d82e07019b8e2fc72c01274c7d50ad4504922d53cff503eac750ad79fbac81cc

Analysis

max time kernel
6s
max time network
152s
platform
android-9_x86
resource
android-x86-arm-20260325-en
resource tags

arch:armarch:x86image:android-x86-arm-20260325-enlocale:en-usos:android-9-x86system
submitted
12/10/2026, 23:04

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
jaffacakes118_not-a-virus.HEUR.RiskTool.AndroidOS.SMSreg.pf.apk
Size 1.7MB
Sample261012-22dwbsgt21
SHA256 d82e07019b8e2fc72c01274c7d50ad4504922d53cff503eac750ad79fbac81cc
MD5 431e833c27320babc202f60c862ba4ca
SHA1 5a072c9a0dd7d7f8705061ffef75f178751e618a
SHA512 28f4e623676039103b5eab52be38a1a14b8783583b232ccba4c26f7965cce841b17758ca7bd6d291a3796bfb6803bfda0902dac0f27ed33179b6da26ab01d5d3
SSDEEP 49152:Dok48xIE3uPnFqY/oU8JVEoDEHZXgWNzPY:ck4a5WnE4oU8flY5XgGPY
TLSH
T1FD85232BEA08C67BC1E37738755661CA33350E58A37622061225F2387BF76DE8B76744
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

banker collection defense_evasion discovery evasion impact persistence

Malware Config

Signatures

Loads dropped Dex/Jar 1 TTPs 8 IoCs

Runs executable file dropped to the device during analysis.

evasion

Download New Code at Runtime

T1407

ioc	pid	Process
/data/user/0/com.qaj.ioiixd/files/zon/XpmLgdn.jar	4345	/system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.qaj.ioiixd/files/zon/XpmLgdn.jar --output-vdex-fd=44 --oat-fd=45 --oat-location=/data/user/0/com.qaj.ioiixd/files/zon/oat/x86/XpmLgdn.odex --compiler-filter=quicken --class-loader-context=&
/data/user/0/com.qaj.ioiixd/files/zon/XpmLgdn.jar	4319	com.qaj.ioiixd
/data/user/0/com.qaj.ioiixd/files/Plugin2.apk	4464	/system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.qaj.ioiixd/files/Plugin2.apk --output-vdex-fd=119 --oat-fd=120 --oat-location=/data/user/0/com.qaj.ioiixd/files/oat/x86/Plugin2.odex --compiler-filter=quicken --class-loader-context=&
/data/user/0/com.qaj.ioiixd/files/Plugin2.apk	4319	com.qaj.ioiixd
/data/user/0/com.qaj.ioiixd/app_dex/utopay.jar	4495	/system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.qaj.ioiixd/app_dex/utopay.jar --output-vdex-fd=124 --oat-fd=125 --oat-location=/data/user/0/com.qaj.ioiixd/app_dex/oat/x86/utopay.odex --compiler-filter=quicken --class-loader-context=&
/data/user/0/com.qaj.ioiixd/app_dex/utopay.jar	4319	com.qaj.ioiixd
/data/user/0/com.qaj.ioiixd/files/yl_plugin.apk	4524	/system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.qaj.ioiixd/files/yl_plugin.apk --output-vdex-fd=124 --oat-fd=123 --oat-location=/data/user/0/com.qaj.ioiixd/files/oat/x86/yl_plugin.odex --compiler-filter=quicken --class-loader-context=&
/data/user/0/com.qaj.ioiixd/files/yl_plugin.apk	4319	com.qaj.ioiixd

Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
banker discovery

Security Software Discovery
T1418.001
Queries the phone number (MSISDN for GSM devices) 1 TTPs
discovery

System Network Configuration Discovery
T1422

Reads the content of SMS inbox messages. 1 TTPs 1 IoCs

collection

SMS Messages

T1636.004

description	ioc	Process
URI accessed for read	content://sms/inbox	com.qaj.ioiixd

Reads the content of the SMS messages. 1 TTPs 1 IoCs

collection

SMS Messages

T1636.004

description	ioc	Process
URI accessed for read	content://sms/	com.qaj.ioiixd

Requests cell location 2 TTPs 1 IoCs

Uses Android APIs to to get current cell location.

