e8031e0a4b87f7c8a68332217fba51cf939b12181228d9d17f23789b46276f45

Analysis

max time kernel
5s
max time network
151s
platform
android-9_x86
resource
android-x86-arm-20260325-en
resource tags

arch:armarch:x86image:android-x86-arm-20260325-enlocale:en-usos:android-9-x86system
submitted
12/10/2026, 23:18

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
jaffacakes118_not-a-virus.HEUR.RiskTool.AndroidOS.SMSreg.pf.apk
Size 1.7MB
Sample261012-299b7sfb39
SHA256 e8031e0a4b87f7c8a68332217fba51cf939b12181228d9d17f23789b46276f45
MD5 7b983275f59a3c4744dc951f3c5736b5
SHA1 2fe56d72e476e1e1795c0f6a82dccb2831c1c6dd
SHA512 aefc3f594d07c88592030b7f6c30d8164156e883df27d58fb26ec039eae38bb0cb404fe468e6d962bfa4713dc73a9703f6079a7a52c1a11f13eb08b2d33331a6
SSDEEP 49152:RCHSc+sKK71n11q9qteN0h6Rho5BRP4LXgWNonkKC:RCH1zK4c0YhyHP4LXgpkb
TLSH
T1F685236AFE45AAAFC2A2B635F45701CE73300E58536523171624E13837F722F9F66B84
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

banker collection defense_evasion discovery evasion impact persistence

Malware Config

Signatures

Checks Android system properties for emulator presence. 1 TTPs 6 IoCs

defense_evasion

System Checks

T1633.001

description	ioc	Process
Accessed system property	key: ro.product.name	getprop
Accessed system property	key: ro.product.model	getprop
Accessed system property	key: ro.product.device	getprop
Accessed system property	key: ro.bootmode	getprop
Accessed system property	key: ro.hardware	getprop
Accessed system property	key: ro.bootloader	getprop

Checks Qemu related system properties. 1 TTPs 5 IoCs

Checks for Android system properties related to Qemu for Emulator detection.

defense_evasion

System Checks

T1633.001

description	ioc	Process
Accessed system property	key: ro.kernel.qemu	getprop
Accessed system property	key: ro.kernel.qemu.gles	getprop
Accessed system property	key: ro.kernel.qemu.vsync	getprop
Accessed system property	key: ro.kernel.android.qemud	getprop
Accessed system property	key: init.svc.qemu-props	getprop

Loads dropped Dex/Jar 1 TTPs 7 IoCs

Runs executable file dropped to the device during analysis.

evasion

Download New Code at Runtime

T1407

ioc	pid	Process
/data/user/0/com.pob.dofgxq/files/jie/tNIJi.jar	4350	/system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.pob.dofgxq/files/jie/tNIJi.jar --output-vdex-fd=44 --oat-fd=45 --oat-location=/data/user/0/com.pob.dofgxq/files/jie/oat/x86/tNIJi.odex --compiler-filter=quicken --class-loader-context=&
/data/user/0/com.pob.dofgxq/files/jie/tNIJi.jar	4324	com.pob.dofgxq
/data/user/0/com.pob.dofgxq/files/Plugin2.apk	4385	/system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.pob.dofgxq/files/Plugin2.apk --output-vdex-fd=57 --oat-fd=58 --oat-location=/data/user/0/com.pob.dofgxq/files/oat/x86/Plugin2.odex --compiler-filter=quicken --class-loader-context=&
/data/user/0/com.pob.dofgxq/files/Plugin2.apk	4324	com.pob.dofgxq
/data/user/0/com.pob.dofgxq/app_dex/utopay.jar	4530	/system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.pob.dofgxq/app_dex/utopay.jar --output-vdex-fd=110 --oat-fd=114 --oat-location=/data/user/0/com.pob.dofgxq/app_dex/oat/x86/utopay.odex --compiler-filter=quicken --class-loader-context=&
/data/user/0/com.pob.dofgxq/app_dex/utopay.jar	4324	com.pob.dofgxq
/storage/emulated/0/Android/data/com.tongyu.pay/plugin1/tongyu-pay-lib.apk	4560	/system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/storage/emulated/0/Android/data/com.tongyu.pay/plugin1/tongyu-pay-lib.apk --output-vdex-fd=113 --oat-fd=115 --oat-location=/storage/emulated/0/Android/data/com.tongyu.pay/plugin1/oat/x86/tongyu-pay-lib.odex --compiler-filter=quicken --class-loader-context=&

Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
banker discovery

Security Software Discovery
T1418.001

Queries information about running processes on the device 1 TTPs 1 IoCs

Application may abuse the framework's APIs to collect information about running processes on the device.

discovery

Process Discovery

T1424

description	ioc	Process
Framework service call	android.app.IActivityManager.getRunningAppProcesses	com.pob.dofgxq

Queries the phone number (MSISDN for GSM devices) 1 TTPs
discovery

System Network Configuration Discovery
T1422

Reads the content of SMS inbox messages. 1 TTPs 1 IoCs

collection

SMS Messages

T1636.004

description	ioc	Process
URI accessed for read	content://sms/inbox	com.pob.dofgxq

Reads the content of the SMS messages. 1 TTPs 1 IoCs

collection

SMS Messages

T1636.004

description	ioc	Process
URI accessed for read	content://sms/	com.pob.dofgxq

Requests cell location 2 TTPs 1 IoCs

Uses Android APIs to to get current cell location.

collection discovery defense_evasion

Location Tracking

T1430

Geofencing

T1627.001

description	ioc	Process
Framework service call	com.android.internal.telephony.ITelephony.getCellLocation	com.pob.dofgxq

Queries information about active data network 1 TTPs 1 IoCs

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.IConnectivityManager.getActiveNetworkInfo	com.pob.dofgxq

Queries information about the current Wi-Fi connection 1 TTPs 1 IoCs

Application may abuse the framework's APIs to collect information about the current Wi-Fi connection.

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.wifi.IWifiManager.getConnectionInfo	com.pob.dofgxq

Queries the mobile country code (MCC) 1 TTPs 1 IoCs

discovery

System Network Configuration Discovery

T1422

description	ioc	Process
Framework service call	com.android.internal.telephony.ITelephony.getNetworkCountryIsoForPhone	com.pob.dofgxq

Reads information about phone network operator. 1 TTPs
discovery

System Network Configuration Discovery
T1422

Requests dangerous framework permissions 17 IoCs

description	ioc
Allows read only access to phone state, including the current cellular network information, the status of any ongoing calls, and a list of any PhoneAccounts registered on the device.	android.permission.READ_PHONE_STATE
Allows an application to write to external storage.	android.permission.WRITE_EXTERNAL_STORAGE
Allows an application to read from external storage.	android.permission.READ_EXTERNAL_STORAGE
Allows an application to read SMS messages.	android.permission.READ_SMS
Allows an application to receive SMS messages.	android.permission.RECEIVE_SMS
Allows an application to send SMS messages.	android.permission.SEND_SMS
Allows an app to access approximate location.	android.permission.ACCESS_COARSE_LOCATION
Allows an app to create windows using the type LayoutParams.TYPE_APPLICATION_OVERLAY, shown on top of all other apps.	android.permission.SYSTEM_ALERT_WINDOW
Allows an application to initiate a phone call without going through the Dialer user interface for the user to confirm the call.	android.permission.CALL_PHONE
Required to be able to access the camera device.	android.permission.CAMERA
Allows read only access to phone state, including the current cellular network information, the status of any ongoing calls, and a list of any PhoneAccounts registered on the device.	android.permission.READ_PHONE_STATE
Allows an application to write to external storage.	android.permission.WRITE_EXTERNAL_STORAGE
Allows an application to read from external storage.	android.permission.READ_EXTERNAL_STORAGE
Allows an application to read SMS messages.	android.permission.READ_SMS
Allows an application to send SMS messages.	android.permission.SEND_SMS
Allows an application to receive SMS messages.	android.permission.RECEIVE_SMS
Allows an app to access approximate location.	android.permission.ACCESS_COARSE_LOCATION

Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs

persistence

Broadcast Receivers

T1624.001

description	ioc	Process
Framework service call	android.app.IActivityManager.registerReceiver	com.pob.dofgxq

Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs

impact

Data Encrypted for Impact

T1471

description	ioc	Process
Framework API call	javax.crypto.Cipher.doFinal	com.pob.dofgxq

Checks memory information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/meminfo	com.pob.dofgxq

com.pob.dofgxq
1⤵
- Loads dropped Dex/Jar
- Queries information about running processes on the device
- Reads the content of SMS inbox messages.
- Reads the content of the SMS messages.
- Requests cell location
- Queries information about active data network
- Queries information about the current Wi-Fi connection
- Queries the mobile country code (MCC)
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Uses Crypto APIs (Might try to encrypt user data)
- Checks memory information
PID:4324
- /system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.pob.dofgxq/files/jie/tNIJi.jar --output-vdex-fd=44 --oat-fd=45 --oat-location=/data/user/0/com.pob.dofgxq/files/jie/oat/x86/tNIJi.odex --compiler-filter=quicken --class-loader-context=&
  2⤵
  - Loads dropped Dex/Jar
  PID:4350
- /system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.pob.dofgxq/files/Plugin2.apk --output-vdex-fd=57 --oat-fd=58 --oat-location=/data/user/0/com.pob.dofgxq/files/oat/x86/Plugin2.odex --compiler-filter=quicken --class-loader-context=&
  2⤵
  - Loads dropped Dex/Jar
  PID:4385
- service list
  2⤵
  PID:4408
- getprop
  2⤵
  - Checks Android system properties for emulator presence.
  - Checks Qemu related system properties.
  PID:4427
- /system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.pob.dofgxq/app_dex/utopay.jar --output-vdex-fd=110 --oat-fd=114 --oat-location=/data/user/0/com.pob.dofgxq/app_dex/oat/x86/utopay.odex --compiler-filter=quicken --class-loader-context=&
  2⤵
  - Loads dropped Dex/Jar
  PID:4530
- /system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/storage/emulated/0/Android/data/com.tongyu.pay/plugin1/tongyu-pay-lib.apk --output-vdex-fd=113 --oat-fd=115 --oat-location=/storage/emulated/0/Android/data/com.tongyu.pay/plugin1/oat/x86/tongyu-pay-lib.odex --compiler-filter=quicken --class-loader-context=&
  2⤵
  - Loads dropped Dex/Jar
  PID:4560

Network

MITRE ATT&CK Mobile v16

Initial Access

Execution

Persistence

Event Triggered Execution

T1624

Broadcast Receivers

T1624.001

Privilege Escalation

Defense Evasion

Download New Code at Runtime

T1407

Execution Guardrails

T1627

Geofencing

T1627.001

Virtualization/Sandbox Evasion

T1633

System Checks

T1633.001

Credential Access

Discovery

Location Tracking

T1430

Process Discovery

T1424

Software Discovery

T1418

Security Software Discovery

T1418.001

System Information Discovery

T1426

System Network Configuration Discovery

T1422

System Network Connections Discovery

T1421

Lateral Movement

Collection

Location Tracking

T1430

Protected User Data

T1636

SMS Messages

T1636.004

Command and Control

Exfiltration

Impact

Data Encrypted for Impact

T1471

Replay Monitor

Loading Replay Monitor...

Downloads

utopay.jar

Path /data/data/com.pob.dofgxq/app_dex/utopay.jar
Size 30KB
SHA256 b825cde84e3dddfc147c71265d2259c422d51a7e56d1dcdba1321e3119b1df07
MD5 eb6089c1acfa9f12535e533aebee845e
SHA1 165e39ee07dcd9ed00fc2dc1ff466bc1d6b813c9
SHA512 5b1bc26bcbcf05fc331865fb4dd572b673a52650d68ab4d9b028ea15219e0d93c1ec17996953436801913388d78e25c67ea33aa93544d65e96a799eb06cc70f5
SSDEEP 768:89WLk9xMPR7PIG0CLUhgdX3IsZEdTkEDF7XG6LA8QCnpAJgm:8QL+M5mCYKR3Ew6LvQ+pAJgm
TLSH
T199E2D0BC10D628F9F8477236F31C6A7BDE33BD2065D65BF2225698021C91A596B0E3E1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

