-china.acl
Size 198KB
SHA256 ca23e4ac7900d90781749447a26555431aee3422454175efac45a92e0c47f64e
MD5 0f998459988dd814771a6a80051c3a06
SHA1 8be300862f840f88ea78c739ceecb9649edc054f
SHA512 153b39ba7fc61dca92091b60084bf4f4be6792498c694826e309732c4e8547e89f81183b5379889198c8f3a7b1e09f48aeba879e462f4eda18a89dbf07c3d60a
SSDEEP 1536:hjxFKFhuNc4imBQ+hNmkg+qPUe7IpPrP98BR1UVxsaChjbryfiogwPnXSJo8O2pF:2UTNYb+E1W4r2ho
TLSH
T1C81464712FD4D7B4F18EEBEEA2EF4624396712F244A0FDE07B9B23101506643B96E851
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

bypass-lan-china.acl

Path /data/data/com.vpn.lofun/bypass-lan-china.acl
Size 198KB
SHA256 c773beeeaa2ad45e6dcc3a32b0fc2a258d880a6d2d012611665b175539fd96ed
MD5 7fffde3be1e1a3e239f2900b3d92e509
SHA1 2940b5585ff5c1cd249ab96427d219cf01115320
SHA512 cc8c3ac97f8cd129c405d6221c4c57181b3d1c378c638e1edb85a6631497567c9129665a5348e15b2800e234dff83ae9bd5b6a5785ef42800404475aa99b611b
SSDEEP 1536:vjxFKFhuNc4imBQ+hNmkg+qPUe7IpPrP98BR1UVxsaChjbryfiogwPnXSJo8O2pF:wUTNYb+E1W4r2ho
TLSH
T1A01464712FD4D7B4F18EEBEEA2EF4624396712F244A0FDE07B9B23101506643B96E851
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

bypass-lan.acl

Path /data/data/com.vpn.lofun/bypass-lan.acl
Size 264B
SHA256 0864047518157be4ecb8807c6036e3f378ca985144e137939c2554611da4e335
MD5 fe97ae180bcdb14b4479af1a53fe7542
SHA1 998022b6cf5903ba403f89de46027dddea2de24a
SHA512 26392758104bcfb40eb1f570973302db11e435bc37c3cb4b93645b260945ee1a7556bb804368722c756360109cdce9dd4741efe850fca8262131da695c16f13d
TLSH
T1ADD05E24354C11F0CC85B7D3A0EFC234F58A408721F2B504435FD1204D01948741CE20
MD5 SHA1 SHA512 TLSH

Submit Download

china-list.acl

Path /data/data/com.vpn.lofun/china-list.acl
Size 81KB
SHA256 df81788859fc6158eb3562b6366a0bdbc649e874d7acada39545af94dc56bc31
MD5 addb0e4c9fbb673d72681df80a0d9c54
SHA1 59c7450dc79c5ceae0d05834489d364e85f3a368
SHA512 f26e4ec049fded4451a515aa436f3663830004e4467d412c72f55df62dd136c34e628dda1f3cd49d58f3bba8161b127f2393fdb0c322b0edec07e810b9440906
SSDEEP 384:DFPRL6ktky6Vc/CmmOR3xMUSRE+thfNx2AjA9xKvG/EpO1Eu0H/gVyC0tVHkFScZ:JHjOxPXjVkFmRZWkTFrdlDGn8IBAXt4H
TLSH
T1D683F67513E92AF895C0F3AAD3E786343DAB15DA51E6F1A0BFEF23605D07081BA54D20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssr_client.db

Path /data/data/com.vpn.lofun/databases/ssr_client.db
Size 24KB
SHA256 10b819ec1aecb0c932944b9f0419e169f5422d69deb0f7d70472839c9afe016a
MD5 de621219bcef3cc4243813a709e86f02
SHA1 90674b338f0d096371c77506af72e8e71a86ec38
SHA512 21eaccb69001f0f8c3423a56688b7a7f48ac46e0dc501bc20f9d6e43d58cc28055712f07c9800a00595306dd2e09a080485e000da7b5b4d0ac03add3839eeb34
SSDEEP 24:TLAlDaiaolS0RiYvivlXPaoloVHB+0dQHVl19CAU6NUdGSzGQ:TAxzlTiYKvNpEQHVdCl6aIS
TLSH
T181B241FA4EA03B28C600687A2E2233B2407F6E6E8573A7845DB450233C63570F6209FD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssr_client.db-journal