collection discovery defense_evasion

Location Tracking

T1430

Geofencing

T1627.001

description	ioc	Process
Framework service call	com.android.internal.telephony.ITelephony.getCellLocation	com.qaj.ioiixd

Queries information about active data network 1 TTPs 1 IoCs

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.IConnectivityManager.getActiveNetworkInfo	com.qaj.ioiixd

Queries information about the current Wi-Fi connection 1 TTPs 1 IoCs

Application may abuse the framework's APIs to collect information about the current Wi-Fi connection.

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.wifi.IWifiManager.getConnectionInfo	com.qaj.ioiixd

Queries the mobile country code (MCC) 1 TTPs 1 IoCs

discovery

System Network Configuration Discovery

T1422

description	ioc	Process
Framework service call	com.android.internal.telephony.ITelephony.getNetworkCountryIsoForPhone	com.qaj.ioiixd

Reads information about phone network operator. 1 TTPs
discovery

System Network Configuration Discovery
T1422

Requests dangerous framework permissions 17 IoCs

description	ioc
Allows read only access to phone state, including the current cellular network information, the status of any ongoing calls, and a list of any PhoneAccounts registered on the device.	android.permission.READ_PHONE_STATE
Allows an application to write to external storage.	android.permission.WRITE_EXTERNAL_STORAGE
Allows an application to read from external storage.	android.permission.READ_EXTERNAL_STORAGE
Allows an application to read SMS messages.	android.permission.READ_SMS
Allows an application to receive SMS messages.	android.permission.RECEIVE_SMS
Allows an application to send SMS messages.	android.permission.SEND_SMS
Allows an app to access approximate location.	android.permission.ACCESS_COARSE_LOCATION
Allows an app to create windows using the type LayoutParams.TYPE_APPLICATION_OVERLAY, shown on top of all other apps.	android.permission.SYSTEM_ALERT_WINDOW
Allows an application to initiate a phone call without going through the Dialer user interface for the user to confirm the call.	android.permission.CALL_PHONE
Required to be able to access the camera device.	android.permission.CAMERA
Allows read only access to phone state, including the current cellular network information, the status of any ongoing calls, and a list of any PhoneAccounts registered on the device.	android.permission.READ_PHONE_STATE
Allows an application to write to external storage.	android.permission.WRITE_EXTERNAL_STORAGE
Allows an application to read from external storage.	android.permission.READ_EXTERNAL_STORAGE
Allows an application to read SMS messages.	android.permission.READ_SMS
Allows an application to send SMS messages.	android.permission.SEND_SMS
Allows an application to receive SMS messages.	android.permission.RECEIVE_SMS
Allows an app to access approximate location.	android.permission.ACCESS_COARSE_LOCATION

Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs

persistence

Broadcast Receivers

T1624.001

description	ioc	Process
Framework service call	android.app.IActivityManager.registerReceiver	com.qaj.ioiixd

Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs

impact

Data Encrypted for Impact

T1471

description	ioc	Process
Framework API call	javax.crypto.Cipher.doFinal	com.qaj.ioiixd

Checks CPU information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/cpuinfo	com.qaj.ioiixd

Checks memory information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/meminfo	com.qaj.ioiixd