740410100062013

Path /data/data/com.pob.dofgxq/databases/740410100062013
Size 4KB
SHA256 0a8ffb6b327963558716e87db8946016d143e39f895fa1b43e95ba7032ce2514
MD5 f2b4b0190b9f384ca885f0c8c9b14700
SHA1 934ff2646757b5b6e7f20f6a0aa76c7f995d9361
SHA512 ec12685fc0d60526eed4d38820aad95611f3e93ae372be5a57142d8e8a1ba17e6e5dfe381a4e1365dddc0b363c9c40daaffdc1245bd515fddac69bf1abacd7f1
TLSH
T1CD810441534000F1D05407F354D1130C1F47D1D5D5410F03351100C5DC415C40C70FC5
MD5 SHA1 SHA512 TLSH

Submit Download

740410100062013-journal

Path /data/data/com.pob.dofgxq/databases/740410100062013-journal
Size 512B
SHA256 d60b62f36da0ca2b1e070bde15f2a710d2ff96c4cbe14d1885bcf0354d8fa620
MD5 5964f09503d4de29e9786fc85bd4cd60
SHA1 ec4b9f0aa3e6cfcb7c454dd3e5b0b9bd38a99bf6
SHA512 50810447fef590b0f7e1e5383178fc5044fc0598d2e1281f8fe391e9cbd09d6ebddf981f596560a9cfef1a2a2568e7f5c1513df8f7e935ff22ba808a2331f2fe
MD5 SHA1 SHA512

Submit Download

740410100062013-shm

Path /data/data/com.pob.dofgxq/databases/740410100062013-shm
Size 28KB
SHA256 18619b678a5c207a971a0aa931604f48162e307c57ecdec450d5f095fe9f32c7
MD5 cf845a781c107ec1346e849c9dd1b7e8
SHA1 b44ccc7f7d519352422e59ee8b0bdbac881768a7
SHA512 4802861ea06dc7fb85229a3c8f04e707a084f1ba516510c6f269821b33c8ee4ebf495258fe5bee4850668a5aac1a45f0edf51580da13b7ee160a29d067c67612
SSDEEP 3::
MD5 SHA1 SHA512 SSDEEP

Submit Download

740410100062013-wal

Path /data/data/com.pob.dofgxq/databases/740410100062013-wal
Size 140KB
SHA256 327517be6b773e343b29c6dee66501d544f140a1e5ebf355b13663d592499620
MD5 56b779b124f64748ccebcd2445fa924a
SHA1 a644a3bdb0fa3db2717ee87dd8ac6b7d255f520a
SHA512 c289e25507a2fbdade92b5fd73f93bba99c028610c905890e59cf4ae60e97765e2803a31599906c5450d1d628276a33ec255e4f1e79f0443187491549e24fab4
SSDEEP 192:Pf9qa8t91hmOeW18OttyPc/XUGzgUut8LQ:3Yvt91h1r5UVUua
TLSH
T17FE373D72A383721C62C8B365782C257897CB71E06C2EFC325B59C345FD298064A9E7D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wochi_v4.db-journal

Path /data/data/com.pob.dofgxq/databases/wochi_v4.db-journal
Size 512B
SHA256 1b2ffa7a5168cc9dc496d3cce71f7eed9ebe4bf1d2b8b51e9b9772df8efde5e0
MD5 ef8e8726a7ba3657df85709cf2784c7a
SHA1 63829997c6bea5cebe6886aa8ab529f1f34a7dd7
SHA512 f7d97ecff50e428426685f0bfa2f2cbb67848d9167c2ba90fd4a988474444941f23e374c14b5d65e48af7417174cf636cf483c3a5d231c2cdffb35ae72172c81
MD5 SHA1 SHA512