Path /data/data/com.vpn.lofun/databases/ssr_client.db-journal
Size 512B
SHA256 da647857418f4f51882e01961b344970c55ec83a042ed3e205321192f29bfe71
MD5 9a0d03221416427ac7845a9de203d18f
SHA1 d800ccd668e74e478ae56ea531abd62921d3b6ad
SHA512 b8c0831b0883e58bfe58f0c973e7ada8326c0a053e73cf0b26b360a5b9233dbb0ffb2c14962e6fa632ebaa7ff8b39a2aab19760da364bd36c18ac215c8c1a34b
MD5 SHA1 SHA512

Submit Download

ssr_client.db-journal

Path /data/data/com.vpn.lofun/databases/ssr_client.db-journal
Size 8KB
SHA256 ab9a322a44fa141c3713fdd7437376e8e5470c55fa57294eeffbccb057063a31
MD5 ed72a0e0dceea1dc07e318051b0af0ee
SHA1 9a1313d34dbb598d0597fa0ba10c2089bb982beb
SHA512 53e543b6b86a5438fa24541dce51f9ba9a08782ab45af9b72d873c3089849e36d48f377ba05611d63296f6574eb610902a3221a61681c771fc194cff8dd842ea
SSDEEP 6:7+/l96f/gn1Ang9bNFlEuWdN/kPlOERX4PBX4ogLugMBX4suuK5:7+tgf/NnqLiuWdYRmBEyPbC
TLSH
T1F702C08C67800813C83D2AB794D483582D00EB6881F1CB1716D00C9C3C8B4CCF4A0F05
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssr_client.db-journal

Path /data/data/com.vpn.lofun/databases/ssr_client.db-journal
Size 8KB
SHA256 703d47d4ca87e60332ce8dde5f303060355158220e657b36d84e45bb25f0ae70
MD5 306e12ead935866ffb01540c833c94f4
SHA1 62c19e582d0b68f4121a9e6c69416b82aea5028a
SHA512 f3dbcae1d66277b9bd29c09915e22080ea0d3a5a96c119a37819ded6c03f87d24b6f07d9bcde68c9a8eef660e3dbe6d3309d164b0ad36c24470825b9f6ceb806
SSDEEP 6:7+/l9BLmHPg9bNFlLde/kPlOERX4PBX4ogLugMBX4suuK6s//5B:7+tL4qLJdeWRmBEyPbjsX5B
TLSH
T1B102808967810913C52D577BA0D983542E25A7299373CB5B169309A47C477CCFC94D54
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ua.db

Path /data/data/com.vpn.lofun/databases/ua.db
Size 40KB
SHA256 47c718e57110d629fe8e4d5c2a3004dd2bf7b4686392336ddb994d5a538811f9
MD5 cca82db4e111e1495599175d4212b733
SHA1 3c4ce2b8d08cab6fd182995c62a93e3e2e6d31c8
SHA512 f41575c55d3c0c72160ab7abf791be19c9d228b6ea03f9b55e276e89ae902d784868e2724901652eab80e7705e0b505dfed36de09f2e1619032ac3f6b55f5b8e
SSDEEP 24:TLBqRrL4PDiP/b+cLglJWcKbEGSvXR4Rvv8vWFJY789x:TspwDeT+EsebTS52wyW8
TLSH
T1360311D7731812A4D518A136D8A3E3204BBD1D1E86DA5BB757B104D2BCAB640B838DAD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ua.db

Path /data/data/com.vpn.lofun/databases/ua.db
Size 24KB
SHA256 cfecbfc7b2508831c620a992ea68bbb37004ac91f52591bad6339e8ce58c7857
MD5 c95385d6894ef78e3ca5073fed5e9f4b
SHA1 2ad5523414c5affb93eb05d2e613e0490caccb75
SHA512 b51e09bd58cc8cd97221c7a6821779d06f379628a3cd3ec25d6d1a1a72c9a58836fe542dc55a74f01d5c278cd4fbfd9b78ad143fc431bf1ccce79f9ea230458b
SSDEEP 24:TLdbqRrL4PDiP/b+cLglJWcKbEGSP/T1PxU+LcWGQ:TJepwDeT+EsebTSP/TL/L/
TLSH
T191B2EFC7F51822D9C158503BDC63A22259BC2D2E96EE8B751AB100D2FDA7600B07EDED
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ua.db

