4948bc537c6573b2a62d59917d583b74ef6009a4ce166c4ec6616098d26a5055

Analysis

max time kernel
77s
max time network
152s
platform
android-9_x86
resource
android-x86-arm-20260325-en
resource tags

arch:armarch:x86image:android-x86-arm-20260325-enlocale:en-usos:android-9-x86system
submitted
12/10/2026, 23:36

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
jaffacakes118_not-a-virus.HEUR.RiskTool.AndroidOS.SMSreg.pf.apk
Size 2.1MB
Sample261012-3lp44aszbx
SHA256 4948bc537c6573b2a62d59917d583b74ef6009a4ce166c4ec6616098d26a5055
MD5 d887f74aae6455d8ecd452112599e293
SHA1 6b50193f9035307dd85f0644101eb6b163f2b280
SHA512 7b021b050b83604c5943a6135db800a06f6a357fb89fcad62b1dccfca426f4dea14cc8dc71d45f2d5d12aa68b162dbc7046a3da2725872cf3b6779c1860bc9ad
SSDEEP 49152:ysHvGeMbhWcTEZnCOF0M8U1IVh578BC+ehxYCUkGgI1tnIPnAi2:XvGeWhWxCKJ8KIV7wCYFxj1tnI/Af
TLSH
T19FA52317CF598185C0BAEF71C2A1C2B7B1A64CB0E35AD2E71D02F4A8A8B79D5D3358C5
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

banker collection defense_evasion discovery evasion impact persistence

Malware Config

Signatures

Checks Android system properties for emulator presence. 1 TTPs 6 IoCs

defense_evasion

System Checks

T1633.001

description	ioc	Process
Accessed system property	key: ro.product.name	getprop
Accessed system property	key: ro.product.model	getprop
Accessed system property	key: ro.product.device	getprop
Accessed system property	key: ro.bootmode	getprop
Accessed system property	key: ro.hardware	getprop
Accessed system property	key: ro.bootloader	getprop

Checks Qemu related system properties. 1 TTPs 5 IoCs

Checks for Android system properties related to Qemu for Emulator detection.

defense_evasion

System Checks

T1633.001

description	ioc	Process
Accessed system property	key: ro.kernel.android.qemud	getprop
Accessed system property	key: init.svc.qemu-props	getprop
Accessed system property	key: ro.kernel.qemu	getprop
Accessed system property	key: ro.kernel.qemu.gles	getprop
Accessed system property	key: ro.kernel.qemu.vsync	getprop

Loads dropped Dex/Jar 1 TTPs 6 IoCs

Runs executable file dropped to the device during analysis.

evasion

Download New Code at Runtime

T1407

ioc	pid	Process
/data/user/0/com.leiwfw.emgrmcum/app_wyzf_plg/pay_plg.jar	4311	/system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.leiwfw.emgrmcum/app_wyzf_plg/pay_plg.jar --output-vdex-fd=49 --oat-fd=52 --oat-location=/data/user/0/com.leiwfw.emgrmcum/app_wyzf_plg/oat/x86/pay_plg.odex --compiler-filter=quicken --class-loader-context=&
/data/user/0/com.leiwfw.emgrmcum/app_wyzf_plg/pay_plg.jar	4267	com.leiwfw.emgrmcum
/data/user/0/com.leiwfw.emgrmcum/files/Plugin2.apk	4459	/system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.leiwfw.emgrmcum/files/Plugin2.apk --output-vdex-fd=113 --oat-fd=114 --oat-location=/data/user/0/com.leiwfw.emgrmcum/files/oat/x86/Plugin2.odex --compiler-filter=quicken --class-loader-context=&
/data/user/0/com.leiwfw.emgrmcum/files/Plugin2.apk	4267	com.leiwfw.emgrmcum
/data/user/0/com.leiwfw.emgrmcum/app_wyzf_plg/5.3.0.jar	4529	/system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.leiwfw.emgrmcum/app_wyzf_plg/5.3.0.jar --output-vdex-fd=113 --oat-fd=114 --oat-location=/data/user/0/com.leiwfw.emgrmcum/app_wyzf_plg/oat/x86/5.3.0.odex --compiler-filter=quicken --class-loader-context=&
/data/user/0/com.leiwfw.emgrmcum/app_wyzf_plg/5.3.0.jar	4267	com.leiwfw.emgrmcum

Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
banker discovery

Security Software Discovery
T1418.001
Queries the phone number (MSISDN for GSM devices) 1 TTPs
discovery

System Network Configuration Discovery
T1422

Reads the content of SMS inbox messages. 1 TTPs 1 IoCs

collection

SMS Messages

T1636.004

description	ioc	Process
URI accessed for read	content://sms/inbox	com.leiwfw.emgrmcum

Reads the content of the SMS messages. 1 TTPs 1 IoCs

collection

SMS Messages

T1636.004

description	ioc	Process
URI accessed for read	content://sms/	com.leiwfw.emgrmcum

Requests cell location 2 TTPs 1 IoCs

Uses Android APIs to to get current cell location.

collection discovery defense_evasion

Location Tracking

T1430

Geofencing

T1627.001

description	ioc	Process
Framework service call	com.android.internal.telephony.ITelephony.getCellLocation	com.leiwfw.emgrmcum

Queries information about active data network 1 TTPs 1 IoCs

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.IConnectivityManager.getActiveNetworkInfo	com.leiwfw.emgrmcum

Queries information about the current Wi-Fi connection 1 TTPs 1 IoCs

Application may abuse the framework's APIs to collect information about the current Wi-Fi connection.

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.wifi.IWifiManager.getConnectionInfo	com.leiwfw.emgrmcum

Queries the mobile country code (MCC) 1 TTPs 1 IoCs

discovery

System Network Configuration Discovery

T1422

description	ioc	Process
Framework service call	com.android.internal.telephony.ITelephony.getNetworkCountryIsoForPhone	com.leiwfw.emgrmcum

Queries the unique device ID (IMEI, MEID, IMSI) 1 TTPs
discovery

System Network Configuration Discovery
T1422
Reads information about phone network operator. 1 TTPs
discovery

System Network Configuration Discovery
T1422

Requests dangerous framework permissions 18 IoCs

description	ioc
Allows read only access to phone state, including the current cellular network information, the status of any ongoing calls, and a list of any PhoneAccounts registered on the device.	android.permission.READ_PHONE_STATE
Allows an application to write to external storage.	android.permission.WRITE_EXTERNAL_STORAGE
Allows an application to read from external storage.	android.permission.READ_EXTERNAL_STORAGE
Allows an application to read SMS messages.	android.permission.READ_SMS
Allows an application to receive SMS messages.	android.permission.RECEIVE_SMS
Allows an application to send SMS messages.	android.permission.SEND_SMS
Allows an app to access approximate location.	android.permission.ACCESS_COARSE_LOCATION
Allows an app to create windows using the type LayoutParams.TYPE_APPLICATION_OVERLAY, shown on top of all other apps.	android.permission.SYSTEM_ALERT_WINDOW
Allows an application to initiate a phone call without going through the Dialer user interface for the user to confirm the call.	android.permission.CALL_PHONE
Required to be able to access the camera device.	android.permission.CAMERA
Allows an application to send SMS messages.	android.permission.SEND_SMS
Allows read only access to phone state, including the current cellular network information, the status of any ongoing calls, and a list of any PhoneAccounts registered on the device.	android.permission.READ_PHONE_STATE
Allows an application to write to external storage.	android.permission.WRITE_EXTERNAL_STORAGE
Allows an application to read SMS messages.	android.permission.READ_SMS
Allows an app to access approximate location.	android.permission.ACCESS_COARSE_LOCATION
Allows an app to access precise location.	android.permission.ACCESS_FINE_LOCATION
Allows an application to read from external storage.	android.permission.READ_EXTERNAL_STORAGE
Allows an application to receive SMS messages.	android.permission.RECEIVE_SMS

Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs

persistence

Broadcast Receivers

T1624.001

description	ioc	Process
Framework service call	android.app.IActivityManager.registerReceiver	com.leiwfw.emgrmcum

Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs

impact

Data Encrypted for Impact

T1471

description	ioc	Process
Framework API call	javax.crypto.Cipher.doFinal	com.leiwfw.emgrmcum

