9cde5c6ea53d33b106e750225f49a9a7d4c989eefed67af392f8d51be66d3451

Analysis

max time kernel
6s
max time network
152s
platform
android-9_x86
resource
android-x86-arm-20260325-en
resource tags

arch:armarch:x86image:android-x86-arm-20260325-enlocale:en-usos:android-9-x86system
submitted
12/10/2026, 23:46

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
jaffacakes118_not-a-virus.HEUR.RiskTool.AndroidOS.SmsPay.il.apk
Size 1.9MB
Sample261012-3sraqstsbx
SHA256 9cde5c6ea53d33b106e750225f49a9a7d4c989eefed67af392f8d51be66d3451
MD5 609facd197639ab6b9d0d740e1b1e281
SHA1 ea95783a8d8a5f9a839cdd4669313a3be59f7311
SHA512 21acd2d75736810eb4e57396ed534f31052e3f44e2373d3e15df5424c0869222263b4915f5f7934ffffb119682d42d149dda447c63b4e5a7f5db425d41853893
SSDEEP 49152:2D54vdljC3im1kqUh1b+nnqQv7tcKZQoF6q:2iC3imrUPsnR75uoIq
TLSH
T1849533426E89A218D37611309F99F259BB2DAC0E4A9FF63B4635706C4EBBDC08F45F44
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

discovery

Malware Config

Signatures

Domain associated with commercial stalkerware software, includes indicators from echap.eu.org 1 IoCs

flow	ioc
12	alog.umeng.com

Queries information about active data network 1 TTPs 1 IoCs

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.IConnectivityManager.getActiveNetworkInfo	com.yelye.wewewleop.pp

Queries information about the current Wi-Fi connection 1 TTPs 1 IoCs

Application may abuse the framework's APIs to collect information about the current Wi-Fi connection.

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.wifi.IWifiManager.getConnectionInfo	com.yelye.wewewleop.pp

Checks CPU information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/cpuinfo	com.yelye.wewewleop.pp

com.yelye.wewewleop.pp
1⤵
- Queries information about active data network
- Queries information about the current Wi-Fi connection
- Checks CPU information
PID:4257

Network

MITRE ATT&CK Mobile v16

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

T1633

System Checks

T1633.001

Credential Access

Discovery

System Information Discovery

T1426

System Network Connections Discovery

T1421

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

cc.db

Path /data/data/com.yelye.wewewleop.pp/databases/cc/cc.db
Size 36KB
SHA256 474c4a54534ed96beacad7cc9a805a3f53ec9c0522fc7bcc59771cf500a6a0da
MD5 5d7ea1a23af19b4340cc8d90f28297d5
SHA1 4cfe95b23a9e98378d69c4290af81b51fbe76aea
SHA512 33071f4c92da0a3df01c4a61dd165df7c7e0f4f37753cafe02d19fc876a5e7fcbb01c069c804e140ab8bfa0644a55f50fd1373646d1c439f817baa5ffbd47f7b
SSDEEP 12:TCFP2yMHdqVcV7p5WUYUW5LfpBKKyBGtbDrNTSFbycKrHBGtb5RmBEyPb8FOwGQn:Tz7sL7yot3BVrHotGGSgGQQQ
TLSH
T186F29EC397101162C97C51B3FD9592620E74962EC7B71746BEE015066DC5B01F83AEFC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cc.db

Path /data/data/com.yelye.wewewleop.pp/databases/cc/cc.db
Size 36KB
SHA256 7b45f576c08c7f78220168cca4a0e33198b13e9bdc8b1da406ddb6887412000c
MD5 ce6135aa1b1fe4f2c2db2a546d2a5558
SHA1 79b59582154017aadab783dc266fcb158c252940
SHA512 2839075fe374c8567c839ae35ce2d33ec72fdaebf170aa7d224b555e5b0e74d4a43f2f67d17ed806dae841da883e9620d788ea052d06152678afa927307c7ce4
SSDEEP 3:o1Xll41Xll41Xllv1Xll:oQQ
MD5 SHA1 SHA512 SSDEEP

Submit Download

cc.db-journal

Path /data/data/com.yelye.wewewleop.pp/databases/cc/cc.db-journal
Size 512B
SHA256 78ddf2b70a50a1fd9b99c47ab1f808a88679bc93d798dbd187e2ae563a010c33
MD5 c1b800a0c9ef73636f2ebc0bcc821cbe
SHA1 07e27fd4c59ba63d83288deca4db5dd8d179d4e8
SHA512 4915e85cee9eddfab0cfab18700f4405f914cd1b0d1deb984ebf63b98b920a7040fd1229d07400c4a838b85003a8a9ae18721a55acdeacf72e707d0b25806c58
MD5 SHA1 SHA512

Submit Download

cc.db-shm

Path /data/data/com.yelye.wewewleop.pp/databases/cc/cc.db-shm
Size 32KB
SHA256 c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479
MD5 bb7df04e1b0a2570657527a7e108ae23
SHA1 5188431849b4613152fd7bdba6a3ff0a4fd6424b
SHA512 768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012
SSDEEP 3::
MD5 SHA1 SHA512 SSDEEP