Path /data/data/com.vpn.lofun/databases/ua.db
Size 32KB
SHA256 f79c43d6ad64483ef8d9bfaab43765ac022f66f03b18449e43e649b215568538
MD5 fec681b7a59702dfe949324369d3e727
SHA1 5e5d2ba20abca2aa482b10eb8af74482061b3f00
SHA512 a644f5a16e109108095c662642664d2bfaafe3b6d327bd26597481e5b1fef38adf59f1b4c85f4cd06c1f13661bf85ca7180de1ff90db0d8cc719a6ad148cd4eb
SSDEEP 24:TLhqRrL4PDiP/b+cLglJWcKbEGSP/hv0Gq5xU+Lcy:TMpwDeT+EsebTSP/hOH/LL
TLSH
T1FCE2C0D7B61C22D9C158503BD8536222597C1D2E96AD9B761BB100D2BD67A00A03DDAD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ua.db

Path /data/data/com.vpn.lofun/databases/ua.db
Size 36KB
SHA256 5df46bbcaba58d4454bcfd1db3516d1bb20e45e1013927075a4956cff85f488b
MD5 d188460cdddf3ba48e62e026c8e338cd
SHA1 2e6201ced42ad1821783218133a5698c258d645e
SHA512 2f72fb51bdcdb5040fb3501af84dfb508595722c6592c109083516d2f56c9f4d35a4dfa88785f85643dcd0770f16905a5403c48f8906ccb7952211d9e8ee784a
SSDEEP 24:TLxqRrL4PDiP/b+cLglJWcKbEGSP/BpyR4Rvv8vWFJY789i:T8pwDeT+EsebTSP/s2wyW8M
TLSH
T13BF253D3B20813D5D518A036D8B392204ABD1D1EC69B4BB75BB104D2FC97600B029EED
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ua.db

Path /data/data/com.vpn.lofun/databases/ua.db
Size 32KB
SHA256 0eebb88447cbda8f824d691e1747d59e7d0c135f1bb67f4283e85d816bd3b73b
MD5 3fd40db7a61c7aec3200867c0e90c747
SHA1 3fe98b20ad0c42bee40d215bb47d57cd4e10e197
SHA512 a2f1002d7c9dc5325736ea1e5d5be833ce39e007a8443c03583440ae34d9fd3f505c54f9a1b26600f64f34ae28915c4caad87f438f0c286c0aedb6556e630f90
SSDEEP 12:TLBSQwRr+o4PD65N5PPJhb9gBcIkJbglTSF7VAWWpNtI7MJ+bvRmBEyPbP/W:TLBqRrL4PDiP/b+cLglJWcKbEGSP/W
TLSH
T1FDE2DCD7B11C1398C22C5037DC6791211A7C2D5E96AE8BB61AF100C2FDA7A00A03CDAD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ua.db-journal

Path /data/data/com.vpn.lofun/databases/ua.db-journal
Size 512B
SHA256 b662a969b21f2a7fbf35ee280e49c21256a6504e758036240e2fc0dd1b4f3414
MD5 42d11a680f5527dbe17d049e48050f31
SHA1 4771f59c997ee3009f39db67791c7bee37e0f574
SHA512 f0d9ad48b3252e16ff322c779370507dd5f37af9b476c9f561537326a90c9016b5a45c4d2e7ea151346d32cf444aaf340612388f38619c61521f609ebe77f647
MD5 SHA1 SHA512

Submit Download

ua.db-journal

Path /data/data/com.vpn.lofun/databases/ua.db-journal
Size 8KB
SHA256 7e9d4d2867a3d52f4959ac0964a8c800e860e5e5100891fa0c2cf71a346b8a90
MD5 c9e22ab9a40347361cd7d8fe3c4cb4b9
SHA1 2813575ca3bbc9e12a40874bea3708a76a6894fe
SHA512 cc48a5f8d94a339bf42688a00a0b60d576529ef891f1f198f75a913448aa2ef897205a45288e3b49cf87d5f6cdb36bda5d0dadaaf10b3037d4238234c2f659ee
SSDEEP 6:7+/l9nkn17fg9bNFlEuWdN/kPlOERX4PBX4ogLugMBX4suuK8vZ:7+tFiqLiuWdYRmBEyPbP
TLSH
T1E602C08C63C01C13C83DB77F90D683400D80FF299171CF17269008947C075CCE4A0D28
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ua.db-journal