com.qaj.ioiixd
1⤵
- Loads dropped Dex/Jar
- Reads the content of SMS inbox messages.
- Reads the content of the SMS messages.
- Requests cell location
- Queries information about active data network
- Queries information about the current Wi-Fi connection
- Queries the mobile country code (MCC)
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Uses Crypto APIs (Might try to encrypt user data)
- Checks CPU information
- Checks memory information
PID:4319
- /system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.qaj.ioiixd/files/zon/XpmLgdn.jar --output-vdex-fd=44 --oat-fd=45 --oat-location=/data/user/0/com.qaj.ioiixd/files/zon/oat/x86/XpmLgdn.odex --compiler-filter=quicken --class-loader-context=&
  2⤵
  - Loads dropped Dex/Jar
  PID:4345
- /system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.qaj.ioiixd/files/Plugin2.apk --output-vdex-fd=119 --oat-fd=120 --oat-location=/data/user/0/com.qaj.ioiixd/files/oat/x86/Plugin2.odex --compiler-filter=quicken --class-loader-context=&
  2⤵
  - Loads dropped Dex/Jar
  PID:4464
- /system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.qaj.ioiixd/app_dex/utopay.jar --output-vdex-fd=124 --oat-fd=125 --oat-location=/data/user/0/com.qaj.ioiixd/app_dex/oat/x86/utopay.odex --compiler-filter=quicken --class-loader-context=&
  2⤵
  - Loads dropped Dex/Jar
  PID:4495
- /system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.qaj.ioiixd/files/yl_plugin.apk --output-vdex-fd=124 --oat-fd=123 --oat-location=/data/user/0/com.qaj.ioiixd/files/oat/x86/yl_plugin.odex --compiler-filter=quicken --class-loader-context=&
  2⤵
  - Loads dropped Dex/Jar
  PID:4524
- getprop ro.product.cpu.abi
  2⤵
  PID:4543
- getprop ro.product.cpu.abi2
  2⤵
  PID:4566

Network

MITRE ATT&CK Mobile v16

Initial Access

Execution

Persistence

Event Triggered Execution

T1624

Broadcast Receivers

T1624.001

Privilege Escalation

Defense Evasion

Download New Code at Runtime

T1407

Execution Guardrails

T1627

Geofencing

T1627.001

Virtualization/Sandbox Evasion

T1633

System Checks

T1633.001

Credential Access

Discovery

Location Tracking

T1430

Software Discovery

T1418

Security Software Discovery

T1418.001

System Information Discovery

T1426

System Network Configuration Discovery

T1422

System Network Connections Discovery

T1421

Lateral Movement

Collection

Location Tracking

T1430

Protected User Data

T1636

SMS Messages

T1636.004

Command and Control

Exfiltration

Impact

Data Encrypted for Impact

T1471

Replay Monitor

Loading Replay Monitor...

Downloads

utopay.jar

Path /data/data/com.qaj.ioiixd/app_dex/utopay.jar
Size 30KB
SHA256 b825cde84e3dddfc147c71265d2259c422d51a7e56d1dcdba1321e3119b1df07
MD5 eb6089c1acfa9f12535e533aebee845e
SHA1 165e39ee07dcd9ed00fc2dc1ff466bc1d6b813c9
SHA512 5b1bc26bcbcf05fc331865fb4dd572b673a52650d68ab4d9b028ea15219e0d93c1ec17996953436801913388d78e25c67ea33aa93544d65e96a799eb06cc70f5
SSDEEP 768:89WLk9xMPR7PIG0CLUhgdX3IsZEdTkEDF7XG6LA8QCnpAJgm:8QL+M5mCYKR3Ew6LvQ+pAJgm
TLSH
T199E2D0BC10D628F9F8477236F31C6A7BDE33BD2065D65BF2225698021C91A596B0E3E1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

740410100062013

Path /data/data/com.qaj.ioiixd/databases/740410100062013
Size 4KB
SHA256 0a8ffb6b327963558716e87db8946016d143e39f895fa1b43e95ba7032ce2514
MD5 f2b4b0190b9f384ca885f0c8c9b14700
SHA1 934ff2646757b5b6e7f20f6a0aa76c7f995d9361
SHA512 ec12685fc0d60526eed4d38820aad95611f3e93ae372be5a57142d8e8a1ba17e6e5dfe381a4e1365dddc0b363c9c40daaffdc1245bd515fddac69bf1abacd7f1
TLSH
T1CD810441534000F1D05407F354D1130C1F47D1D5D5410F03351100C5DC415C40C70FC5
MD5 SHA1 SHA512 TLSH

