d3c0c481c56dfa5b74a85d0802a72ecd3fbe4fd9af386a2eb47e4da219b74c14

Analysis

max time kernel
3s
max time network
150s
platform
android-9_x86
resource
android-x86-arm-20260325-en
resource tags

arch:armarch:x86image:android-x86-arm-20260325-enlocale:en-usos:android-9-x86system
submitted
12/10/2026, 23:30

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
jaffacakes118_not-a-virus.HEUR.RiskTool.AndroidOS.SMSreg.pf.apk
Size 1.7MB
Sample261012-3hcdtsfc49
SHA256 d3c0c481c56dfa5b74a85d0802a72ecd3fbe4fd9af386a2eb47e4da219b74c14
MD5 b5996fb26057eaeb2939bdcc2fa503bf
SHA1 5c14a50103cdc54de42a614c664e1566582ccda2
SHA512 77ccf2ecb35b54a64f7530117b9089b7a3eccec679a00968fa3ff286d6991d31810dc4b2916185e7f6e857c6028f31ec3c060d9a79fd41f1e01335e03bf22918
SSDEEP 49152:l/VwgxgKsliP4rWJXSdtSDXahXgWNvnkUi:lF3cIJX0tSr+XgWkj
TLSH
T1C385233AFF49AB5BC4A76738F40741DF33311E4C9B55621A0A24E23837F251D5BA6B88
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

banker collection defense_evasion discovery evasion impact persistence

Malware Config

Signatures

Checks Android system properties for emulator presence. 1 TTPs 2 IoCs

defense_evasion

System Checks

T1633.001

description	ioc	Process
Accessed system property	key: ro.product.model	com.aqp.dgtidp
Accessed system property	key: ro.hardware	com.aqp.dgtidp

Loads dropped Dex/Jar 1 TTPs 4 IoCs

Runs executable file dropped to the device during analysis.

evasion

Download New Code at Runtime

T1407

ioc	pid	Process
/data/user/0/com.aqp.dgtidp/files/xu/YPVts.jar	4416	/system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.aqp.dgtidp/files/xu/YPVts.jar --output-vdex-fd=44 --oat-fd=45 --oat-location=/data/user/0/com.aqp.dgtidp/files/xu/oat/x86/YPVts.odex --compiler-filter=quicken --class-loader-context=&
/data/user/0/com.aqp.dgtidp/files/xu/YPVts.jar	4388	com.aqp.dgtidp
/data/user/0/com.aqp.dgtidp/files/Plugin2.apk	4459	/system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.aqp.dgtidp/files/Plugin2.apk --output-vdex-fd=59 --oat-fd=66 --oat-location=/data/user/0/com.aqp.dgtidp/files/oat/x86/Plugin2.odex --compiler-filter=quicken --class-loader-context=&
/data/user/0/com.aqp.dgtidp/files/Plugin2.apk	4388	com.aqp.dgtidp

Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
banker discovery

Security Software Discovery
T1418.001
Queries the phone number (MSISDN for GSM devices) 1 TTPs
discovery

System Network Configuration Discovery
T1422

Reads the content of SMS inbox messages. 1 TTPs 1 IoCs

collection

SMS Messages

T1636.004

description	ioc	Process
URI accessed for read	content://sms/inbox	com.aqp.dgtidp

Reads the content of the SMS messages. 1 TTPs 1 IoCs

collection

SMS Messages

T1636.004

description	ioc	Process
URI accessed for read	content://sms/	com.aqp.dgtidp

Requests cell location 2 TTPs 1 IoCs

Uses Android APIs to to get current cell location.

collection discovery defense_evasion

Location Tracking

T1430

Geofencing

T1627.001

description	ioc	Process
Framework service call	com.android.internal.telephony.ITelephony.getCellLocation	com.aqp.dgtidp

Queries information about active data network 1 TTPs 1 IoCs

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.IConnectivityManager.getActiveNetworkInfo	com.aqp.dgtidp

Queries information about the current Wi-Fi connection 1 TTPs 1 IoCs

Application may abuse the framework's APIs to collect information about the current Wi-Fi connection.