Path /data/data/com.vpn.lofun/databases/ua.db-journal
Size 8KB
SHA256 d61ff4dafce605edf9c654adac5cb115e330f0615fd3c9e39c776eb09fc792b0
MD5 ccd00e0fec18ba11ac33d5dd388abb75
SHA1 f6c6e8c145b9a7fbb6ab9ad71458fadc05579009
SHA512 139456bb5735cd4a36379674a65f82f36ec2732903c87cae95feb9eed3bf1447b0151b183d865570d6170fafd2f8ffeaf09b460afd0f628626e2d5c149e475bc
SSDEEP 6:7+/l9lFPg9bNFlLde/kPlOERX4PBX4ogLugMBX4suuKZd8t/G1:7+tDBqLJdeWRmBEyPbL8
TLSH
T18602228C63420803C02D177BA0C883401F10A7399363CB271A9108943C0B6CCA8A0DC0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ua.db-journal

Path /data/data/com.vpn.lofun/databases/ua.db-journal
Size 12KB
SHA256 790409ac152cbf5d909338d11a767f383f9e03c1f5e7210740bfe0ca70aec8ba
MD5 31d1df3bd7585fcfc3e7f6540812ef24
SHA1 6a4f063fb149d6439ad0a19247573481734f5594
SHA512 ee022ffd55cc11f9f5641573559a319e948adc6e2f3d208535d0ba0122cecf152228f7a42966b75d9ee9403012f0cd6cb0e6243311a529ec76dfaaf8d7094969
SSDEEP 24:7+trhwqLxqRrL4PDiP/b+cLglJWcKbEGS8:7Mrhwq8pwDeT+EsebTS8
TLSH
T1D642BDDB721D13A4C21C5037DC7791211A7C2D5E96EF9BB62AF100C2ED97600A07CDAD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ua.db-journal

Path /data/data/com.vpn.lofun/databases/ua.db-journal
Size 16KB
SHA256 9fda8a2a7eea547bef541c96722feb15cd0fb5be80618f797c680189211b2c1a
MD5 a2b5d43a4b3166743e0541ea59a7b3c1
SHA1 af6fd5491fd2ccdd452b6b75fd694130091d9730
SHA512 643eabbb8acfacf0fba51aecbc9e096318cdcd24d0db8cc3c427a88d7c23687f800640a3dfd0b0c1a1a72faaf0fa14c60f3a64a5519b14395aacbdceb53d9bb1
SSDEEP 24:7+t16o/pqLBqRrL4PDiP/b+cLglJWcKbEGSl:7M16gqspwDeT+EsebTSl
TLSH
T18E729ED7711D13A4C11C5037DC67D121197C1D5D9AEE5B751AB100D2BD67640A07CDAE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ua.db-journal

Path /data/data/com.vpn.lofun/databases/ua.db-journal
Size 16KB
SHA256 f1e74197cb94b344ce661fbedd768a1f0c6740ea3ca1a9c9ce50f34da66e5c14
MD5 cb7662db3cafbc4685acae992720a1fa
SHA1 20be0202c626082b30c9a880f64ed8fa561b0003
SHA512 6b622f5a6602247d919a9b23a85ec7b9eec86b8e225100e3c515d81cfec0f2a3b00d579fe59bb7a5db00c5e3898dc8791657198dc47416e2084ef35406b2ef33
SSDEEP 48:7MKHR8LYq8pwDeT+EsebTSPbqJepwDeT+EsebTSs:7/es5pwyiERbWPbZpwyiERbWs
TLSH
T12072EED7B11D13D9C2189037DC67A221597C2D1ED6AE8BB61AB100C2FD67A00A03DDBD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

umeng_zero_cache.db

Path /data/data/com.vpn.lofun/databases/umeng_zero_cache.db
Size 20KB
SHA256 5617afb521e54443ab321ab6cf0f7ca6641c040975dfcf30248684d0940200d9
MD5 be6c792b8a6a5c290b97626af17dc49d
SHA1 239f8716cf8c6f31952a3002a58f6220df353227
SHA512 0c96823118cf7ab65091f884f1b22beaedad21c150a23582ec21bed48caee5c8186f9847dda661f66f229cf9366f4286ec5a03c32d4310855b2c4df54513c533
SSDEEP 12:TLmaMWyNTSFbyEKMFUvL9TtL4+qRmBEyPbAVOwG:TLXw9M2xTtLlGSEG
TLSH
T1D492ABC7A7801386C60D45B1D8BB73A109B0561EC3958B977AF214809C43AC854F2D3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