Submit Download

740410100062013-journal

Path /data/data/com.qaj.ioiixd/databases/740410100062013-journal
Size 512B
SHA256 b9e43c7c4139e3b0a599d9dfdd2de2be72781216dcf12f01358f5b6a40e595ae
MD5 36a5b6e3a940b042e7a11d66a12b6d53
SHA1 bd842a37c4516d240dfd35812dd7abf1bc0bfd9d
SHA512 c540b403da7876f98b540daf470e9fb3db179807937d04ab28581511425b8268d3a75222419a81c266d216b35800df61e635f9b8edcfb752eca0752db9c7464d
MD5 SHA1 SHA512

Submit Download

740410100062013-shm

Path /data/data/com.qaj.ioiixd/databases/740410100062013-shm
Size 28KB
SHA256 18619b678a5c207a971a0aa931604f48162e307c57ecdec450d5f095fe9f32c7
MD5 cf845a781c107ec1346e849c9dd1b7e8
SHA1 b44ccc7f7d519352422e59ee8b0bdbac881768a7
SHA512 4802861ea06dc7fb85229a3c8f04e707a084f1ba516510c6f269821b33c8ee4ebf495258fe5bee4850668a5aac1a45f0edf51580da13b7ee160a29d067c67612
SSDEEP 3::
MD5 SHA1 SHA512 SSDEEP

Submit Download

740410100062013-wal

Path /data/data/com.qaj.ioiixd/databases/740410100062013-wal
Size 140KB
SHA256 419d1c8109e2175ac489d10e15d142021e93957b0872dc41bf7835c64e20fab3
MD5 dc0d82b4ae56fbcb5cebed55ad169807
SHA1 c3526a6857ca62233e6efa97cb3786445f0e7cd1
SHA512 a4bf82ac3ee6a61e680df7ef7395bcdf42d96e355c1d2298954f416119b3af67f9161f6fa7a4bc3d4bd928a02632e0a375b8dc5f23bb381eff4b8b5281dc1ecf
SSDEEP 192:fs9qa8t91hmOeW18OttyPc9fzhUut8k7:EYvt91h1r5Uua
TLSH
T1B4E351D32A0827E1C62D8A3BC481DA51A978971D0BC3DBE33671CE391ED2D802429D7F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wochi_v4.db-journal

Path /data/data/com.qaj.ioiixd/databases/wochi_v4.db-journal
Size 512B
SHA256 08abcb2bd9b08d64a4411b6e79ec1e8c1111917bbf7de04a5ba0fa7bb958061b
MD5 5b4bbbfe1ad4c13a8e31a9f49ed94955
SHA1 f918b387b419e1e2afa1eec258046a5c707bf8ab
SHA512 3f2e1a91a3b7c8b6100498a5fd4ad3608e93093b184379ac7e0bb01beb3b16021425d8fd57ac48bbcc9241a55b1ae5d8dfc1d71b33e90717f3e01269c7d21674
MD5 SHA1 SHA512

Submit Download

wochi_v4.db-wal

Path /data/data/com.qaj.ioiixd/databases/wochi_v4.db-wal
Size 20KB
SHA256 610c157a2ec79967e4ea566cbc6cc54346d8632deeef31264bed42449cfe806e
MD5 210b992e2c64bcbe6a32659bc134c357
SHA1 6338b79697cd52fd752e46bd1658d1cf459b3eac
SHA512 056c2750a38a5477976b4d8a02468b164aec7ee27fb696d4d472edf6e8eca18270456b3f7940249bf7222ca074974f36717d6459c0043e09a081b972a9b45093
SSDEEP 12:KEArri8zdTRmBEyPbP/1A6WAcOwCldYA9zqDRmBEyPbV:KtbzyGSP/1A6WAWEYA9zDGSV
TLSH
T1FA92EC9563803E93C515577794C8C3811DB6EE2D8722D74F15A1185CFD437CCE492D48
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Plugin2.apk