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.wifi.IWifiManager.getConnectionInfo	com.aqp.dgtidp

Requests dangerous framework permissions 10 IoCs

description	ioc
Allows read only access to phone state, including the current cellular network information, the status of any ongoing calls, and a list of any PhoneAccounts registered on the device.	android.permission.READ_PHONE_STATE
Allows an application to write to external storage.	android.permission.WRITE_EXTERNAL_STORAGE
Allows an application to read from external storage.	android.permission.READ_EXTERNAL_STORAGE
Allows an application to read SMS messages.	android.permission.READ_SMS
Allows an application to receive SMS messages.	android.permission.RECEIVE_SMS
Allows an application to send SMS messages.	android.permission.SEND_SMS
Allows an app to access approximate location.	android.permission.ACCESS_COARSE_LOCATION
Allows an app to create windows using the type LayoutParams.TYPE_APPLICATION_OVERLAY, shown on top of all other apps.	android.permission.SYSTEM_ALERT_WINDOW
Allows an application to initiate a phone call without going through the Dialer user interface for the user to confirm the call.	android.permission.CALL_PHONE
Required to be able to access the camera device.	android.permission.CAMERA

Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs

persistence

Broadcast Receivers

T1624.001

description	ioc	Process
Framework service call	android.app.IActivityManager.registerReceiver	com.aqp.dgtidp

Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs

impact

Data Encrypted for Impact

T1471

description	ioc	Process
Framework API call	javax.crypto.Cipher.doFinal	com.aqp.dgtidp

Checks CPU information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/cpuinfo	com.aqp.dgtidp

com.aqp.dgtidp
1⤵
- Checks Android system properties for emulator presence.
- Loads dropped Dex/Jar
- Reads the content of SMS inbox messages.
- Reads the content of the SMS messages.
- Requests cell location
- Queries information about active data network
- Queries information about the current Wi-Fi connection
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Uses Crypto APIs (Might try to encrypt user data)
- Checks CPU information
PID:4388
- /system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.aqp.dgtidp/files/xu/YPVts.jar --output-vdex-fd=44 --oat-fd=45 --oat-location=/data/user/0/com.aqp.dgtidp/files/xu/oat/x86/YPVts.odex --compiler-filter=quicken --class-loader-context=&
  2⤵
  - Loads dropped Dex/Jar
  PID:4416
- /system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.aqp.dgtidp/files/Plugin2.apk --output-vdex-fd=59 --oat-fd=66 --oat-location=/data/user/0/com.aqp.dgtidp/files/oat/x86/Plugin2.odex --compiler-filter=quicken --class-loader-context=&
  2⤵
  - Loads dropped Dex/Jar
  PID:4459
- getprop ro.product.cpu.abi
  2⤵
  PID:4495
- getprop ro.product.cpu.abi2
  2⤵
  PID:4515

Network

MITRE ATT&CK Mobile v16

Initial Access

Execution

Persistence

Event Triggered Execution

T1624

Broadcast Receivers

T1624.001

Privilege Escalation

Defense Evasion

Download New Code at Runtime

T1407

Execution Guardrails

T1627

Geofencing

T1627.001

Virtualization/Sandbox Evasion

T1633

System Checks

T1633.001

Credential Access

Discovery

Location Tracking

T1430

Software Discovery

T1418

Security Software Discovery

T1418.001

System Information Discovery

T1426

System Network Configuration Discovery

T1422

System Network Connections Discovery

T1421

Lateral Movement

Collection

Location Tracking

T1430

Protected User Data

T1636

SMS Messages

T1636.004

Command and Control

Exfiltration

Impact

Data Encrypted for Impact

T1471

Replay Monitor

Loading Replay Monitor...

Downloads

wochi_v4.db

Path /data/data/com.aqp.dgtidp/databases/wochi_v4.db
Size 4KB
SHA256 0a8ffb6b327963558716e87db8946016d143e39f895fa1b43e95ba7032ce2514
MD5 f2b4b0190b9f384ca885f0c8c9b14700
SHA1 934ff2646757b5b6e7f20f6a0aa76c7f995d9361
SHA512 ec12685fc0d60526eed4d38820aad95611f3e93ae372be5a57142d8e8a1ba17e6e5dfe381a4e1365dddc0b363c9c40daaffdc1245bd515fddac69bf1abacd7f1
TLSH
T1CD810441534000F1D05407F354D1130C1F47D1D5D5410F03351100C5DC415C40C70FC5
MD5 SHA1 SHA512 TLSH

Submit Download

wochi_v4.db-journal

Path /data/data/com.aqp.dgtidp/databases/wochi_v4.db-journal
Size 512B
SHA256 ba5f810ad5e7d60ae94a0a8a5932873178bf66741a84fa22f2fb039c7251db2f
MD5 ba2f5d029cb98a24a908c7cccb501e75
SHA1 35c58ed09a4bcb0dab509b389f4d6d5140cec5ae
SHA512 f556118a447e0973c26c50b5a46d599d0024179761351cddaeeb5ccce556afdb90d4bbe066eee2b617522397938e27af13817e1ba708ac4a727ebce3e097a19e
MD5 SHA1 SHA512