umeng_zero_cache.db-journal

Path /data/data/com.vpn.lofun/databases/umeng_zero_cache.db-journal
Size 512B
SHA256 cbabdb305d0a4127ad04fc067bae0cb38f5897a93eb8c3a18ee082b9a140c500
MD5 30e3c03117f16318b467b05d93c45e5b
SHA1 56fa08d7bcd040d2b34f96f8fd2f0ca2eb9268fd
SHA512 1496d93822d36d596f62e1915ffd5b9c06ac32277f0e31577d8b4a858a4c3535c12470e718fbc3f15bab3e6910e6598aac681a087db4462dd4c4abbbcf533150
MD5 SHA1 SHA512

Submit Download

umeng_zero_cache.db-journal

Path /data/data/com.vpn.lofun/databases/umeng_zero_cache.db-journal
Size 8KB
SHA256 10a9251f97118a4297820533392628c9594729c969b88df4bbf32ff2839b5c6a
MD5 04b3f5cdf225777c9b7ac24cf559ccdd
SHA1 3686d6eb875c314d3f93d08c0b500a67e314d8c7
SHA512 dc813a436e5feecc154c9c3a56e3d34bd4968b8ea6c6bd4a3e667036f8bc58be33429fef373b1b6823111f451058166d7a6ca3ca69f7bb2d03b4ac20d1c1255a
SSDEEP 6:7+/l9Li9n1bg9bNFlEuWdN/kPlOERX4PBX4ogLugMBX4suuKU:7+tpiHqLiuWdYRmBEyPbD
TLSH
T1C102C08C63C90D13C82D567794DE83803E42E7388171CB1717B0089C3C0B9DCE4B1E04
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

umeng_zero_cache.db-journal

Path /data/data/com.vpn.lofun/databases/umeng_zero_cache.db-journal
Size 8KB
SHA256 f155689014e6e6ca9eba2591bf83adbd7f43686c80885d5fc499a25cd1a87992
MD5 2b44c225e0ed61b5edf8daa3119a32de
SHA1 518a1843e20e3dc4865aa38d5b24fcf0096cee3e
SHA512 a0ab2b3f17b94ab6e94c5dd8a4356016daae2f2594a6080e17b2596f26a064a30e48e1e8481ae7b5a0b3198bb12cbf2df0fcfa451b81e39951a4013e2f0d8233
SSDEEP 6:7+/l96NPg9bNFlLde/kPlOERX4PBX4ogLugMBX4suuKkK//SW:7+tspqLJdeWRmBEyPbfql
TLSH
T1260222CBA3400933D02D1777A0C883401E10A728E2A3CF8726A508A46C06ACCB8A0D00
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

default-server.acl

Path /data/data/com.vpn.lofun/default-server.acl
Size 149KB
SHA256 ea782bf9398be26029b18eff89b6bb81197f71e1afa8046cb61614f9d3edd96d
MD5 dc05f34f4d07c4df3646e9faea3eeffd
SHA1 ac161b4f5194c1b737a20262b3e76b67a2cfe5c4
SHA512 5124226fe029e4c7595c167da71aaa2f1f3e9e11be0761a6e8ccf153a4a39940855c191d4aca5e20f5c0917cb4758fce437fd20864d3d6aca336ec8f37663e2a
SSDEEP 1536:TYyGynrt+q7D53Bxe6YIyi24GD3ZpAeXwJG/8RL68F6T9yKJff1LWg:ywt+ITe6dvATKg
TLSH
T13DE377341BD9DBF4E589FBDE93EF813439AB11E610E5FDE07B9F22605906282B95C810
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i==1.2.0&&2.0.13_1787673303212_dW5pZnlfbG9ncw== .log

Path /data/data/com.vpn.lofun/files/.envelope/i==1.2.0&&2.0.13_1787673303212_dW5pZnlfbG9ncw== .log
Size 1KB
SHA256 ae707c4dd3772134d5b3dd939e151d6bdca03a0cbc36f37cedca0c34d390bd3d
MD5 7e54a296bd0b7d3fef2f9b6a8c5cf495
SHA1 060b1d081730cf53d55c7b300fc6720d599dc2c9
SHA512 d9cdd21d34396c54da43dae0aee94b53ce78b7ab58dfa69b8ccf64b4d7fca0a077886702a79d45a4a6079fd6f6436adc4c7cac06405c9d022965c24bc4f391f2
TLSH
T1D83119BD99A84709FCF267114E86E031148E91BB2E9F53524CA71F6DABF561042B0F50
MD5 SHA1 SHA512 TLSH