Submit Download

wochi_v4.db-wal

Path /data/data/com.pob.dofgxq/databases/wochi_v4.db-wal
Size 20KB
SHA256 07da80882adf62761f66f74ada1ffdb18dee734eecaefa06326e9ccda604e865
MD5 786156491000b2c203f66c937dfe903c
SHA1 4bf1a3c5d91d8697f550d3e5b4c9b6b5c514de98
SHA512 e7eae8dce9a53f3fa95ce826c0221762517871f72adb5b0be05c74fbe9e14e1b692091a53bac19e867cdfaf3427696af4153bf586fb3e3b99fc98092b4a2592e
SSDEEP 12:KsUUzdTRmBEyPbP/BnozEOwCld+HsvqzqDRmBEyPbV:KwzyGSP/BnPEEzDGSV
TLSH
T12E92A798B3C01793C1995B72B5C5C3621ED5EA199363CBAF6A614865BC4268CB6D0E0C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Plugin2.apk

Path /data/data/com.pob.dofgxq/files/Plugin2.apk
Size 96KB
SHA256 61b4ea846f922634ddfbbd46369b23b8560780fae62db1b0ae90aceb4a976831
MD5 cecd3872a89699f8a52c04b36770ac28
SHA1 0825677ccb088f8eb59390d3d5c54d29b00a5fbb
SHA512 7be6809effa982bbab73df9f2ead279821ac7b2f52e52f5272fdd9fcafdc592ab76251e782cd964974a67f54fef6ca6bba191f2af10c811223650d710cd4c95c
SSDEEP 3072:kfrMW3vCNUnvF303nHKypYotCX7LmF4iaE:kj93vhvu3HTTaE
TLSH
T1EEA302D1B6D8CC9AC135FCB752A35A316870B9B907A38DDB8D834BF8509679F8E30914
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tNIJi.jar

Path /data/data/com.pob.dofgxq/files/jie/tNIJi.jar
Size 789KB
SHA256 081a4e31372c5bab50b5d1e5e425a35334e04d1395b207790bd45d30f9c4f91f
MD5 f57b3c752d5cf1bf51b5d70bda9f4c4c
SHA1 f11fc841697f76502ebf9b025ed1d613564b9655
SHA512 fc973caddfeac275dfe60c17e2c8d1b479f955693bc837d7ae68e6f779c4d97f9fab2c33156112c9c58c88e36b0afd1aa35d5b34798d7c1786d6280484da2239
SSDEEP 12288:d8ltwN8IgWz8t8x/vI3dYWIXaDPV7TOP9eMMjugLxsY/61LhJTjWaj:jbz8tw/vIizXusP9eMMjBxsY/61LHj
TLSH
T1150523607445F3CB59B7A24FE212317BA471C0EF1D6EAEA5339E88D4443D062AEDE706
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

log.dat

Path /data/data/com.pob.dofgxq/files/log.dat
Size 221B
SHA256 77fc3599be409f7e73e643de843c0ebcfa20662964c498fc59e245c7f5e003a2
MD5 ff9229f8e7c92d44d48e25206d43b021
SHA1 be3d75050c16c5b7484652ba292fdd6510f205d3
SHA512 be7b3aa8d670a2873c6b7bfd4ca93121fd2450723cbbc36d9d06d152fafa3ce90451f0a60ab56bc96bccb81cf5aae0167b404073db14dc17b9513ac73d455c58
TLSH
T152D0976200094CC1A048B30CA835C6E9F060285304090098B21B06086A223F0B2AE909
MD5 SHA1 SHA512 TLSH

Submit Download

yl_plugin.apk

Path /data/data/com.pob.dofgxq/files/yl_plugin.apk
Size 52KB
SHA256 a9125fe3920936fe0bdc864d06bf516ea6dd30e64dcf5feb9db552824fc62d83
MD5 873e825f412ffdad718a6d281273d544
SHA1 f32a38d16bd49766262ece262f1733a3fcf4c4ed
SHA512 5dd809daad41094b47ee4c378647ff033922c45ac6b7c79e08c8dbc5e22c95ac9624ad49a6b4a9f4a98316c5c2caec2049940ab1c6d1fbfeb467f984e769bbcf
SSDEEP 1536:bmweZpoWpD3MsnQHD53Em00okAjJaS3RTRojdd9:SZpbBQq0oJk6Rojp
TLSH
T16733F1543A3DE0EED79F9134439C5B8ACF758B9611686A0B5A82EC397E6BD000B76D02
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