Checks CPU information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/cpuinfo	cat /proc/cpuinfo

Checks memory information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/meminfo	com.leiwfw.emgrmcum

com.leiwfw.emgrmcum
1⤵
- Loads dropped Dex/Jar
- Reads the content of SMS inbox messages.
- Reads the content of the SMS messages.
- Requests cell location
- Queries information about active data network
- Queries information about the current Wi-Fi connection
- Queries the mobile country code (MCC)
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Uses Crypto APIs (Might try to encrypt user data)
- Checks memory information
PID:4267
- /system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.leiwfw.emgrmcum/app_wyzf_plg/pay_plg.jar --output-vdex-fd=49 --oat-fd=52 --oat-location=/data/user/0/com.leiwfw.emgrmcum/app_wyzf_plg/oat/x86/pay_plg.odex --compiler-filter=quicken --class-loader-context=&
  2⤵
  - Loads dropped Dex/Jar
  PID:4311
- cat /proc/cpuinfo
  2⤵
  - Checks CPU information
  PID:4334
- getprop apps.customerservice.device
  2⤵
  PID:4358
- /system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.leiwfw.emgrmcum/files/Plugin2.apk --output-vdex-fd=113 --oat-fd=114 --oat-location=/data/user/0/com.leiwfw.emgrmcum/files/oat/x86/Plugin2.odex --compiler-filter=quicken --class-loader-context=&
  2⤵
  - Loads dropped Dex/Jar
  PID:4459
- service list
  2⤵
  PID:4483
- getprop
  2⤵
  - Checks Android system properties for emulator presence.
  - Checks Qemu related system properties.
  PID:4504
- /system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.leiwfw.emgrmcum/app_wyzf_plg/5.3.0.jar --output-vdex-fd=113 --oat-fd=114 --oat-location=/data/user/0/com.leiwfw.emgrmcum/app_wyzf_plg/oat/x86/5.3.0.odex --compiler-filter=quicken --class-loader-context=&
  2⤵
  - Loads dropped Dex/Jar
  PID:4529

Network

MITRE ATT&CK Mobile v16

Initial Access

Execution

Persistence

Event Triggered Execution

T1624

Broadcast Receivers

T1624.001

Privilege Escalation

Defense Evasion

Download New Code at Runtime

T1407

Execution Guardrails

T1627

Geofencing

T1627.001

Virtualization/Sandbox Evasion

T1633

System Checks

T1633.001

Credential Access

Discovery

Location Tracking

T1430

Software Discovery

T1418

Security Software Discovery

T1418.001

System Information Discovery

T1426

System Network Configuration Discovery

T1422

System Network Connections Discovery

T1421

Lateral Movement

Collection

Location Tracking

T1430

Protected User Data

T1636

SMS Messages

T1636.004

Command and Control

Exfiltration

Impact

Data Encrypted for Impact

T1471

Replay Monitor

Loading Replay Monitor...

Downloads

5.3.0.jar

Path /data/data/com.leiwfw.emgrmcum/app_wyzf_plg/5.3.0.jar
Size 48KB
SHA256 aebf9e15ce1d2dca3257517d292c45a65f4f47393f3244e560ad67c5be8bddcc
MD5 40e9bf119530bc5eaf778e305179ad7c
SHA1 9b4b8ebecb04f08259172e32f8895030e8498e31
SHA512 07b3ace7cb450f15aa26e287a9bbde3297e23e77b2aaca0a4a0dd21d824234f1e6f3ecfa0b5a21b0b9dd83498fe7071f32e4ebaacaf730f487ecbb877950cfaa
SSDEEP 768:7q9S1JVD817nWSV5lb004yVTH9VTixGVTyIag/aykb14GmjmrxYBC0K0HmxyfF52:7HsT4yVTH3u6TV/ay8Nrx0rKYmxEF5+H
TLSH
T10923F01E7052A65D86F2380E335AAB7CF66CE04135D23EA7C9B88527E21F8E909DC15D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pay_plg.jar