Path /data/data/com.qaj.ioiixd/files/Plugin2.apk
Size 99KB
SHA256 de7bf40574754a5144fa5cf3bc5e97f7adc7f5abebb18c41e8f0631917db4c0c
MD5 3d216f8fddb9705a6720a285475837f1
SHA1 f053d23b284bfe2faf6e76d353ff052471e2de2c
SHA512 38be39da8f96abc87109cfd57b2d63ddfa72971f023024a5b4ce1f97cd905a96a94e19eea19ae9b745f28d02c6689a4473627ce57ec85dce2018a77e699620cb
SSDEEP 3072:O/hr91fY/9tdWXLqQRClwYJ4sAAq4/IZn8NxQNRmDJS:2B9NMDGLqofsAAbNI8g
TLSH
T130A302021B29DD42D537903648558B26B23AB62BEDF6F32A1E63D36D3083DC8CB33549
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

log.dat

Path /data/data/com.qaj.ioiixd/files/log.dat
Size 221B
SHA256 77fc3599be409f7e73e643de843c0ebcfa20662964c498fc59e245c7f5e003a2
MD5 ff9229f8e7c92d44d48e25206d43b021
SHA1 be3d75050c16c5b7484652ba292fdd6510f205d3
SHA512 be7b3aa8d670a2873c6b7bfd4ca93121fd2450723cbbc36d9d06d152fafa3ce90451f0a60ab56bc96bccb81cf5aae0167b404073db14dc17b9513ac73d455c58
TLSH
T152D0976200094CC1A048B30CA835C6E9F060285304090098B21B06086A223F0B2AE909
MD5 SHA1 SHA512 TLSH

Submit Download

umeng_it.cache

Path /data/data/com.qaj.ioiixd/files/umeng_it.cache
Size 310B
SHA256 6bbf426f655563de515c934c8bf66f7740b260f339febfd1e15500b02c2bf670
MD5 70a1a7522e713dfd006bf71a31ec46df
SHA1 d56538aedb69970bce90c373bdb194a4c366b918
SHA512 72994b781f8460da9dc71ed2cf2cebbb51f8ba334d1b8e1c3a0bcb87545f8dfaf9b418a62bad784690fcfbff633dcb69719283fdde7336f2d3d7aac63599646e
TLSH
T1A3E08C2CC220149AA64CACA2269ABBCBFB01EC72D8A1424B317499D8A632741DC8C707
MD5 SHA1 SHA512 TLSH

Submit Download

yl_plugin.apk

Path /data/data/com.qaj.ioiixd/files/yl_plugin.apk
Size 58KB
SHA256 05eb3e1ca331b8c6a1f60f92abb2bddbac54a7b2c229ac07bf26c756297fe72a
MD5 5a4c666b43ee7f2b6995aaf3527e4a4d
SHA1 b205bcb022797f3b16635db139c7524c0c388adc
SHA512 c84fceddbf9928110fc3b85e0989b9cedd06383007ff99dea5a25096d8f892ab52d30ed9b52b72211449041f1274ead85bb42929ec269b58b6b0e616a8545e17
SSDEEP 1536:D0L/5wazYVM3W7ymXFSRJcL7KIBOWNMunou3faONts:D0z5vcKG7BXsRJcL7gW+ul3a
TLSH
T1984302F14FECB302C166B5391F95E6AFBE9ACD4496B4719B4106A0A8F4D885C42EF02C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

XpmLgdn.jar

Path /data/data/com.qaj.ioiixd/files/zon/XpmLgdn.jar
Size 790KB
SHA256 64b816f190519e279cf47ad4d94d6a82e5a7d766a9cc73b1f88ffe452a0c9373
MD5 8b7150fafbc3dc532e434da356e1f079
SHA1 509da6eac0fe4a18351f83008c2db8af1bd6a2e7
SHA512 ab7a64725c562c81c1f1694d6260c09df013c77bd478db1b3e46bcdba920ca292cae54676693344bec3b922a29c0e139e99899dba7d6198a72918115a8e0a11d
SSDEEP 12288:1b1NVPLP80EYy5olOqWHHVEk6xmjTAe9cCvMA6T9TNd06xrXxT/PR/RypFk7z:1RNVDklYy+lOqWH1Kk3zkUwXxjZqCz
TLSH
T1FE0523FB3109A3578E8C91D37B148419FB4544A22DA4AF197032BCC3B4BEF7399B0A85
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