Submit Download

t==9.4.7&&2.0.13_1787673303286_dW5pZnlfbG9ncw== .log

Path /data/data/com.vpn.lofun/files/.envelope/t==9.4.7&&2.0.13_1787673303286_dW5pZnlfbG9ncw== .log
Size 1KB
SHA256 6152b2c6434605cc28a6e640e08e5643cdccb66ff75d8680b12f8fd5695ba10e
MD5 fef81829d7aa220aaca96e0b650bf5aa
SHA1 ae88fa3e25b071ba4585d56a94ae08f1d4536419
SHA512 78fe90d90dece31b5d086e63c487c4bb9c912920f92ef448f9af5644d5fee60c91a21a008c8a8dd86fab78ba1397419ac9a8af5dc4fc8de8a58562369f625598
TLSH
T1812198E670F31B1D270AC256150D387B2A1A5AA109D8E3A94A15ABFDC34A640D3547CA
MD5 SHA1 SHA512 TLSH

Submit Download

z==1.2.0&&2.0.13_1787673301180_emNmZw== .log

Path /data/data/com.vpn.lofun/files/.envelope/z==1.2.0&&2.0.13_1787673301180_emNmZw== .log
Size 287B
SHA256 48265c27dbdd0e487193840d085a4d7aa33dca9f9941ba7bc744a870aab2a606
MD5 bcd57daae532744cbbe21239d19bddc9
SHA1 21d2ec401e43857ca9af74255a92937dcea4df9f
SHA512 427d9f6c505f91304022801b3d377df23c13caff368069ba1793cccc755b888c31b075fc1aa2a7ca9c2508f524bc16d08ac95a37a6322f6c9689a40b08fd588f
TLSH
T1DCD02BD43542174791E86B072B4490B3072539499DC6A7FE2E5BBB8D834AA018369ED0
MD5 SHA1 SHA512 TLSH

Submit Download

.imprint

Path /data/data/com.vpn.lofun/files/.imprint
Size 91B
SHA256 be0f94fa47f6ff685950c8800e1671118c69931e50ebd25d74b398c0d9cc7f71
MD5 75b8c549af2f4474278d80dd63d83ba6
SHA1 f01d8058f7aa74a048ff1cd13d84c377fa507e07
SHA512 f831450ee29ddca5959d6fdb0c7ec6655eb5e3e8435cecac6cc78b9bceed6b16dea2aeb43292e39a95668b7b6469742ae0c55b874074ac54c4d97708d0829edd
TLSH
T166B012E03D2652B1554D491C1AC4CA1152F3D10640403338791090605227944761E214
MD5 SHA1 SHA512 TLSH

Submit Download

.imprint

Path /data/data/com.vpn.lofun/files/.imprint
Size 216B
SHA256 a177414421ee5d37d183150ef8f56dc48719ecdab67630460cda52aa54268e76
MD5 222a40288ec7741d42af72cf60a7913c
SHA1 9ca3523e15275db0b77fd189976250210a5f1334
SHA512 dd057be5087d52941c2852a9adb26f0b1147bec1c4b5341265d3e2f82d8361994307c9ade9226e779fc592df397f971a4e9c23bd857e7a381da7f342a664dca7
TLSH
T173D0A7C13C7582704409DD4019D537248645A4927562693DE82536E0476BF9FA13E848
MD5 SHA1 SHA512 TLSH

Submit Download

.imprint

Path /data/data/com.vpn.lofun/files/.imprint
Size 307B
SHA256 3504d7d1cf5132c7e3f841de910ee50dfcfc44572121d87b6c63cb3b4a3c538a
MD5 72645754a7a1b2258d2817b06c8abe09
SHA1 0543aadb96e8c77f8b835e5a3b93dfce622e713b
SHA512 f162758133d7c4c9d9190e9956bf0560ed30cabf1746653f14440e85b8febee5ea9303aa799a6193e60b1e08fe028089a63953bf10fcd8210e25d5f8f7e1776a
TLSH
T150E07DC53CB041643D0DE74805C36710735834125901662D9D66BAC1A6FBE4DA59EB49
MD5 SHA1 SHA512 TLSH