Path /data/data/com.leiwfw.emgrmcum/app_wyzf_plg/pay_plg.jar
Size 60KB
SHA256 ddedf666700cf84b9fbbfd3abd86ba9f4814843802be03e354d3c42b90f6ba93
MD5 84c38bdf6bc48127bf310fc09de647a0
SHA1 049cea8e8541835455ceae59b974e9558971183b
SHA512 8f6d15295242e920708e4c9ae0a6ca4e46dbb378269076f74f595c3d9027d1badd4abaf87451dba54f3a9b22d3774b0d28f1344bfcff38b4ceaa3e09e8933ea9
SSDEEP 1536:Zz2ABSQEJFdj0dZpllX0CHmzu9KxW7Hx3EpRniuc+ihncQ/QPt:ZJ5EJjjiX0WDMxsd0XcPhKV
TLSH
T1D45302CA884E49D1451EE6B753EF2FD4B417E5F3398126CFE82B92A41FB1B85604809D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

740410100062013

Path /data/data/com.leiwfw.emgrmcum/databases/740410100062013
Size 4KB
SHA256 0a8ffb6b327963558716e87db8946016d143e39f895fa1b43e95ba7032ce2514
MD5 f2b4b0190b9f384ca885f0c8c9b14700
SHA1 934ff2646757b5b6e7f20f6a0aa76c7f995d9361
SHA512 ec12685fc0d60526eed4d38820aad95611f3e93ae372be5a57142d8e8a1ba17e6e5dfe381a4e1365dddc0b363c9c40daaffdc1245bd515fddac69bf1abacd7f1
TLSH
T1CD810441534000F1D05407F354D1130C1F47D1D5D5410F03351100C5DC415C40C70FC5
MD5 SHA1 SHA512 TLSH

Submit Download

740410100062013-journal

Path /data/data/com.leiwfw.emgrmcum/databases/740410100062013-journal
Size 512B
SHA256 d2a4c167776a05ab9e7e45e880dcf1b0ace7748a78e9de6d283e2cf84b612993
MD5 58edd7070d0fc0895cf145b86e627642
SHA1 1e7297608e58cae3f4ec87bfd0b2eab73bf4e940
SHA512 efc0f8e22c38c33e0993604327cc3b81045b287ecb36d3546bc6a62f51f99286417beef64e90637303b3cfc1a24cc275d0a9067f8606401fa942e196e2a93552
MD5 SHA1 SHA512

Submit Download

740410100062013-shm

Path /data/data/com.leiwfw.emgrmcum/databases/740410100062013-shm
Size 32KB
SHA256 c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479
MD5 bb7df04e1b0a2570657527a7e108ae23
SHA1 5188431849b4613152fd7bdba6a3ff0a4fd6424b
SHA512 768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012
SSDEEP 3::
MD5 SHA1 SHA512 SSDEEP

Submit Download

740410100062013-wal

Path /data/data/com.leiwfw.emgrmcum/databases/740410100062013-wal
Size 140KB
SHA256 1e8e66900f821555a6a0df0797d469b75adc549749eb44f58787d0bf4bb93435
MD5 12a485f91b0a4af57c52117a5c65906d
SHA1 748599aa4d75f177cc6d43a59aefe241490c1ef6
SHA512 e7066b015445e9e6a93a3830c55b9c13c88886ca61dcf382415d28d591c2935155171f02bca3823250a4dd47287f065c17ef427c05c7bb2f16fad2f96deefa9a
SSDEEP 192:RC9qa8t91hmOeW18OttyPcRFzCUut8H4V:wYvt91h1r7EUua
TLSH
T18CE363F72A082721D70D8E36458292439B7CA76E9DC29BC3A9719C351ED3D802439CBD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Plugin2.apk