utopay.jar

Path /data/user/0/com.qaj.ioiixd/app_dex/utopay.jar
Size 67KB
SHA256 83c996c0d067b5f516897480f427dfffdcfb49ab7654dac9b805376bbd49e1db
MD5 3b8bb9a8679ac8c24e8d179fc5bae999
SHA1 e6ea7a1095524087f481ba04321c4cb6fd2426f3
SHA512 abf1cbed7a8cf4a29d7a32a83f15aa0a6c9e2be8484c2dd8d9bf16a76e337b17b9c05efa0773598806b3d3da4fe3a9217b583abb9aaf5e3dc054dc77b10cae63
SSDEEP 1536:ycmJZ5F4TYHs8RFDNnB7u5EPNcwYNLg70:sJZzC+BnB7u5EVcvyY
TLSH
T1F0633A03B3821963E5ADAB3991670380A333F5231FA7D347485858B9EEC27C15E797E8
MD5 SHA1 SHA512 SSDEEP TLSH

Download

utopay.jar

Path /data/user/0/com.qaj.ioiixd/app_dex/utopay.jar
Size 67KB
SHA256 6286a800597b845785eb664710253ebd20771737dddd5b80067e0e9d37c804b2
MD5 5220524411d0bacd600da60814d1ee9f
SHA1 fef7210ff44e757328bc0ff7aae7bb2191cbf634
SHA512 b2d8af5019c176d682634747d83320e609fb6122ef850f4069a0c78c2415d242087099cf60ecb03039a9ab71902a4e3b22e9cf144de89e506991fb93280f6a5f
SSDEEP 1536:ycmJZ5xSSTYJQHUO19/7U+rnB7u5EPNcwYNLg70:sJZLSEfH31hnB7u5EVcvyY
TLSH
T1AB631717F3835892E9AD9638716613407332FA221FABD3574848D8B5DFC27C69DB06E8
MD5 SHA1 SHA512 SSDEEP TLSH

Download

Plugin2.apk

Path /data/user/0/com.qaj.ioiixd/files/Plugin2.apk
Size 201KB
SHA256 1d83642ede6b16a071676e895f547d056543b5b4622bbc9b9b4ab45e47bf9ba0
MD5 ef019d14367b7346b1ae2419e9d445c8
SHA1 23d81fcf81f3a9f2a991ba4d0d135fe2a28aa188
SHA512 ea582f21c6054c37c679c798e93116c9c18c9544c0feb78fb949bed7b2cd3122c8d7bb8ecef329829c2531764abeb6200f0af49ede97c3b0b7448bdb65a34a60
SSDEEP 3072:1kVF+ursMg5xMFLchcmdbaNiikyqW+q7JDcN6W:1kVVrsMg5x6AhndcfxaV
TLSH
T1D9143C4BA555F877ED6BAB3284E34F40BB32E2952B13674B2048C1B6FCC77858E4D984
MD5 SHA1 SHA512 SSDEEP TLSH

Download

Plugin2.apk

Path /data/user/0/com.qaj.ioiixd/files/Plugin2.apk
Size 201KB
SHA256 2c61a25f1ad5783bf82eea9faa2536cac4788ed3147bc1864d9ef17ea01be6a7
MD5 2a425e0fae74f20a2c475da937a619a2
SHA1 4d701c7e6d828aa96ba8a493720e7282c49ec741
SHA512 44c8d2a837b606de99055badbd4b5e708424ca9809b1583d13aefadc4d4af974658dc3a3f179fc3047eef7167151c638ff66dd6c8d38121b6ecdfb464d2a5a60
SSDEEP 3072:1kVF+urNfpK7fagHwanMuBwQS/EdaHgqW+q7JDcN6W:1kVVrNfQ7fHwiBgm3xaV
TLSH
T1CC144A52D9C9B8E6FCBBA23A54E347017F31E659772B57471448C1B2BDC23838E8E984
MD5 SHA1 SHA512 SSDEEP TLSH