Submit Download

cc.db-wal

Path /data/data/com.yelye.wewewleop.pp/databases/cc/cc.db-wal
Size 48KB
SHA256 64a80a057e680659c6bdcc624c46d939aad6c041c74671ca918306aac643901e
MD5 aa056adf97d502895b06ab2e083d2662
SHA1 b476248725ef3f4664772ca9848a6e41b70a5143
SHA512 a8ca4f1e52d40756249f1d061bea3c9fbebc8ae6a61ba511c86f2723d405ce5574d1eae7812ee5265d2a2cf2afa263279eed1282e0ade3c1f165775232bec299
SSDEEP 24:KnqzyGSP/2huaxz7sL7yot3BVrHotGGSP/Oa:TzNSP/boshBWfSP/H
TLSH
T1CF23CBC3A3100163D82C51BBBDD5D2171E75A63E93B74F477AE0191E7C86A44A435EE8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cc.db-wal

Path /data/data/com.yelye.wewewleop.pp/databases/cc/cc.db-wal
Size 16KB
SHA256 ca67ec339df3a1d98df3eb888f9b1c9f9cbd783fdf76cbff933b27c6239956d0
MD5 b40007956e76d69cc4e42813744ab076
SHA1 f354ec1d2bec25300404f24eb6a37c6994965cff
SHA512 99d1efdf15d65d64f371b977528aeb31159254c1799a46fa5eb012c1d2b0d78c902a60450f5907669a1cb13caa04ce9a4df4ea137a2865a17734b799b962563a
SSDEEP 3:OlH/l9uSD+nqe9YwLvHgNlfllNwUFXjDl3llnluSzobUl3llDeG9Xll:KwnD6mANP7ttHG8
TLSH
T1757292327642273DC05E327A0E6A401310B826CCC4C51C1971ABF4508CC162F2533F6C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

.imprint

Path /data/data/com.yelye.wewewleop.pp/files/.imprint
Size 1001B
SHA256 ad73b82b15cc1a22e971d5cb461e97ca7b9cd373ad4053f488fa7d9be3d73d20
MD5 7038a59dccb0c89181577ad15612abee
SHA1 9736e6b8a89f41d9f4daa23409ba53bd83ae2989
SHA512 6d496035d0017e531598083884af0295c039f1219e39245943b05c5e6b6f6bbb65202c9ec384c9b8e283756627fd704aafd7189fc2fc9080e21692818d7e7f4b
TLSH
T1BA11A8A78C78A120F2FBCE8A01C2EFC3E6C5DB1A844C4A2268427383073604C65DA54A
MD5 SHA1 SHA512 TLSH

Submit Download

exchangeIdentity.json

Path /data/data/com.yelye.wewewleop.pp/files/.umeng/exchangeIdentity.json
Size 162B
SHA256 1bd68e24967c151f3057e21225c7730fd9069437953f2c801011e8e53b37efad
MD5 0a3b3990264ea166447e572af2dc1012
SHA1 e1b3fc3512e762eea4a7beeebb1b9c8ce1d0c16a
SHA512 ca5809c4429c50e986cad0d4f1778b0550b9dd2d4ec5382ea8e5569c6678b195379f97961ece8ebdb141c1fb9174e6014241f32df4a6f2b6391676582dcbce59
TLSH
T187C02B2562A15C7B4068B16F64C742A320ABA57D33CCB8052BE5010ECFDC3B52F4B813
MD5 SHA1 SHA512 TLSH

Submit Download

exid.dat

Path /data/data/com.yelye.wewewleop.pp/files/exid.dat
Size 57B
SHA256 2382b4d710d6edc6f5ab717ef10c8246f14cb26d0e367c29cab5247336aee59b
MD5 fee0b059af0156286065b5b9bbbe5f94
SHA1 7789e6b7186d078c6392c62aba7d980482ade4bf
SHA512 0577eae36ad858ce24638caa0815a4c7008a460fa2a32151db53dcd68531beea2aaecad521f7a633d6577cdd76b8d23b6e4b9e4b4af102e3a170e0dee3bc9c9c
TLSH
T15290028890B54CF67160758F5559452E1117B63577916024A4D51604CBB8515501C813
MD5 SHA1 SHA512 TLSH

Submit Download

umeng_it.cache

Path /data/data/com.yelye.wewewleop.pp/files/umeng_it.cache
Size 211B
SHA256 bd6358b033c5a65ed6cf7fff980c3fdf47e3cc0f874975b55aef0840183da9c9
MD5 f4bc06597c30b468659c7e5203db40e4
SHA1 7af612a7e30c05bc9c4477912faaa4664cde2438
SHA512 c94e440a6cb23d183fe8b474bff28c5d18a1a2f12b77cc21e6006d62d0160e5c1fe432a6412cdc764d7ca672e88bbbb4c28111a767c96f8cda85278525c290e3
TLSH
T13DD0A77871240853864254B1364072C3FF06B8B200A406B6642651C416F9571CA4030B
MD5 SHA1 SHA512 TLSH

Submit Download

umeng_it.cache

Path /data/data/com.yelye.wewewleop.pp/files/umeng_it.cache
Size 415B
SHA256 3b2d157a3f0b010225ff011cabd90ab572428a1bee04ef8faaaafe64c4929496
MD5 e504bae0406a6e0f1ea2442865ccf87e
SHA1 059135e57e323564a3bae8491564d278d1b34e1c
SHA512 4ab834b615ed58579243f4476fad0eeb249f5d5b03774b317fc620b4548e932866895704c1d1393d3cb3c83eddf66740c4fea9166c71c69057bb2fadfe4b513c
TLSH
T1FCE0E578B2240867C697A4B22B917383FF07E87305B40AEBB47792C86679561CB8430B
MD5 SHA1 SHA512 TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Mobile v16

Replay Monitor

Loading Replay Monitor...

Downloads