Submit Download

wochi_v4.db-shm

Path /data/data/com.aqp.dgtidp/databases/wochi_v4.db-shm
Size 28KB
SHA256 18619b678a5c207a971a0aa931604f48162e307c57ecdec450d5f095fe9f32c7
MD5 cf845a781c107ec1346e849c9dd1b7e8
SHA1 b44ccc7f7d519352422e59ee8b0bdbac881768a7
SHA512 4802861ea06dc7fb85229a3c8f04e707a084f1ba516510c6f269821b33c8ee4ebf495258fe5bee4850668a5aac1a45f0edf51580da13b7ee160a29d067c67612
SSDEEP 3::
MD5 SHA1 SHA512 SSDEEP

Submit Download

wochi_v4.db-wal

Path /data/data/com.aqp.dgtidp/databases/wochi_v4.db-wal
Size 20KB
SHA256 400231e87af897d1804babed55ecede7a331153c478cb96939ec637de89616e1
MD5 d6ade17baa241ba2dd1a8c00a26314b6
SHA1 894a3c74a70410338482ad111f84c98290e6f1ee
SHA512 c6ed6f6e0b0f3be31804323ae79c69e045e18946ca0e195826c09cbcee6663af6eb63a4ec7f4ae43ab5f856cd98cfc30d89bdca9c4ef129b85fa265c48d4b6b8
SSDEEP 12:KtI5qzdTRmBEyPbP/fcWVIOwCldvBL8zqDRmBEyPbV:KzzyGSP/UGyEv98zDGSV
TLSH
T16892EC55A3801B53C5454377E0C9D3451DA1E7199323CB4BB5A4279AFC02BCCF470E8C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Plugin2.apk

Path /data/data/com.aqp.dgtidp/files/Plugin2.apk
Size 99KB
SHA256 de7bf40574754a5144fa5cf3bc5e97f7adc7f5abebb18c41e8f0631917db4c0c
MD5 3d216f8fddb9705a6720a285475837f1
SHA1 f053d23b284bfe2faf6e76d353ff052471e2de2c
SHA512 38be39da8f96abc87109cfd57b2d63ddfa72971f023024a5b4ce1f97cd905a96a94e19eea19ae9b745f28d02c6689a4473627ce57ec85dce2018a77e699620cb
SSDEEP 3072:O/hr91fY/9tdWXLqQRClwYJ4sAAq4/IZn8NxQNRmDJS:2B9NMDGLqofsAAbNI8g
TLSH
T130A302021B29DD42D537903648558B26B23AB62BEDF6F32A1E63D36D3083DC8CB33549
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

log.dat

Path /data/data/com.aqp.dgtidp/files/log.dat
Size 221B
SHA256 77fc3599be409f7e73e643de843c0ebcfa20662964c498fc59e245c7f5e003a2
MD5 ff9229f8e7c92d44d48e25206d43b021
SHA1 be3d75050c16c5b7484652ba292fdd6510f205d3
SHA512 be7b3aa8d670a2873c6b7bfd4ca93121fd2450723cbbc36d9d06d152fafa3ce90451f0a60ab56bc96bccb81cf5aae0167b404073db14dc17b9513ac73d455c58
TLSH
T152D0976200094CC1A048B30CA835C6E9F060285304090098B21B06086A223F0B2AE909
MD5 SHA1 SHA512 TLSH

Submit Download

umeng_it.cache

Path /data/data/com.aqp.dgtidp/files/umeng_it.cache
Size 310B
SHA256 80173c5eaa506ac563fd3a0eefb5d2af2b6da633d440da659570888a0c5b1971
MD5 2250d5854b9473fe90fe68d625e931bc
SHA1 b6a77b272df586b05a53dd5959ea0241cbb7415a
SHA512 92030fd1039a5e852bf48d41ace639fc34605eb991fbe2066d2e80fb6a207bf92bde390e71b0ed775b8e2efda238d7fd4ac92efce9e76e14361c64f8881cc128
TLSH
T145E0266972E00862F319A16320893387FF24DD33C4E0D25A761A43C45020B14CA84203
MD5 SHA1 SHA512 TLSH

