df5786d6baa9b763136a663e4d089b53e71a20cda56f586610022f63d30d8410

Analysis

max time kernel
7s
max time network
151s
platform
android-9_x86
resource
android-x86-arm-20260325-en
resource tags

arch:armarch:x86image:android-x86-arm-20260325-enlocale:en-usos:android-9-x86system
submitted
12/10/2026, 04:10

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
jaffacakes118_not-a-virus.HEUR.RiskTool.AndroidOS.SmsPay.il.apk
Size 1.9MB
Sample261012-erkjsse17x
SHA256 df5786d6baa9b763136a663e4d089b53e71a20cda56f586610022f63d30d8410
MD5 c121a518983ccd21918b1ca9b26537d9
SHA1 039a6934d0ef85af4616f05175707a2a18a12e1b
SHA512 0a9174d1cdae0b4834dd0263abc863cb5213ded97004a6718e99c12aa99984188f07518df4a30e5b9606c57d0ea798963f520405616f19f920476c9a43ab03e7
SSDEEP 49152:2DXFvdl/UtGcH9xLWQR+/ZrWWItLomn0ylFrYZYwZ6l:21UvdIQJWItvzlNYKw8l
TLSH
T1AF953341F556E60CD33B40356A96E19CA67E8C291846F7370F12B1E84EB7EC28E99FC4
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

discovery

Malware Config

Signatures

Domain associated with commercial stalkerware software, includes indicators from echap.eu.org 1 IoCs

flow	ioc
14	alog.umeng.com

Queries information about active data network 1 TTPs 1 IoCs

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.IConnectivityManager.getActiveNetworkInfo	com.yelye.wewewleop.pp

Queries information about the current Wi-Fi connection 1 TTPs 1 IoCs

Application may abuse the framework's APIs to collect information about the current Wi-Fi connection.

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.wifi.IWifiManager.getConnectionInfo	com.yelye.wewewleop.pp

Checks CPU information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/cpuinfo	com.yelye.wewewleop.pp

com.yelye.wewewleop.pp
1⤵
- Queries information about active data network
- Queries information about the current Wi-Fi connection
- Checks CPU information
PID:4264

Network

MITRE ATT&CK Mobile v16

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

T1633

System Checks

T1633.001

Credential Access

Discovery

System Information Discovery

T1426

System Network Connections Discovery

T1421

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

cc.db

Path /data/data/com.yelye.wewewleop.pp/databases/cc/cc.db
Size 36KB
SHA256 474c4a54534ed96beacad7cc9a805a3f53ec9c0522fc7bcc59771cf500a6a0da
MD5 5d7ea1a23af19b4340cc8d90f28297d5
SHA1 4cfe95b23a9e98378d69c4290af81b51fbe76aea
SHA512 33071f4c92da0a3df01c4a61dd165df7c7e0f4f37753cafe02d19fc876a5e7fcbb01c069c804e140ab8bfa0644a55f50fd1373646d1c439f817baa5ffbd47f7b
SSDEEP 12:TCFP2yMHdqVcV7p5WUYUW5LfpBKKyBGtbDrNTSFbycKrHBGtb5RmBEyPb8FOwGQn:Tz7sL7yot3BVrHotGGSgGQQQ
TLSH
T186F29EC397101162C97C51B3FD9592620E74962EC7B71746BEE015066DC5B01F83AEFC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cc.db

Path /data/data/com.yelye.wewewleop.pp/databases/cc/cc.db
Size 36KB
SHA256 7b45f576c08c7f78220168cca4a0e33198b13e9bdc8b1da406ddb6887412000c
MD5 ce6135aa1b1fe4f2c2db2a546d2a5558
SHA1 79b59582154017aadab783dc266fcb158c252940
SHA512 2839075fe374c8567c839ae35ce2d33ec72fdaebf170aa7d224b555e5b0e74d4a43f2f67d17ed806dae841da883e9620d788ea052d06152678afa927307c7ce4
SSDEEP 3:o1Xll41Xll41Xllv1Xll:oQQ
MD5 SHA1 SHA512 SSDEEP

Submit Download

cc.db-journal

Path /data/data/com.yelye.wewewleop.pp/databases/cc/cc.db-journal
Size 512B
SHA256 5460ca6a0d4d8de724f61b8b70d97a2446b7d66567c74cdfde3afc56cbb7e6f2
MD5 15452abf992a51e2fd15506fb3e792a2
SHA1 0ebf47e64ee30089f18eca3d41884579e6d39142
SHA512 0416d3e6f6f549831118b4a151fb1798855a0f0bb20bfb9783ba3b2c44be3e187087e4b349e8024c58b94a35b3b5112b2219118eb8885e2443638fc087e8f701
MD5 SHA1 SHA512

Submit Download

cc.db-shm

Path /data/data/com.yelye.wewewleop.pp/databases/cc/cc.db-shm
Size 32KB
SHA256 c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479
MD5 bb7df04e1b0a2570657527a7e108ae23
SHA1 5188431849b4613152fd7bdba6a3ff0a4fd6424b
SHA512 768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012
SSDEEP 3::
MD5 SHA1 SHA512 SSDEEP