Download

yl_plugin.apk

Path /data/user/0/com.qaj.ioiixd/files/yl_plugin.apk
Size 123KB
SHA256 87751b4f40f3cf03b3e2a1e5eb9ef248ad79a8f47304d2a527939ed634ac8f2c
MD5 9fc68c74fcdf2ca6c0252ed39de275f0
SHA1 84438de24f01ade937d2f1a0f70c797e616b7199
SHA512 10feb413b7a89f92339dd1d1a9538fdb22009279778d985f6649faf0af7cd1d5998adff439cad6b99ec2aade6b235b72385a83d9943e5b5898eb7ecdd7a398e8
SSDEEP 3072:9z9mTBK0rBe+6zH7roW8IHpPJm8WnDts9WQB:6k0rBe+6zH7roW/pxlZ1B
TLSH
T155C34A03F3955523FAAD4F3248F38BC1E322E8516A939783118497BDFC963E25F5A588
MD5 SHA1 SHA512 SSDEEP TLSH

Download

yl_plugin.apk

Path /data/user/0/com.qaj.ioiixd/files/yl_plugin.apk
Size 123KB
SHA256 57d03ac2189851d5069515da6997e12ca307c145aa21679da001477df5f81836
MD5 918890b3fc5a3dc184a57d027ead24da
SHA1 c638f375f49bc4731b633bdc001aeeadf9462039
SHA512 fd9bfe41ce4041dc8c7db17df2a2164a24ea96372c212399c499f94d1fb7d95d430b8a7eb86041b9b2db88dfca0cf39e53cba2dad1e346aebed29e4ca5deb2ef
SSDEEP 3072:9z9mTBIMIPxpL1FBeznUmushBZWrTmFiYVj5y1zm8WnDts9WQB:6tVj5ylZ1B
TLSH
T1C8C35903F7999A22FDEC893924E29780A331FC15A95797435189D3FEFC467E34D8A488
MD5 SHA1 SHA512 SSDEEP TLSH

Download

XpmLgdn.jar

Path /data/user/0/com.qaj.ioiixd/files/zon/XpmLgdn.jar
Size 2.3MB
SHA256 8a91d220373f5642f13549c4efae1fd59ff2fa24d090189c7e1d752fbe293efd
MD5 0d3c4bc0aebbe15a4187fbe31c3e0db6
SHA1 80fdd30fcdb3c5077a09a701e1fb3c6121837de1
SHA512 c4666d723bce6c4cc1936d29b98cf797776f11ac85b5d887df19eef978413cbab173a2d5a13de4078cb88dc23ca3fc77c99289cad06cd7530dcbdd2ce5463064
SSDEEP 24576:m2Z6N6/UfT1D6OlzpzYjR84c3QJzjvFZRst2VJKa:mFk/UpSj2QVvFZRka
TLSH
T19CB55A02E6120E33D49D5B3254B757E56336A5093F439B67210C81B8FCE76C8EEEA29D
MD5 SHA1 SHA512 SSDEEP TLSH

Download

XpmLgdn.jar

Path /data/user/0/com.qaj.ioiixd/files/zon/XpmLgdn.jar
Size 2.3MB
SHA256 7214d5216123871f1991af510ce0aa25472899dc96c8ece8a765c858fa8767cf
MD5 c0f7eb9fb2ffbfbb67ef00caeecbd027
SHA1 c62f570cb512c88329b56d76a623ca8c2600ea16
SHA512 8889d30506bc0b5dd98fa71bd38b06356233c824e6168e064414e6fa6c594affc2669529fa9c07182045438089ce87b4d73c86f53e21a0f96d7fef6a1eb1c1a6
SSDEEP 24576:m2Z6N6/UfT1D6OlOJpz2SE4yLL/eoasUtc9vFZRst2VJKa:mFk/UpTlTLeoasZvFZRka
TLSH
T1A9B55B02EA628D72D49C933A25F393717735A60CAB038763204ED6F46EB36D4DED528D
MD5 SHA1 SHA512 SSDEEP TLSH

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Mobile v16

Replay Monitor

Loading Replay Monitor...

Downloads