Path /data/data/com.leiwfw.emgrmcum/files/Plugin2.apk
Size 96KB
SHA256 77ff63fc4125b3c1bf970feb1722e02cf43c9c4d6abeff4b2cccb6a9e55a51ef
MD5 38e2a484a18765834e721e42df3b89cb
SHA1 21bb2bc4f29e40abdb103b9d64af815956cb504b
SHA512 1ad43dbcfdffe2c21649e043ed3e6a61f81f69ac53bac68a9350624b3613be8c249ff0df5b8b7711cb13e030033d23aa71bc3f730becabede1040417f576a618
SSDEEP 1536:Kh6mBpBM3vDKmJJj0Z/maH2/88Hsv0SBblAi9HQ1oF1YOVUAOgrULB+hsr:UFKbPIZ/me8Mv0s1q25VU3lBwsr
TLSH
T138A3124FE694F63CE1FBCB34F0E28738B73AC919D961534F682A6088D9336905580F99
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jiepayplugin.apk

Path /data/data/com.leiwfw.emgrmcum/files/jiepayplugin.apk
Size 46KB
SHA256 f43a70684b7cdbba963da30122103866ca9c8aed7ed04e7007399ea12d10af90
MD5 1c8bc255f8123e7c34e49dffe5d1d9a9
SHA1 d5d10a7f20171b04ddf7da46cb3ee6dd7447a150
SHA512 5335da7e1bf4ee883b4faa78006a3915652b040a5e830f6aded9c7e75c1c06a686dc2e4081bd3da3a5714c1b5fb34cccbc11c9655b03da9c59a551267287d63e
SSDEEP 768:6It03WP8WHHryWzArGI7edVTIo7cE2Kqz4LyvNm+gY9Tu2fPrEfphz:6NYPWGfTIE/qMYgWZP+phz
TLSH
T15F23F122BF4B789AF60A593B21FBA123F056CBE491410B774F36325D683FF906B12458
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

shunpay_config

Path /data/data/com.leiwfw.emgrmcum/files/shunpay_config
Size 12B
SHA256 8f4e0794026c8e7994df0d791f16dab227c6b1d473547d4d1b38eb682fa613d1
MD5 44b753427fa207b671e4a49e0e4b1e9b
SHA1 318e2dfbbe9737546f8300dcad50ae8d7aeeefdb
SHA512 604e94fab28456cf0a4b9d5dbdfb93cf9a92fa920cf0e1c1534a441247f0d727970a66b0294a6a69089b469a0ef9f32d1954641aa095a67509da83c21511bbf7
MD5 SHA1 SHA512

Submit Download

5.3.0.jar

Path /data/user/0/com.leiwfw.emgrmcum/app_wyzf_plg/5.3.0.jar
Size 109KB
SHA256 32eb5440ff205d5584be465ba5f677f3cd2015e30e1c8c519e7d21ed0846452e
MD5 cd4f131a109c4e053e5ef5c02ddb6041
SHA1 7b98be9e4cacfa142d2d1bb2065a1b66b81c0aac
SHA512 d24004ea8fd73fd8ec3c183025d4f78b7f878b94d8cfe866bad1df62e9c0b77b5eeb230c52d793a4e0d0cf211ccc4e37a1e45cf2c5acf2edaf61389f86f131a3
SSDEEP 3072:lKsPcIc5Cr7dE+baxrwK8b1gmNJJsr5HffoOgKsqh:xbrhBb+w+2Y4OgKsqh
TLSH
T1D0B35C57BB91A413CD6D8F3764E3AB811732F6062F53C343888859B6EDC63C27D9A294
MD5 SHA1 SHA512 SSDEEP TLSH

Download

5.3.0.jar

Path /data/user/0/com.leiwfw.emgrmcum/app_wyzf_plg/5.3.0.jar
Size 109KB
SHA256 1ff40b2f0942752b5867c952a20fe0696bc1d98b7607da830045778d0ae77be8
MD5 eae245c98ea9490d5f420d60f7022385
SHA1 7dc661c4ec945510d480de5956be7ef0818c1013
SHA512 3d6cf69ddc595bf6e5546626874498122c0344c34330aaf2935defc5d4f92ad24434bd846eb0ba7ce8ca458043f70796f1581fef14840429e8a79f3e7db6bc6c
SSDEEP 3072:lKsP3QB9mhdEpvK8b1gmNJJsr5HffoOgKsqh:xrrWv+2Y4OgKsqh
TLSH
T10DB35D16FB919492DE6D873A74D29B812732FB1A2F17C3438888D9F6ADC13C37D86194
MD5 SHA1 SHA512 SSDEEP TLSH

