c203211c7cc2d6f7fb49efd4b27133d12b0b944efddaaa2b8813330d92d2974b

Analysis

max time kernel
6s
max time network
150s
platform
android-9_x86
resource
android-x86-arm-20260325-en
resource tags

arch:armarch:x86image:android-x86-arm-20260325-enlocale:en-usos:android-9-x86system
submitted
12/10/2026, 23:46

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
jaffacakes118_not-a-virus.HEUR.RiskTool.AndroidOS.SmsPay.il.apk
Size 1.9MB
Sample261012-3spf5stsbv
SHA256 c203211c7cc2d6f7fb49efd4b27133d12b0b944efddaaa2b8813330d92d2974b
MD5 46ac56c3c385af0a97ea8e5f4888bd76
SHA1 73e5b1587fb331ec14bc7b606ec77cfba275284a
SHA512 af8dd1d15ea770f3b405527e6ea18fddcc1d3d6771d27180f18c81e52ebce291950245b5b06eaeccef883e60684c1c51180df86220f30f7fbd673aff6c5de2e4
SSDEEP 49152:2DCUvdlgUtGcH9xLWQR+/ZrWWItLomn0ylFrUzq+L6j:24UvdIQJWItvzlNU++uj
TLSH
T18C953342F556E60CD33B40356E9AE18CB63E8C291846F7371F12B1E84EB7EC54A99F84
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

discovery

Malware Config

Signatures

Domain associated with commercial stalkerware software, includes indicators from echap.eu.org 1 IoCs

flow	ioc
9	alog.umeng.com

Queries information about active data network 1 TTPs 1 IoCs

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.IConnectivityManager.getActiveNetworkInfo	com.yelye.wewewleop.pp

Queries information about the current Wi-Fi connection 1 TTPs 1 IoCs

Application may abuse the framework's APIs to collect information about the current Wi-Fi connection.

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.wifi.IWifiManager.getConnectionInfo	com.yelye.wewewleop.pp

Reads information about phone network operator. 1 TTPs
discovery

System Network Configuration Discovery
T1422

Checks CPU information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/cpuinfo	com.yelye.wewewleop.pp

com.yelye.wewewleop.pp
1⤵
- Queries information about active data network
- Queries information about the current Wi-Fi connection
- Checks CPU information
PID:4295

Network

MITRE ATT&CK Mobile v16

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

T1633

System Checks

T1633.001

Credential Access

Discovery

System Information Discovery

T1426

System Network Configuration Discovery

T1422

System Network Connections Discovery

T1421

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

cc.db

Path /data/data/com.yelye.wewewleop.pp/databases/cc/cc.db
Size 36KB
SHA256 474c4a54534ed96beacad7cc9a805a3f53ec9c0522fc7bcc59771cf500a6a0da
MD5 5d7ea1a23af19b4340cc8d90f28297d5
SHA1 4cfe95b23a9e98378d69c4290af81b51fbe76aea
SHA512 33071f4c92da0a3df01c4a61dd165df7c7e0f4f37753cafe02d19fc876a5e7fcbb01c069c804e140ab8bfa0644a55f50fd1373646d1c439f817baa5ffbd47f7b
SSDEEP 12:TCFP2yMHdqVcV7p5WUYUW5LfpBKKyBGtbDrNTSFbycKrHBGtb5RmBEyPb8FOwGQn:Tz7sL7yot3BVrHotGGSgGQQQ
TLSH
T186F29EC397101162C97C51B3FD9592620E74962EC7B71746BEE015066DC5B01F83AEFC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cc.db

Path /data/data/com.yelye.wewewleop.pp/databases/cc/cc.db
Size 36KB
SHA256 7b45f576c08c7f78220168cca4a0e33198b13e9bdc8b1da406ddb6887412000c
MD5 ce6135aa1b1fe4f2c2db2a546d2a5558
SHA1 79b59582154017aadab783dc266fcb158c252940
SHA512 2839075fe374c8567c839ae35ce2d33ec72fdaebf170aa7d224b555e5b0e74d4a43f2f67d17ed806dae841da883e9620d788ea052d06152678afa927307c7ce4
SSDEEP 3:o1Xll41Xll41Xllv1Xll:oQQ
MD5 SHA1 SHA512 SSDEEP

Submit Download

cc.db-journal

Path /data/data/com.yelye.wewewleop.pp/databases/cc/cc.db-journal
Size 512B
SHA256 c4fd3cbb3a432fdce3e64b139e0d1abc0e00e126b99a75bdd095011cd5d6a892
MD5 76c77eba21d28340c56dac11a0e61cce
SHA1 f1bce2485e3f9dd0dae711756dec2b32ecb8392f
SHA512 7e7aac49b957c1a95df8d795d82b782560623ebb8ac800c4d13065f33a74fc3c431479a5a637144142c5b741c16c61f92556e1ebf1b9d648b0e87c0ccc5c379b
MD5 SHA1 SHA512

Submit Download

cc.db-shm

Path /data/data/com.yelye.wewewleop.pp/databases/cc/cc.db-shm
Size 32KB
SHA256 c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479
MD5 bb7df04e1b0a2570657527a7e108ae23
SHA1 5188431849b4613152fd7bdba6a3ff0a4fd6424b
SHA512 768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012
SSDEEP 3::
MD5 SHA1 SHA512 SSDEEP