Submit Download

YPVts.jar

Path /data/data/com.aqp.dgtidp/files/xu/YPVts.jar
Size 789KB
SHA256 3a6a349fdfe58b735643c358559ba80ddbc2ad5fb94113b493510b7b3940aa01
MD5 bbf07c9f09d64b5ffe5844d7fb062d49
SHA1 3aea4560aad8a9ccec45e6d01db3a30a5fc8f78c
SHA512 9ec14184ae9c8b8c152bb8e6e81d39f5c6570581d4c2bc3f2ff07c6e0a6ecf3a156771c155f73ec320e63e207fbe645135cdfa662ba3adf6aac8c9c3e55f39c9
SSDEEP 24576:tr2vhTtxRB/FrlNypwY/oYRBhrCimgW4P:8vfT3ZN+/oYRrnmgL
TLSH
T18A0533D5ED1F3DF78EF637E014A115261A4BCEE4A2BB736C981F0E831102ED21E952A1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Plugin2.apk

Path /data/user/0/com.aqp.dgtidp/files/Plugin2.apk
Size 201KB
SHA256 1d83642ede6b16a071676e895f547d056543b5b4622bbc9b9b4ab45e47bf9ba0
MD5 ef019d14367b7346b1ae2419e9d445c8
SHA1 23d81fcf81f3a9f2a991ba4d0d135fe2a28aa188
SHA512 ea582f21c6054c37c679c798e93116c9c18c9544c0feb78fb949bed7b2cd3122c8d7bb8ecef329829c2531764abeb6200f0af49ede97c3b0b7448bdb65a34a60
SSDEEP 3072:1kVF+ursMg5xMFLchcmdbaNiikyqW+q7JDcN6W:1kVVrsMg5x6AhndcfxaV
TLSH
T1D9143C4BA555F877ED6BAB3284E34F40BB32E2952B13674B2048C1B6FCC77858E4D984
MD5 SHA1 SHA512 SSDEEP TLSH

Download

Plugin2.apk

Path /data/user/0/com.aqp.dgtidp/files/Plugin2.apk
Size 201KB
SHA256 2c61a25f1ad5783bf82eea9faa2536cac4788ed3147bc1864d9ef17ea01be6a7
MD5 2a425e0fae74f20a2c475da937a619a2
SHA1 4d701c7e6d828aa96ba8a493720e7282c49ec741
SHA512 44c8d2a837b606de99055badbd4b5e708424ca9809b1583d13aefadc4d4af974658dc3a3f179fc3047eef7167151c638ff66dd6c8d38121b6ecdfb464d2a5a60
SSDEEP 3072:1kVF+urNfpK7fagHwanMuBwQS/EdaHgqW+q7JDcN6W:1kVVrNfQ7fHwiBgm3xaV
TLSH
T1CC144A52D9C9B8E6FCBBA23A54E347017F31E659772B57471448C1B2BDC23838E8E984
MD5 SHA1 SHA512 SSDEEP TLSH

Download

YPVts.jar

Path /data/user/0/com.aqp.dgtidp/files/xu/YPVts.jar
Size 1.9MB
SHA256 9878427fda5efc263bdfc652a90a4e1a1a2437fa5d7fea6b3429c8336b1f48d6
MD5 1e04a654a986ff4638adc2c268fc71dd
SHA1 9c12d8e43a012cd7559b64b711a8df514ad6cae2
SHA512 ff7234b64d57ebfa100548c28a5483cd46adf20db11ce334db38134eb650f44e50701af612cee67104ab6bb423d04770a8a2fd98f45bb1951a9f3524d3e197a1
SSDEEP 24576:MdgPrQ61iDN8Mue5FH3Jxcqv59Pmczl41JYvyLhOA2:pjQ6AFjm1JYvahOb
TLSH
T12D956B02EA521E37C96E8B3684F38BE5633655492F83C71714089179FCE72C5AF6E29C
MD5 SHA1 SHA512 SSDEEP TLSH

Download

YPVts.jar

Path /data/user/0/com.aqp.dgtidp/files/xu/YPVts.jar
Size 1.9MB
SHA256 ccdc485f41bbab77be1b04ce9406a2fac304bc2b1097167d1ff0f0b50eb69769
MD5 07ed85d8e6cd21dc38cfa93bf68dcb6c
SHA1 996cca89cb2a794ec0e7705c8c3a7852c8b2c26f
SHA512 451444bbe1d6ea1e020fdeb59bbdae1c97b1cb31805a7b3ad0384163cda5bd753e9f1cc6d5e7653c423fcbda3970cdbe614e51cf6c44b0928887225c124ac8e4
SSDEEP 24576:MdgPrQ61iDN85uex1t2pF1Bty+tG8Y80H1JYvyLhOA2:pjQ6/271e+tGqw1JYvahOb
TLSH
T130955A02FA524DB6C89EC73A65F2CBB07731994C6B878327100ED6746DB32D5DE9928C
MD5 SHA1 SHA512 SSDEEP TLSH

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Mobile v16

Replay Monitor

Loading Replay Monitor...

Downloads