utopay.jar

Path /data/user/0/com.pob.dofgxq/app_dex/utopay.jar
Size 67KB
SHA256 83c996c0d067b5f516897480f427dfffdcfb49ab7654dac9b805376bbd49e1db
MD5 3b8bb9a8679ac8c24e8d179fc5bae999
SHA1 e6ea7a1095524087f481ba04321c4cb6fd2426f3
SHA512 abf1cbed7a8cf4a29d7a32a83f15aa0a6c9e2be8484c2dd8d9bf16a76e337b17b9c05efa0773598806b3d3da4fe3a9217b583abb9aaf5e3dc054dc77b10cae63
SSDEEP 1536:ycmJZ5F4TYHs8RFDNnB7u5EPNcwYNLg70:sJZzC+BnB7u5EVcvyY
TLSH
T1F0633A03B3821963E5ADAB3991670380A333F5231FA7D347485858B9EEC27C15E797E8
MD5 SHA1 SHA512 SSDEEP TLSH

Download

utopay.jar

Path /data/user/0/com.pob.dofgxq/app_dex/utopay.jar
Size 67KB
SHA256 6286a800597b845785eb664710253ebd20771737dddd5b80067e0e9d37c804b2
MD5 5220524411d0bacd600da60814d1ee9f
SHA1 fef7210ff44e757328bc0ff7aae7bb2191cbf634
SHA512 b2d8af5019c176d682634747d83320e609fb6122ef850f4069a0c78c2415d242087099cf60ecb03039a9ab71902a4e3b22e9cf144de89e506991fb93280f6a5f
SSDEEP 1536:ycmJZ5xSSTYJQHUO19/7U+rnB7u5EPNcwYNLg70:sJZLSEfH31hnB7u5EVcvyY
TLSH
T1AB631717F3835892E9AD9638716613407332FA221FABD3574848D8B5DFC27C69DB06E8
MD5 SHA1 SHA512 SSDEEP TLSH

Download

Plugin2.apk

Path /data/user/0/com.pob.dofgxq/files/Plugin2.apk
Size 205KB
SHA256 c6da7635863d702274cd4a21431eaae6d70689234ee9e132f31e478e26485842
MD5 1adf4f685d0075d28e5deb2ab6082e49
SHA1 5c684f81799621c375804fd7684ae59525e53be1
SHA512 ea120f0c9eed7dbe8e89024169552f8bd5fab75aa0922e1a04c62fefbab019ad19c0769b44e6c9f31745eba63c601415016a0894e74521a927d645a130a3cf10
SSDEEP 3072:lrFFCDqILAerD9t8eTU3RNwUyFE0In3AgsJt+5kuaeXr+fm18mkt4atF:lrFFSseALyF305k7bM8mm4av
TLSH
T1B12427429960652BDDAF9B3288E38BC6B735F5417F43C78B008855B9FCC23D94E6E198
MD5 SHA1 SHA512 SSDEEP TLSH

Download

Plugin2.apk

Path /data/user/0/com.pob.dofgxq/files/Plugin2.apk
Size 205KB
SHA256 72b339c0bbf45a6a16d9228cbf65d6efcf4cfd203b86d5d02b7e0a3a9a516bf7
MD5 e5c8a0f8021064ef97edff3a0aa821d3
SHA1 c92a2f236bbd2230b7bb5f83037ab16ff2df7a47
SHA512 514b502b5ad6bf092c9d7ab7594667e431f1f308509660bcd48440a487c2e26af375791611e9289bcf3c66cc74a7c7ef1fe773cf5b8fe1fc484197e0ad11ec8e
SSDEEP 3072:lrFFCDqIetfrD9t8p2LJag5RcxuUjqdOMwqAzWVBvgsJt+5kuaeXr+fm18mkt4av:lrFFStp2LJagYpqdsqAzv5k7bM8mm4av
TLSH
T1EB243842E89465A6DCEF923989C387827730FD607F5BC787008A85F5FD863E64E9B094
MD5 SHA1 SHA512 SSDEEP TLSH