Submit Download

cc.db-wal

Path /data/data/com.yelye.wewewleop.pp/databases/cc/cc.db-wal
Size 48KB
SHA256 33d13c630c015f1cd031f7be1735ebbc0655fc371bbcf30048644462d817ae87
MD5 385b5f41d0ff2e9bcdd397320295384a
SHA1 2f7f3f73123687a1186b70a3c829484995d903d3
SHA512 671d16698b2a87606e92898b31060f5fb5526b0979ac64613d4b87fe5de29092d701ee3bc7f5a8b1fa189daf79408f3d1d366447f66a0f628a1af4b84acd6330
SSDEEP 24:Ky8zyGSP/t/z7sL7yot3BVrHotGGSP/IrTw8:98zNSP/ZshBWfSP/IrE
TLSH
T14123A9C397140513C86812B3FD8583621E74E22E83B34B06BBA21E12EC87716B426EE8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cc.db-wal

Path /data/data/com.yelye.wewewleop.pp/databases/cc/cc.db-wal
Size 16KB
SHA256 c4652064ba4cee8dc559608948675fb672a3d5fff4ceaa37546aa219ead1a44e
MD5 96fb3e28ddcb3882cb9ad7204e86b0f2
SHA1 20396ab98524b46f53b56588a46b93ed234242af
SHA512 931b290694e5c944155ca5d37291dfe9540a0765fc0cf57d72281fd3253e9a73f1488a1e5ee9277a950ebe89da577de65a3a94eea376e25677e1ee0b1ba155a2
SSDEEP 3:OlH/lGjUClZalokHbiAsfllr2biayllnlOUCUgD9ll1XllGBAbih3gH9Xll:KUjUCl0lok7iAHiaVUC/l1eBki
TLSH
T1E37292103060ED31C2AF09320B230522286092FC05C1CD19B38CA1EF2ACBD17F234F8D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

.imprint

Path /data/data/com.yelye.wewewleop.pp/files/.imprint
Size 1001B
SHA256 f177655a3a64d2e3c897017c718435f0698937b3cdc93486bef50f1def8a87c3
MD5 9acf7ffb6a7ba4e83697ed3562298675
SHA1 11b27d1e77551d00de048fe919995c72dd9e415b
SHA512 0f52d4b3465e856eec7429852bd12cf0e73a7138b162d4e5066ba3bfb50b1f41a7562a72a724022c5db86f0892d90d3980d5bcbdabbffefe4434d0220da287c0
TLSH
T19D11CE42FAA054513ACD1A2542C3EE4E6E19BB335C3D85371247A243CD35709EEA5C8B
MD5 SHA1 SHA512 TLSH

Submit Download

exchangeIdentity.json

Path /data/data/com.yelye.wewewleop.pp/files/.umeng/exchangeIdentity.json
Size 162B
SHA256 95ed449af445cbbbdbf6b5cc6bd759e1e155ce84d162822c069c39f1f0611dd3
MD5 f8588002c6396ec897e778c944d11f0e
SHA1 b8e9ac412048d18ea0d9b85b3eac041bd21ddfc9
SHA512 881b21db9f2ba926b9bdf1cf49c826ccb709903c2022f9a0a880a533fba907393fe59c339b7f3c214af3676b47941f68be9b5df46bf98351e65871aa4f6174da
TLSH
T186C0800468E12C949225401C585781551146FCBC32E4740444C15209C5E95B1600B917
MD5 SHA1 SHA512 TLSH

Submit Download

exid.dat

Path /data/data/com.yelye.wewewleop.pp/files/exid.dat
Size 57B
SHA256 2382b4d710d6edc6f5ab717ef10c8246f14cb26d0e367c29cab5247336aee59b
MD5 fee0b059af0156286065b5b9bbbe5f94
SHA1 7789e6b7186d078c6392c62aba7d980482ade4bf
SHA512 0577eae36ad858ce24638caa0815a4c7008a460fa2a32151db53dcd68531beea2aaecad521f7a633d6577cdd76b8d23b6e4b9e4b4af102e3a170e0dee3bc9c9c
TLSH
T15290028890B54CF67160758F5559452E1117B63577916024A4D51604CBB8515501C813
MD5 SHA1 SHA512 TLSH

Submit Download

umeng_it.cache

Path /data/data/com.yelye.wewewleop.pp/files/umeng_it.cache
Size 211B
SHA256 563f2f17577eeb8562d1e2bcb69f596388f79bf075d99c43d141e551cee39057
MD5 ba1c7932684c8fc7b2fb57ce88052f24
SHA1 d82d76e04e69c3c027677dd4f25d3df97f31912d
SHA512 85b6526b8acee3cdf69333f5553b2e6945dce48a939795978fff53160bd77a651d43171c5f1fa76e5c5068b9df54738e2406a6015d03791282d829004fbe5a04
TLSH
T1F3D0A9B9512000638242F4A0378CBEA3BB0D8BB203A1068A702258D7C63EA81CA8000B
MD5 SHA1 SHA512 TLSH

Submit Download

umeng_it.cache

Path /data/data/com.yelye.wewewleop.pp/files/umeng_it.cache
Size 415B
SHA256 4cebc476a5115fba2bac167ef2b67b14d57d008ef3d8864a62f9e9fdff26b6ec
MD5 48d1ea8008fca89b5b4082b8ead67d3c
SHA1 31ac5dcc3c72eaf83f975de4b67df0b02b7f3953
SHA512 30d7c9d48988b7c60eeb3ad46bc9b655ea4b7e8341a83dc6c6a2173d42ee7e4e97afc46af5582fa8ff9e107ca4cc2de43bffc36309d191072be9572836359103
TLSH
T1B0E0A07D577000639256F4912B8C7EA3AE0A8E7307A106CA70225CD6D639A41CA8010B
MD5 SHA1 SHA512 TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Mobile v16

Replay Monitor

Loading Replay Monitor...

Downloads