Download

pay_plg.jar

Path /data/user/0/com.leiwfw.emgrmcum/app_wyzf_plg/pay_plg.jar
Size 139KB
SHA256 a6ab2fa4f7a3d979bc9f1b098fe7b7294dd8c1c933affed7ee00f46b8aaf08e2
MD5 76bec5e9d8ae3e2df33737b2bf355006
SHA1 5950a3ecdb8c8fc75b9c2593b24348abaa2cafe1
SHA512 1e1624e3304f5dee2cd91616f241bc5c2b19f3ec8d18f2dd75e57f1416adeff3f95f23c41bbd4a02789a481bd548ab69c37632c712d8e99e89c8aa0c8e838ee5
SSDEEP 3072:xz4vOQtNG/LQsxYIrxXI39uCsRsQ1b9WcV:ivf6LYIrc96sh0
TLSH
T143D33A07FB80AE23E989A73250E303456736F4155F63A78B598544BAECC26C63F5F1E8
MD5 SHA1 SHA512 SSDEEP TLSH

Download

pay_plg.jar

Path /data/user/0/com.leiwfw.emgrmcum/app_wyzf_plg/pay_plg.jar
Size 139KB
SHA256 786ddeb939dbbe259de94c1b11d60e89d54ecba5532afb4bdcc5c24aef0f010e
MD5 4eb1ec5bc2f45753e81b371cd3517867
SHA1 893b5ff1417cfdf01ad262098742ad95c0c1b8dd
SHA512 03cf7058d4f890a8b89eee2e47648cb5d75db95364d5f37b3874d3eb58545e3f76b917c4125eae8950c54a1d75b960cad51d8a47637e927b00cd8b411bb02877
SSDEEP 3072:xz4rL59WPJq/1owq5AIrxXI39uCsRsQ1b9WcV:in6KowZIrc96sh0
TLSH
T1A2D31916FF80AA52ED99973860E343013732F9299B37E74759C684B76E812C33F5B198
MD5 SHA1 SHA512 SSDEEP TLSH

Download

Plugin2.apk

Path /data/user/0/com.leiwfw.emgrmcum/files/Plugin2.apk
Size 206KB
SHA256 2e80dd205ff415e530a217310fb52a9f97cdcf5db3c9f0b1e0401663cd00011f
MD5 cafd25d8741a3a816dc68fa1ddd26612
SHA1 df3b581874de4e3a9e5e624aebd8dafd7f07884e
SHA512 c99637604c502456ad6aa2aaef97f18fdceca5e2143af074b97a8b0d3b2f96ae01eca3317cc6fa3c7fe132c796e828ab23c63eb1343345946f957d1e487e151e
SSDEEP 3072:UN5r36EUqAhV+18dYU/CMZqp/aX0+GKkLF+kuJihuPaSQPSEy3bZ7zJx:REomlpE0+IvhiLKyr1b
TLSH
T1BF241932AA61A627ECAF9B3180D3C6C2F73AF9512707C353059C10B5FC963DA4E6E594
MD5 SHA1 SHA512 SSDEEP TLSH

Download

Plugin2.apk

Path /data/user/0/com.leiwfw.emgrmcum/files/Plugin2.apk
Size 206KB
SHA256 1f60ae0f7ca558ee9b0a6745881b7123925e603afbb4ec0ea1c973c38e659901
MD5 52e90ce3cc1f84fccc81e46706bf338f
SHA1 3f98d84bead1db6dda6b3c773300787b6677f324
SHA512 3dfad621b9df17981eeb9f227176b6b36a144a613d7a07f5b827798fe8b8db1b108ad2404daaa3157261b34ed4435510a0476e4303bb1b52d8e6a1de42524acb
SSDEEP 3072:UN5r36E9/ety2pLuIsDCI4pRc+YM1v5lGRG6V0IeIF+kuJihuPaSQPSEy3bZ7zJx:REIEyI4pRH1QlVNvhiLKyr1b
TLSH
T134243B32E951A692ECAF923990C3C282B736FD50371B8363055D94F5BC853E79AEF058
MD5 SHA1 SHA512 SSDEEP TLSH

Download