Download

tNIJi.jar

Path /data/user/0/com.pob.dofgxq/files/jie/tNIJi.jar
Size 1.9MB
SHA256 d1d71ac67c58195ae50671e59a93cd57bfb2e7f9dc43b43a37bc6d70ba38b9bb
MD5 4644f3c25d9d1b74a741bc56029442f0
SHA1 a526db3944893f88e10951dafd3b7f7acd0b8ea9
SHA512 711ff4f1be2b1ae4048da927d315135e0693d818cc05fd11f741a5cfd7f466cfe8cdd5d857ff697f86d42d14a849e00576f5d9dc503ab304d3fb7aea54abfc74
SSDEEP 12288:2P/q9pYRTpJoSRbexGzA4OzcnTsg870hDfQ2TzIuqtpV3FBMzBKyHkIkXMNRWgQ3:p5EjX6hyI2JtuzTvPkVI
TLSH
T1C0955B06E6121A33D99DDB3B54B78BD5633261493F83971B25085138FCE72C89F6A2EC
MD5 SHA1 SHA512 SSDEEP TLSH

Download

tNIJi.jar

Path /data/user/0/com.pob.dofgxq/files/jie/tNIJi.jar
Size 1.9MB
SHA256 f992fc2aa1f684a982170758045d4a8c60da6fd4a104c637fd37bc72a8c63ea6
MD5 ea455957bf7930b06063d6954e820d70
SHA1 3c72eca6fb73a56dd5662e5f3be688554da055fa
SHA512 a7df213ffd8b85be344bf4f71d7fe49b060676d67307212cf583b18e88fae7ea9d123141d5593e439124950434b5bcabd69a6ee6e632ed536e83235cd90f31ef
SSDEEP 12288:2P/q9pYRTpJoSRbexGzA4OzcnTsg88fd7xLqHdvZhX4ZaYWjIrC4bumlj4jXabL1:p5EjX6DkVnj4G0ZtuzTvPkVI
TLSH
T1FC958E06E6625E72C9CDC33E29BB8BA0773165C87F93832B1049D174ACB32E59F9519C
MD5 SHA1 SHA512 SSDEEP TLSH

Download

tongyu-pay-lib.apk

Path /storage/emulated/0/Android/data/com.tongyu.pay/plugin1/tongyu-pay-lib.apk
Size 107KB
SHA256 a86462621910a408278a23363571f528be4275ed72e718ab386253fb3f47e2b6
MD5 5286d64aa08d6b874a081e272487e073
SHA1 223ceb3c031d5671523bd6e5a3fd781686d64905
SHA512 9798ac011926024068db16621ea160eda051d67f4a4f6c6ca1616dac77be0cbfc6650b70107f9c2c26ce9b93677df891cbd29deb1120aa783c5afcc4ca83ec1e
SSDEEP 3072:vlC8entgkric7hi2fYqX9pM9BepJNk8Lk+egKa:vstj7ffYO9urepQ8wgKa
TLSH
T171B3122E4BCDE1AEED22AEF9C23BC5BE275BE5924B2C06570300B0046D7BD851D2DD45
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tongyu-pay-lib.apk

Path /storage/emulated/0/Android/data/com.tongyu.pay/plugin1/tongyu-pay-lib.apk
Size 181KB
SHA256 2ee9a7e91c8142757311b061e520e6f67bbbb676516061b8fff314d82139688a
MD5 0a9ac3028d1480b3b76be9284cc1ccb8
SHA1 ec484fd087c5514db11fd94ab2a708c3c68b7884
SHA512 2a27ed1e18008f50ec5e07ada7921ee37a66d60be10d555d0faf283c8293f4cfff6282c0dff65cd40d53ac93fd197970dc40ef54fbb28c348ca9bb1bea68dde2
SSDEEP 3072:Hemf39On8uJVt/lDZsIPg+Ty30VMCLJGqpScTgouQIp8P4LAXh/1sNB3PqRu:HemfMn8uJVVTEWOZLHAu
TLSH
T1F1042902FEC19952DCBF82796DE353903B32F1195F86A787018CD1B9BCB26D36A994C4
MD5 SHA1 SHA512 SSDEEP TLSH

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Mobile v16

Replay Monitor

Loading Replay Monitor...

Downloads