Submit Download

exchangeIdentity.json

Path /data/data/com.vpn.lofun/files/.umeng/exchangeIdentity.json
Size 162B
SHA256 4c158b80257637da2a6b9b7a7ff9e1cbc6753669db2cb9bbf5af052e087a0ac2
MD5 cca1f2c6e867068b026a73173da8f5bb
SHA1 5fffbe791b825ce7c77c8cf155dcdae496ba9147
SHA512 b323c7052f37180d09c0c29cb6967cdcdc4ce21037bf2f10b74eeb90a0625e55f150279b2464790703e1522dffa5653423f83f4cea97eb0e51a287fa4dde0604
TLSH
T1B3C08CCE51A2C611060C930A060550721BAB09E21DCA99F99E82BA4E818D8156316A48
MD5 SHA1 SHA512 TLSH

Submit Download

exid.dat

Path /data/data/com.vpn.lofun/files/exid.dat
Size 54B
SHA256 907189c8dc45bdcd6c917a1c23ce1b90fe62cf66a7fa70b0a12029851bfa08dc
MD5 7d574f8e603d4f09a29f59d398bd2161
SHA1 850f67cf31883a0226c23244f6fc94d32164d274
SHA512 721e9c23e12af4ce4e81bd6a8e18a60ffefb6fba494ea6e3c841278f67c794b856f9ce0815d0617de1255f56231a6809061f605e989c346ab46a3c77106e3de6
TLSH
T12A9002C7D49EC5716215E48B1E8B986215F965E38D6A6512405C1140D0958054044515
MD5 SHA1 SHA512 TLSH

Submit Download

umeng_it.cache

Path /data/data/com.vpn.lofun/files/umeng_it.cache
Size 285B
SHA256 7662367a14cb359eaed35e5749a8b41c156751751af057eb59abb4c71aa28311
MD5 7d01fcf97fae7aa646456bb6cb340905
SHA1 427bf5df6989685cc3d90bac66cff1f81a7b29ff
SHA512 c14e59889e10da9fce18ac7eb2f2917681339a4bf8d4bccb6b28b3282d113b4f4c25d40b87812620b65c1815b197653e8f5571a2d500bb79f360d84ff7171791
TLSH
T145D02BF8356002D42C4CD9A1816A581ECF195891F62727A950742DC2F1FBEC0DB5CAD4
MD5 SHA1 SHA512 TLSH

Submit Download

umeng_it.cache

Path /data/data/com.vpn.lofun/files/umeng_it.cache
Size 145B
SHA256 0689e950de41fff5bae11178d2ac5f49cb9652acae334d08b68bf6476a4bc4f0
MD5 4fc8895a11c05ae3a01724dbf86e92e2
SHA1 0b36e610fb2a1366c2a3281316335d481725368e
SHA512 f4c92c947a93b2a6b83a4e4447be2813fa14a062b085eb45e62129fb749a35cdaa6586aa111a56fc456f20f145a04e27044ad4be85558faac1efe4686f7322f3
TLSH
T18FC02BF4352000D01C4CC9D08366945CDF1C1490E513176900742DC2B1FBEC0CB0C9C4
MD5 SHA1 SHA512 TLSH

Submit Download

gfwlist.acl

Path /data/data/com.vpn.lofun/gfwlist.acl
Size 116KB
SHA256 b40ccc93bf545b4c2b7143c09c8c3bfa6c82ac00638fc6e979e96a71fd2c978c
MD5 9ee1d0fadb81ef6f1e3fb3f8c2a28edd
SHA1 ad75dc9cbe69357bac1305a3b9daf95c06d5aaff
SHA512 51129dd92a7491f40518c3c4484d1092fa6faeadb92caa2343fac85269c1aa182063af3f672e190beca71091a980e7d6077f4c0cbb3acb90f7ec0a314ca5c81d
SSDEEP 1536:EmBQ+hNmkg+qPUe7IpPrP98BR1UVxsaChjbryfiogwPnXSJo8O2pr2cSQziI:EUTNYb+E1W4r2ho
TLSH
T1B6C3B7B27FD0E770F64FCCEF652F0A485D2316B18854FDE262A6620801A6B57B57F092
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Mobile v16

Replay Monitor

Loading Replay Monitor...

Downloads