Submit Download

cc.db-wal

Path /data/data/com.yelye.wewewleop.pp/databases/cc/cc.db-wal
Size 48KB
SHA256 2df81e969897b5f2245a8aa6f83868f9957c719c65cb298f8499ba2096c0a2da
MD5 68840b3dd7be7eba9c94ffeac133b4c4
SHA1 c5cb136ef6847effd4ef1a8a99629c355504f697
SHA512 5fc59059420d2acc86754fb133cbd4d0575f6bf9120ae3165b54f7c18e5d7f26f6812ee15f6fba42f3bda589828fbceef98f041ab9092e6bf1596c4f2e2cb890
SSDEEP 24:KUfzyGSP/ccfyz7sL7yot3BVrHotGGSP/imUhg:xzNSP/cwyshBWfSP/t
TLSH
T140238EC2A7221AB2C56C01F7FD9593522EB49A2E83774B067AF009126D46706F527EAC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cc.db-wal

Path /data/data/com.yelye.wewewleop.pp/databases/cc/cc.db-wal
Size 16KB
SHA256 bcd35ce940b848e07c2131cffc75c430556044336529082be4e17cfb4e0f4a7c
MD5 eca9ccc534ac98fea05a219900ef4249
SHA1 291cbb4a2c163f5403a3a1a1231f1bb0626f4fe7
SHA512 60b00989081a36f80d920d738e6b9d7cfa405dfe0cbfa6b857dd22c622ab1e0c29beeb96b546ebef237f78b5fde11de99e7d5ea7b02ffe01e5b60d433b945736
SSDEEP 3:OlH/lJkgl9ynvty2dWTz4/fllkX+4vXllnloglYEzoXllJ2mWWUzG9/vXll:KwgqvZsz4Uu4veghzoQ
TLSH
T1B4729298B0A0F2F2D3AF407D8C3A201035FE458D74C86D24F201633B065432419F0E6C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

.imprint

Path /data/data/com.yelye.wewewleop.pp/files/.imprint
Size 1001B
SHA256 3596ed5f6df7f934d03a586c0061b965ff37d81c7845ca9f9e946db4332c8938
MD5 8005417b1d9a5b25195736a5783338b6
SHA1 ee88a656a5954dd6aae926448a416468ca99feed
SHA512 f5883395696a8a187f3aff7467ca00b33de2a54d65a21da6ea1c07f69468dbe201050adb6765f555ad663bfddda39af58cc303d5f5380fe1977b4215c20711f1
TLSH
T17311CBD89BE342B12A27FED605D7FA8EAB8CC3C56D64C00E321E9E9106217AD4851C17
MD5 SHA1 SHA512 TLSH

Submit Download

exchangeIdentity.json

Path /data/data/com.yelye.wewewleop.pp/files/.umeng/exchangeIdentity.json
Size 162B
SHA256 f9345b11b75a4ab98b7f2dbca404cfeb1ed6338f832a925ab3d6570e1d33b079
MD5 b0f6b69eb363a7d6922e77047159e82e
SHA1 7240566733ace0608af96fd501b51dad0d3ded8b
SHA512 ea03b7923575605732f18d19cee5d4a88425ba9893009db3401c14c8afa07d187d10860e911ae4ee69d7ce8d06c101d40d8d86daecb61381c27799981a3486f8
TLSH
T113C08CA895AA4CB469641608445E00F8028374BC2BB2F90A95CB1096CEAD030386F03B
MD5 SHA1 SHA512 TLSH

Submit Download

exid.dat

Path /data/data/com.yelye.wewewleop.pp/files/exid.dat
Size 57B
SHA256 2382b4d710d6edc6f5ab717ef10c8246f14cb26d0e367c29cab5247336aee59b
MD5 fee0b059af0156286065b5b9bbbe5f94
SHA1 7789e6b7186d078c6392c62aba7d980482ade4bf
SHA512 0577eae36ad858ce24638caa0815a4c7008a460fa2a32151db53dcd68531beea2aaecad521f7a633d6577cdd76b8d23b6e4b9e4b4af102e3a170e0dee3bc9c9c
TLSH
T15290028890B54CF67160758F5559452E1117B63577916024A4D51604CBB8515501C813
MD5 SHA1 SHA512 TLSH

Submit Download

umeng_it.cache

Path /data/data/com.yelye.wewewleop.pp/files/umeng_it.cache
Size 211B
SHA256 95f1a634121841479c0fa486b0575b2ace2d3a0956729f6809412747f9f83093
MD5 c372e33d6dd601c81ff54d2edcbd38cf
SHA1 cdd081bd11355fb6d1d5bf9572fc304630ce5520
SHA512 ed14b54c99fb13e939dc5087b4eee05cd45b036b5b9bf96649c3c219c3e73f58c1025dd6104aafd7c00d424ab75b6a322f5ba6ef121ff2fee29391705afeef24
TLSH
T160D0A798A0200193950654A0369473C3FF0DB9B200BD47BA302653C5453956ECA81347
MD5 SHA1 SHA512 TLSH

Submit Download

umeng_it.cache

Path /data/data/com.yelye.wewewleop.pp/files/umeng_it.cache
Size 415B
SHA256 9bb51718c6cdaee9cb874fad587edf32afae88a873b822f2173a97d32c342ae6
MD5 88c851268bab8390ba3c77dc9f8a0b97
SHA1 ee44ddc3aa48cafea0b2a215e52c9b4894d8781a
SHA512 c272a60b4f848939e5a0d90e133bf96eda29c2f074c80545a3cb13726cc530a4f505d791337304ec6aaaa76b1fa7245f9181dde183c1b7c370d54377513076e2
TLSH
T1A3E02758F0300193D20694612A9473C3EF4EDD7204B947EB306756C5413951ECA8134B
MD5 SHA1 SHA512 TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Mobile v16

Replay Monitor

Loading Replay Monitor...

Downloads